Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Example: Next Gen Services Inter-Chassis Stateful High Availability for NAT and Stateful Firewall (MX-SPC3)

 

This example shows how to configure Next Gen Services inter-chassis high availability for stateful firewall and NAT services.

Requirements

This example uses the following hardware and software components:

  • Two MX480 routers with MX-SPC3 services cards

  • Junos OS Release 19.3R2, 19.4R1 or later

Overview

Two MX 3D routers are identically configured to facilitate stateful failover for firewall and NAT services in case of a chassis failure.

Configuration

To configure inter-chassis high availability for this example, perform these tasks:

CLI Quick Configuration

To quickly configure this example on the routers, copy the following commands and paste them into the router terminal window after removing line breaks and substituting interface information specific to your site.

Note

The following configuration is for chassis 1.

Note

The following configuration is for chassis 2. The NAT, stateful firewall, and service-set information must be identical for chassis 1 and 2.

Configuring Interfaces for Chassis 1.

Step-by-Step Procedure

The interfaces for each of the HA pair of routers are configured identically with the exception of the following service PIC options:

  • redundancy-options redundancy-peer ipaddress address

  • unit unit-number family inet address address of a unit, other than 0, that contains the ip-address-owner service-plane option

To configure interfaces:

  1. Configure the redundant service PIC on chassis 1.
  2. Configure the interfaces for chassis 1 that are used as interchassis links for synchronization traffic.
  3. Configure remaining interfaces as needed.

Results

user@host# show interfaces

Configure Routing Information for Chassis 1

Step-by-Step Procedure

Detailed routing configuration is not included for this example. A routing instance is required for the HA synchronization traffic between the chassis as follows:

  • Configure routing instances for Chassis 1.

Results

user@host# show routing-instances

Configuring NAT and Stateful Firewall for Chassis 1

Step-by-Step Procedure

Configure NAT and stateful firewall identically on both routers. To configure NAT and stateful firewall:

  1. Configure NAT as needed.
  2. Configure stateful firewall as needed.

Results

user@host# show services nat
user@host show services stateful-firewell

Configuring the Service Set

Step-by-Step Procedure

Configure the the service set identically on both routers. To configure the service set:

  1. Configure the service set replication options.
  2. Configure references to NAT and stateful firewall rules for the service set.
  3. Configure next-hop service interface on the vms-PIC.
  4. Configure desired logging options.

Results

user@host# show services service-set ss2

Configuring Interfaces for Chassis 2

Step-by-Step Procedure

The interfaces for each of the HA pair of routers are configured identically with the exception of the following service PIC options:

  • redundancy-options redundancy-peer ipaddress address

  • unit unit-number family inet address address of a unit, other than 0, that contains the ip-address-owner service-plane option

  1. Configure the redundant service PIC on chassis 2.

    The redundancy-peer ipaddress points to the address of the unit (unit 10) on vms-4/0/0 on chassis on chassis 1 that contains the ip-address-owner service-plane statement.

  2. Configure the interfaces for chassis 2 that are used as interchassis links for synchronization traffic
  3. Configure remaining interfaces for chassis 2 as needed.

Results

user@host# show interfaces

Configure Routing Information for Chassis 2

Step-by-Step Procedure

Detailed routing configuration is not included for this example. A routing instance is required for the HA synchronization traffic between the two chassis and is included here.

  • Configure routing instances for chassis 2.
    Note

    The following configuration steps are identical to the steps shown for chassis 1.

    • Configuring NAT and Stateful Firewall

    • Configuring the Service Set

Results

user@host# show services routing-instances