[tdvit]

Thanks for the reply.

VPN is traditional mode
the ip cluster is in forwarding mode and its load sharing not HA
and the arrow points to the left on eth2c0 which is the internal interface
and when it reports on the working node it gets accepted on the external interface of the fwall with the arrow pointing to the left so it looks like this could be where the problem is?

and when orion reports it as down it is absolutely and definately up and running.

thanks for the help

Mick