Need help troubleshooting

Started by zsing82, October 12, 2012, 04:47:29 PM

Previous topic - Next topic

zsing82

I have NetXMS 1.2.3 setup on Windows 2008 R2 64-bit.  One of my nodes is a SonicWall TZ210.  Firmware is SonicOS Enhanced 5.8.1.8-57o.  This firewall is the default gateway for all my servers, with custom NATs for my hosted services.  It is also configured for SSLVPN Access.  SonicWall TZ210 IP address is 192.168.1.99.  When SSLVPN client connects to SSLVPN router, the client gets an IP address from a static pool configured within the TZ210.  (FYI, I have DHCP on my domain controller configured to issue 192.168.1.100-200.  SSLVPN static pool is 192.168.1.201-215)

At random times (I believe during configuration polling...?), an alarm is generated saying that SonicWall TZ210 node is down.  When I check the node in NetXMS console, I notice the Primary IP Address has changed.  The IP address is different sometimes, but it's always within the static pool for SSLVPN clients.  After the Primary IP address changes, none of the details or DCIs are available.  I can go into Node Properties and manually change the IP address back to 192.168.1.99, then run a Configuration Poll and everything is back to normal.  Then, at some point, the IP address will change back to an IP within the SSLVPN static pool.

So, my question is kind of loaded, but how can I troubleshoot this?  I'm not sure if it's something in the SonicWall or NetXMS.  Any help is appreciated.  Thanks in advance!!

zsing82

Still trying to figure this one out.  The arp cache on NetXMS server maps the correct MAC address to the SonicWall's IP address on my LAN.  I've tried disabling status polling, configuration polling, routing table polling, and topology polling, each one at a time.  For some reason, the IP address still gets changed at random.  After disabling the various polls, the only one left is Network Discovery polling.  I just manually set the IP address and ran a configuration poll.  All the interfaces are back and DCIs are collecting data.  I'm going to disable network discovery polling for this node only and see if the IP address still changes at random.  I will post my results back.

Again, any help would be appreciated.  Thanks!

millerpaint

If you turn off SSL VPN services on the SonicWall, does it stop "changing" IP's and going offline in the NetXMS console?

We have the same setup, only we use a WatchGuard with SSL VPN for our remote users, and it is not our default gateway.  I've had no problems with NetXMS showing the WatchGuard as going offline, changing IP's, etc.

zsing82

Disabling network discovery polling had no effect.  The primary IP address of the SonicWall changed after a few minutes.

millerpaint,
I haven't tried that approach yet.  I will have to schedule downtime or try it late night this weekend.  Thanks for the idea.  I will post back.

zsing82

Well, no such luck.  I disabled all my VPN and SSLVPN policies and the primary IP address continues to change to an IP address from the SSLVPN IP pool.  Other suggestions welcome.

zsing82

Alex, Victor,

Any ideas why the Primary IP Address of my SonicWall TZ210 gets changed from the LAN IP to an IP address from the VPN static pool?  I can provide SNMP-walks if need be.  I just don't know where to start or what to look for.  Any help would be appreciated.  Thanks again!!

zsing82

OK, maybe I should clarify a little bit.  The IP address that is bound to the X0 (LAN) port on my TZ210 does not change.  It is always 192.168.1.99.  It is only within NetXMS that shows the primary IP address as something from the Static IP pool for SSLVPN clients.  The actual IP address on the device never changes.  I can always pull up a web browser and administer the TZ210.  But, within NetXMS, after the node's Primary IP address is changed from 192.168.1.99 to an IP from the static pool, NetXMS shows the node as "DOWN" and none of the DCI's work, presumably because NetXMS is trying to communicate via an IP address from within the static pool, and not the IP that is bound to the X0 port.

What is the mechanism used to determine a nodes Primary IP Address?  Also, what polling occurs at regular intervals?