Interfaces go to "Unknown State"

Question

Hi all. I'm new to Orion and here so please be nice to the noob.

We are running NPM 8.5.1 SP2. Everything is working well on our LAN but the PIX firewalls on the WAN slowly keep loosing the interfaces we are monitoring. I have been playing around with the polling intervals but it does not seem to be helping. Over time we see more and more of the firewalls with the interface status going to "Unknown". I have found that if I Unmanage the node, wait 5 minutes and the Manage the node, everthing works again for a day or two. Thus far I have not been able to find any pattern to those nodes that display this behavior. It does seem to reoccur more in some nodes but never happens with others.

Our WAN consists of DSL connections with pings normally in the 45ms-80ms range with the occasional spikes of 300ms+.

Has anyone seen this behavior or any ideas what I can try?

This is fairly typical except that the SNMP Outstanding will occasionall rise to 500 to 600 outstanding:

Orion Network Performance Monitor Version 8.5.1
NetPerfMon Engine 
Network Node Elements 473
Interface Elements 997
Volume Elements 252
Date Time 1/25/2008 6:38:20 PM
Paused False
Max Outstanding Polls 900
Status Pollers 
ICMP Status Polling Index 1722 out of 1722
SNMP Status Polling Index 1722 out of 1722
ICMP Polls per second 0
SNMP Polls per second 30
Max Status Polls Per Second 90
Packet Queues 
DNS Outstanding 0
ICMP Outstanding 7
SNMP Outstanding 219
Statistics Pollers 
ICMP Statistic Polling Index 3066 out of 3066
SNMP Statistic Polling Index 3066 out of 3066
ICMP Polls per second 0
SNMP Polls per second 0
Max Statistic Polls Per Second 30

Thanks in advance for any help.

FormerMember · Answer

I have this issue with my Windows servers where their interfaces will drop to unknown for no reason.

This issue is that I have done packet traces and confirmed that the devices(servers in my case) are responding correctly to the snmp requests from Orion but the response is not accepted at the server.

currently the accepted method to bandaid the problem is to restart SNMP on the device with unknown interfaces.  Some how this makes things ok back on Orion again.  Even though the same replys are being sent when it works as when it stops working.

AndrewShine · Answer

I'm (still) having the same problem using Juniper\Netscreen firewalls and Orion 9.0 (and earlier versions) and useing the same temorary unmanage\manage trick to work round the issue. The last time I looked in to this the suggestion was flaky snmp agents on the firewalls. If so then you could try upgradeing the PIX firewalls to the latest os version..? Might fix the snmp agent...??

..and no a similar approach on the Netscreens didn't work ...

vhcato · Answer

I've noticed a couple of instances where router interfaces would show up as "unknown" for no apparent reason since moving to 8.5.1 SP1. It hasn't happend enough to be a major concern, but I know something's not right somewhere. Hopefully, this will be addressed in a SP.