Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Next Gen Services Inter-chassis High Availability Overview for NAT, Stateful Firewall, and IDS Flows

 

Inter-chassis High Availability Overview for NAT, Stateful Firewall, and IDS Flows for Next Gen Services

Carrier-grade NAT, stateful firewall, and IDS flows can be configured with a dual-chassis, redundant data path. Although intra-chassis high availability can be used in an MX Series device by employing the AMS interfaces, this method only deals locally with services PIC failures. If for any reason traffic is switched to a backup router due to some other failure in the router, the session state from the services PIC is lost unless you configure synchronization of the services session states with a services PIC on the backup router.

Inter-chassis high availability provides this synchronization, and controls switchovers between the services PICs in the redundancy pair. Inter-chassis high availability is a primary-secondary model, not an active-active cluster. Only one services PIC in a redundancy pair, the current master, receives traffic to be serviced.

To configure interchassis high availability for NAT, stateful firewall, and IDS, you configure:

  1. Stateful synchronization, which replicates the session state from the master services PICs on the master to the backup services PIC on the other chassis.

  2. Inter-chassis services redundancy, which controls mastership switchovers in the services PIC redundancy pair, based on monitored events. Most operators would not want to employ stateful synchronization without also implementing services redundancy.

Benefits

Interchassis high availability provides automatic switchovers from a services PIC on one chassis to a services PIC on another chassis, while providing uninterrupted services for customer traffic.

Example: Next Gen Services Inter-Chassis Stateful High Availability for NAT and Stateful Firewall (MX-SPC3)

This example shows how to configure Next Gen Services inter-chassis high availability for stateful firewall and NAT services.

Requirements

This example uses the following hardware and software components:

  • Two MX480 routers with MX-SPC3 services cards

  • Junos OS Release 19.3R2, 19.4R1 or later

Overview

Two MX 3D routers are identically configured to facilitate stateful failover for firewall and NAT services in case of a chassis failure.

Configuration

To configure inter-chassis high availability for this example, perform these tasks:

CLI Quick Configuration

To quickly configure this example on the routers, copy the following commands and paste them into the router terminal window after removing line breaks and substituting interface information specific to your site.

Note

The following configuration is for chassis 1.

Note

The following configuration is for chassis 2. The NAT, stateful firewall, and service-set information must be identical for chassis 1 and 2.

Configuring Interfaces for Chassis 1.

Step-by-Step Procedure

The interfaces for each of the HA pair of routers are configured identically with the exception of the following service PIC options:

  • redundancy-options redundancy-peer ipaddress address

  • unit unit-number family inet address address of a unit, other than 0, that contains the ip-address-owner service-plane option

To configure interfaces:

  1. Configure the redundant service PIC on chassis 1.
  2. Configure the interfaces for chassis 1 that are used as interchassis links for synchronization traffic.
  3. Configure remaining interfaces as needed.

Results

user@host# show interfaces

Configure Routing Information for Chassis 1

Step-by-Step Procedure

Detailed routing configuration is not included for this example. A routing instance is required for the HA synchronization traffic between the chassis as follows:

  • Configure routing instances for Chassis 1.

Results

user@host# show routing-instances

Configuring NAT and Stateful Firewall for Chassis 1

Step-by-Step Procedure

Configure NAT and stateful firewall identically on both routers. To configure NAT and stateful firewall:

  1. Configure NAT as needed.
  2. Configure stateful firewall as needed.

Results

user@host# show services nat
user@host show services stateful-firewell

Configuring the Service Set

Step-by-Step Procedure

Configure the the service set identically on both routers. To configure the service set:

  1. Configure the service set replication options.
  2. Configure references to NAT and stateful firewall rules for the service set.
  3. Configure next-hop service interface on the vms-PIC.
  4. Configure desired logging options.

Results

user@host# show services service-set ss2

Configuring Interfaces for Chassis 2

Step-by-Step Procedure

The interfaces for each of the HA pair of routers are configured identically with the exception of the following service PIC options:

  • redundancy-options redundancy-peer ipaddress address

  • unit unit-number family inet address address of a unit, other than 0, that contains the ip-address-owner service-plane option

  1. Configure the redundant service PIC on chassis 2.

    The redundancy-peer ipaddress points to the address of the unit (unit 10) on vms-4/0/0 on chassis on chassis 1 that contains the ip-address-owner service-plane statement.

  2. Configure the interfaces for chassis 2 that are used as interchassis links for synchronization traffic
  3. Configure remaining interfaces for chassis 2 as needed.

Results

user@host# show interfaces

Configure Routing Information for Chassis 2

Step-by-Step Procedure

Detailed routing configuration is not included for this example. A routing instance is required for the HA synchronization traffic between the two chassis and is included here.

  • Configure routing instances for chassis 2.
    Note

    The following configuration steps are identical to the steps shown for chassis 1.

    • Configuring NAT and Stateful Firewall

    • Configuring the Service Set

Results

user@host# show services routing-instances