Fortinet black logo

Administration Guide

SLA link monitoring for dynamic IPsec and SSL VPN tunnels

SLA link monitoring for dynamic IPsec and SSL VPN tunnels

The link health monitor settings can measure SLA information of dynamic VPN interfaces, which assign IP addresses to their clients during tunnel establishment. This includes SSL VPN tunnels, IPsec remote access, and IPsec site-to-site tunnels.

Note

This feature currently only supports IPv4 and the ICMP monitoring protocol. In the IPsec tunnel settings, net-device must be disabled.

config system link-monitor
    edit <name>
        set server-type {static | dynamic}
    next
end
To view the dial-up tunnel statistics:
# diagnose sys link-monitor tunnel {name | all} [<tunnel_name>]

Example

In this example, endpoint users dial up using FortiClient to create IPSec tunnels with the FortiGate and obtain IP addresses. The link monitor on the FortiGate's dynamic VPN interface detects the path quality to the endpoints.

To configure SLA link health monitoring in dynamic IPsec tunnels:
  1. Configure the IPsec phase 1 interface:
    config vpn ipsec phase1-interface
        edit "for_Branch"
            set type dynamic
            set interface "port15"
            set mode aggressive
            set peertype any
            set net-device disable
            set mode-cfg enable                                  
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1   
            set dpd on-idle
            set dhgrp 5
            set xauthtype auto
            set authusrgrp "vpngroup"
            set assign-ip-from name                          
            set ipv4-netmask 255.255.255.0
            set dns-mode auto
            set ipv4-split-include "172.16.205.0"
            set ipv4-name "client_range"
            set save-password enable
            set psksecret **********
            set dpd-retryinterval 60
        next
    end
  2. Configure the IPsec phase 2 interface:
    config vpn ipsec phase2-interface
        edit "for_Branch_p2"
            set phase1name "for_Branch"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set dhgrp 5
        next
    end
  3. Configure the dynamic interface:
    config system interface
        edit "for_Branch"
            set vdom "root"
            set ip 10.10.10.254 255.255.255.255
            set type tunnel
            set remote-ip 10.10.10.253 255.255.255.0
            set snmp-index 100
            set interface "port15"
        next
    end
  4. Add the IPsec dial-up tunnel to the link health monitor:
    config system link-monitor
        edit "1"
            set srcintf "for_Branch"
            set server-type dynamic
        next
    end
  5. Once endpoint users have connected using FortiClient, verify the tunnel information:
    # get vpn ipsec tunnel summary
    'for_Branch_0' 10.1.100.23:0  selectors(total,up): 1/1  rx(pkt,err): 21091/0  tx(pkt,err): 20741/0
    'for_Branch_1' 10.1.100.13:0  selectors(total,up): 1/1  rx(pkt,err): 19991/0  tx(pkt,err): 20381/0
  6. Verify the link health monitor status:
    # diagnose sys link-monitor tunnel all
    for_Branch_0 (1): state=alive, peer=10.10.10.1, create_time=2022-02-08 10:43:11, srcintf=for_Branch, latency=0.162, jitter=0.018, pktloss=0.000%
    for_Branch_1 (1): state=alive, peer=10.10.10.2, create_time=2022-02-08 10:49:24, srcintf=for_Branch, latency=0.266, jitter=0.015, pktloss=0.000%
  7. Manually add 200 ms latency on the path between the FortiGate and FortiClients.
  8. Verify the link health monitor status again:
    # diagnose sys link-monitor tunnel all
    for_Branch_0 (1): state=alive, peer=10.10.10.1, create_time=2022-02-08 10:43:11, srcintf=for_Branch, latency=200.177, jitter=0.021, pktloss=0.000%
    for_Branch_1 (1): state=alive, peer=10.10.10.2, create_time=2022-02-08 10:49:24, srcintf=for_Branch, latency=200.257, jitter=0.017, pktloss=0.000%

SLA link monitoring for dynamic IPsec and SSL VPN tunnels

The link health monitor settings can measure SLA information of dynamic VPN interfaces, which assign IP addresses to their clients during tunnel establishment. This includes SSL VPN tunnels, IPsec remote access, and IPsec site-to-site tunnels.

Note

This feature currently only supports IPv4 and the ICMP monitoring protocol. In the IPsec tunnel settings, net-device must be disabled.

config system link-monitor
    edit <name>
        set server-type {static | dynamic}
    next
end
To view the dial-up tunnel statistics:
# diagnose sys link-monitor tunnel {name | all} [<tunnel_name>]

Example

In this example, endpoint users dial up using FortiClient to create IPSec tunnels with the FortiGate and obtain IP addresses. The link monitor on the FortiGate's dynamic VPN interface detects the path quality to the endpoints.

To configure SLA link health monitoring in dynamic IPsec tunnels:
  1. Configure the IPsec phase 1 interface:
    config vpn ipsec phase1-interface
        edit "for_Branch"
            set type dynamic
            set interface "port15"
            set mode aggressive
            set peertype any
            set net-device disable
            set mode-cfg enable                                  
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1   
            set dpd on-idle
            set dhgrp 5
            set xauthtype auto
            set authusrgrp "vpngroup"
            set assign-ip-from name                          
            set ipv4-netmask 255.255.255.0
            set dns-mode auto
            set ipv4-split-include "172.16.205.0"
            set ipv4-name "client_range"
            set save-password enable
            set psksecret **********
            set dpd-retryinterval 60
        next
    end
  2. Configure the IPsec phase 2 interface:
    config vpn ipsec phase2-interface
        edit "for_Branch_p2"
            set phase1name "for_Branch"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set dhgrp 5
        next
    end
  3. Configure the dynamic interface:
    config system interface
        edit "for_Branch"
            set vdom "root"
            set ip 10.10.10.254 255.255.255.255
            set type tunnel
            set remote-ip 10.10.10.253 255.255.255.0
            set snmp-index 100
            set interface "port15"
        next
    end
  4. Add the IPsec dial-up tunnel to the link health monitor:
    config system link-monitor
        edit "1"
            set srcintf "for_Branch"
            set server-type dynamic
        next
    end
  5. Once endpoint users have connected using FortiClient, verify the tunnel information:
    # get vpn ipsec tunnel summary
    'for_Branch_0' 10.1.100.23:0  selectors(total,up): 1/1  rx(pkt,err): 21091/0  tx(pkt,err): 20741/0
    'for_Branch_1' 10.1.100.13:0  selectors(total,up): 1/1  rx(pkt,err): 19991/0  tx(pkt,err): 20381/0
  6. Verify the link health monitor status:
    # diagnose sys link-monitor tunnel all
    for_Branch_0 (1): state=alive, peer=10.10.10.1, create_time=2022-02-08 10:43:11, srcintf=for_Branch, latency=0.162, jitter=0.018, pktloss=0.000%
    for_Branch_1 (1): state=alive, peer=10.10.10.2, create_time=2022-02-08 10:49:24, srcintf=for_Branch, latency=0.266, jitter=0.015, pktloss=0.000%
  7. Manually add 200 ms latency on the path between the FortiGate and FortiClients.
  8. Verify the link health monitor status again:
    # diagnose sys link-monitor tunnel all
    for_Branch_0 (1): state=alive, peer=10.10.10.1, create_time=2022-02-08 10:43:11, srcintf=for_Branch, latency=200.177, jitter=0.021, pktloss=0.000%
    for_Branch_1 (1): state=alive, peer=10.10.10.2, create_time=2022-02-08 10:49:24, srcintf=for_Branch, latency=200.257, jitter=0.017, pktloss=0.000%