Monitoring and alerts for IPsec tunnels
The appliance monitors the health of each IPsec tunnel on a periodic interval, independently of the on-demand status updates that occur when you create, edit, or delete a tunnel.
If an application instance is online but its IPsec service is not running, the appliance raises an alert to indicate that the IPsec service is down for that instance. When the IPsec service returns to a healthy state, the appliance automatically clears the alert.
Note:
This alert covers only the health of the IPsec service itself. If the service is running but an individual tunnel's tunnel state changes to Failed (for example, because of a rekey or negotiation problem with the peer), the appliance does not raise a separate alert for that tunnel. Check the IPsec tunnels list for the application instance periodically, or enable your own alerting on the affected workload (such as NetBackup job-failure notifications), to detect a dropped tunnel that leaves the IPsec service itself healthy.