Skip to main content

Can we monitor a IPSec tunnel?

We don’t provide an in-tunnel probe IP/URL. Use DPD, a private /32 you control, or probe one of your device IPs.

Jonas Nielsen avatar
Written by Jonas Nielsen
Updated over 2 weeks ago

Environment

  • Onomondo Core Network: IPsec Connector

  • OpenVPN / IPsec: IPsec

  • Applies to: All subscriptions and SIM types

Question

  • Can we monitor the IPsec tunnels between our infrastructure and Onomondo?

  • Is there a specific IP address or endpoint on your side we can use?

Answer

Use one of the following options to monitor tunnel health and data-plane reachability. We don’t host a unique ICMP/TCP endpoint inside the tunnel.

  1. Dead Peer Detection (DPD) on IKEv2 (control-plane keepalive)

    Enable DPD on your headend to detect peer liveness and trigger re-negotiation when the far end stops responding.

  2. Tunnel monitoring to a private /32 you control (data-plane check)

    Add a loopback /32 (or any internal IP) to your Phase-2/CHILD SA selectors and allow ICMP or open a TCP port/HTTP URL you host. Point your firewall’s tunnel monitor at that IP/port/URL.
    ​
    ​Suggested steps:

    1. Add a loopback /32 (or any internal IP) to your Phase-2/CHILD SA selectors and allow ICMP or open a TCP port/HTTP URL you host. Point your firewall’s tunnel monitor at that IP/port/URL.

    2. Add it to the Phase-2/CHILD SA traffic selectors on both sides.

    3. Permit ICMP (or a chosen TCP port) to that /32 in your security policy.

    4. Configure your firewall’s tunnel monitor/SLAs to ping or connect across the tunnel.

  3. Probe a device IP (data-plane check using a SIM/device)

    Target one of your devices that replies to ICMP/TCP using its private IP (as assigned in your routing to Onomondo). Ensure your policies allow this traffic and the device stack responds.

  • We route device traffic into the IPsec Connector when the SIMs are attached to it. If you test against public IPs, NAT/routing on your side must allow and hairpin as needed.

  • Today there is one Connector per organization (with two local endpoints for redundancy), so there isn’t a concept of a unique “probe endpoint per tunnel.”

  • We don’t block ICMP inside the tunnel; we simply don’t host an in-tunnel service.

Cause

Onomondo terminates IKE/IPsec but does not operate an internal “probe host.” In IPsec, DPD verifies the control plane (IKE SA health), while probing a /32 or device IP verifies the data plane (CHILD SA traffic and routing). Hosting the probe on your side lets you control the target, logs, and alerting.

Telco terms:

  • IKEv2 + DPD: IKE keepalive that proves the peer is alive (a control-plane heartbeat).

  • Phase-2/CHILD SA selectors: The list of subnets/hosts allowed through the tunnel (what traffic is “inside”).

  • Data-plane probe: Ping/TCP/HTTP check that confirms packets are actually routed across the tunnel.

Did this answer your question?