Network Management

NetPath graph issue: Intermittent endpoint is unreachable

First published date

10/19/2018 6:38 PM

Last published date

1/14/2022 8:30 PM

Overview

The NetPath graph does not seem to be accurate.

Occasionally an endpoint is unreachable. This mostly happens to HTTPS or another protocol that requires SSL or TLS. This is potentially caused by NetPath not handling SSL/TLS handshaking, and possible interference from the firewall with NetPath probing.

Product section

Network Performance Monitor

Resolution

Step 1: Test TCP connectivity

  1. Download and extract PSTools.zip from Microsoft. (© 2018 Microsoft Corp., available at https://technet.microsoft.com, obtained on November 19, 2018)
  2. Identify the IP address from the endpoint with the issue.
  3. Run psping from the command prompt to test end-to-end latency and packet loss to the NetPath service.

    psping -t endpoint_ip_address:endpoint_port

  4. After receiving 20 results, press Ctrl+C to stop.
  5. Look at the packet loss in the results. Check if it reads "Access is Denied" or if the packet loss less than 5%.

 

Did the TCP connectivity test successfully?

  • Yes: Go to Step 2.
  • No: This confirms a connectivity problem. Further investigation is needed, starting from the device just before the red dotted line.


Step 2: Test the HTTP port on the endpoint

  1. Identify the IP address from the endpoint with the issue.
  2. Add a new NetPath service using port 80 and that IP address.
  3. Wait two or more probing intervals to get the NetPath probing results.
  4. Check if the issue with intermittent endpoint connectivity exists here as well.

Does the connectivity issue exist on the HTTP port of the endpoint?


Step 3: Check if the firewall is creating logs for NetPath probing packets

  1. Find the endpoint IP address and TCP port from the service that has the issue.
  2. Find the IP address of the NetPath agent that probes the service.
  3. Locate the firewall that the NetPath probing traffic traverses. The firewall may or may not display in the NetPath graph.
  4. Make sure the log is enabled for Drop rules, including Default and Implicit Drop rules.
  5. Based on the firewall manual:
    1. For the outbound direction from agent to endpoint, find the firewall drop logs for TCP packets from the IP address of the NetPath agent and any source port, to the endpoint IP address and port of the service with the issue.
    2. For the inbound direction from endpoint to agent, find the firewall drop logs for ICMP Type 11 packets from any IP address to the IP address of the NetPath agent.


Check firewall logs; see NetPath graph issues: basic troubleshooting .

Open Check Point SmartView Tracker > All Records > Add filters.

For outbound NetPath probing packets, add the filter for:

  • Service: TCP service specified in NetPath Services
  • Source: NetPath probe
  • Destination: Endpoint

For inbound NetPath probing packets, add the filter for:

  • ICMP Type 11
  • Destination: NetPath probe

The log option must be enabled for rules that can allow or deny NetPath probing traffic.

Did you find the logs?