Hi,

I have noticed that one of my firewall contexts interfaces shows input and output packets even though the interface was in the admin shutdown state during reboot.

Interface Vlan111 "DMZ-NET", is administratively down, line protocol is down
        Description: Interface routing to DMZ-NET (Also used for Context Management)
        MAC address 0021.55be.8100, MTU 1500
        IP address 192.168.4.254, subnet mask 255.255.255.0
  Traffic Statistics for "DMZ-NET":
        45377 packets input, 3779957 bytes
        1130 packets output, 79010 bytes
        1999 packets dropped

The FWSM is running v3.1(7) and is a failover pair (The standby also has traffic stats). Do I have to admin shut the interface in the system context to properly close the interface during boot? Is there something in the way that the FWSM loads its system context configuration first and then loads the individual contexts later that means the interface could be live for a few seconds?

This issue became apparent after reloading the FWSM during some failover testing prior to deploying it on the network. These switches and FWSMs  are cabled to the existing network (with the IPs of the devices they will replace) and it had put a MAC entry in another firewall device which caused an outage. The reason for keeping the interfaces in the admin shutdown state was to avoid anything like this happening.

Thanks

Mel