Sensor link state is displayed as Down 
======================================

Symptom
-------

Sensor link state is displayed as Down in the node management or sensor management screen.

  .. image:: /images/sensor-down.png
    :width: 600px

Cause
-----

The network sensor periodically sends a keep-alive packet to the policy server to inform that it is operating normally.
If this packet is not forwarded to the policy server, the link status is displayed as Down.

The keep-alive packet communicates on the following ports:
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

**On-Premeses**
  Allow for UDP / 3870 ports

**Cloud-managed**
  (Varies)
  
  Go to **System> Service > Port** and allow port in **Keepalive** section

  .. image:: /images/keepalive-port.png
    :width: 600px

Resolution
----------

In this case, the following should be confirmed:

#. The network sensor is turned on.
#. A communication path exists between policy server and network sensor on the keep-alive port.
   Ensure necessary exceptions on firewalls or other appliances. 
#. Through SSH on the Policy Server, inspect traffic using the command to see if the keep-alive
   packet is reaching the policy server: ``tcpdump -i eth0 host [Network Sensor IP] [keep-alive port]`` , to check for keep-alive packet.