WAN and VPN logs

[Timur1]

Hi Guys,

i am have a hard time with looking up specific logs for network events. recently we had few minutes of ISP outage, i can see that in the bandwidth widget (graph showed 0 mbps) but i can't see it in logs. i need something more than a widget screenshot to take it up with our ISP provider. 

same issue with VPN logs. i can't see clear logs for why user got disconnected, is it drop in internet connection at my end or user's internet? user disconnected? among other such logs

is there any way to see this information?

thanks,

Taimur

[pminarik]

You can set up some link-monitor, either as an SD-WAN health-check, or the "old-school" 'config system link-monitor' (CLI-only nowadays). When the health-check changes state (alive<->dead) it generates an entry in the System event log.

[Timur1]

thats great, thank you i will try that :) any suggestions for the VPN logs?

[pminarik]

No such info is really available.

If a VPN dies because of timeouts, it's impossible for the FGT to say if the packets are dropped on the FGT's ISP's side, client's ISP's side, or somewhere in the middle.

Best you can do is look at the VPN logs for SSL-VPN disconnection and/or IPsec phase1/2 down messages and check the vague reason. (e.g. "user-requested termination", "timeout", ...)

An example would be log ID 39425 for SSL-VPN logged when the tunnel goes down. The "reason" field will give a hint of why the tunnel closed.