For the circumstances described, there isn't a way to distinguish between actual outage vs a interfering firewall rule. The good news is that it warranted an investigation, and you were able to identify the root cause. Going forward, you could change the way you determine firewall status to be based on SNMP as opposed to ICMP, and create a dependency for all the DMZ nodes on this parent firewall node.
The other options are
- to place a polling engine in the DMZ, but you will have to determine if the cost of the polling engine makes sense for your DMZ size.
- an independent instance of NPM inside DMZ