Analyzing IPSec tunnels

Here is a summary of how IPSec tunnels are discovered and monitored:

• The IP Manager discovers the WAN subinterface endpoints of the tunnels and layers them over the underlying physical interfaces.

• The IP Manager monitors the tunnels by monitoring the IsDownOrFlapping attribute of the subinterface endpoints that are associated with the tunnels and then creates the network connections between the local and remote subinterface endpoints to form the IPSec tunnels.

  “Network adapters and device connections” on page 32 provides information about physical interfaces, subinterfaces, network connections, and WANs.

  The IP Manager then uses the discovered physical interfaces, subinterfaces, and network connections, in conjunction with the subinterface statuses that are obtained from the monitoring of the IsDownOrFlapping attribute, to diagnose IPSec tunnel failures. For each physical interface, and depending on the symptoms, the IP Manager diagnoses one or more NetworkConnection::DownOrFlapping impact events, and diagnoses either an Interface::Down problem or one or more NetworkConnection::Down problems:

• Interface::Down, if the physical interface is operationally down, which explains why all of the subinterfaces that are layered over the physical interface have failed, along with any peer interfaces of those subinterfaces. “Interface” in “Interface::Down” represents the physical interface.

• NetworkConnection::Down, if the physical interface is operationally up, for each network connection failure at the subinterface level.

  Network connections at the subinterface level represent WAN circuits that are carrying IPSec tunnels.

  As a precondition for IPSec tunnel analysis, add the following line to the BASEDIR/smarts/conf/local runcmd_env.sh file:

  SM_LOGICALCONNECTIONDOWN=DISABLED

  The procedure and reason for completing this task are given in the IP Manager User Guide. The Interface::Down problem, NetworkConnection::Down problem, and NetworkConnection::DownOrFlapping impact events are described in the IP Manager Reference Guide.