Expand All close

Contrail Service Orchestration User Guide

play_arrow Administration Portal
- play_arrow Introduction
  - Unified Administration and Customer Portal Overview
  - Administration Portal Overview
  - Logging in to Administration Portal
  - Switching the Tenant Scope
  - Changing the Administration Portal Password
  - Changing the Password on First Login
  - Resetting the Password
  - Setting Password Duration
  - Extending the User Login Session
  - Setting Up the Cloud CPE Centralized Deployment Model with Administration Portal
  - Setting Up the Cloud CPE Distributed Deployment Model with Administration Portal
- play_arrow Managing Objects
  - Creating Objects
  - Modifying an Object
  - Deleting Objects
  - Viewing Object Details
  - Searching for Text in an Object Data Table
  - Sorting Objects
- play_arrow Using the Dashboard
  - About the Administration Portal Dashboard
- play_arrow Monitoring Alerts, Alarms, and Device Events
  - About the Monitor Overview Page
  - Alerts Overview
  - About the Generated Alerts Page
  - About the Alert Definitions Page
  - Creating SD-WAN Alert Definitions
  - Editing and Deleting SD-WAN Alert Definitions
  - About the Alarms Page
  - About the Device Events Page
- play_arrow Monitoring Tenants SLA Performance
  - Multidepartment CPE Device Support
  - About the SLA Performance of All Tenants Page
  - About the SLA Performance of a Single Tenant Page
  - Monitoring Application-Level SLA Performance for real time-optimized SD-WAN
  - Viewing the SLA Performance of a Site
  - Viewing the SLA Performance of an Application or Application Group
  - Understanding SLA Performance Score for Applications, Links, Sites, and Tenants
- play_arrow Monitoring Jobs
  - About the Jobs Page
  - Viewing Job Details
  - Editing and Deleting Scheduled Jobs
  - Retrying a Failed Job on Devices
- play_arrow Managing POPs
  - About the POPs Page
  - Creating a Single POP
  - Importing Data for Multiple POPs
  - Viewing the History of POP Data Imports
  - Viewing the History of POP Data Deletions
  - Managing a Single POP
  - About the VIMs Page
  - Creating a Cloud VIM
  - About the EMS Page
  - Creating an EMS
  - Changing the Junos Space Virtual Appliance Password
  - About the Routers Page
  - Creating Devices
  - Configuring Devices
  - View the History of Device Data Deletions
- play_arrow Managing Devices
  - About the Tenant Devices Page
  - About the Cloud Hub Devices Page
  - Managing a Tenant Device
  - Managing a Cloud Hub Device
  - Device Redundancy Support Overview
  - Viewing the History of Tenant Device Activation Logs
  - Viewing the History of Cloud Hub Device Activation Logs
  - Secure OAM Network Overview
  - Adding a Cloud Hub Device
  - Upgrading a Cloud Hub Device
  - Rebooting a CPE Device
- play_arrow Managing Device Templates
  - Device Template Overview
  - About the Device Template Page
  - Cloning a Device Template
  - Importing a Device Template
  - Configuring a Device Template
  - Modifying a Device Template Description
  - Deleting a Device Template
- play_arrow Managing Software Images
  - Device Images Overview
  - About the Device Images Page
  - Deploying Device Images to Devices
  - Uploading a Device Image
  - Deleting Device Images
- play_arrow Configuring Network Services in a Centralized Deployment
  - Network Services Overview
  - About the Network Services Page
  - About the Service Overview Page
  - About the Service Instances Page
  - Configuring VNF Properties
  - Allocating a Service to Tenants
  - Removing a Service from Tenants
  - Viewing a Service Configuration
  - vSRX VNF Configuration Settings
  - LxCIPtable VNF Configuration Settings
  - Cisco CSR-1000v VNF Configuration Settings
  - Riverbed Steelhead VNF Configuration Settings
  - Managing a Single Service
- play_arrow Configuring Application SLA Profiles
  - Application Quality of Experience (AppQoE) Overview
  - About the Application Traffic Type Profiles Page
  - Creating Traffic Type Profiles
  - Editing and Deleting Traffic Type Profiles
  - SLA Profiles and SD-WAN Policies Overview
  - Cost-Based Link Switching
  - Local Breakout Overview
  - About the Application SLA Profiles Page
  - Creating SLA Profiles
  - Editing and Deleting SLA Profiles
- play_arrow Configuring Application Signatures
  - Application Signatures Overview
  - About the Application Signatures Page
  - Creating Application Signature Groups
  - Editing, Cloning, and Deleting Application Signature Groups
- play_arrow Managing Tenants
  - Tenant Overview
  - Full Mesh Topology Overview
  - About the Tenants Page
  - Adding a Single Tenant
  - Editing Tenant Information
  - Importing Data for Multiple Tenants
  - Allocating Network Services to a Tenant
  - Viewing the History of Imported Tenant Data
  - Viewing the History of Deleted Tenant Data
- play_arrow Managing Operating Companies
  - Operating Companies Overview
  - About the Operating Companies Page
  - Creating Operating Companies
  - Editing and Deleting Operating Companies
- play_arrow Configuring SP Users
  - Role-Based Access Control Overview
  - About the Service Provider Users Page
  - Adding Service Provider Users
  - Editing and Deleting Service Provider Users
  - Resetting the Password for Service Provider and Tenant Users
- play_arrow Managing Audit Logs
  - Audit Logs Overview
  - About the Audit Logs Page
  - Viewing the Details of an Audit Log
  - Exporting Audit Logs
- play_arrow Managing Roles
  - Roles Overview
  - About the Roles Page
  - Adding User-Defined Roles for Service Provider, OpCo, and Tenant Users
  - Editing, Cloning, and Deleting User-Defined Roles for Service Provider, OpCo, and Tenant Users
  - Access Privileges for Role Scopes (Service Provider, Tenant, and Operating Company)
- play_arrow Configuring Authentication
  - Authentication Methods Overview
  - About the Authentication Page
  - Editing the Authentication Method
  - Configuring a Single Sign-On Server
  - Editing and Deleting SSO Servers
  - Configuring SMTP Settings
- play_arrow Configuring Licenses
  - About the License Files Page
  - Uploading a License File
  - Editing and Deleting Licenses
  - Pushing a License to Devices
- play_arrow Customizing the Unified Portal
  - Personalizing the Unified Administration and Customer Portal
- play_arrow Managing Signature Database
  - Signature Database Overview
  - About the Active Database Page
  - Downloading a Signature Database
  - Download Locations for Signature Database
  - Installing Signatures
play_arrow Customer Portal
- play_arrow Introduction
  - Unified Administration and Customer Portal Overview
  - Customer Portal Overview
  - Switching the Tenant Scope
  - Accessing Customer Portal
  - Setting Up Your Network with Customer Portal
  - Changing the Password on First Login
  - Changing the Customer Portal Password
  - Resetting the Password
  - Extending the User Login Session
- play_arrow Using the Dashboard
  - About the Customer Portal Dashboard
- play_arrow Managing Objects
  - Sorting Objects
  - Viewing Object Details
  - Searching for Text in an Object Data Table
- play_arrow Monitoring Security Alerts and Alarms
  - About the Monitor Overview Page
  - Alerts Overview
  - About the Generated Alerts Page
  - About the Alert Definitions Page
  - Managing Security Alerts Definitions
  - Creating Security Alert Definitions
  - Editing, Cloning, and Deleting Security Alert Definitions
  - About the Alarms Page
- play_arrow Monitoring Security and Device Events
  - About the All Security Events Page
  - About the Firewall Events Page
  - About the Web Filtering Events Page
  - About the IPsec VPNs Events Page
  - About the Content Filtering Events Page
  - About the Antispam Events Page
  - About the Antivirus Events Page
  - About the IPS Events Page
  - About the Device Events Page
  - About the Screen Events Page
- play_arrow Monitoring SD-WAN Events
  - SD-WAN Events Overview
  - About the SD-WAN Events Page
- play_arrow Monitoring Applications
  - About the SLA Performance of a Single Tenant Page
  - Viewing the SLA Performance of a Site
  - Viewing the SLA Performance of an Application or Application Group
  - Application Visibility Overview
  - About the Application Visibility Page
  - Selecting Devices
- play_arrow Monitoring Threats
  - About the Threats Map (Live) Page
- play_arrow Monitoring Jobs
  - About the Jobs Page
  - Editing and Deleting Scheduled Jobs
  - Viewing Job Details
  - Retrying a Failed Job on Devices
- play_arrow Managing Devices
  - Multidepartment CPE Device Support
  - About the Devices Page
  - Performing Return Material Authorization (RMA) for a Single-CPE Device
  - Performing Return Material Authorization (RMA) for Dual-CPE Devices
  - Granting RMA for a Device
  - Managing a Single CPE Device
  - Rebooting a CPE Device
- play_arrow Managing Device Images
  - Device Images Overview
  - About the Device Images Page
  - Deleting Device Images
- play_arrow Configuring Network Services in a Distributed Deployment
  - Network Service Overview
  - About the Network Services Page
  - About the Service Overview Page
  - About the Service Instances Page
  - Configuring VNF Properties
  - vSRX VNF Configuration Settings
  - LxCIPtable VNF Configuration Settings
  - Cisco CSR-1000v VNF Configuration Settings
  - Riverbed Steelhead VNF Configuration Settings
- play_arrow Managing Firewall Policies
  - Firewall Policy Overview
  - About the Firewall Policy Page
  - Creating Firewall Policy Intents
  - Editing, Cloning, and Deleting Firewall Policy Intents
  - Selecting Firewall Source
  - Selecting Firewall Destination
  - Firewall Policy Examples
  - Firewall Policy Schedules Overview
  - About the Firewall Policy Schedules Page
  - Creating Schedules
  - Editing, Cloning, and Deleting Schedules
- play_arrow Unified Threat Management
  - UTM Overview
  - Configuring UTM Settings
  - About the UTM Profiles Page
  - Creating UTM Profiles
  - Editing, Cloning, and Deleting UTM Profiles
  - About the Web Filtering Profiles Page
  - Creating Web Filtering Profiles
  - Editing, Cloning, and Deleting Web Filtering Profiles
  - About the Antivirus Profiles Page
  - Creating Antivirus Profiles
  - Editing, Cloning, and Deleting Antivirus Profiles
  - About the Antispam Profiles Page
  - Creating Antispam Profiles
  - Editing, Cloning, and Deleting Antispam Profiles
  - About the Content Filtering Profiles Page
  - Creating Content Filtering Profiles
  - Editing, Cloning, and Deleting Content Filtering Profiles
  - About the URL Patterns Page
  - Creating URL Patterns
  - Editing, Cloning, and Deleting URL Patterns
  - About the URL Categories Page
  - Creating URL Categories
  - Editing, Cloning, and Deleting URL Categories
- play_arrow Managing SD-WAN
  - SLA Profiles and SD-WAN Policies Overview
  - About the SD-WAN Policy Page
  - Creating SD-WAN Policy Intents
  - Editing and Deleting SD-WAN Policy Intents
  - About the Application SLA Profiles Page
  - Creating SLA Profiles
  - Editing and Deleting SLA Profiles
- play_arrow Managing NAT Policies
  - NAT Policies Overview
  - About the NAT Policies Page
  - Creating NAT Policies
  - Editing and Deleting NAT Policies
  - About the Single NAT Policy Page
  - Creating NAT Policy Rules
  - Editing, Cloning, and Deleting NAT Policy Rules
  - Deploying NAT Policy Rules
  - Selecting NAT Source
  - Selecting NAT Destination
  - NAT Pools Overview
  - About the NAT Pools Page
  - Creating NAT Pools
  - Editing, Cloning, and Deleting NAT Pools
- play_arrow Managing SSL Proxies
  - SSL Forward Proxy Overview
  - About the SSL Proxy Policy Page
  - Creating SSL Proxy Policy Intents
  - Editing, Cloning, and Deleting SSL Proxy Policy Intents
  - Understanding How SSL Proxy Policy Intents Are Applied
  - About the SSL Proxy Profiles Page
  - Creating SSL Forward Proxy Profiles
  - Editing, Cloning, and Deleting SSL Forward Proxy Profiles
  - Configuring and Deploying an SSL Forward Proxy Policy
- play_arrow Managing Shared Objects
  - Addresses and Address Groups Overview
  - About the Addresses Page
  - Creating Addresses or Address Groups
  - Editing, Cloning, and Deleting Addresses and Address Groups
  - Services and Service Groups Overview
  - About the Services Page
  - Creating Services and Service Groups
  - Creating Protocols
  - Editing and Deleting Protocols
  - Editing, Cloning, and Deleting Services and Service Groups
  - Application Signatures Overview
  - About the Application Signatures Page
  - Creating Application Signature Groups
  - Editing, Cloning, and Deleting Application Signature Groups
  - About the Departments Page
  - Creating a Department
  - Modifying a Department
  - Deleting a Department
- play_arrow Managing Deployments
  - Deploying Policies Overview
  - About the Deployments Page
  - Using the Deployment Icon to Deploy Policies
  - Deploying Policies
- play_arrow Managing Sites
  - About the Sites Page
  - Local Breakout Overview
  - Multihoming Overview
  - Device Redundancy Support Overview
  - Upgrading Sites Overview
  - Creating Spoke Sites for Hybrid WAN Deployment
  - Creating Local Service Edge Sites for Hybrid WAN Deployment
  - Creating Regional Service Edge Sites for Hybrid WAN Deployment
  - Creating On-Premise Hub Sites for SD-WAN Deployment
  - Creating On-Premise Spoke Sites for SD-WAN Deployment
  - Creating Cloud Hub Sites for SD-WAN Deployment
  - Creating Cloud Spoke Sites for SD-WAN Deployment
  - Provisioning a Cloud Spoke Site in AWS VPC
  - Importing Multiple Sites
  - Managing a Single Site
  - Configuring a Single Site
  - Upgrading Sites
  - Managing LAN Segments on a Tenant Site
  - Activating a CPE Device
  - Activating Dual CPE Devices (Device Redundancy)
  - Viewing the History of Tenant Device Activation Logs
  - Configuring VRFs and PNE Details for a Site in a Centralized Deployment
- play_arrow Managing Site Groups
  - About the Site Groups Page
  - Creating Site Groups
- play_arrow Security Reports
  - Reports Overview
  - About the Security Report Definitions Page
  - Performing Different Actions on Reports
  - About the Security Generated Reports Page
  - Creating Log Report Definition
  - Creating Bandwidth Report Definition
  - Editing and Deleting Log Report Definitions
  - Editing and Deleting Bandwidth Report Definitions
- play_arrow SD-WAN Reports
  - About the SD-WAN Report Definitions Page
  - Editing and Deleting SD-WAN Report Definitions
  - Creating SD-WAN Tenant Performance Report Definition
  - Creating SD-WAN Site Performance Report Definition
  - About the SD-WAN Generated Reports Page
- play_arrow Managing Tenant Users
  - Role-Based Access Control Overview
  - About the Tenant Users Page
  - Adding Tenant Users
  - Editing and Deleting Tenant Users
  - Resetting the Password for Tenant Users
- play_arrow Managing Audit Logs
  - Audit Logs Overview
  - About the Audit Logs Page
  - Viewing the Details of an Audit Log
  - Exporting Audit Logs
- play_arrow Managing Tenant User Roles
  - Roles Overview
  - About the Tenant Roles Page
  - Adding User-Defined Roles for Tenant Users
  - Editing, Cloning, and Deleting User-Defined Roles for Tenant Users
  - Access Privileges for Role Scopes (Service Provider, Tenant, and Operating Company)
- play_arrow Licenses
  - About the Licenses Page
- play_arrow Signature Database
  - Signature Database Overview
  - About the Active Database Page
  - Installing Signatures
- play_arrow Managing Certificates
  - Certificates Overview
  - About the Certificates Page
  - Importing a Certificate
  - Installing and Uninstalling Certificates
  - About the VPN Authentication Page
- play_arrow Managing Juniper Identity Management Service
  - Juniper Identity Management Service Overview
  - About the Identity Management Page
  - Configuring CSO and JIMS Connection
  - Configuring JIMS for an SRX Device
play_arrow Designer Tools
play_arrow Downloads
- Download this guide: User Guide

list Table of Contents

PDF

English

Device Redundancy Support Overview

date_range 10-Jun-18

arrow_backward

arrow_forward

Contrail Service Orchestration (CSO) provides support for spoke device redundancy for large enterprise SD-WAN on-premise spoke sites. You can configure an SD-WAN site with two CPE devices to act as primary and secondary devices and protect the site against device and link failures. If the primary device fails, the secondary device takes over the traffic processing.

Note

You must use the same device model for both primary and secondary devices and the devices must have the same version of Junos OS installed.

The following SD-WAN features are not supported for device redundancy:

AppQOE (latency-optimized SLA)
CPE in Full-mesh Topology
LTE WAN backup link
Service chain support
Hub in Hub-Spoke Topology

Note

Device redundancy is supported only on SD-WAN deployments.

Prerequisites for SRX Series Devices

The prerequisites to configure an SD-WAN site with dual CPE SRX Series devices are as follows:

For SRX Series, you need to form the cluster manually by connecting two SRX Series devices together using a pair of the same type of Ethernet connections. To create an SRX cluster, see Chassis Cluster Feature Guide for SRX Series Devices.
Log in to any one of the SRX Series devices, copy the Stage-1 configuration from the Sites page and paste it into the console screen and commit the configuration.

Supported Connection Plans

The following connection plans are supported for device redundancy:

Dual NFX250 as SD-WAN CPEs—Supports dual CPE NFX Series devices on an SD-WAN site.
Dual SRX as SD-WAN CPEs—Supports dual CPE SRX Series devices on an SD-WAN site.

Create and Configure an SD-WAN Site

You can create and configure an SD-WAN site with dual CPE devices and the two devices back up each other, with one node acting as the primary device and the other as the secondary device. The workflow to add and configure a site with dual CPE devices is similar to the single CPE device. For more information about creating and configuring a site with dual CPE devices, see Creating On-Premise Spoke Sites for SD-WAN Deployment and Configuring a Single Site.

Dual CPE Devices Logical Topology for NFX Network Services Platform

Figure 1 shows the logical topology of the NFX Series dual CPE devices.

Dual
CPE Device Topology - NFX Network Services Platform

You can form a cluster using two NFX Series devices. The front panel ports of the NFX Series devices are used to interconnect two NFX Series devices and to carry the control and fabric interconnect traffic between the two NFX250 devices.

The Junos Control Plane (JCP) component acts as a switch, controls the front panel ports, and sends the traffic which arrives from the LAN or WAN to the NFX Series devices. On the LAN, the active/backup mechanism is used and if the primary device fails, the secondary device takes over processing of traffic. On the WAN, the active/active mechanism is used and all four WAN links are active and distributed across two NFX Series devices.

Dual CPE Devices Logical Topology for SRX Series Gateway Devices

Figure 2 shows the logical topology of the SRX Series dual CPE devices.

Dual
CPE Device Topology - SRX Series Devices

You can form a cluster using two SRX devices. A chassis cluster is formed between these nodes and performs as a single logical router. On the LAN, the active/backup mechanism is used and if the primary device fails, the secondary device takes over traffic processing. On the WAN, the active/active mechanism is used and all four WAN links are active and distributed across two NFX Series device.