Administrative and operational state — the four states of an interface

Every interface has two independent state machines: the administrative state (configured up or down) and the operational state (the link is up or down). The combination produces four states, and the routing engineer must be able to read all four at a glance.

The four states

stateDiagram-v2
  [*] --> UpUp: cable in, admin enabled
  UpUp --> UpDown: cable unplugged
  UpDown --> UpUp: cable plugged back
  UpUp --> DownUp: set disable
  DownUp --> DownDown: cable unplugged
  DownUp --> UpUp: delete disable
  DownDown --> DownUp: cable plugged in

Reading the state

vyos@vyos:~$ show interface ethernet
Codes: S - State, L - Link, u - Up, D - Down, A - AdminDown
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
eth0             192.0.2.1/24                      u/u  OUTSIDE
eth1             10.0.0.1/24                       u/u  INSIDE
eth2             -                                 u/D  TRANSIT
eth3             -                                 A/D  unused

The S/L column shows:

• u/u — admin-up, link-up. Normal operational state.
• u/D — admin-up, link-down. Cable is unplugged or remote is down.
• A/D — admin-down, link-down. Operator disabled the interface.
• D/u — admin-down, link-up. Cannot happen with normal VyOS configuration; would indicate a bug.

Disabling an interface

[edit]
vyos@vyos# set interfaces ethernet eth2 disable
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The interface is admin-down. The kernel sets IFF_UP off; the interface drops all traffic.

Re-enabling

[edit]
vyos@vyos# delete interfaces ethernet eth2 disable
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The interface comes back up.

How the result is validated

show interface ethernet
ip link show eth0
ip -d link show eth0

The first shows the VyOS view; the second shows the kernel state; the third shows detailed kernel state including admin-state and oper-state.

How it fails

The production failure modes the engineer must recognise:

• Admin-up, link-down. Cable is unplugged, switch port is disabled, peer is powered off, NIC driver is hung. The interface is in the configuration but not in the network.
• Admin-down, link-up. The interface was disabled but a cable was plugged in. The kernel reports link-up but the interface is admin-down. The interface cannot pass traffic.
• State mismatch after reboot. The configuration has the interface enabled but the cable was unplugged during the reboot. The interface comes up admin-up but link-down.
• Driver hung. The kernel reports link-up but the interface does not pass traffic. The driver must be reset.
• Auto-negotiation failure. Both ends are admin-up, the cables are good, but auto-negotiation did not converge. The interface is link-down or has high error rate.

Rollback

The recovery from a bad interface state:

• Admin-down needed: set interfaces ethernet ethX disable; commit; save.
• Driver hung: ifdown ethX; ifup ethX or reboot.
• Auto-negotiation failure: configure both ends manually with ethtool -s ethX speed 1000 duplex full autoneg off.

Production discipline

Cross-course references

The Linux course’s XIX-Linux-NetFoundations covers the kernel state model. The Proxmox course’s XXIX-Proxmox-Networking covers the host-side state. The Observability course’s LX-Observability-NetworkObs covers how to alert on state changes.

Quiz