Line Module Redundancy

You can install an extra line module in a group of identical line modules to provide redundancy if one of the modules fails.

The process by which the router switches to the spare line module is called switchover. During switchover, the line, circuit, and IP interfaces on the I/O module or one or more IOAs appear to go down temporarily. The duration of the downtime depends on the number of interfaces and the size of the routing table, because the router must reload the interface configuration and the routing table from the SRP module.

If the line module software is not compatible with the running SRP module software release, a warning message appears on the console.

Module Requirements

The requirements for line module redundancy depend on the type of router that you have.

Note: The information in this section does not apply to the ERX-310 router, which does not support line module redundancy.

ERX-7xx Models and ERX-14xx Models

To use this feature on ERX-7xx models and ERX-14xx models, you must also install a redundancy midplane and a redundancy I/O module. For a detailed explanation of how the router provides redundancy for line modules and procedures for installing the modules, see the ERX Hardware Guide.

E120 Router and E320 Router

To configure line module redundancy on the E120 router or the E320 router, you must also install an ES2-S1 Redund IOA in either slot 0 or slot 11. The ES2-S1 Redund IOA is a full-height IOA. For a detailed explanation of how the router provides redundancy for line modules and procedures for installing the modules, see the E120 and E320 Hardware Guide.

On E120 and E320 routers, each side of the chassis is treated as a redundancy group. The lowest numbered slot for each side acts as the spare line module, providing backup functionality when an ES2-S1 Redund IOA is located directly behind it. When the line module does not contain an ES2-S1 Redund IOA, it is considered a primary line module.

The spare line module only backs up a line module of the same type. For example, an ES2 4G LM spare line module backs up any ES2 4G LM, but does not back up an ES2 10G Uplink LM. The router accepts the following redundancy groups:

• ES2 4G LM and ES2 4G LM
• ES2 10G Uplink LM and ES2 10G Uplink LM
• ES2 10G LM and ES2 10G LM

Also, you cannot configure redundancy for the ES2-S1 Service IOA.

On E120 and E320 routers, switchover is based on the combined states of the line module and the IOAs that are installed in the affected slot.

When the router reboots and the formerly configured primary line module is not present, or is present and fails diagnostics, it switches to a spare line module and takes inventory of the IOAs. If the IOA is present and new, the router reverts back to the primary line module so that the spare line module can service other active primary line modules.

When the router reboots and there is a slot that contains a line module and one active and one inactive IOA, the inactive IOA remains in that state.

On E120 and E320 routers, a line module reboots when you issue the adapter disable or adapter enable commands for an associated IOA.

When you issue the adapter disable or adapter enable commands, the line module (primary or spare) currently associated with that IOA reboots. If the IOA is protected by a line module redundancy group, an automatic line module redundancy switchover or revert can be triggered by the line module reboot. To prevent undesired line module redundancy actions, issue the redundancy lockout command for the primary line module slot before issuing the adapter disable or adapter enable commands.

Automatic Switchover

Provided you have not issued the redundancy lockout command for the primary line module, the router switches over to the spare line module automatically if it detects any of the following failures on the primary line module:

• Power-on self-test (POST) failure
• Software-detected unrecoverable error
• Software watchdog timer expiration
• Primary line module failure to respond to keepalive polling from the SRP module
• Removal, disabling, or reloading of the primary line module
• Missing or disabled primary line modules when the router reboots
• Resetting the primary line module using the concealed push button

Limitations of Automatic Switchover

If automatic switchover is enabled on a slot (the default configuration) and a spare line module is available, issuing some CLI commands for the primary line module causes a switchover (see Table 42).

You can also disable automatic switchover on individual slots. For more information, see Configuring Line Module Redundancy.

Table 42: Commands That Can Cause Automatic Switchover

Reversion after Switchover

You can install only one spare line module in the group of slots covered by the redundancy midplane or redundancy group. If the router is using the spare line module, no redundancy is available. It is desirable to revert to the primary module as soon as possible. By default, the router does not automatically revert to the primary module after switchover; however, you can configure it to do so. (See Configuring Line Module Redundancy.) Before reversion can take place, the primary line module must complete the POST diagnostics.

Configuring Line Module Redundancy

You can modify the default redundancy operations on the router
as follows:

• Disable automatic switchover on a slot.
• Enable automatic reversion after switchover.

redundancy lockout

• Use to prevent the router from switching automatically to a spare line module if the primary module in the specified slot fails.
• The redundancy force-switchover command overrides the redundancy lockout command.
• Example

  host1(config)#redundancy lockout 5

• Use the no version to restart redundancy protection for the slot.
• See redundancy lockout.

redundancy revertive

• Use to enable the router to revert from all spare line modules to the associated primary line modules automatically.
• Reversion takes place when the primary line module is once again available unless you specify a time of day. In that case, reversion takes place only when the primary module is available and after the specified time.
• Example

  host1(config)#redundancy revertive 23:00:00

• Use the no version to disable automatic reversion.
• See redundancy revertive.

Managing Line Module Redundancy

When the router is running and a redundancy group is installed, you can manage the redundancy situation as follows:

• Force switchover manually.
• Force reversion manually.

redundancy force-switchover

• Use to force the router to switch from the primary line module in the specified slot or the primary SRP module to the spare line module or SRP module.
• The command causes a single switchover. When you reboot, the router reverts to the configured setting for this slot.
• The redundancy force-switchover command overrides the redundancy lockout command.
• Example

  host1#redundancy force-switchover 5

• There is no no version.
• See redundancy force-switchover.

redundancy revert

• Use to force the router to revert to the primary line module in the specified slot.
• The router acts on this command immediately unless you specify a time or a time and date that the action is to take place.
• The command causes a single reversion. When you reboot, the router uses the configured setting for this slot.
• Example

  host1#redundancy revert 4 23:00:00 5 September 200X

• There is no no version.
• See redundancy revert.

SRP Module Redundancy

This section covers general issues of SRP module redundancy. It does not cover NVS cards or the behavior on systems running high availability features such as hitless SRP switchover. For information about managing NVS in a router that contains two SRP modules, see Managing Flash Cards on SRP Modules. For information about managing high availability in a router, see Managing Modules.

The information in this section does not apply to the ERX-310 router, which does not support SRP module redundancy. For this reason, any references to synchronization that may appear in command output or system messages do not apply to the ERX-310 router.

SRP Module Behavior

The SRP module uses a 1:1 redundancy scheme. When two SRP modules are installed in the router, one acts as a primary and the second as a redundant module. On ERX-7xx models, ERX-14xx models, and the ERX-310 router, both SRP modules share a single SRP I/O module located in the rear of the chassis. On the E120 router and the E320 router, both SRP modules share an SRP IOA located in the rear of the chassis.

After you install two SRP modules, the modules negotiate for the primary role. A number of factors determine which module becomes the primary; however, preference is given to the module in the lower slot. The SRP modules record their latest roles and retain them the next time you switch on the router.

With the default software settings, if the primary SRP module fails, the redundant SRP module assumes control without rebooting itself. For information about preventing the redundant SRP module from assuming control, see Managing SRP Module Redundancy.

On E120 and E320 routers, the switch fabric is distributed between the SFMs and the SRP modules. If the primary SRP module fails a diagnostic test on its resident slice of switch fabric, then it abdicates control to the redundant SRP module if both of the following are true:

• The standby SRP module does not indicate any error.
• The standby SRP module passes diagnostics on its attached fabric slice.

When the redundant SRP module assumes control, the following sequence of events occurs:

1. The original primary SRP module reboots and assumes the redundant role.
2. The redundant SRP module restarts and assumes the primary role without reloading new code. (When upgrading software, you must reload the software on the redundant SRP module. See Installing JUNOSe Software .)
3. All line modules reboot.

The following actions activate the redundant SRP module:

• Failure of the primary SRP module (hardware or software)
• Pushing the recessed reset button on the primary SRP module (see Figure 25 and Figure 26)
• Issuing the srp switch command
• Issuing the redundancy force-switchover command

  Figure 25: SRP Module on ERX-7xx Models and ERX-14xx Models

  

  Figure 26: SRP Module on the E120 Router and the E320 Router

  

Specifying the Configuration for Redundant SRP Modules

On a router with redundant SRP modules, you can specify the configuration that both the primary and redundant modules load in the event of a reload or switchover. A switchover can result from an error on the primary SRP module or from an srp switch command. The following behavior takes place only in the event of a cold restart; it does not take place in the event of a warm restart.

When you arm a configuration (.cnf) file by issuing the boot config cnfFilename command, a subsequent SRP switchover causes the redundant SRP module to assume the role of primary SRP module with the configuration specified by the .cnf file. The new primary SRP module does not use the running configuration.

If you want the redundant SRP module to instead use the running configuration when it assumes the primary role, then you must first arm a configuration file with the boot config cnfFilename once command. To exhaust the once option, you must then cause the redundant SRP module to reload for some reason, such as by issuing a reload command or by arming a new JUNOSe release or a hotfix file.

When a switchover subsequently occurs, the redundant SRP module reloads with the running configuration and assumes the primary role. For more information about the boot config command, see Booting the System .

Installing a Redundant SRP Module

You can install a redundant SRP module into a running router, provided that the redundant SRP module has a valid, armed software release on its NVS card. Access to a software release in NVS ensures that the redundant SRP module can boot; the release need not be the same as that on the primary SRP module. To install a redundant SRP module into a running router, follow these steps:

Warning: Do not insert any metal object, such as a screwdriver, or place your hand into an open slot or the backplane when the router is on. Remove jewelry (including rings, necklaces, and watches) before working on equipment that is connected to power lines. These actions prevent electric shock and serious burns.

Caution: When handling modules, use an antistatic wrist strap connected to the router’s ESD grounding jack, and hold modules by their edges. Do not touch the components, pins, leads, or solder connections. These actions help to protect modules from damage by electrostatic discharge.

1. Install the redundant SRP module into the open SRP slot (slot 6 or 7 for ERX-14xx models, the E120 router, and the E320 router; slot 0 or 1 for ERX-7xx models).

   For detailed information about installing the SRP module, see the ERX Hardware Guide or the E120 and E320 Hardware Guide.

2. Wait for the redundant SRP module to boot, initialize, and reach the standby state.

   When the module is in standby state, the REDUNDANT LED is on and the ONLINE LED is off. If you issue the show version command, the state field for the slot that contains the redundant SRP module is standby.

3. Synchronize the NVS file system of the redundant SRP module to that of the primary SRP module.

   Note: The SRP module reboots after synchronization is complete.

reload slot

• Use to reboot a selected slot on the router.
• If you specify a slot on the E120 router or the E320 router that contains an SRP module, you reboot the SC subsystem on that slot by default. You do not, however, reboot the fabric slice that resides on the slot.
  • Use the srp keyword to reboot the portion of the SC subsystem that resides on a specified SRP module.
  • Use the fabric keyword to reboot the fabric slice that resides on the specified SRP module.
• Example 1—Reboots the module in slot 7

  host1#reload slot 7

• Example 2—Reboots the SC on the SRP module in slot 7 (applies only to E120 and E320 routers)

  host1#reload slot 7 srp

• There is no no version.
• See reload slot.

synchronize

• Use to force the file system of the redundant SRP module to synchronize with the NVS file system of the primary SRP module.
• If you synchronize the redundant SRP module with the primary SRP module and the redundant module is armed with a release different from the one it is currently running, the redundant SRP module is automatically rebooted to load the armed release.
• Optionally, you can use the low-level-check keyword to force the router to validate all files or only configuration files in NVS, and to synchronize all files that failed the checksum test during the flash-disk-compare command as well as any other files that are unsynchronized. See Validating and Recovering Redundant SRP File Integrity for details.
• Examples

  host1#synchronize

  host1#synchronize low-level-check all

  host1#synchronize low-level-check configuration

• There is no no version.
• See synchronize.

Managing SRP Module Redundancy

You can prevent the redundant SRP module from taking over when:

• The primary SRP module experiences a software failure.
• You push the reset button on the primary SRP module.

  Note: If you do not configure this option, when troubleshooting an SRP module, disconnect the other SRP module from the router. This action prevents the redundant SRP module from taking over if you push the reset button on the primary SRP module.

To configure this option:

1. Issue the disable-switch-on-error command.
2. Synchronize the NVS file system of the redundant SRP module to that of the primary SRP module.

Refer to the commands and guidelines in the previous section and below.

disable-switch-on-error

• Use to prevent the redundant SRP module from taking over if the primary SRP module experiences a software failure or if you push the reset button on the primary SRP module.
• Issue the synchronize command immediately before you issue this command.
• If you issue the disable-switch-on-error command, and later issue the srp switch command, the redundant SRP module waits about 30 seconds before it takes over from the primary SRP module.
• Example

  host1(config)#disable-switch-on-error

• Use the no version to revert to the default situation, in which the redundant SRP module takes over if the primary SRP module experiences a software failure.
• See disable-switch-on-error.

synchronize

• Use to force the NVS file system of the redundant SRP module to synchronize with the NVS file system of the primary SRP module.
• If you synchronize the redundant SRP module with the primary SRP module and the redundant module is armed with a release different from the one it is currently running, the redundant SRP module is automatically rebooted to load the armed release.
• Optionally, you can use the low-level-check keyword to force the router to validate all files or only configuration files in NVS, and to synchronize all files that failed the checksum test during the flash-disk-compare command as well as any other files that are unsynchronized. See Validating and Recovering Redundant SRP File Integrity for details.
• Examples

  host1#synchronize

  host1#synchronize low-level-check all

  host1#synchronize low-level-check configuration

• There is no no version.
• See synchronize.

Switching to the Redundant SRP Module

To switch immediately from the primary SRP module to the redundant SRP module, issue the redundancy force-switchover command or the srp switch command. You can configure the router to prompt you if the modules are in a state that could lead to loss of configuration data or NVS corruption.

redundancy force-switchover

• Use to force the router to switch from the primary line module in the specified slot or the primary SRP module to the spare line module or SRP module.
• The command causes a single switchover. When you reboot, the router reverts to the configured setting for this slot.
• With the srp option, the command is equivalent to the srp switch command.
• The redundancy force-switchover command overrides the redundancy lockout command.
• Example

  host1#redundancy force-switchover 5

• There is no no version.
• See redundancy force-switchover.

srp switch

• Use to switch from the primary SRP module to the redundant SRP module.
• When the high availability state is active, this command delays until all transaction data, up to when you issue the command, has been mirrored to the standby SRP module. This preserves legacy behavior requiring that SRP modules be synchronized before the switchover.
• If you specify the force keyword, the procedure fails if the SRP modules are in certain states, such as during a synchronization. In these cases, the router displays a message that indicates that the procedure cannot currently be performed and the reason why. However, if the SRP modules are in other states that could lead to a loss of configuration data or an NVS corruption, the router displays a message that explains the state of the SRP modules, and asks you to confirm (enter yes or no) whether you want to proceed.
• If you do not specify the force keyword, the procedure fails if the SRP modules are in any state that could lead to a loss of configuration data or an NVS corruption, and the router displays a message explaining the command failure.
• When you issue this command, the router prompts you for a confirmation before the command takes effect.
• If you issue the disable-switch-on-error command and later issue the srp switch command, the redundant SRP module waits about 30 seconds before it takes over from the primary SRP module.
• If the router does not contain a redundant SRP module, this command has no effect.
• Example

  host1#srp switch

  host1#srp switch force

• There is no no version.
• See srp switch.

Upgrading Software on a Redundant SRP Module

For information about upgrading software on SRP modules on ERX-7xx models, ERX-14xx models, or the ERX-310 router, see Installing JUNOSe Software .

Monitoring the Status LEDs

You can determine the redundancy state of line modules and SRP modules by examining their status LEDs. See Table 43 for a description of the LEDs functions. In addition, if you issue the show version command, the state field for the slot that contains the redundant SRP module should be standby.

Table 43: Function of the Online and Redundant LEDs

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.