I have a main (active) Juniper Netscreen SSG firewall that I can access. I can't access the standby unit. I'd love to find out more about the standby unit from the main unit. Are there commands that would answer any of these questions?

What is the IP of the standby unit? Let's reboot the standby unit from the active. What is the status of the standby unit? (get nsrp is very cryptic and not clear, how do I decipher that?) When was the last failover and is there a reason why it happened? Is the standby unit ok enough to fail back over to without it immediately failing back?


The main commands you want to use is get nsrp vsd-group all. That will show the current status. Note which units are master, primary back up and any secondary backups.

For the IP address of the stand by unit, it won't have one unless you set a manage-ip on the interface. The address on any interfaces are shared addresses by all devices in the vsd-group. The manage-ip on any interface is unique to that device. You should always set a manage-ip on devices on secure network interfaces (i.e., usually in the Trust zone or on the management interface) and generally not on unsecured networks (i.e., the Untrust zone). If you only have access to one over the network I suggest logging in on the serial console and setting a manage-ip for each device.

The best way to know when the last failover was is to check the log (get event). The reason why is almost always because a manual failover was initiated or a device went to ineligible state. Devices usually go to ineligible state if one of the monitor conditions (e.g., interface, ip-track).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.