Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Monitoring devices that deny ICMP

I have a couple devices that have built in firewalls that block ICMP totally with no way to allow Pings. I can pull up the interfaces OK and the CPU, but they get reported as down since they deny ping. How can I set Orion to show them up without ICMP? I actually have this problem with ASA's and monitoring devices behind one unless I bing the IP to a device after setting up all the port translations.

Find more posts tagged with

monitor

firewall

block_ping

icmp

Accepted answers

All comments

brokenjeep

I am sure you have seen this one.. I know it is a feature request but if there is any idea of how far down the list it is, would be cool. More devices are shutting down ICMP these days..

ACDII

I missed that one, but it answers my question for sure. I guess my phone proxies will remain unmonitored.

brokenjeep

SW devs, please but down two more people requesting this feature..

bshopp

Noted, thanks!

chris.schock

Please add me to the list of those requesting the feature.

Side note/rant, ICMP has unfortunately gotten a bad name and a lot of organizations shut it all down regardless of type code. Personally I think this is a shortsighted practice at best, and disastrous at worst. Ping and traceroute are two of the easiest and most helpful tools for troubleshooting, now made useless.

Even more nefarious is that disabling ICMP carte blanche breaks MTU discovery. With all the IPSec and GRE tunnels (think: WCCP) out there today this can do to an application what Rome did to Carthage. Most people never even think of this and I am fairly sure there are many organizations suffering from this undetected issue.

So for all you firewall/security guys out there, please allow ICMP and just rate limit instead. That way techs can still do what they need to do, your IP stack still has a fighting chance, and you limit your exposure to viruses, worms, and smurfs.

bshopp

I have appended y'all to the enhancement request

kiwi

Hi Brandon

HP OV NNM solves this by having the user add the Non-pingable IP addresses to a flat file that has a Reserved file name recognised by the network monitor process that instructs it to use SNMP instead of ICPM (ping) to monitor the interface Up/Down status for those particulat interfaces. May be Lab eng will do similar thing for this NPM service request, if I may suggest

K. rgrds