renegotiated. This default to a value of 10 if not specified.
Viewing Tunnel Monitor Status
The status of an IPsec tunnel monitor can be viewed by using the hostmon command. Below is
an example showing messages sent for two tunnels using two different IPv4 addresses.
gw-world:/> hostmon
Monitor sessions:
Session #1:
Failed Latency ms
Reachable Proto Host Port Interval Sample (act / max) (act / max)
--------- ----- -------------- ---- -------- ------ ----------- -----------
YES ICMP 192.168.1.1 1000 5 0 / 4 20 / 3000
YES ICMP 192.168.3.1 1000 5 0 / 4 10 / 3000
If, instead, the hostmon -verbose command is used, the source IP of the ICMP messages can also
be seen.
Logging
A log event message is generated by NetDefendOS in the following instances:
• When a host is determined to be reachable, the following log message is generated:
IPSEC prio=Info id=01803600 rev=1 event=monitored_host_reachable
action=none ip=192.168.1.2 tunnel=PSK-NAT
• When a host is determined to be unreachable, the following log message is generated:
IPSEC prio=Error id=01803600 rev=1 event=monitored_host_unreachable
action=sas_deleted ip=192.168.1.2 tunnel=PSK-NAT
Example 9.11. Enabling IPsec Tunnel Monitoring
This example will enable tunnel monitoring on an existing IPsec Tunnel object called
my_ipsec_tunnel1. The host used for monitoring has the IPv4 address 203.0.11.5 and it is
acceptable to not get up to 5 replies to the ICMP messages sent.
Command-Line Interface
gw-world:/> Set Interface IPsecTunnel my_ipsec_tunnel1
TunnelMonitor=Yes
MonitoredIP=203.0.11.5
MaxLoss=5
Web Interface
Chapter 9: VPN
722
To Next Page
Loading...
