When the "optimized" option of VPN Monitor is enabled, existing traffic through the VPN is used for the monitoring packet instead of using the VPN monitor ping, which would normally be sent.
This article shows how to enable the "optimized" feature.
What does the "optimized" feature do?
When VPN monitoring is enabled for a specific tunnel, the security device sends ICMP echo requests (or “pings”) through the tunnel at specified intervals (configured in seconds) to monitor network connectivity through the tunnel. However, when the "optimized" feature is selected, the VPN monitoring behavior changes as follows:
The SRX Series device accepts incoming traffic through the VPN tunnel as a substitute for ICMP echo replies.
If there is both incoming and outgoing traffic through the VPN tunnel, the SRX Series device suppresses VPN monitoring pings.
Note: If you enable VPN monitoring optimization, be aware that VPN monitoring can no longer provide accurate SNMP statistics.
To enable the "optimized" feature of VPN Monitor, use one of the following methods:
CLI:
root@srx#set security ipsec vpn <vpn-name> vpn-monitor optimized
J-Web:
Go To Configure > Security Services > IPsec (Phase II) .
Double-click the IPsec VPN on which you want to configure the feature.
Click the IPSec VPN Options tab.
Select the "Enable VPN monitor" check box.
Select the Optimized check box.
Optional: Specify a "Destination ip" and/or a "Source interface."
For information about using Source Interface and Destination IP, consult KB10119 - Configuring the Source Interface and Destination IP options of VPN Monitor [juniper.net] .
2020-06-12: Article reviewed for accuracy; no changes required
2020-12-28: Article reviewed for accuracy; J-Web navigation options modified