--- title: VPN Monitoring description: Get started with monitoring your devices VPN tunnels. breadcrumbs: Docs > Network Monitoring > Network Device Monitoring > VPN Monitoring --- # VPN Monitoring ## Overview{% #overview %} VPN monitoring provides visibility into your devices' VPN tunnels within Network Device Monitoring (NDM). This feature allows you to keep track of critical data and metrics to examine the health of your VPN tunnels. When configured, the SNMP check collects VPN tunnel data from your devices. This can be configured for [individual](https://docs.datadoghq.com/network_monitoring/devices/vpn_monitoring/?tab=individual#configuration) as well as [Autodiscovered](https://docs.datadoghq.com/network_monitoring/devices/vpn_monitoring/?tab=autodiscovery#configuration) devices. ## Prerequisites{% #prerequisites %} Agent version `7.70` or higher. ### Limitations{% #limitations %} - Support is limited to Cisco IPsec VPN tunnels. ## Configuration{% #configuration %} 1. Install or upgrade the [Datadog Agent](https://docs.datadoghq.com/agent) to v7.70+. 1. Edit the `snmp.d/conf.yaml` file in the `conf.d/` folder at the root of your [Agent's configuration directory](https://docs.datadoghq.com/agent/configuration/agent-configuration-files/#agent-configuration-directory) for individual devices, or the [`datadog.yaml`](https://docs.datadoghq.com/agent/configuration/agent-configuration-files/?tab=agentv6v7#agent-main-configuration-file) Agent configuration file for Autodiscovery. {% tab title="Individual" %} To enable VPN monitoring to all *manually* configured devices, add the `collect_vpn` configuration in the `init_config` section: ```yaml init_config: loader: core use_device_id_as_hostname: true collect_vpn: true # (default false) enable collecting VPN tunnel data instances: - ip_address: '1.2.3.4' community_string: 'sample-string' tags: - 'key1:val1' - 'key2:val2' ``` Or, apply the `collect_vpn` configuration *per* instance: ```yaml init_config: loader: core use_device_id_as_hostname: true instances: - ip_address: '1.2.3.4' community_string: 'sample-string' tags: - 'key1:val1' - 'key2:val2' collect_vpn: true # (default false) enable collecting VPN tunnel data ``` {% /tab %} {% tab title="Autodiscovery" %} To enable VPN monitoring to all *Autodiscovery* subnets, add the `collect_vpn` configuration under the `network_devices.autodiscovery` section: ```yaml network_devices: autodiscovery: workers: 100 discovery_interval: 3600 loader: core use_device_id_as_hostname: true collect_vpn: true # (default false) enable collecting VPN tunnel data configs: - network_address: 10.10.0.0/24 loader: core snmp_version: 2 port: 161 community_string: '***' tags: - "key1:val1" - "key2:val2" ``` {% /tab %} ## Viewing VPN tunnels{% #viewing-vpn-tunnels %} To view VPN tunnels for a device, click the device in the [NDM device list](https://app.datadoghq.com/devices) or the [Device Topology Map](https://docs.datadoghq.com/network_monitoring/devices/topology/) to open the NDM device view. The **Dependencies** section shows the number of connected devices and VPN tunnels at a glance. {% image source="https://datadog-docs.imgix.net/images/network_device_monitoring/vpn_monitoring/dependency_tab.ef84b132add9aa556bc1e71938c25fd8.png?auto=format" alt="The NDM device view showing the Dependencies section with connected devices and a VPN tunnel count." /%} Click **View dependencies** to open the full device page. On the **Dependencies** tab, select the **VPN** filter to see all VPN tunnels for the device. The table displays the local outside IP, remote peer IP, protocol, tunnel interface, destination subnets, bytes in, bytes out, and active time for each tunnel. {% image source="https://datadog-docs.imgix.net/images/network_device_monitoring/vpn_monitoring/vpn_dependency.ac54fdd82b57783830aa4f4daba65341.png?auto=format" alt="The Dependencies tab on the NDM device page with the VPN filter selected, showing a table of VPN tunnels with connection details." /%} ### Metrics collected{% #metrics-collected %} The following metrics are made available after enabling VPN monitoring: | Metric Name | Description | | ------------------------------- | ---------------------------------------------------------------------------- | | `snmp.cipSecTunActiveTime` | The duration the tunnel has been active in hundredths of seconds. | | `snmp.cipSecTunHcInOctets` | The number of octets received by the tunnel. | | `snmp.cipSecTunHcOutOctets` | The number of octets sent by the tunnel. | | `snmp.cipSecTunInPkts` | The number of packets received by the tunnel. | | `snmp.cipSecTunOutPkts` | The number of packets sent by the tunnel. | | `snmp.cipSecTunInAuthFails` | The number of inbound authentications that ended in failure for the tunnel. | | `snmp.cipSecTunOutAuthFails` | The number of outbound authentications that ended in failure for the tunnel. | | `snmp.cipSecTunInDecryptFails` | The number of inbound decryptions that ended in failure for the tunnel. | | `snmp.cipSecTunOutEncryptFails` | The number of outbound encryptions that ended in failure for the tunnel. | ## Troubleshooting{% #troubleshooting %} If you experience issues using VPN monitoring, use the following troubleshooting guidelines. If you need further assistance, contact [Datadog support](https://docs.datadoghq.com/help). ### VPN tunnels not displayed{% #vpn-tunnels-not-displayed %} The VPN tunnel data is collected with SNMP. If VPN tunnels are missing on a device, verify the following: - Datadog Agent version 7.70 or later is installed. - Verify the device exposes the relevant VPN tunnel data with SNMP by running the following command: ```shell sudo -u dd-agent datadog-agent snmp walk 1.3.6.1.4.1.9.9.171.1.3.2 ``` ## Further Reading{% #further-reading %} - [SNMP Monitoring Overview](https://www.datadoghq.com/knowledge-center/network-monitoring/snmp-monitoring/) - [Monitor SNMP with Datadog](https://www.datadoghq.com/blog/monitor-snmp-with-datadog/)