VPN Monitoring

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Overview

VPN monitoring provides visibility into your devices’ VPN tunnels within Network Device Monitoring (NDM). This feature allows you to keep track of critical data and metrics to examine the health of your VPN tunnels.

When configured, the SNMP check collects VPN tunnel data from your devices. This can be configured for individual as well as Autodiscovered devices.

Prerequisites

Agent version 7.70 or higher.

Limitations

  • Support is limited to Cisco IPsec VPN tunnels.

Configuration

  1. Install or upgrade the Datadog Agent to v7.70+.

  2. Edit the snmp.d/conf.yaml file in the conf.d/ folder at the root of your Agent’s configuration directory for individual devices, or the datadog.yaml Agent configuration file for Autodiscovery.

    To enable VPN monitoring to all manually configured devices, add the collect_vpn configuration in the init_config section:

    init_config:
  loader: core
  use_device_id_as_hostname: true
  collect_vpn: true          # (default false) enable collecting VPN tunnel data
instances:
  - ip_address: '1.2.3.4'
    community_string: 'sample-string'
    tags:
    - 'key1:val1'
    - 'key2:val2'

    Or, apply the collect_vpn configuration per instance:

    init_config:
  loader: core
  use_device_id_as_hostname: true
instances:
  - ip_address: '1.2.3.4'
    community_string: 'sample-string'
    tags:
      - 'key1:val1'
      - 'key2:val2'
    collect_vpn: true        # (default false) enable collecting VPN tunnel data

    To enable VPN monitoring to all Autodiscovery subnets, add the collect_vpn configuration under the network_devices.autodiscovery section:

    network_devices:
  autodiscovery:
    workers: 100
    discovery_interval: 3600
    loader: core
    use_device_id_as_hostname: true
    collect_vpn: true        # (default false) enable collecting VPN tunnel data
    configs:
      - network_address: 10.10.0.0/24
        loader: core
        snmp_version: 2
        port: 161
        community_string: '***'
        tags:
        - "key1:val1"
        - "key2:val2"

    Viewing VPN tunnels

    To view VPN tunnels in the UI:

    1. Select a monitored device in NDM that has VPN tunnels.
    2. Click on the VPN Tunnels tab in the device’s side panel.

    Metrics collected

    The following metrics are made available after enabling VPN monitoring:

    Metric NameDescription
    snmp.cipSecTunActiveTimeThe duration the tunnel has been active in hundredths of seconds.
    snmp.cipSecTunHcInOctetsThe number of octets received by the tunnel.
    snmp.cipSecTunHcOutOctetsThe number of octets sent by the tunnel.
    snmp.cipSecTunInPktsThe number of packets received by the tunnel.
    snmp.cipSecTunOutPktsThe number of packets sent by the tunnel.
    snmp.cipSecTunInAuthFailsThe number of inbound authentications that ended in failure for the tunnel.
    snmp.cipSecTunOutAuthFailsThe number of outbound authentications that ended in failure for the tunnel.
    snmp.cipSecTunInDecryptFailsThe number of inbound decryptions that ended in failure for the tunnel.
    snmp.cipSecTunOutEncryptFailsThe number of outbound encryptions that ended in failure for the tunnel.

    Troubleshooting

    If you experience issues using VPN monitoring, use the following troubleshooting guidelines. If you need further assistance, contact Datadog support.

    VPN tunnels not displayed

    The VPN tunnel data is collected with SNMP. If VPN tunnels are missing on a device, ensure the following:

    • Datadog Agent version 7.70 or later is installed.
    • Verify the device exposes the relevant VPN tunnel data with SNMP by running the following command:
    sudo -u dd-agent datadog-agent snmp walk <DEVICE_IP> 1.3.6.1.4.1.9.9.171.1.3.2

    Further Reading

    추가 유용한 문서, 링크 및 기사:

    SNMP Monitoring OverviewKNOWLEDGE CENTER more more Monitor SNMP with DatadogBLOG more more