Monitoring LAN to LAN Tunnels

johnroche_2 · ‎10-20-2008

Hi

I have a number of 3800 ISR with LAN to LAN IPSEC VPNS.

One One Gig port I have 18 VPN's my network monitor on alerts if the physical interface drops. I would like to monitor each tunnel and alert if it fails. I have tried a few different OID.

Can any one recommend what OID to monitor to alert a tunnel down.

drolemc · ‎10-24-2008

To monitor LAN to LAN Ipsec VPN tunnel

User these commands on routers.

Router# show crypto ipsec sa

Router# show crypto isakmp sa.

You can view the IPsec and IKE statistics when you select Monitoring > Statistics > IPSec on the VPN Concentrators.

For further information click this link

http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00801f0f0c.shtml

johnroche_2 · ‎10-26-2008

Thanks for the reply, but I am really looking for snmo monitoring rather than CLI.

I have tried watching phase one but is the tunnel state is UP-NO-IKE it alarms down.

If I watch phase two tunnel numbers, these change and the tunnel alarms down.

Right now I am alarming on the absence of any tunnel.

I am just wondering if there is a better way