Firewall running NSRP is in (I) state, and the firewall is configured to monitor interfaces. How do I get the firewall out of the (I) state? How do I fix this situation?
Symptoms:
- Firewall running NSRP is in (I) state, and the firewall is configured to monitor interfaces. How do I get the firewall out of the (I) state? How do I fix this situation?
- When you run the following commands, you see that a monitored interface is down:
get nsrp | inc device
get event
For example:
In this case you can see that monitored interface e0/0 is down:
SSG550(I)-> get nsrp | inc device
device based nsrp monitoring threshold: 255, weighted sum: 255, failed
device based nsrp monitor interface: ethernet0/0(weight 255, DOWN)
device based nsrp monitor zone:
device based nsrp track ip: (weight: 255, disabled)
SSG550(I)->
In the "get nsrp" output you see:
group priority preempt holddown inelig master PB other members
0 100 no 3 no 8347392 none myself(inoperable)
You also notice event log messages related to this change:
2008-04-09 06:15:27 system crit 00075 The local device 8345472 in the
Virtual Security Device group 0
changed state from primary backup to
inoperable.
2008-04-09 06:15:26 system notif 00513 The physical state of interface
ethernet0/0 has changed to Down.
Check the cables connected to the interface in question, in this case eth0/0. Check to see if the interface is manually shut down on the firewall. (In this case, check if the config has the command "
set int ethernet0/0 phy link-down").
Also, check the switch and switch port that the interface is connected to. If the cable is connected, but the interface is still down, try using a different cable or a different switch port.
After bringing up the monitored interface, the output of '
get nsrp' will show that the monitored interface is UP, and the firewall prompt will no longer report that it is Inoperable (I):
SSG550(B)-> get nsrp | in dev
device based nsrp monitoring threshold: 255, weighted sum: 0, not failed
device based nsrp monitor interface: ethernet0/0(weight 255, UP)
device based nsrp monitor zone:
device based nsrp track ip: (weight: 255, disabled)
SSG550(B)->