Firewall running NSRP is in (I) state.  How do I get the firewall out of the (I) state? How do I fix this situation?

Symptoms:

• Backup firewall running NSRP is in (I) state. How do I check what triggered it?  How do I get the firewall out of the (I) state? How do I fix this situation?
• Firewall prompt has an (I) at end

 

If the NSRP monitored objects for device failover exceed the failure threshold, it will result in the device to enter the Inoperable state.  The firewall prompt has a (I) appended to the hostname when it is in the Inoperable state. 

NSRP monitored objects include:

•  Physical Interfaces
•  Zones
•  Specific target IP addresses

Run the command 'get nsrp | inc device'  to see which NSRP monitored objects caused the firewall to go into the Inoperable state.  Depending on how you configured the weights, it could be more that one object.


Monitoring Physical Interfaces
If the monitored physical interface failed, then the interface is identified as DOWN in the 'get nsrp' output:


For more information on how to fix this condition, see KB11327.


Monitoring Zones
If all the interfaces in the monitored zone are down, then the zone is identified as DOWN in the 'get nsrp' output:


For more information on how to fix this condition, see KB11331.


Monitoring Specific Target IP Address(es)
If the monitored specific target address(es) are unreachable and exceed the failure threshold, then it is identified as FAILED in the 'get nsrp' output: