Appendix: Building an Extended Full Stack Topology with Juniper EX Switch Virtual Chassis and SSR HA Cluster

Create a Wi-Fi Guest Network

Go to Organization -> Networks. Configure the first network in the following way:

• Name=GUEST
• Subnet IP Address=10.11.11.0. This will be the same on all sites.
• Prefix Length=24
• VLAN ID=1011
• Access to Mist Cloud=Unchecked/Disabled. This should not be needed for guests.
• Advertised via Overlay=Unchecked/Disabled. This is mandatory here as we can’t have the same IP address range announced from multiple sites.

The result should look like the figure below:

Create a WAN Edge Template for HA Spoke with LAG

Go to Organization -> WAN Edge Templates.

Should you choose to use the import option, click on Import Profile and import the below JSON as a file.

Should you decide to configure everything manually in the Juniper Mist portal, then use the following steps.

We recommend you clone the existing “Spokes-with-LAN-LAG” template and name the new template “haspoke-with-lag”. Then make the following changes as the WAN and LAN interfaces change with the high-availability configuration.

Delete all prior WAN interfaces and add the following three new WAN interfaces.

Configure a first WAN interface for Node0 as follows:

• Name=N0-INET. This indicates which topology and node it’s going to use.
• WAN Type=Ethernet
• Interface=ge-0/0/0 as all interfaces starting with ge-0 are on Node0.
• IP Configuration=DHCP
• Source NAT=Interface
• Overlay Hub Endpoints
  • Endpoint1=hub1-INET
  • BFD Profile1=Broadband
  • Endpoint2=hub2-INET
  • BFD Profile2=Broadband

Then configure the first WAN interface for Node1 as follows:

• Name=N1-INET. This indicates which topology and node it’s going to use.
• WAN Type=Ethernet
• Interface=ge-1/0/0 as all interfaces starting with ge-1 are on Node1.
• IP Configuration=DHCP
• Source NAT=Interface
• Overlay Hub Endpoints
  • Endpoint1=hub1-INET
  • BFD Profile1=Broadband
  • Endpoint2=hub2-INET
  • BFD Profile2=Broadband

Then, configure the third and redundant WAN interface for the MPLS path for Node0 and Node1 as follows:

• Name=HA-MPLS. This indicates which topology and node it’s going to use.
• WAN Type=Ethernet
• Interface=ge-0/0/1 and ge-1/0/1
• Redundant=Checked/Enabled
• Redundant Index=1. This is not required for an SSR, but we add for compatibility.
• Primary Node=node0
• IP Configuration=Static
• IP Address={{WAN1_PFX}}.2
• Prefix Length=24
• Gateway={{WAN1_PFX}}.1
• Source NAT=Interface
• Overlay Hub Endpoints
  • Endpoint1=hub1-MPLS
  • BFD Profile1=Broadband
  • Endpoint2=hub2-MPLS
  • BFD Profile2=Broadband

The result should look like the figure below:

In the LAN section, we need to add the following IP Configuration:

• Network=GUEST
• IP Address=10.11.11.1
• Prefix Length=24

Then, we create an additional DHCP server for this network with the following configuration:

• Network=GUEST
• DHCP=Server
• IP Start=10.11.11.10
• IP End=10.11.11.250
• Gateway=10.11.11.1
• Maximum Lease Time=86400
• DNS Servers=8.8.8.8, 9.9.9.9

Delete the existing LAN interface configuration and create the following new LAG + redundant interface:

• Interface=ge-0/0/4,ge-0/0/5,ge-1/0/4,ge-1/0/5
• Port Aggregation=Checked/Enabled
  • Disable LACP=Unchecked/Disabled
  • Enable Force Up=Checked/Enabled
  • AE Index=0
• Redundant=Checked/Enabled
  • Redundant Index=4
  • Primary Node=node0
• Networks=SPOKE-LAN1 + GUEST + MGMT
• Untagged VLAN Network=None

The result should look like the figure below:

You need to change the existing “LBO” traffic steering profile for the Node0 and Node1 redundant WAN interfaces in the following way:

• Name=LBO
• Strategy=Ordered
• Paths
  • Path1 Type=WAN: N0-INET
  • Path2 Type=WAN: N1-INET

The result should look like the figure below:

Insert the following application policy:

• Number=5
  • Name=guest-to-lbo
  • Network=GUEST
  • Action=Pass
  • Application=any
  • Traffic Steering=LBO

The result should look like the figure below:

Remaining Tasks for This Lab

First you need to assign the new spoke templates to their sites.

Go to Organization -> WAN Edge Templates -> “haspoke-with-lag” template and click Assign to Sites. Then, you assign spoke2-site to this template.

If you have the spoke devices in use from previous labs, then go to the inventory and release them. This will bring them back into a factory state.

Here, we describe how to build a cluster during the onboarding assuming all devices are in a factory default state.

Go to Organization -> Inventory and select WAN Edges and click Claim WAN Edges. Then, do the following:

• Assign claimed WAN Edge to site=Unchecked/Disabled
• Enter the claim codes for the two devices.

This will claim the two devices without assigning them to a site.

Select the two devices and click on Assign To Site from the More menu.

Now configure:

• Assign 2 selected WAN Edges to site=spoke2-site
• Create Cluster=Checked/Enabled
• Select a device to act as node0 = select that as required
• Manage Configuration with Mist=Enabled (automatically)

This will commit the needed cluster configuration for the HA Spoke.

Test Your Network Configuration

We are now ready to test our configuration. In our case, you'll notice the following differences compared to the lab setup described in the previous section:

• The reported MAC address of the WAN router will now be 00:00:5e:00:01:01 as the LAG also has a redundant VRRP configuration.
• The Virtual Chassis was already built automatically before, depending on the EX Series Switch model, when following the appropriate power-up sequence. Please review the Day 0 section in the JVD for Distributed Branch EX Series for more information.

With the redundant spoke configuration on Spoke2 in place and a console cable attached to the switch, you can evaluate the following.

The test above shows that the switch obtained a DHCP lease and should be able to initiate traffic with the Juniper Mist cloud to be managed. The remaining steps to onboard an EX Series Switch are explained in the JVD Distributed Branch EX Series. In the Day 1 section, review the sections shown in the figure below:

This section does not repeat the traffic topology tests, as the changes introduced are minimal. For detailed testing procedures, please refer to the Test Your Network Configuration section in the first topology.