Sensor link state is displayed as Down
Sensor link state is displayed as Down in the node management or sensor management screen.
The network sensor periodically sends a keep-alive packet to the policy server to inform that it is operating normally.
If this packet is not forwarded to the policy server, the link status is displayed as Down.
The keep-alive packet communicates on the following ports:
- Allow for UDP / 3870 ports
Go to System> Service > Port and allow port in Keepalive section
In this case, the following should be confirmed:
- The network sensor is turned on.
- A communication path exists between policy server and network sensor on the keep-alive port.
Ensure necessary exceptions on firewalls or other appliances.
- Through SSH on the Policy Server, inspect traffic using the command to see if the keep-alive
packet is reaching the policy server:
tcpdump -i eth0 host [Network Sensor IP] [keep-alive port] , to check for keep-alive packet.