topic Re: SolarWinds Orion in General Topics

SolarWinds Orion

RemoteUser — Mon, 10 Nov 2025 11:26:26 GMT

Hi Mates!

The customer is experiencing intermittent ICMP DOWN alert events reported by SolarWinds, i checked on the firewall site but i dont'see nothing realted, have any idea?
Orion polls ICMP every 3 minutes.

Re: SolarWinds Orion

Chris_Atkinson — Mon, 10 Nov 2025 12:14:32 GMT

What address is being probed is there a VPN involved or is the gateway under load?

Re: SolarWinds Orion

RemoteUser — Mon, 10 Nov 2025 12:46:36 GMT

Orion go out through a cluster, there is no VPN involved

Re: SolarWinds Orion

the_rock — Mon, 10 Nov 2025 12:49:53 GMT

Hey brother,

Are there any relevant logs in Smart Console you can see about this?

Re: SolarWinds Orion

RemoteUser — Mon, 10 Nov 2025 13:17:10 GMT

the only thing that i see it is that:
dropped by fw_first_packet_state_checks Reason: ICMP reply does not match a previous request;

Re: SolarWinds Orion

the_rock — Mon, 10 Nov 2025 13:23:45 GMT

https://support.checkpoint.com/results/sk/sk66443

https://community.checkpoint.com/t5/General-Topics/ICMP-reply-does-not-match-a-previous-request/td-p/62792

Re: SolarWinds Orion

RemoteUser — Mon, 10 Nov 2025 13:31:10 GMT

yeah brother, i know about that, but the main purpose it's to understand why it happens

Re: SolarWinds Orion

the_rock — Mon, 10 Nov 2025 13:32:57 GMT

My most educated guess is assymetric routing. Thats what I always experienced, since R55 days.

Re: SolarWinds Orion

Chris_Atkinson — Tue, 11 Nov 2025 06:44:50 GMT

Any aggressive aging active log messages or cluster failover events that correspond?

Re: SolarWinds Orion

the_rock — Tue, 11 Nov 2025 01:56:53 GMT

Hey bro,

Just curious. when did this issue happen?

Re: SolarWinds Orion

RemoteUser — Tue, 11 Nov 2025 06:42:27 GMT

one month ago brother

Re: SolarWinds Orion

RemoteUser — Tue, 11 Nov 2025 06:42:58 GMT

I'm sorry, I don't understand your question.

Re: SolarWinds Orion

Shyy — Tue, 11 Nov 2025 09:26:36 GMT

Happened to me once due to asymetric routing,
I'd suggest to check the revisions and look at the changes that were probably made around the time the issue started.

Re: SolarWinds Orion

the_rock — Tue, 11 Nov 2025 11:28:46 GMT

Its aggressive aging protection, brother, check out below.

https://sc1.checkpoint.com/documents/R80.20/SmartConsole_OLH/EN/html_frameset.htm?topic=documents/R80.20/SmartConsole_OLH/EN/Wh_4163Q-r2uASm5pwt7Iw2

Re: SolarWinds Orion

the_rock — Tue, 11 Nov 2025 12:46:48 GMT

Can you find any relevant logs around that time that could potentially help us figure out why this may have happened?

Re: SolarWinds Orion

the_rock — Wed, 12 Nov 2025 01:01:14 GMT

Hey brother,

I did some more research on this and found some notes about this tool when I worked with one of our customers few years ago on some alerts and it turned out to be false positive. Can you check with the client if thats a possibility?

Re: SolarWinds Orion

genisis__ — Wed, 12 Nov 2025 09:03:59 GMT

Is this just polling a standard gateway or VSX?

Only issue I've seen is when you attempt to ping the cluster IP and a real IP on the node.

Re: SolarWinds Orion

RemoteUser — Wed, 12 Nov 2025 09:08:47 GMT

standard gw, what you mean by the real IP

Re: SolarWinds Orion

genisis__ — Wed, 12 Nov 2025 09:45:17 GMT

If you are ping the cluster IP and the real IP it likely won't work on the active gateway (See SK26874), I specifically experienced this on VSX, so may not be relevant.

Re: SolarWinds Orion

the_rock — Wed, 12 Nov 2025 11:47:58 GMT

But is it cluster or single gw?