VPN Monitoring

Docs > Surveillance réseau > Network Device Monitoring > VPN Monitoring

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Overview

VPN monitoring provides visibility into your devices’ VPN tunnels within Network Device Monitoring (NDM). This feature allows you to keep track of critical data and metrics to examine the health of your VPN tunnels.

When configured, the SNMP check collects VPN tunnel data from your devices. This can be configured for individual as well as Autodiscovered devices.

Prerequisites

Agent version 7.70 or higher.

Limitations

Support is limited to Cisco IPsec VPN tunnels.

Configuration

Install or upgrade the Datadog Agent to v7.70+.
Edit the snmp.d/conf.yaml file in the conf.d/ folder at the root of your Agent’s configuration directory for individual devices, or the datadog.yaml Agent configuration file for Autodiscovery.

To enable VPN monitoring to all manually configured devices, add the collect_vpn configuration in the init_config section:

init_config:
  loader: core
  use_device_id_as_hostname: true
  collect_vpn: true          # (default false) enable collecting VPN tunnel data
instances:
  - ip_address: '1.2.3.4'
    community_string: 'sample-string'
    tags:
    - 'key1:val1'
    - 'key2:val2'

Or, apply the collect_vpn configuration per instance:

init_config:
  loader: core
  use_device_id_as_hostname: true
instances:
  - ip_address: '1.2.3.4'
    community_string: 'sample-string'
    tags:
      - 'key1:val1'
      - 'key2:val2'
    collect_vpn: true        # (default false) enable collecting VPN tunnel data

To enable VPN monitoring to all Autodiscovery subnets, add the collect_vpn configuration under the network_devices.autodiscovery section:

network_devices:
  autodiscovery:
    workers: 100
    discovery_interval: 3600
    loader: core
    use_device_id_as_hostname: true
    collect_vpn: true        # (default false) enable collecting VPN tunnel data
    configs:
      - network_address: 10.10.0.0/24
        loader: core
        snmp_version: 2
        port: 161
        community_string: '***'
        tags:
        - "key1:val1"
        - "key2:val2"

Viewing VPN tunnels

To view VPN tunnels in the UI:

Select a monitored device in NDM that has VPN tunnels.
Click on the VPN Tunnels tab in the device’s side panel.

Metrics collected

The following metrics are made available after enabling VPN monitoring:

Metric Name	Description
`snmp.cipSecTunActiveTime`	The duration the tunnel has been active in hundredths of seconds.
`snmp.cipSecTunHcInOctets`	The number of octets received by the tunnel.
`snmp.cipSecTunHcOutOctets`	The number of octets sent by the tunnel.
`snmp.cipSecTunInPkts`	The number of packets received by the tunnel.
`snmp.cipSecTunOutPkts`	The number of packets sent by the tunnel.
`snmp.cipSecTunInAuthFails`	The number of inbound authentications that ended in failure for the tunnel.
`snmp.cipSecTunOutAuthFails`	The number of outbound authentications that ended in failure for the tunnel.
`snmp.cipSecTunInDecryptFails`	The number of inbound decryptions that ended in failure for the tunnel.
`snmp.cipSecTunOutEncryptFails`	The number of outbound encryptions that ended in failure for the tunnel.

Troubleshooting

If you experience issues using VPN monitoring, use the following troubleshooting guidelines. If you need further assistance, contact Datadog support.

VPN tunnels not displayed

The VPN tunnel data is collected with SNMP. If VPN tunnels are missing on a device, ensure the following:

Datadog Agent version 7.70 or later is installed.
Verify the device exposes the relevant VPN tunnel data with SNMP by running the following command:

sudo -u dd-agent datadog-agent snmp walk <DEVICE_IP> 1.3.6.1.4.1.9.9.171.1.3.2