Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)

 

Configuring Inter-chassis MS-MPC and MS-MIC Redundancy for NAT and Stateful Firewall Overview (Release 16.1 and later)

Note

This topic applies to Junos OS release 16.1 and higher. (For Junos OS release 15.1 and earlier, see Inter-Chassis High Availability for MS-MIC and MS-MPC (Release 15.1 and earlier)).

Carrier-grade NAT (CGN) and stateful firewall deployments can use a dual-chassis implementation to provide a redundant data path and redundancy for key components in the router. Although intra-chassis high availability can be used in an MX Series device by employing the AMS interfaces, this method only deals locally with service PIC and full MS-MPC or MS-MIC card failures. If for any reason traffic is switched to a backup router due to some other failure in the router, the session state from the Service PICs is lost. Inter-chassis high availability offers a more robust solution by preserving the session state of NAT and stateful firewalls from the services PICs. This technology is a primary-secondary model, not an active-active cluster. Traffic to be serviced by the services PICs that are configured for inter-chassis high availability only flows through the MX Series device that is currently the primary in the pair.

To configure interchassis redundancy for NAT and stateful firewall, you configure:

  1. Stateful synchronization, which replicates the session state from the services PICs on the primary chassis to the backup chassis. For more information, see Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) Overview (Release 16.1 and later).

  2. The service redundancy daemon, which allows primary-role switchover to occur based on a monitored event. Most operators would not want to employ stateful synchronization without also implementing the service redundancy daemon. For more information, see Service Redundancy Daemon Overview

Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) Overview (Release 16.1 and later)

Note

This topic applies to Junos OS release 16.1 and higher. (For Junos OS release 15.1 and earlier, see Inter-Chassis High Availability for MS-MIC and MS-MPC (Release 15.1 and earlier)).

Stateful synchronization synchronizes long-lived sessions between the primary and backup MX Series chassis in the high availability pair. By default, long lived sessions are stateful firewall, NAT, and IDS sessions that have been active on the services PIC for 180 seconds, though you can configure this to be a higher or lower value. Stateful firewall sessions, NAT sessions, and IDS sessions are the session types that can be synchronized.

Inter-chassis high availability works with ms- service interfaces configured on MS-MIC or MS-MPC interface cards. An ms- interface unit other than unit 0 must be configured with the ip-address-owner service-plane option.

The following NAT translation types and sessions support stateful synchronization:

  • basic-nat44

  • dynamic-nat44

  • napt-44

  • napt-44 with endpoint-independent mapping (EIM), or endpoint-independent filters (EIF)

  • dnat-44

  • twice-nat

  • stateful-nat64

The following restrictions apply:

  • Replicating state information for the port block allocation (PBA), endpoint-independent mapping (EIM), or endpoint-independent filters (EIF) features is not supported.

  • When configuring a service set for NAT or stateful firewall that belongs to a stateful synchronization setup, - the NAT and stateful firewall configurations for the service set must be identical on both MX Series devices.

  • Application Layer Gateway (ALG) sessions do not support stateful synchronization.

Figure 1 shows the inter-chassis high availability topology.

Figure 1: Stateful Sync Topology
Stateful Sync Topology

Configuring Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)

Note

This topic applies to Junos OS release 16.1 and higher. (For Junos OS release 15.1 and earlier, see Inter-Chassis High Availability for MS-MIC and MS-MPC (Release 15.1 and earlier)).

To configure stateful synchronization inter-chassis high availability for stateful firewall and NAPT44 on MS-MIC or MS-MPC service PICs, perform the following configuration steps on each chassis of the high availability pair.

  1. Configure the services ms- interface.
    1. Specify the IPv4 address of the local services card. This address is used by the TCP channel between the HA pairs.

      When you configure the other chassis, this is the address you use for the redundancy-peer ipaddress.

    2. Specify the IPv4 address of the remote services card. This address is used by the TCP channel between the HA pairs.

      When you configure the other chassis, this is the address you use for the redundancy-local data-address.

    3. Configure the length of time that the flow remains active for replication, in seconds.

    4. Configure a unit other than 0 with the ip-address-owner service-plane option.

    5. For the unit configured with the ip-address-owner service-plane option, assign the IPv4 address of the local services card that you configured with the redundancy-local data-address option.

    6. Configure the inside and outside interface units, which are used by the next-hop service set. Use different unit numbers for the inside and outside units, and do not use 0 or the unit number used with the ip-address-owner service-plane option.

  2. Configure the next-hop service set that contains the NAT rules or stateful firewall rules. The service set must be configured identically on each chassis of the high availability pair. The NAT rules and stateful firewall rules must also be configured identically on each chassis.
  3. For ease of management, we recommend you create a special routing instance with instance-type vrf to host the HA synchronization traffic between the MX Series high availability pair. Then specify the name of the special routing instance to apply to the HA synchronization traffic between the high availability pair.
  4. Repeat these steps for the other chassis of the high availability pair.

Example: Inter-Chassis Stateful Synchronization for Long-Lived NAT and Stateful Firewall Flows (MS-MIC, MS-MPC) (Release 16.1 and later)

This example shows how to configure inter-chassis high availability for NAT services.

Requirements

This example uses the following hardware and software components:

  • Two MX480 routers with MS-MPC line cards

  • Junos OS Release 16.1 or later

Overview

Two MX Series routers are identically configured to facilitate stateful failover for NAT services in case of a chassis failure.

Configuration

To configure inter-chassis high availability for this example, perform these tasks:

CLI Quick Configuration

To quickly configure this example on the routers, copy the following commands and paste them into the router terminal window after removing line breaks and substituting interface information specific to your site.

Note

The following configuration is for chassis 1.

Note

The following configuration is for chassis 2. NAT and service set information must be identical for chassis 1 and 2.

Configuring Interfaces for Chassis 1

Step-by-Step Procedure

The interfaces for each of the HA pair of routers are configured identically with the exception of the following service PIC options:

  • The redundancy-options redundancy-peer ipaddress address must be different on each chassis and must point to the redundancy-options redundancy-local data-address data-address on the peer chassis.

  • The unit unit-number family inet address address of a unit, other than 0, that contains the ip-address-owner service-plane option must be different on each chassis.

To configure interfaces:

  1. Configure the redundant service PIC on chassis 1.
  2. Configure the interfaces for chassis 1 that are used as interchassis links for synchronization traffic.
  3. Configure remaining interfaces as needed.

Results

user@host# show interfaces

Configure Routing Information for HA Synchronization Traffic Between MX Series Routers for Chassis 1

Step-by-Step Procedure

Detailed routing configuration is not included for this example. A routing instance is required for the HA synchronization traffic between the chassis as follows:

To configure the routing instances for chassis 1:

  1. Specify a dummy policy statement. This statement is referenced in the routing instance configuration.
  2. Specify the options for the routing instance.
  3. Specify the next-hop traffic to which the service set is applied.

Results

@user@host# show routing-instances

Configuring NAT for Chassis 1

Step-by-Step Procedure

Configure NAT identically on both routers.

To configure NAT:

  1. Specify NAT pool and rule information..

Results

user@host# show services nat

Configuring the Service Set

Step-by-Step Procedure

Configure the service set identically on both routers. To configure the service set:

  1. (Optional) Service sets are replicated by default. To exclude a service set from replication using the following option.
  2. Configure references to NAT rules for the service set.
  3. Configure next-hop service interface on the MS-PIC.
  4. Configure desired logging options.

Results

user@host# show services service-set ss2

Configuring Interfaces for Chassis 2

Step-by-Step Procedure

The interfaces for each of the HA pair of routers are configured identically with the exception of the following service PIC options:

  • redundancy-options redundancy-peer ipaddress address

  • unit unit-number family inet address address of a unit, other than 0, that contains the ip-address-owner service-plane option

  1. Configure the redundant service PIC on chassis 2.

    The redundancy-peer ipaddress points to the address of the unit (unit 10) on ms-4/0/0 on chassis on chassis 1 that contains the ip-address-owner service-plane statement.

  2. Configure the interfaces for chassis 2 that are used as interchassis links for synchronization traffic
  3. Configure remaining interfaces for chassis 2 as needed.

Results

user@host# show interfaces

Configure Routing Information for HA Synchronization Traffic Between MX Series Routers for Chassis 2

Step-by-Step Procedure

Detailed routing configuration is not included for this example. A routing instance is required for the HA synchronization traffic between the two chassis and is included here.

  • Configure routing instances for chassis 2.
    Note

    The following configuration steps are identical to the steps shown for chassis 1.

    • Configuring NAT

    • Configuring the Service Set

Results

@user@host# show services routing-instances