title: Palo Alto IPSec VPN tunnels
agents: paloalto_ipsec
catalog: hw/networking
license: MIT
distribution: check_mk
description:
 This check monitors IPSec VPN tunnels on Palo Alto Networks firewalls.

 The data is retrieved through the PAN-OS XML API command
 <tt><show><vpn><flow/></vpn></show></tt>.

 The check creates one service per discovered IPSec tunnel.

 Tunnel states are mapped as follows:

 * <tt>active</tt> results in <tt>OK</tt>
 * <tt>inactive</tt> results in <tt>CRIT</tt>
 * any other state results in <tt>UNKNOWN</tt>

 The service details include the peer IP, local IP, tunnel interface,
 outer interface, tunnel monitoring state, tunnel ID and gateway ID.

 The PAN-OS XML API key is read from the Checkmk password store.
 The key itself is not exposed in the command line or process list.

item:
 The PAN-OS IPSec tunnel name.

inventory:
 One service is created for every IPSec tunnel returned by the PAN-OS
 XML API.

examples:
 Palo Alto IPSec Branch-VPN
 Palo Alto IPSec Backup-VPN
