topic Re: Monitoring VPN tunnels through SNMP Mibs in Firewall and Security Management

Monitoring VPN tunnels through SNMP Mibs

snthl — Mon, 15 Jan 2024 04:57:48 GMT

I am trying to monitor VPN Site-to-site tunnel via SNMP mibs. In this regard, I have few questions and I could not conclusively get information from the documents.

The tunnelTable (.1.3.6.1.4.1.2620.500.9002.1) has the VPN tunnel entries . I currently have access and the snmpwalks from only one side the VPN Gateway. Will the Gateway at both end of Tunnel report the same tunnel , reporting each other as VPN Peer ?
The MIB oid tunnelInterface (.1.3.6.1.4.1.2620.500.9002.1.6) doesn't have any value in snmpwalk file I got. I assume this is interface name of the interface on which this VPN tunnel is operating. Do I expect to see valid value for this MIB always or Are there reason why I may not see any value for this mib oid ?
Related to the above question, I have the same doubt related to tunnelSourceIpaddress. Do I expect to see valid value for this MIB oid as well always for a vpn tunnel ?
Are the MIB Oids tunnelInterface and tunnelSourceIPAddress are interface and IP address of the VPN gateway reporting the VPN tunnel in the tunnel Table MIB ?
What does the MIB Oid tunnelPeerObjName (.1.3.6.1.4.1.2620.500.9002.1.2) give ? Is it VPN Gateway's host name ? or any configured name for vpn ?
There are two MIB tables that give vpn tunnel information : tunnelTable (.1.3.6.1.4.1.2620.500.9002) and permanentTunnelTable(.1.3.6.1.4.1.2620.500.9003). It appears the tunnelTable has both regular and Permanent VPN tunnel information , So that I can get all vpn tunnels of a gateway from just tunnelTable entries alone. Is that correct?

Thanks in advance for any help in getting answers or pointing to any doc/material that can provide answers.

Re: Monitoring VPN tunnels through SNMP Mibs

PhoneBoy — Wed, 17 Jan 2024 05:59:17 GMT

1. My understanding is yes.
2-4, I believe they may only be relevant if you are using route-based VPNs, but aren't sure and recommend consulting with the TAC: https://help.checkpoint.com
5. Believe it's the object name as defined in SmartConsole.
6. The documentation says to monitor tunnelTable: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Chassis_AdminGuide/Content/Topics-Chassis-AG/Monitoring-VPN-Tunnels.htm

Re: Monitoring VPN tunnels through SNMP Mibs

snthl — Wed, 17 Jan 2024 10:52:36 GMT

Thanks a lot for your response.

Re: Monitoring VPN tunnels through SNMP Mibs

David_C1 — Thu, 29 Feb 2024 19:54:02 GMT

I've been fighting with snmp for tunnel monitoring for a few months now...and I can tell you that the data in .1.3.6.1.4.1.2620.500.9002.1 cannot be trusted. The snmp data shows tunnel status as "down", this is obviously contradicted by my logs, which shows encrypted/decrypted traffic going through this tunnel. It is also contradicted by the output of 'vpn tu tlist' which shows tunnels as established. I assume the tunnel status shown in SmartView Monitor is based on snmp - this is inaccurate as well. This is a problem as I'm trying to configure alerts for tunnel up/down status, and I don't have an accurate way to get this information.

Frustrating to say the least - it's the year 2024, we should not have to be dealing with bugs in snmp.

Dave

Re: Monitoring VPN tunnels through SNMP Mibs

the_rock — Thu, 29 Feb 2024 21:09:42 GMT

My experience is sadly the same...

Best,

Andy

Re: Monitoring VPN tunnels through SNMP Mibs

Pacific0 — Mon, 06 May 2024 14:21:56 GMT

Dear ones,

I'm in the same situation, I'm trying to monitor the vpn tunnels via zabbix, but without much results, did you get anything?

Re: Monitoring VPN tunnels through SNMP Mibs

the_rock — Mon, 06 May 2024 15:05:15 GMT

Seee if example I gave here helps.

Andy

https://community.checkpoint.com/t5/Management/Monitoring-VPN-Tunnels/m-p/212428/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufExWR1k1MEhXWkNZTEgzfDIxMjQyOHxTVUJTQ1JJUFRJT05TfGhL#M38603

https://support.checkpoint.com/results/sk/sk90860