Tunnel Flapping Detected
Focus
Focus
Next-Generation Firewall

Tunnel Flapping Detected

Table of Contents

Tunnel Flapping Detected

Incident Code
INC_NGFW_TUNNEL_FLAPPING
Severity
High
Category
Network and Traffic
Subcategory
Site/Tunnel
Description
Detect when the IPsec tunnel is flapping
Raise Condition
A flap counter is incremented when the tunnel transitions from an 'up' to a 'down' state at least 3 times (which means it has also transitioned to an 'up' state at least twice) within a window of 24 hours. We'll refer to this as the hold timer window. Note, so if a tunnel flaps multiple times, say, within 10 mins, that would trigger a tunnel flap alert. If at the end of the hold timer window the tunnel is down, then AIOps generates the Tunnel Flapping Incident.
Clear Condition
When the tunnel comes up, and has been up for at least 24 hours it clears the tunnel flap incident.