Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Ethernet Switching on Chassis Cluster

You can configure a chassis cluster to act as a Layer 2 Ethernet switch. For more information, see the following topics:.

Layer 2 Ethernet Switching Capability in a Chassis Cluster Mode

Understanding Layer 2 Ethernet Switching Capability in a Chassis Cluster on SRX Series Devices

Ethernet ports support various Layer 2 features such as spanning-tree protocols (STPs), IEEE 802.1x, Link Layer Discovery Protocol (LLDP), and Multiple VLAN Registration Protocol (MVRP). With the extension of Layer 2 switching capability to devices in a chassis cluster, you can use Ethernet switching features on both nodes of a chassis cluster.

To ensure that Layer 2 switching works seamlessly across chassis cluster nodes, a dedicated physical link connecting the nodes is required. This type of link is called a switching fabric interface. Its purpose is to carry Layer 2 traffic between nodes.

  • Configuring a LAG with family ethernet-switching is not supported.

  • Configuring a Reth with family ethernet-switching is not supported. This is only supported in Transparent mode.

  • If a switching fabric interface (swfab) is not configured on both nodes, and if you try to configure Ethernet switching related features on the nodes, then the behavior of the nodes might be unpredictable.

Understanding Chassis Cluster Failover and New Primary Election

When chassis cluster failover occurs, a new primary node is elected and the Ethernet switching process (eswd) runs in a different node. During failover, the chassis control subsystem is restarted. Also during failover, traffic outage occurs until the PICs are up and the VLAN entries are reprogrammed. After failover, all Layer 2 protocols reconverge because Layer 2 protocol states are not maintained in the secondary node.

The Q-in-Q feature in chassis cluster mode is not supported because of chip limitation for swfab interface configuration in Broadcom chipsets.

Benefits of Ethernet Switching on Chassis Cluster

  • Enables Ethernet switching functionality on both nodes of a chassis cluster and provides the option to configure the Ethernet ports on either node for family Eethernet switching.

  • Enables configuring a Layer 2 VLAN domain with member ports from both nodes and the Layer 2 switching protocols on both devices.

Example: Configuring Switch Fabric Interfaces to Enable Switching in Chassis Cluster Mode on a Security Device

This example shows how to configure switching fabric interfaces to enable switching in chassis cluster mode.

Requirements

  • The physical link used as the switch fabric member must be directly connected to the device.

  • Switching fabric interfaces must be configured on ports that support switching features. See Ethernet Ports Switching Overview for Security Devices for information about the ports on which switching features are supported.

The physical link used as the switch fabric member must be directly connected to the device. Switching supported ports must be used for switching fabric interfaces. See Ethernet Ports Switching Overview for Security Devices for switching supported ports.

Before you begin, See Example: Configuring the Chassis Cluster Fabric Interfaces.

Overview

In this example, pseudointerfaces swfab0 and swfab1 are created for Layer 2 fabric functionality. You also configure dedicated Ethernet ports on each node to be associated with the swfab interfaces.

Configuration

Procedure

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

To configure swfab interfaces:

  1. Configure swfab0 and swfab1 and associate these switch fabric interfaces to enable switching across the nodes. Note that swfab0 corresponds to node 0 and swfab1 corresponds to node 1.

  2. If you are done configuring the device, commit the configuration.

Results

From configuration mode, confirm your configuration by entering the show interfaces swfab0 command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct the configuration.

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying Switching Fabric Ports
Purpose

Verify that you are able to configure multiple ports as members of switching fabric ports.

Action

From configuration mode, enter the show interfaces swfab0 command to view the configured interfaces for each port.

From operational mode, enter the show chassis cluster ethernet-switching interfaces command to view the appropriate member interfaces.

Example: Configure IRB and VLAN with Members Across Two Nodes on a Security Device using Tagged

Note:

Our content testing team has validated and updated this example.

Requirements

This example uses the following hardware and software components:

Overview

This example shows the configuration of a VLAN with members across node 0 and node 1.

Topology

Figure 1 shows the Layer 2 Ethernet switching across chassis cluster nodes using tagged traffic.

Figure 1: Layer 2 Ethernet Switching Across Chassis Cluster using Tagged TrafficLayer 2 Ethernet Switching Across Chassis Cluster using Tagged Traffic

Configuration

Procedure

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

To configure IRB and a VLAN:

  1. Configure security zones.

  2. Configure Ethernet switching on the node0 interfaces.

  3. Define the interfaces used for the fab connection (data plane links for RTOsync) by using physical ports from each node. These interfaces must be connected back-to-back, or through a Layer 2 infrastructure.

  4. configure a switching fabric interface on both nodes to configure Ethernet switching-related features on the nodes.

  5. Configure the irb interface.

  6. Create and associate a VLAN interface with the VLAN.

  7. If you are done configuring the device, commit the configuration.

Results

From configuration mode, confirm your configuration by entering the show security, show interfaces, and show vlans commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct the configuration.

Verification

Verifying Tagged VLAN With IRB
Purpose

Verify that the configuration for tagged VLAN with IRB is working properly.

Action

From operational mode, enter the show chassis cluster interfaces command.

From operational mode, enter the show ethernet-switching table command.

From operational mode, enter the show arp command.

From operational mode, enter the show ethernet-switching interface command to view the information about Ethernet switching interfaces.

Meaning

The output shows the VLANs are configured and working fine.

Example: Configure IRB and VLAN with Members Across Two Nodes on a Security Device using Untagged Traffic

Note:

Our content testing team has validated and updated this example.

Requirements

This example uses the following hardware and software components:

Overview

This example shows the configuration of a VLAN with members across node 0 and node 1.

Topology

Figure 2 shows the Layer 2 Ethernet switching across chassis cluster nodes using untagged traffic.

Figure 2: Layer2 Ethernet Switching Across Chassis Cluster Nodes using Untagged TrafficLayer2 Ethernet Switching Across Chassis Cluster Nodes using Untagged Traffic

Configuration

Procedure

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

To configure IRB and a VLAN:

  1. Configure security zones.

  2. Configure Ethernet switching on the node0 interfaces.

  3. Define the interfaces used for the fab connections (data plane links for RTOsync) by using physical ports from each node. These interfaces must be connected back-to-back, or through a Layer 2 infrastructure.

  4. configure a switching fabric interface on both nodes to configure Ethernet switching-related features on the nodes.

  5. Configure the irb interface.

  6. Create and associate a VLAN interface with the VLAN.

  7. If you are done configuring the device, commit the configuration.

Results

From configuration mode, confirm your configuration by entering the show security, show interfaces, and show vlans commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct the configuration.

Verification

Verifying Untagged VLAN With IRB
Purpose

Verify that the configuration of untagged VLAN with IRB is working properly.

Action

From operational mode, enter the show chassis cluster interfaces command.

From operational mode, enter the show ethernet-switching table command.

From operational mode, enter the show arp command.

From operational mode, enter the show ethernet-switching interface command to view the information about Ethernet switching interfaces.

Meaning

The output shows the VLANs are configured and working fine.

Example: Configuring VLAN with Members Across Two Nodes on a Security Device

Requirements

This example uses the following hardware and software components:

Overview

This example shows the configuration of a VLAN with members across node 0 and node 1.

Configuration

Procedure

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

To configure VLAN:

  1. Configure Ethernet switching on the node0 interface.

  2. Configure Ethernet switching on the node1 interface.

  3. Create VLAN vlan100 with vlan-id 100.

  4. Add interfaces from both nodes to the VLAN.

  5. Create a VLAN interface.

  6. Associate an VLAN interface with the VLAN.

  7. If you are done configuring the device, commit the configuration.

Results

From configuration mode, confirm your configuration by entering the show vlans and show interfaces commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct the configuration.

Verification

Verifying VLAN

Purpose

Verify that the configuration of VLAN is working properly.

Action

From operational mode, enter the show interfaces terse ge-0/0/3 command to view the node 0 interface.

From operational mode, enter the show interfaces terse ge-0/0/4 command to view the node 0 interface.

From operational mode, enter the show interfaces terse ge-7/0/5 command to view the node1 interface.

From operational mode, enter the show vlans command to view the VLAN interface.

From operational mode, enter the show ethernet-switching interface command to view the information about Ethernet switching interfaces.

Meaning

The output shows the VLANs are configured and working fine.