Skip to content

Commit 53e4799

Browse files
Pierre-L42aliciascott
Pierre-L42
and
aliciascott
authored
[NDMII-3557] Create VPN Monitoring docs (#30803)
* Create VPN Monitoring docs * Add content * Fix tab * Fix spaces * Fix warnings * Fix warnings * Update content/en/network_monitoring/devices/vpn_monitoring.md Co-authored-by: Alicia Scott <[email protected]> * Update content/en/network_monitoring/devices/vpn_monitoring.md Co-authored-by: Alicia Scott <[email protected]> * Update content/en/network_monitoring/devices/vpn_monitoring.md Co-authored-by: Alicia Scott <[email protected]> * Update content/en/network_monitoring/devices/vpn_monitoring.md Co-authored-by: Alicia Scott <[email protected]> * Update content/en/network_monitoring/devices/vpn_monitoring.md Co-authored-by: Alicia Scott <[email protected]> * Update content/en/network_monitoring/devices/vpn_monitoring.md Co-authored-by: Alicia Scott <[email protected]> * Update content/en/network_monitoring/devices/vpn_monitoring.md Co-authored-by: Alicia Scott <[email protected]> * Update content/en/network_monitoring/devices/vpn_monitoring.md Co-authored-by: Alicia Scott <[email protected]> * Add tics to metrics * Add section in Setup page * Add highlights to config * Fix yaml code blocks * adjusting table, command and links --------- Co-authored-by: Alicia Scott <[email protected]> Co-authored-by: aliciascott <[email protected]>
1 parent 5efcaff commit 53e4799

File tree

3 files changed

+187
-3
lines changed

3 files changed

+187
-3
lines changed

‎config/_default/menus/main.en.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3477,6 +3477,11 @@ menu:
34773477
parent: ndm_setup
34783478
identifier: ndm_sd-wan
34793479
weight: 30005
3480+
- name: VPN Monitoring
3481+
url: network_monitoring/devices/vpn_monitoring
3482+
parent: ndm_setup
3483+
identifier: ndm_vpn_monitoring
3484+
weight: 30006
34803485
- name: Profiles
34813486
url: network_monitoring/devices/profiles
34823487
parent: ndm

‎content/en/network_monitoring/devices/setup.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,10 @@ To begin monitoring your network devices, enable SNMP monitoring using one of th
6868
[Ping][5]
6969
: Additionally, SNMP supports enabling ping on your devices.
7070

71-
### Enrich network devices with tags
71+
[VPN Monitoring][21]
72+
: Configure VPN monitoring to start monitoring your devices' VPN tunnels.
73+
74+
### Enrich network devices with tags
7275

7376
After NDM is configured on your devices, you can further enrich them by adding network device tags using the following methods:
7477

@@ -94,7 +97,7 @@ Customize metrics and tags on your devices by viewing the [Supported Devices][9]
9497
[GUI based profile authoring][6]
9598
: Take advantage of Datadog Network Monitoring's GUI based device onboarding experience where you can add custom metrics and tags to your devices.
9699

97-
### NetFlow Monitoring
100+
### NetFlow Monitoring
98101

99102
Configure [NetFlow Monitoring][11] to visualize and monitor your flow records from your NetFlow-enabled devices.
100103

@@ -143,4 +146,5 @@ Configure [NetFlow Monitoring][11] to visualize and monitor your flow records fr
143146
[17]: /api/latest/network-device-monitoring/#get-the-list-of-tags-for-a-device
144147
[18]: /api/latest/network-device-monitoring/#update-the-tags-for-a-device
145148
[19]: /network_monitoring/devices/troubleshooting
146-
[20]: /integrations/guide/high_availability
149+
[20]: /integrations/guide/high_availability
150+
[21]: /network_monitoring/devices/vpn_monitoring

‎content/en/network_monitoring/devices/vpn_monitoring.md

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
---
2+
title: VPN Monitoring
3+
description: Get started with monitoring your devices VPN tunnels.
4+
further_reading:
5+
- link: "https://www.datadoghq.com/knowledge-center/network-monitoring/snmp-monitoring/"
6+
tag: "Knowledge Center"
7+
text: "SNMP Monitoring Overview"
8+
- link: "https://www.datadoghq.com/blog/monitor-snmp-with-datadog/"
9+
tag: "Blog"
10+
text: "Monitor SNMP with Datadog"
11+
---
12+
13+
## Overview
14+
15+
VPN monitoring provides visibility into your devices' VPN tunnels within Network Device Monitoring (NDM). This feature allows you to keep track of critical data and metrics to examine the health of your VPN tunnels.
16+
17+
When configured, the SNMP check collects VPN tunnel data from your devices. This can be configured for [individual][4] as well as [Autodiscovered][5] devices.
18+
19+
## Prerequisites
20+
21+
Agent version `7.70` or higher.
22+
### Limitations
23+
24+
- Support is limited to Cisco IPsec VPN tunnels.
25+
26+
## Configuration
27+
28+
1. Install or upgrade the [Datadog Agent][1] to v7.70+.
29+
30+
2. Edit the `snmp.d/conf.yaml` file in the `conf.d/` folder at the root of your [Agent's configuration directory][2] for individual devices, or the [`datadog.yaml`][3] Agent configuration file for Autodiscovery.
31+
32+
{{< tabs >}}
33+
{{% tab "Individual" %}}
34+
35+
To enable VPN monitoring to all _manually_ configured devices, add the `collect_vpn` configuration in the `init_config` section:
36+
37+
{{< highlight yaml "hl_lines=4" >}}
38+
init_config:
39+
loader: core
40+
use_device_id_as_hostname: true
41+
collect_vpn: true # (default false) enable collecting VPN tunnel data
42+
instances:
43+
- ip_address: '1.2.3.4'
44+
community_string: 'sample-string'
45+
tags:
46+
- 'key1:val1'
47+
- 'key2:val2'
48+
{{< /highlight >}}
49+
50+
Or, apply the `collect_vpn` configuration _per_ instance:
51+
52+
{{< highlight yaml "hl_lines=10" >}}
53+
init_config:
54+
loader: core
55+
use_device_id_as_hostname: true
56+
instances:
57+
- ip_address: '1.2.3.4'
58+
community_string: 'sample-string'
59+
tags:
60+
- 'key1:val1'
61+
- 'key2:val2'
62+
collect_vpn: true # (default false) enable collecting VPN tunnel data
63+
{{< /highlight >}}
64+
65+
{{% /tab %}}
66+
67+
{{% tab "Autodiscovery" %}}
68+
69+
To enable VPN monitoring to all _Autodiscovery_ subnets, add the `collect_vpn` configuration under the `network_devices.autodiscovery` section:
70+
71+
{{< highlight yaml "hl_lines=7" >}}
72+
network_devices:
73+
autodiscovery:
74+
workers: 100
75+
discovery_interval: 3600
76+
loader: core
77+
use_device_id_as_hostname: true
78+
collect_vpn: true # (default false) enable collecting VPN tunnel data
79+
configs:
80+
- network_address: 10.10.0.0/24
81+
loader: core
82+
snmp_version: 2
83+
port: 161
84+
community_string: '***'
85+
tags:
86+
- "key1:val1"
87+
- "key2:val2"
88+
{{< /highlight >}}
89+
90+
{{% /tab %}}
91+
{{< /tabs >}}
92+
93+
## Viewing VPN tunnels
94+
95+
To view VPN tunnels in the UI:
96+
97+
1. Select a monitored device in NDM that has VPN tunnels.
98+
2. Click on the **VPN Tunnels** tab in the device's side panel.
99+
100+
### Metrics collected
101+
102+
The following metrics are made available after enabling VPN monitoring:
103+
104+
<table style="width: 100%;">
105+
<thead>
106+
<tr>
107+
<th style="width: 40%;">Metric Name</th>
108+
<th style="width: 65%;">Description</th>
109+
</tr>
110+
</thead>
111+
<tbody>
112+
<tr>
113+
<td><code>snmp.cipSecTunActiveTime</code></td>
114+
<td>The duration the tunnel has been active in hundredths of seconds.</td>
115+
</tr>
116+
<tr>
117+
<td><code>snmp.cipSecTunHcInOctets</code></td>
118+
<td>The number of octets received by the tunnel.</td>
119+
</tr>
120+
<tr>
121+
<td><code>snmp.cipSecTunHcOutOctets</code></td>
122+
<td>The number of octets sent by the tunnel.</td>
123+
</tr>
124+
<tr>
125+
<td><code>snmp.cipSecTunInPkts</code></td>
126+
<td>The number of packets received by the tunnel.</td>
127+
</tr>
128+
<tr>
129+
<td><code>snmp.cipSecTunOutPkts</code></td>
130+
<td>The number of packets sent by the tunnel.</td>
131+
</tr>
132+
<tr>
133+
<td><code>snmp.cipSecTunInAuthFails</code></td>
134+
<td>The number of inbound authentications that ended in failure for the tunnel.</td>
135+
</tr>
136+
<tr>
137+
<td><code>snmp.cipSecTunOutAuthFails</code></td>
138+
<td>The number of outbound authentications that ended in failure for the tunnel.</td>
139+
</tr>
140+
<tr>
141+
<td><code>snmp.cipSecTunInDecryptFails</code></td>
142+
<td>The number of inbound decryptions that ended in failure for the tunnel.</td>
143+
</tr>
144+
<tr>
145+
<td><code>snmp.cipSecTunOutEncryptFails</code></td>
146+
<td>The number of outbound encryptions that ended in failure for the tunnel.</td>
147+
</tr>
148+
</tbody>
149+
</table>
150+
151+
## Troubleshooting
152+
153+
If you experience issues using VPN monitoring, use the following troubleshooting guidelines. If you need further assistance, contact [Datadog support][6].
154+
155+
### VPN tunnels not displayed
156+
157+
The VPN tunnel data is collected with SNMP. If VPN tunnels are missing on a device, ensure the following:
158+
159+
- Datadog Agent version 7.70 or later is installed.
160+
- Verify the device exposes the relevant VPN tunnel data with SNMP by running the following command:
161+
162+
```shell
163+
sudo -u dd-agent datadog-agent snmp walk <DEVICE_IP> 1.3.6.1.4.1.9.9.171.1.3.2
164+
```
165+
166+
## Further Reading
167+
168+
{{< partial name="whats-next/whats-next.html" >}}
169+
170+
[1]: /agent
171+
[2]: /agent/configuration/agent-configuration-files/#agent-configuration-directory
172+
[3]: /agent/configuration/agent-configuration-files/?tab=agentv6v7#agent-main-configuration-file
173+
[4]: /network_monitoring/devices/vpn_monitoring/?tab=individual#configuration
174+
[5]: /network_monitoring/devices/vpn_monitoring/?tab=autodiscovery#configuration
175+
[6]: /help

0 commit comments

Comments
 (0)