Netscreen: Troubleshooting NSRP

Netscreen firewalls setup in Active/Passive mode will have the letter “M” or “B” in parenthesis with the hostname to indicate status of Master or Backup. Example: Firewall1(M):

To check the current HA status on a firewall run:

“get nsrp”


To check if the configuration is sync’d between the two firewalls run:

exec nsrp sync global-config check-sum

To resync without a reboot:

exec nsrp sync global-config run

Or, to resync the cluster in a way that requires a reboot:

exec nsrp sync global-config save


If both firewalls indicate the status of “master”, check the HA interface connections: (run “get interface” to show which interfaces are being used for the HA connection)


labfw1(M)-> get int


A – Active, I – Inactive, U – Up, D – Down, R – Ready


Interfaces in vsys Root:

Name           IP Address                        Zone        MAC                 VLAN State VSD Vsys

mgt                  MGT                    001b.c065.b480    –       U   –      Root

eth1/1                            Untrust                  0010.dbff.2070               –          U   0               Root

eth1/2                            Trust         0010.dbff.2080               –          U   0     Root

eth1/3                            Null           0010.dbff.2090               –          D   0     Root

eth1/4                            HA            001b.c065.b48a    –       U   –      Root

vlan1                            VLAN        0010.dbff.20f0                1         D   0     Root

null                               Null           N/A               –   U          0          Root



In this example interface eth1/4 is being used for HA communication between the two firewalls


Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s