SLA link monitoring for dynamic IPsec and SSL VPN tunnels

The link health monitor settings can measure SLA information of dynamic VPN interfaces, which assign IP addresses to their clients during tunnel establishment. This includes SSL VPN tunnels, IPsec remote access, and IPsec site-to-site tunnels.

This feature currently only supports IPv4 and the ICMP monitoring protocol. In the IPsec tunnel settings, net-device must be disabled.

config system link-monitor
    edit <name>
        set server-type {static | dynamic}
    next
end

To view the dial-up tunnel statistics:

# diagnose sys link-monitor tunnel {name | all} [<tunnel_name>]

Example

In this example, endpoint users dial up using FortiClient to create IPSec tunnels with the FortiGate and obtain IP addresses. The link monitor on the FortiGate's dynamic VPN interface detects the path quality to the endpoints.

To configure SLA link health monitoring in dynamic IPsec tunnels:

1. Configure the IPsec phase 1 interface:

   config vpn ipsec phase1-interface
       edit "for_Branch"
           set type dynamic
           set interface "port15"
           set mode aggressive
           set peertype any
           set net-device disable
           set mode-cfg enable                                  
           set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1   
           set dpd on-idle
           set dhgrp 5
           set xauthtype auto
           set authusrgrp "vpngroup"
           set assign-ip-from name                          
           set ipv4-netmask 255.255.255.0
           set dns-mode auto
           set ipv4-split-include "172.16.205.0"
           set ipv4-name "client_range"
           set save-password enable
           set psksecret **********
           set dpd-retryinterval 60
       next
   end

2. Configure the IPsec phase 2 interface:

   config vpn ipsec phase2-interface
       edit "for_Branch_p2"
           set phase1name "for_Branch"
           set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
           set dhgrp 5
       next
   end

3. Configure the dynamic interface:

   config system interface
       edit "for_Branch"
           set vdom "root"
           set ip 10.10.10.254 255.255.255.255
           set type tunnel
           set remote-ip 10.10.10.253 255.255.255.0
           set snmp-index 100
           set interface "port15"
       next
   end

4. Add the IPsec dial-up tunnel to the link health monitor:

   config system link-monitor
       edit "1"
           set srcintf "for_Branch"
           set server-type dynamic
       next
   end

5. Once endpoint users have connected using FortiClient, verify the tunnel information:

   # get vpn ipsec tunnel summary
   'for_Branch_0' 10.1.100.23:0  selectors(total,up): 1/1  rx(pkt,err): 21091/0  tx(pkt,err): 20741/0
   'for_Branch_1' 10.1.100.13:0  selectors(total,up): 1/1  rx(pkt,err): 19991/0  tx(pkt,err): 20381/0

6. Verify the link health monitor status:

   # diagnose sys link-monitor tunnel all
   for_Branch_0 (1): state=alive, peer=10.10.10.1, create_time=2022-02-08 10:43:11, srcintf=for_Branch, latency=0.162, jitter=0.018, pktloss=0.000%
   for_Branch_1 (1): state=alive, peer=10.10.10.2, create_time=2022-02-08 10:49:24, srcintf=for_Branch, latency=0.266, jitter=0.015, pktloss=0.000%

7. Manually add 200 ms latency on the path between the FortiGate and FortiClients.
8. Verify the link health monitor status again:

   # diagnose sys link-monitor tunnel all
   for_Branch_0 (1): state=alive, peer=10.10.10.1, create_time=2022-02-08 10:43:11, srcintf=for_Branch, latency=200.177, jitter=0.021, pktloss=0.000%
   for_Branch_1 (1): state=alive, peer=10.10.10.2, create_time=2022-02-08 10:49:24, srcintf=for_Branch, latency=200.257, jitter=0.017, pktloss=0.000%