Zenping failure on WAN

[Antonio Formato]

Antonio Formato [http://community.zenoss.org/people/Format] created the discussion

"Zenping failure on WAN"

To view the discussion, visit: http://community.zenoss.org/message/64567#64567

--------------------------------------------------------------
Hello,
I have some errors on zenping daemon.
Periodically Zenoss advises "ip x.x.x.x is down" but host is up; if I ping device it will respond.
I have to restart zenping daemon to figure out problem temporarily.
This strange behaviour is only for devices connected via WAN. Devices on the LAN could be monitored without an error.
I'm running Zenoss 3.2.1 and localhost collector has default configuration.

What can be the cause of the problem?

Regards
Antonio
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64567#64567]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Shane Scott]

Shane Scott [http://community.zenoss.org/people/hackman238] created the discussion

"Re: Zenping failure on WAN"

To view the discussion, visit: http://community.zenoss.org/message/64575#64575

--------------------------------------------------------------
Antonio:

Do you have netscreen or gss devices somewhere in the mix? If you do, they're almost certainly eating packets.

--Shane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64575#64575]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Antonio Formato]

Antonio Formato [http://community.zenoss.org/people/Format] created the discussion

"Re: Zenping failure on WAN"

To view the discussion, visit: http://community.zenoss.org/message/64580#64580

--------------------------------------------------------------
Shane,
I have a Cisco ASA Security Plus version 8.4.2 and Fortigate 80C.
Do you think about problem caused by firewalls?

Thank you
Antonio
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64580#64580]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Shane Scott]

Shane Scott [http://community.zenoss.org/people/hackman238] created the discussion

"Re: Zenping failure on WAN"

To view the discussion, visit: http://community.zenoss.org/message/64583#64583

--------------------------------------------------------------
Antonio:

I've found ASA's responsible for Zenoss ICMP packet mutalation, yes. I can't say about the Forigate. Most of the time the issue comes down to zenping crafting slightly unusual icmp packets. A good way to try to work around trouble devices like these are to add them to a group called 'icmpHungry' (or whatever you like) and crafting a special alerting rule or transform which qualifies all up/down (event class /Status/Ping) alerts from the devices in said group. I'd reccomend the rule qualify downs by waiting for them to occur more than once before alerting. In Zenoss v4 zenping has undergone a massive rewrite to help fix these types of problems as much as possible.

--Shane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64583#64583]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Antonio Formato]

Antonio Formato [http://community.zenoss.org/people/Format] created the discussion

"Re: Zenping failure on WAN"

To view the discussion, visit: http://community.zenoss.org/message/64601#64601

--------------------------------------------------------------
Shane,
if ASA were the cause of the ICMP problem, why does the problem go away when I restart the zenping?

Thank you
Antonio
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64601#64601]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Shane Scott]

Shane Scott [http://community.zenoss.org/people/hackman238] created the discussion

"Re: Zenping failure on WAN"

To view the discussion, visit: http://community.zenoss.org/message/64667#64667

--------------------------------------------------------------
Antonio:

Good question. I can't tell you. The same issue occurs with netscreens and gss appliances.

--Shane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64667#64667]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]