This article provides information about the default VPN-Monitoring values and behavior.

Default VPN-Monitoring values and behavior.

In the IPsec configuration, we have the VPN-Monitoring option, with which you can configure the Interval and Threshold for VPN-Monitoring. The default values are:

• VPN-Monitoring Interval: 10 Seconds
• VPN-Monitoring Threshold: 10

Assuming we have configured the VPN-Monitoring with the optimized option. In this case, once traffic stops passing, every ten seconds the device will send a keepalive message and if all 10 messages do not receive a response, VPN-Monitoring will bring down the VPN (Phase-2) and clear the SA.
(Note: It doesn't cause re-negotiation of Phase 1 unless Phase 1 has timed out.)

Once SA is cleared, the KMD Process sends KMD_VPN_DOWN_ALARM_USER to RE. If we have a syslog for the messages file configured for any any or any info , then you will see the same message in the messages file.

We should see this message every 100 seconds; if we do not modify the default VPN-Monitoring parameters. If parameters are modified, it will send the VPN Down message based on the configured value and this message will be sent for every tunnel being down.

VPN-Monitor threshold and interval values can be customized by the following commands:

root@srx5400-r2009# set security ipsec vpn-monitor-options interval ?
Possible completions:
  <interval>           Monitor interval in seconds (2..3600 seconds)
[edit]
root@srx5400-r2009# set security ipsec vpn-monitor-options threshold ? 
Possible completions:
  <threshold>          Number of consecutive failures to determine connectivity
[edit]
root@srx5400-r2009# set security ipsec vpn-monitor-options threshold     

2023-09-05: Modified categories and added a note in the solution section
2020-09-30: Added command to modify VPN-monitor threshold/interval values.