VPN Uptime

[David_Chau]

What is the command for finding the uptime for a vpn tunnel?  I have a couple of 1450s at each branch that has a tunnel back to corporate and need to the uptime for each tunnel.  Thanks.

[Timothy_Hall]

Keep in mind that the initial IKE Phase 1 tunnel will never stay continuously up longer than the "Renegotiate IKE security associations every" SA timer expressed in minutes (1440 by default).  Similarly the IPSec tunnel will never stay continuously up longer than the "Renegotiate IPSec security associations every" SA timer expressed in seconds (3600 by default).  However when the SA Lifetime is reached for either of these tunnels associated with a VPN Community, if there is still traffic trying to traverse the VPN connection (or Permanent Tunnels is enabled) then the tunnel will come right back. 

That being said, other than examining "Key Exchange" events (key icon) in the firewall logs there is not really a direct way to see how long a tunnel has been continually available ("up" is probably not the proper term here) that I can find.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

[Danny · Accepted solution]

You can easily use the "fw log" command on your firewall management in order to check when a specific VPN tunnel was recently initiated and if VPN Phase1 (IKE) and Phase2 (IPSec) is still established on the firewall gateway in order to tell the uptime of the VPN tunnel.

[roeiz2019]

hi 

i suspect  that 2 of my vpn tunell were down for 5 min and i cant find a command or from smartview monitor about the up time

[HristoGrigorov]

If it is centrally managed SMB then there is an option in Link selection -> Outgoing link tracking to send e-mail alert.

But I prefer to use monitoring system to ping host on the other side. That always works.