Can anyone recommend a good way of setting up monitoring of IPsec tunnels via SNMP for example? VTI-tunnels are very easy to monitor since there are no difference from any other virtual interface, but with IPsec tunnels I haven't found a good way yet. Usually what I do is monitor some equipment at the other side, through the tunnel.

Kind regards, Andreas

  • 3
    Thank you for asking; right now the question is too broad to get a good answer without guessing too much about the context of your situation. Please consider adding more details to your question; as a general rule, detailed questions get better answers. Users with at least 20 points can also ask in our dedicated Network Engineering chat room where we welcome a wide variety of networking discussions. – This Apr 9 '14 at 13:50
  • There is a IPSec Prometheus Exporter written in GO that does this. github.com/dennisstritzke/ipsec_exporter – user1302884 May 10 '19 at 14:31

Have you considered making a loopback interface on the distant end router/firewall (whatever the other end tunnel device is) and monitoring that? You could make it an RFC 1918 address and only accessible via the VPN tunnel. That should give you something to monitor that isn't affected by equipment/network instability at the distant end.


From my experience, depends on the equipment that creates the IPSec tunnel and if it is route or policy based.

For route based IPSec tunnels, equipment normally adds it as another interface and you can monitor that directly in MIB2.

For policy based... monitoring something on the far side, like the internal IP of the far end, is probably best. A loopback can work to avoid the false positive of the far end network dropping but the device still up, but in policy based tunnels it is probably more work to create than not and the tunnel is really only useful if there are things talking over it.

I'd just go ahead and monitor the far side. Simple and, if the far side is down in monitoring, you know that the tunnel isn't working (either tunnel down or far side equipment problem; either way the tunnel is not passing traffic).

Not the answer you're looking for? Browse other questions tagged or ask your own question.