Active/Passive Chassis Cluster Deployments

 

Understanding Active/Passive Chassis Cluster Deployment

In this case, a single device in the cluster is used to route all traffic while the other device is used only in the event of a failure (see Figure 1). When a failure occurs, the backup device becomes master and controls all forwarding.

Figure 1: Active/Passive Chassis Cluster Scenario
 Active/Passive Chassis
Cluster Scenario

An active/passive chassis cluster can be achieved by using redundant Ethernet interfaces (reths) that are all assigned to the same redundancy group. If any of the interfaces in an active group in a node fails, the group is declared inactive and all the interfaces in the group fail over to the other node.

This configuration minimizes the traffic over the fabric link because only one node in the cluster forwards traffic at any given time.

Example: Configuring an Active/Passive Chassis Cluster on SRX5800 Devices

This example shows how to set up basic active/passive chassis clustering on an SRX5800 devices.

Requirements

Before you begin:

  • You need two SRX5800 Services Gateways with identical hardware configurations, one MX240 edge router, and one EX8208 Ethernet Switch.

  • Physically connect the two devices (back-to-back for the fabric and control ports) and ensure that they are the same models.

  • Before the cluster is formed, you must configure control ports for each device, as well as assign a cluster ID and node ID to each device, and then reboot. When the system boots, both the nodes come up as a cluster.

    Note

    Control port configuration is required for SRX5400, SRX5600, and SRX5800 devices.

Now the devices are a pair. From this point forward, configuration of the cluster is synchronized between the node members, and the two separate devices function as one device.

Overview

This example shows how to set up basic active/passive chassis clustering on an SRX Series device. The basic active/passive example is the most common type of chassis cluster.

The basic active/passive chassis cluster consists of two devices:

  • One device actively provides routing, firewall, NAT, VPN, and security services, along with maintaining control of the chassis cluster.

  • The other device passively maintains its state for cluster failover capabilities in case the active device becomes inactive.

Note

This active/passive mode example for the SRX5800 Services Gateway does not describe in detail miscellaneous configurations such as how to configure NAT, security policies, or VPNs. They are essentially the same as they would be for standalone configurations. See Introduction to NAT, Security Policies Overview, and IPsec VPN Overview. However, if you are performing proxy ARP in chassis cluster configurations, you must apply the proxy ARP configurations to the reth interfaces rather than the member interfaces because the RETH interfaces hold the logical configurations. See Configuring Proxy ARP for NAT (CLI Procedure). You can also configure separate logical interface configurations using VLANs and trunked interfaces in the SRX5800 Services Gateway. These configurations are similar to the standalone implementations using VLANs and trunked interfaces.

Figure 2 shows the topology used in this example.

Figure 2: Basic Active/Passive Chassis Clustering on an SRX Series Device Topology Example
Basic Active/Passive Chassis
Clustering on an SRX Series Device Topology Example

Configuration

Configuring the Control Ports and Enabling Cluster Mode

Step-by-Step Procedure

On SRX5400, SRX5600, and SRX5800 devices have a chassis cluster control port that is used to connect two SRX Series devices to form a chassis cluster.

  1. Configure the control port for each device, and commit the configuration.

    Select FPC 1/13, because the central point is always on the lowest SPC/SPU in the cluster (for this example, it is slot 0). For maximum reliability, place the control ports on a separate SPC from the central point (for this example, use the SPC in slot 1). You must enter the operational mode commands on both devices. For example:

    • On node 0:

    • On node 1:

  2. Set the two devices to cluster mode. A reboot is required to enter into cluster mode after the cluster ID and node ID are set. You can cause the system to boot automatically by including the reboot parameter in the CLI command line. You must enter the operational mode commands on both devices. For example:
    • On node 0:

    • On node 1:

    The cluster ID is the same on both devices, but the node ID must be different because one device is node 0 and the other device is node 1. The range for the cluster ID is 1 through 255. Setting a cluster ID to 0 is equivalent to disabling a cluster. Cluster ID greater than 15 can only be set when the fabric and control link interfaces are connected back-to-back.

Configuring a Chassis Cluster in Active/Passive Mode

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

On {primary:node0}

To quickly configure an EX8208 Core Switch, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

On {primary:node0}

To quickly configure an MX240 edge router, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

On {primary:node0}

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure a chassis cluster on an SRX Series device:

Note

In cluster mode, the cluster is synchronized between the nodes when you execute a commit command. All commands are applied to both nodes regardless of from which device the command is configured.

  1. Configure the fabric (data) ports of the cluster that are used to pass RTOs in active/passive mode. For this example, use one of the 1-Gigabit Ethernet ports because running out of bandwidth using active/passive mode is not an issue. Define two fabric interfaces, one on each chassis, to connect together.
  2. Because the SRX5800 Services Gateway chassis cluster configuration is contained within a single common configuration, to assign some elements of the configuration to a specific member only, you must use the Junos OS node-specific configuration method called groups. The set apply-groups ${node} command uses the node variable to define how the groups are applied to the nodes; each node recognizes its number and accepts the configuration accordingly. You must also configure out-of-band management on the fxp0 interface of the SRX5800 Services Gateway using separate IP addresses for the individual control planes of the cluster.Note

    Configuring the backup router destination address as x.x.x.0/0 is not allowed.

  3. Configure redundancy groups for chassis clustering. Each node has interfaces in a redundancy group where interfaces are active in active redundancy groups (multiple active interfaces can exist in one redundancy group). Redundancy group 0 controls the control plane and redundancy group 1+ controls the data plane and includes the data plane ports. For this active/passive mode example, only one chassis cluster member is active at a time so you need to define redundancy groups 0 and 1 only. Besides redundancy groups, you must also define:
    • Redundant Ethernet groups—Configure how many redundant Ethernet interfaces (member links) will be active on the device so that the system can allocate the appropriate resources for it.

    • Priority for control plane and data plane—Define which device has priority (for chassis cluster, high priority is preferred) for the control plane, and which device is preferred to be active for the data plane.

      Note
      • In active/passive or active/active mode, the control plane (redundancy group 0) can be active on a chassis different from the data plane (redundancy group 1+ and groups) chassis. However, for this example we recommend having both the control and data plane active on the same chassis member. When traffic passes through the fabric link to go to another member node, latency is introduced (z line mode traffic).

      • On SRX Series devices (SRX5000 line), the IPsec VPN is not supported in active/active chassis cluster configuration (that is, when there are multiple RG1+ redundancy groups).

  4. Configure the data interfaces on the platform so that in the event of a data plane failover, the other chassis cluster member can take over the connection seamlessly. Seamless transition to a new active node will occur with data plane failover. In case of control plane failover, all the daemons are restarted on the new node thus enabling a graceful restart to avoid losing neighborship with peers (ospf, bgp). This promotes a seamless transition to the new node without any packet loss.

    You must define the following items:

    • Define the membership information of the member interfaces to the reth interface.

    • Define which redundancy group the reth interface is a member of. For this active/passive example, it is always 1.

    • Define reth interface information such as the IP address of the interface.

  5. Configure the chassis cluster behavior in case of a failure. For the SRX5800 Services Gateway, the failover threshold is set at 255. You can alter the weights to determine the impact on the chassis failover. You must also configure control link recovery. The recovery automatically causes the secondary node to reboot should the control link fail, and then come back online. Enter these commands on node 0.

    This step completes the chassis cluster configuration part of the active/passive mode example for the SRX5800 Services Gateway. The rest of this procedure describes how to configure the zone, virtual router, routing, EX8208 Core Switch, and MX240 Edge Router to complete the deployment scenario.

  6. Configure and connect the reth interfaces to the appropriate zones and virtual routers. For this example, leave the reth0 and reth1 interfaces in the default virtual router inet.0, which does not require any additional configuration.
  7. For this active/passive mode example, because of the simple network architecture, use static routes to define how to route to the other network devices.
  8. For the EX8208 Ethernet Switch, the following commands provide only an outline of the applicable configuration as it pertains to this active/passive mode example for the SRX5800 Services Gateway; most notably the VLANs, routing, and interface configuration.
  9. For the MX240 edge router, the following commands provide only an outline of the applicable configuration as it pertains to this active/passive mode example for the SRX5800 Services Gateway; most notably you must use an IRB interface within a virtual switch instance on the switch.

Results

From operational mode, confirm your configuration by entering the show configuration command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

> show configuration

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Verifying Chassis Cluster Status

Purpose

Verify the chassis cluster status, failover status, and redundancy group information.

Action

From operational mode, enter the show chassis cluster status command.

{primary:node0}
show chassis cluster status

Verifying Chassis Cluster Interfaces

Purpose

Verify information about chassis cluster interfaces.

Action

From operational mode, enter the show chassis cluster interfaces command.

{primary:node0}
user@host> show chassis cluster interfaces

Verifying Chassis Cluster Statistics

Purpose

Verify information about chassis cluster services and control link statistics (heartbeats sent and received), fabric link statistics (probes sent and received), and the number of RTOs sent and received for services.

Action

From operational mode, enter the show chassis cluster statistics command.

{primary:node0}
user@host> show chassis cluster statistics

Verifying Chassis Cluster Control Plane Statistics

Purpose

Verify information about chassis cluster control plane statistics (heartbeats sent and received) and the fabric link statistics (probes sent and received).

Action

From operational mode, enter the show chassis cluster control-plane statistics command.

{primary:node0}
user@host> show chassis cluster control-plane statistics

Verifying Chassis Cluster Data Plane Statistics

Purpose

Verify information about the number of RTOs sent and received for services.

Action

From operational mode, enter the show chassis cluster data-plane statistics command.

{primary:node0}
user@host> show chassis cluster data-plane statistics

Verifying Chassis Cluster Redundancy Group Status

Purpose

Verify the state and priority of both nodes in a cluster and information about whether the primary node has been preempted or whether there has been a manual failover.

Action

From operational mode, enter the chassis cluster status redundancy-group command.

{primary:node0}
user@host> show chassis cluster status redundancy-group 1

Troubleshooting with Logs

Purpose

Use these logs to identify any chassis cluster issues. You must run these logs on both nodes.

Action

From operational mode, enter these show log commands.

user@host> show log jsrpd


user@host> show log chassisd


user@host> show log messages


user@host> show log dcd


user@host> show traceoptions

Example: Configuring an Active/Passive Chassis Cluster Pair (CLI)

This example shows how to configure active/passive chassis clustering for SRX1500 device.

Requirements

Before you begin:

  1. Physically connect a pair of devices together, ensuring that they are the same models.
  2. Create a fabric link by connecting a Gigabit Ethernet interface on one device to another Gigabit Ethernet interface on the other device.
  3. Create a control link by connecting the control port of the two SRX1500 devices.
  4. Connect to one of the devices using the console port. (This is the node that forms the cluster.) and set the cluster ID and node number.
  5. Connect to the other device using the console port and set the cluster ID and node number.

Overview

In this example, a single device in the cluster is used to route all traffic, and the other device is used only in the event of a failure. (See Figure 3.) When a failure occurs, the backup device becomes master and controls all forwarding.

Figure 3: Active/Passive Chassis Cluster Topology
Active/Passive
Chassis Cluster Topology

You can create an active/passive chassis cluster by configuring redundant Ethernet interfaces (reths) that are all assigned to the same redundancy group. This configuration minimizes the traffic over the fabric link because only one node in the cluster forwards traffic at any given time.

In this example, you configure group (applying the configuration with the apply-groups command) and chassis cluster information. Then you configure security zones and security policies. See Table 1 through Table 4.

Table 1: Group and Chassis Cluster Configuration Parameters

Feature

Name

Configuration Parameters

Groups

node0

  • Hostname: srx1500-A

  • Interface: fxp0

    • Unit 0

    • 192.0.2.110/24

node1

  • Hostname: srx1500-B

  • Interface: fxp0

    • Unit 0

    • 192.0.2.111/24

Table 2: Chassis Cluster Configuration Parameters

Feature

Name

Configuration Parameters

Fabric links

fab0

Interface: ge-0/0/1

fab1

Interface: ge-7/0/1

Heartbeat interval

1000

Heartbeat threshold

3

Redundancy group

0

  • Priority:

    • Node 0: 254

    • Node 1: 1

1

  • Priority:

    • Node 0: 254

    • Node 1: 1

Interface monitoring

  • ge-0/0/4

  • ge-7/0/4

  • ge-0/0/5

  • ge-7/0/5

Number of redundant Ethernet interfaces

2

Interfaces

ge-0/0/4

Redundant parent: reth0

ge-7/0/4

Redundant parent: reth0

ge-0/0/5

Redundant parent: reth1

ge-7/0/5

Redundant parent: reth1

reth0

Redundancy group: 1

  • Unit 0

  • 198.51.100.1/24

reth1

Redundancy group: 1

  • Unit 0

  • 203.0.113.233/24

Table 3: Security Zone Configuration Parameters

Name

Configuration Parameters

trust

The reth1.0 interface is bound to this zone.

untrust

The reth0.0 interface is bound to this zone.

Table 4: Security Policy Configuration Parameters

Purpose

Name

Configuration Parameters

This security policy permits traffic from the trust zone to the untrust zone.

ANY

  • Match criteria:

    • source-address any

    • destination-address any

    • application any

  • Action: permit

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

To configure an active/passive chassis cluster:

  1. Configure the management interface.
  2. Configure the fabric interface.
  3. Configure heartbeat settings.
  4. Configure redundancy groups.
  5. Configure redundant Ethernet interfaces.
  6. Configure security zones.
  7. Configure security policies.

Results

From configuration mode, confirm your configuration by entering the show configuration command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

For brevity, this show command output includes only the configuration that is relevant to this example. Any other configuration on the system has been replaced with ellipses (...).

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Verifying Chassis Cluster Status

Purpose

Verify the chassis cluster status, failover status, and redundancy group information.

Action

From operational mode, enter the show chassis cluster status command.

{primary:node0}
user@host> show chassis cluster status

Verifying Chassis Cluster Interfaces

Purpose

Verify information about chassis cluster interfaces.

Action

From operational mode, enter the show chassis cluster interfaces command.

{primary:node0}
user@host> show chassis cluster interfaces

Verifying Chassis Cluster Statistics

Purpose

Verify information about the statistics of the different objects being synchronized, the fabric and control interface hellos, and the status of the monitored interfaces in the cluster.

Action

From operational mode, enter the show chassis cluster statistics command.

{primary:node0}
user@host> show chassis cluster statistics

Verifying Chassis Cluster Control Plane Statistics

Purpose

Verify information about chassis cluster control plane statistics (heartbeats sent and received) and the fabric link statistics (probes sent and received).

Action

From operational mode, enter the show chassis cluster control-plane statistics command.

{primary:node0}
user@host> show chassis cluster control-plane statistics

Verifying Chassis Cluster Data Plane Statistics

Purpose

Verify information about the number of RTOs sent and received for services.

Action

From operational mode, enter the show chassis cluster data-plane statistics command.

{primary:node0}
user@host> show chassis cluster data-plane statistics

Verifying Chassis Cluster Redundancy Group Status

Purpose

Verify the state and priority of both nodes in a cluster and information about whether the primary node has been preempted or whether there has been a manual failover.

Action

From operational mode, enter the chassis cluster status redundancy-group command.

{primary:node0}
user@host> show chassis cluster status redundancy-group 1

Troubleshooting with Logs

Purpose

Use these logs to identify any chassis cluster issues. You must run these logs on both nodes.

Action

From operational mode, enter these show commands.

Example: Configuring an Active/Passive Chassis Cluster Pair (J-Web)

  1. Enable clustering. See Step 1 in Example: Configuring an Active/Passive Chassis Cluster Pair (CLI).
  2. Configure the management interface. See Step 2 in Example: Configuring an Active/Passive Chassis Cluster Pair (CLI).
  3. Configure the fabric interface. See Step 3 in Example: Configuring an Active/Passive Chassis Cluster Pair (CLI).
  4. Configure the redundancy groups.
    • Select Configure>Chassis Cluster.

    • Enter the following information, and then click Apply:

      • Redundant ether-Interface Count: 2

      • Heartbeat Interval: 1000

      • Heartbeat Threshold: 3

      • Nodes: 0

      • Group Number: 0

      • Priorities: 100

    • Enter the following information, and then click Apply:

      • Nodes: 0

      • Group Number: 1

      • Priorities: 1

    • Enter the following information, and then click Apply:

      • Nodes: 1

      • Group Number: 0

      • Priorities: 100

  5. Configure the redundant Ethernet interfaces.
    • Select Configure>Chassis Cluster.

    • Select ge-0/0/4.

    • Enter reth1 in the Redundant Parent box.

    • Click Apply.

    • Select ge-7/0/4.

    • Enter reth1 in the Redundant Parent box.

    • Click Apply.

    • Select ge-0/0/5.

    • Enter reth0 in the Redundant Parent box.

    • Click Apply.

    • Select ge-7/0/5.

    • Enter reth0 in the Redundant Parent box.

    • Click Apply.

    • See Step 5 in Example: Configuring an Active/Passive Chassis Cluster Pair (CLI) for the last four configuration settings.

  6. Configure the security zones. See Step 6 in Example: Configuring an Active/Passive Chassis Cluster Pair (CLI).
  7. Configure the security policies. See Step 7 in Example: Configuring an Active/Passive Chassis Cluster Pair (CLI).
  8. Click OK to check your configuration and save it as a candidate configuration, then click Commit Options>Commit.

Understanding Active/Passive Chassis Cluster Deployment with an IPsec Tunnel

In this case, a single device in the cluster terminates in an IPsec tunnel and is used to process all traffic while the other device is used only in the event of a failure (see Figure 4). When a failure occurs, the backup device becomes master and controls all forwarding.

Figure 4: Active/Passive Chassis Cluster with IPsec Tunnel Scenario (SRX Series Devices)
 Active/Passive
Chassis Cluster with IPsec Tunnel Scenario (SRX Series Devices)

An active/passive chassis cluster can be achieved by using redundant Ethernet interfaces (reths) that are all assigned to the same redundancy group. If any of the interfaces in an active group in a node fails, the group is declared inactive and all the interfaces in the group fail over to the other node.

This configuration provides a way for a site-to-site IPsec tunnel to terminate in an active/passive cluster where a redundant Ethernet interface is used as the tunnel endpoint. In the event of a failure, the redundant Ethernet interface in the backup SRX Series device becomes active, forcing the tunnel to change endpoints to terminate in the new active SRX Series device. Because tunnel keys and session information are synchronized between the members of the chassis cluster, a failover does not require the tunnel to be renegotiated and all established sessions are maintained.

Note

Dynamic tunnels cannot load-balance across different SPCs.

Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel

This example shows how to configure active/passive chassis clustering with an IPsec tunnel for SRX Series devices.

Requirements

Before you begin:

  • Get two SRX5000 models with identical hardware configurations, one SRX1500 device, and four EX Series Ethernet switches.

  • Physically connect the two devices (back-to-back for the fabric and control ports) and ensure that they are the same models. You can configure both the fabric and control ports on the SRX5000 line.

  • Set the two devices to cluster mode and reboot the devices. You must enter the following operational mode commands on both devices, for example:

    • On node 0:

    • On node 1:

    The cluster ID is the same on both devices, but the node ID must be different because one device is node 0 and the other device is node 1. The range for the cluster ID is 1 through 255. Setting a cluster ID to 0 is equivalent to disabling a cluster.

    Cluster ID greater than 15 can only be set when the fabric and control link interfaces are connected back-to-back.

  • Get two SRX5000 models with identical hardware configurations, one SRX1500 edge router, and four EX Series Ethernet switches.

  • Physically connect the two devices (back-to-back for the fabric and control ports) and ensure that they are the same models. You can configure both the fabric and control ports on the SRX5000 line.

From this point forward, configuration of the cluster is synchronized between the node members and the two separate devices function as one device. Member-specific configurations (such as the IP address of the management port of each member) are entered using configuration groups.

Overview

In this example, a single device in the cluster terminates in an IPsec tunnel and is used to process all traffic, and the other device is used only in the event of a failure. (See Figure 5.) When a failure occurs, the backup device becomes master and controls all forwarding.

Figure 5: Active/Passive Chassis Cluster with IPsec Tunnel Topology (SRX Series Devices)
Active/Passive
Chassis Cluster with IPsec Tunnel Topology (SRX Series Devices)

In this example, you configure group (applying the configuration with the apply-groups command) and chassis cluster information. Then you configure IKE, IPsec, static route, security zone, and security policy parameters. See Table 5 through Table 11.

Table 5: Group and Chassis Cluster Configuration Parameters

Feature

Name

Configuration Parameters

Groups

node0

  • Hostname: SRX5800-1

  • Interface: fxp0

    • Unit 0

    • 172.19.100.50/24

node1

  • Hostname: SRX5800-2

  • Interface: fxp0

    • Unit 0

    • 172.19.100.51/24

Table 6: Chassis Cluster Configuration Parameters

Feature

Name

Configuration Parameters

Fabric links

fab0

Interface: xe-5/3/0

fab1

Interface: xe-17/3/0

Number of redundant Ethernet interfaces

2

Heartbeat interval

1000

Heartbeat threshold

3

Redundancy group

0

  • Priority:

    • Node 0: 254

    • Node 1: 1

1

  • Priority:

    • Node 0: 254

    • Node 1: 1

Interface monitoring

  • xe-5/0/0

  • xe-5/1/0

  • xe-17/0/0

  • xe-17/1/0

Interfaces

xe-5/1/0

Redundant parent: reth1

xe-5/1/0

Redundant parent: reth1

xe-5/0/0

Redundant parent: reth0

xe-17/0/0

Redundant parent: reth0

reth0

Redundancy group: 1

  • Unit 0

  • 10.1.1.60/16

reth1

Redundancy group: 1

  • Multipoint

  • Unit 0

  • 10.10.1.1/30

st0

  • Unit 0

  • 10.10.1.1/30

Table 7: IKE Configuration Parameters

Feature

Name

Configuration Parameters

Proposal

proposal-set standard

-

Policy

preShared

  • Mode: main

  • Proposal reference: proposal-set standard

  • IKE Phase 1 policy authentication method: pre-shared-key ascii-text

Gateway

SRX1500-1

  • IKE policy reference: perShared

  • External interface: reth0.0

  • Gateway address: 10.1.1.90

Note: In SRX chassis clustering, only reth and lo0 interfaces are supported for the IKE external interface configuration. Other interface types can be configured, but IPsec VPN might not work. If a lo0 logical interface is used as an IKE gateway external interface, it cannot be configured with RG0.

Table 8: IPsec Configuration Parameters

Feature

Name

Configuration Parameters

Proposal

proposal-set standard

Policy

std

VPN

SRX1500-1

  • IKE gateway reference: SRX1500-1

  • IPsec policy reference: std

  • Bind to interface: st0.0

  • VPN monitoring: vpn-monitor optimized

  • Tunnels established: establish-tunnels immediately

Note: The manual VPN name and the site-to-site gateway name cannot be the same.

Table 9: Static Route Configuration Parameters

Name

Configuration Parameters

0.0.0.0/0

Next hop: 10.2.1.1

10.3.0.0/16

Next hop: 10.10.1.2

Table 10: Security Zone Configuration Parameters

Name

Configuration Parameters

trust

  • All system services are allowed.

  • All protocols are allowed.

  • The reth0.0 interface is bound to this zone.

untrust

  • All system services are allowed.

  • All protocols are allowed.

  • The reth1.0 interface is bound to this zone.

vpn

  • All system services are allowed.

  • All protocols are allowed.

  • The st0.0 interface is bound to this zone.

Table 11: Security Policy Configuration Parameters

Purpose

Name

Configuration Parameters

This security policy permits traffic from the trust zone to the untrust zone.

ANY

  • Match criteria:

    • source-address any

    • destination-address any

    • application any

  • Action: permit

This security policy permits traffic from the trust zone to the vpn zone.

vpn-any

  • Match criteria:

    • source-address any

    • destination-address any

    • application any

  • Action: permit

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

To configure an active/passive chassis cluster pair with an IPsec tunnel:

  1. Configure control ports.
  2. Configure the management interface.
  3. Configure the fabric interface.
  4. Configure redundancy groups.
  5. Configure redundant Ethernet interfaces.
  6. Configure IPsec parameters.
  7. Configure static routes.
  8. Configure security zones.
  9. Configure security policies.

Step-by-Step Procedure

Results

From operational mode, confirm your configuration by entering the show configuration command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

For brevity, this show command output includes only the configuration that is relevant to this example. Any other configuration on the system has been replaced with ellipses (...).

user@host> show configuration

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Verifying Chassis Cluster Status

Purpose

Verify the chassis cluster status, failover status, and redundancy group information.

Action

From operational mode, enter the show chassis cluster status command.

{primary:node0}
show chassis cluster status

Verifying Chassis Cluster Interfaces

Purpose

Verify the chassis cluster interfaces.

Action

From operational mode, enter the show chassis cluster interfaces command.

{primary:node0}
user@host> show chassis cluster interfaces

Verifying Chassis Cluster Statistics

Purpose

Verify information about chassis cluster services and control link statistics (heartbeats sent and received), fabric link statistics (probes sent and received), and the number of RTOs sent and received for services.

Action

From operational mode, enter the show chassis cluster statistics command.

{primary:node0}
user@host> show chassis cluster statistics

Verifying Chassis Cluster Control Plane Statistics

Purpose

Verify information about chassis cluster control plane statistics (heartbeats sent and received) and the fabric link statistics (probes sent and received).

Action

From operational mode, enter the show chassis cluster control-panel statistics command.

{primary:node0}
user@host> show chassis cluster control-plane statistics

Verifying Chassis Cluster Data Plane Statistics

Purpose

Verify information about the number of RTOs sent and received for services.

Action

From operational mode, enter the show chassis cluster data-plane statistics command.

{primary:node0}
user@host> show chassis cluster data-plane statistics

Verifying Chassis Cluster Redundancy Group Status

Purpose

Verify the state and priority of both nodes in a cluster and information about whether the primary node has been preempted or whether there has been a manual failover.

Action

From operational mode, enter the chassis cluster status redundancy-group command.

{primary:node0}
user@host> show chassis cluster status redundancy-group 1

Troubleshooting with Logs

Purpose

Use these logs to identify any chassis cluster issues. You must run these logs on both nodes.

Action

From operational mode, enter these show commands.

Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel (J-Web)

  1. Enable clusters. See Step 1 in Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel.
  2. Configure the management interface. See Step 2 in Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel.
  3. Configure the fabric interface. See Step 3 in Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel.
  4. Configure the redundancy groups.
    • Select Configure>System Properties>Chassis Cluster.

    • Enter the following information, and then click Apply:

      • Redundant ether-Interfaces Count: 2

      • Heartbeat Interval: 1000

      • Heartbeat Threshold: 3

      • Nodes: 0

      • Group Number: 0

      • Priorities: 254

    • Enter the following information, and then click Apply:

      • Nodes: 0

      • Group Number: 1

      • Priorities: 254

    • Enter the following information, and then click Apply:

      • Nodes: 1

      • Group Number: 0

      • Priorities: 1

    • Enter the following information, and then click Apply:

      • Nodes: 1

      • Group Number: 1

      • Priorities: 1

      • Preempt: Select the check box.

      • Interface Monitor—Interface: xe-5/0/0

      • Interface Monitor—Weight: 255

      • Interface Monitor—Interface: xe-5/1/0

      • Interface Monitor—Weight: 255

      • Interface Monitor—Interface: xe-17/0/0

      • Interface Monitor—Weight: 255

      • Interface Monitor—Interface: xe-17/1/0

      • Interface Monitor—Weight: 255

  5. Configure the redundant Ethernet interfaces.
    • Select Configure>System Properties>Chassis Cluster.

    • Select xe-5/1/0.

    • Enter reth1 in the Redundant Parent box.

    • Click Apply.

    • Select xe-17/1/0.

    • Enter reth1 in the Redundant Parent box.

    • Click Apply.

    • Select xe-5/0/0.

    • Enter reth0 in the Redundant Parent box.

    • Click Apply.

    • Select xe-17/0/0.

    • Enter reth0 in the Redundant Parent box.

    • Click Apply.

    • See Step 5 in Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel.

  6. Configure the IPsec configuration. See Step 6 in Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel.
  7. Configure the static routes .
    • Select Configure>Routing>Static Routing.

    • Click Add.

    • Enter the following information, and then click Apply:

      • Static Route Address: 0.0.0.0/0

      • Next-Hop Addresses: 10.2.1.1

    • Enter the following information, and then click Apply:

      • Static Route Address: 10.3.0.0/16

      • Next-Hop Addresses: 10.10.1.2

  8. Configure the security zones. See Step 8 in Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel.
  9. Configure the security policies. See Step 9 in Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel.
  10. Click OK to check your configuration and save it as a candidate configuration, then click Commit Options>Commit.