I have an issue where I am monitoring multiple devices and one gives me an email alert just about every hour, sometimes more frequently, stating that a device has gone down and then 5 minutes or so later that it has gone back up. Now as this is just an ICMP test I figured I could check myself by performing a continuous ping on the device and see if it IS going down. Well, I've been pinging for about 14 hours now and I have no breaks at all in my ICMP echo replies. However, I've received dozens of alerts stating that it has gone down. It's the same device each time. What could be causing this?
My ping is through a VPN from a remote site. The location in question is very small, just basic wireless for a clients vacation home. The router is a SonicWALL TZ210 that has its ports setup as "Portshield" which is basically a LAN switch with one WAN port. There are two Ruckus AP's and a Ruckus WLAN controller connected as well as the OnPlus. That's it. The Ruckus AP's never show alerts but the controller does constantly. My ping, even though remote, is done via the LAN IP of the controller and never gets interrupted.
In short, as I'm VPN'ing directly to the SonicWALL and the controller AND OnPlus agent are directly connected to the SonicWALL there shouldn't be an issue with the data path. Also, I would think that the Ruckus AP's would exhibit the same issue as the Zonedirector (controller).
Thanks for all of the clarification above! The AP's, wireless controller, and the ON100 are in the same network segment and all defined under the the same portshield interface on the SonicWall device correct?
It looks like you verified the data path to the controller's interface on the LAN. I wonder if there could be a chance the controller might not initially resolving ARP for the ON100 and/or timing the entry out after a while (as it should)?
Do you think there could be any filtering on the SonicWall?
BTW, I did find out a bit more information about that specific monitor that you are using as well. The monitor uses a grouping of 5 packets, spaced 80ms apart, with a 10 second timeout. It takes a single reply for the monitor to determine the host is up and it's checked every 5 minutes. If there's a failure, then the monitor repeats every 60 seconds.
Perhaps I can setup sometime for us to chat and take a closer look at the issue. If you have some time to spare, please private message me your contact information and I'll setup something.
Article ID:4018 Monitor Web Services on a Device on Cisco OnPlus Portal
Objective Event Monitors are mainly used to monitor the device in order
to provide notifications to the technicians in a timely manner if there
are any problems with the device perfor...
Article ID:3884 Monitor Duplicate IP on OnPlus100 Objective The
Duplicate IP monitor is one of the event monitors on the OnPlus100
device to check the network performance. Duplicate IP monitor checks
whether more than one device in the network uses the sa...
Article ID:3986 Monitor Host Performance with Internet Contol Message
Protocol (ICMP) for a Device on Cisco OnPlus Portal Objective Event
Monitors are mainly used to monitor the device in order to provide
notifications to the technicians in a timely manne...