Sensor link state is displayed as Down

Symptom

Sensor link state is displayed as Down in the node management or sensor management screen.

Cause

The network sensor periodically sends a keep-alive packet to the policy server to inform that it is operating normally. If this packet is not forwarded to the policy server, the link status is displayed as Down.

The keep-alive packet communicates on the following ports:

On-Premeses

Allow for UDP / 3870 ports

Cloud-managed

(Varies)

Go to System> Service > Port and allow port in Keepalive section

Resolution

In this case, the following should be confirmed:

1. The network sensor is turned on.
2. A communication path exists between policy server and network sensor on the keep-alive port. Ensure necessary exceptions on firewalls or other appliances.
3. Through SSH on the Policy Server, inspect traffic using the command to see if the keep-alive packet is reaching the policy server: tcpdump -i eth0 host [Network Sensor IP] [keep-alive port] , to check for keep-alive packet.