> Source: [sk1000167](https://support.checkpoint.com/results/sk/sk1000167)

# sk1000167 - VPN network probes with a spoofed ICMP source show "Down" on ElasticXL, but the destination is reachable

| Property | Value |
|----------|-------|
| Solution ID | sk1000167 |
| Date Created | 2026-09-17 |
| Last Modified | 2026-09-27 |
| Technical Level | General |
| Products | Check Point Firewall |
| Versions | R82.20 |

## Symptoms

- * Some VPN network probes show `Up` and other probes show `Down`, although the VPN tunnel is established.
* The server that owns the spoofed source IP address can ping the destination. But the VPN network probe shows `Down`.
* The probe status is different on different ElasticXL clusters. The status can also change over time.
* The probes can show `Up` after you restart the `probemond` process or create the probes again. Later, the probes change to `Down` again.
* The `zdebug` output and the SmartConsole logs do not show related drops.
* The probes show `Up` when only one cluster member is active.

## Cause

On ElasticXL, the traffic distribution between cluster members can cause VPN network probes with a spoofed ICMP source to fail.

1. The `probemond` process sends the VPN probe traffic. This process runs only on the Master (Pivot) cluster member.
2. On ElasticXL, the Master member is also the orchestrator. The orchestrator can send traffic to other cluster members.
3. The `probemond` process injects the spoofed ICMP probe traffic into the interface. For this reason, the Master member does not identify the reply as a reply to its own probe traffic.
4. ElasticXL can send the reply to a different cluster member. That member handles the reply as usual ICMP traffic.
5. The `probemond` process on the Master member does not receive the reply. As a result, it sets the probe status to `Down`.

## Solution

Use this workaround:

### Step 1: Configure an ElasticXL exception for each probe

**Warning:** This command changes how ElasticXL handles the specified traffic. Configure it only for the necessary pair of probe source and destination IP addresses. Make this change only during a maintenance window or an approved change window.

1. Connect to the command line of the applicable ElasticXL cluster.

2. For each pair of probe source and destination IP addresses, run this command:

   `asg_excp_conf set 5 <Probe_Source_IP> 0 <Probe_Destination_IP> 0`

   Where:
   * `<Probe_Source_IP>` - The spoofed source IP address that the VPN network probe uses.
   * `<Probe_Destination_IP>` - The real IP address of the remote destination that the VPN network probe monitors.
   * Example:
   `asg_excp_conf set 5 10.255.43.213 0 10.252.28.4 0`
3. Do these steps on each applicable ElasticXL cluster.

### Step 2: Create the applicable VPN Network Probes again

**Important:** The ElasticXL exception applies only to new connections. You must delete the probes to close the current connections. Then, the new probes use the exception.

1. In SmartConsole, delete the applicable VPN network probes.

2. Install the Access Control Policy.

3. In the command line of the ElasticXL cluster, stop the `probemond` process on all cluster members:

   `g_all probemon stop`
4. In SmartConsole, create the VPN network probes again. Use the same source and destination settings as before.

5. Install the Access Control Policy.

6. In the command line of the ElasticXL cluster, start the `probemond` process on all cluster members:

   `g_all probemon start`
7. Make sure that the VPN network probes show `Up`.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content