I am using a CSR in an AWS VPC for IPsec/IKEv2 termination to remote branches. I'm using dynamtic VTIs/Virtual templates to implement the tunnels. The remote ends of the tunnels are ASAs that use policy-based IPsec tunnels. Given this set-up, my understanding is that the SA will not be active unless there is interesting traffic. I do not manage the ASAs and have limited ability to influence their configuration.
I want to publish SNS notifications when an individual IPsec tunnel is unable to establish. What is the recommended way to accomplish this?
