Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel (CLI)

1. Enabling clustering

   In node 0:

   user@host> set chassis cluster node 0 cluster-id 1warning: A reboot is required for chassis cluster to be enabled

   In node 1:

   user@host> set chassis cluster node 1 cluster-id 1 rebootSuccessfully enabled chassis cluster. Going to reboot now.{primary:node1}user@host# set chassis cluster control-ports fpc 2 port 0{primary:node1}user@host# set chassis cluster control-ports fpc 14 port 0
2. Management interface

   In a cluster, the configuration is shared among the cluster members. Member-specific configurations (such as the IP address of the management port of each member) are entered using configuration groups.

   {primary:node1}user@host# set groups node0 system host-name SRX5800-1{primary:node1}user@host# set groups node0 interfaces fxp0 unit 0 family inet address 172.19.100.50/24{primary:node1}user@host#set groups node1 system host-name SRX5800-2{primary:node1}user@host# set groups node1 interfaces fxp0 unit 0 family inet address 172.19.100.51/24{primary:node1}user@host# set apply-groups “${node}”
3. Fabric interface
   {primary:node1}user@host# set interfaces fab0 fabric-options member-interfaces xe-5/3/0{primary:node1}user@host# set interfaces fab1 fabric-options member-interfaces xe-17/3/0
4. Redundancy groups
   {primary:node1}user@host# set chassis cluster reth-count 2{primary:node1}user@host# set chassis cluster heartbeat-interval 1000{primary:node1}user@host# set chassis cluster heartbeat-threshold 3{primary:node1}user@host# set chassis cluster node 0{primary:node1}user@host# set chassis cluster node 1{primary:node1}user@host# set chassis cluster redundancy-group 0 node 0 priority 254{primary:node1}user@host# set chassis cluster redundancy-group 0 node 1 priority 1{primary:node1}user@host# set chassis cluster redundancy-group 1 node 0 priority 254{primary:node1}user@host# set chassis cluster redundancy-group 1 node 1 priority 1{primary:node1}user@host# set chassis cluster redundancy-group 1 preempt{primary:node1}user@host# set chassis cluster redundancy-group 1 interface-monitor xe-5/0/0 weight 255{primary:node1}user@host# set chassis cluster redundancy-group 1 interface-monitor xe-5/1/0 weight 255{primary:node1}user@host# set chassis cluster redundancy-group 1 interface-monitor xe-17/0/0 weight 255{primary:node1}user@host# set chassis cluster redundancy-group 1 interface-monitor xe-17/1/0 weight 255
5. Redundant Ethernet interfaces
   {primary:node1}user@host# set interfaces xe-5/1/0 gigether-options redundant-parent reth1{primary:node1}user@host# set interfaces xe-17/1/0 gigether-options redundant-parent reth1{primary:node1}user@host# set interfaces xe-5/0/0 gigether-options redundant-parent reth0{primary:node1}user@host# set interfaces xe-17/0/0 gigether-options redundant-parent reth0{primary:node1}user@host# set interfaces reth0 redundant-ether-options redundancy-group 1{primary:node1}user@host# set interfaces reth0 unit 0 family inet address 10.1.1.60/16{primary:node1}user@host# set interfaces reth1 redundant-ether-options redundancy-group 1{primary:node1}user@host# set interfaces reth1 unit 0 family inet address 10.2.1.60/16
6. IPsec configuration
   {primary:node1}user@host# set interfaces st0 unit 0 multipoint family inet address 10.10.1.1/30{primary:node1}user@host# set interfaces st0 family inet address 10.10.1.1/30{primary:node1}user@host# set security ike policy preShared mode main{primary:node1}user@host# set security ike policy preShared proposal-set standard{primary:node1}user@host# set security ike policy preShared pre-shared-key ascii-text "juniper"## Encrypted password{primary:node1}user@host# set security ike gateway SRX210-1 ike-policy preShared{primary:node1}user@host# set security ike gateway SRX210-1 address 10.1.1.90{primary:node1}user@host# set security ike gateway SRX210-1 external-interface reth0.0{primary:node1}user@host# set security ipsec policy std proposal-set standard{primary:node1}user@host# set security ipsec vpn SRX210-1 bind-interface st0.0{primary:node1}user@host# set security ipsec vpn SRX210-1 vpn-monitor optimized{primary:node1}user@host# set security ipsec vpn SRX210-1 ike gateway SRX210-1{primary:node1}user@host# set security ipsec vpn SRX210-1 ike ipsec-policy std{primary:node1}user@host# set security ipsec vpn SRX210-1 establish-tunnels immediately
7. Static routes
   {primary:node1}user@host# set routing-options static route 0.0.0.0/0 next-hop 10.2.1.1{primary:node1}user@host# set routing-options static route 10.3.0.0/16 next-hop 10.10.1.2
8. Security zones
   {primary:node1}user@host# set security zones security-zone Untrust host-inbound-traffic system-services all{primary:node1}user@host# set security zones security-zone Untrust host-inbound-traffic protocols all{primary:node1}user@host# set security zones security-zone Untrust interfaces reth1.0{primary:node1}user@host# set security zones security-zone Trust host-inbound-traffic system-services all{primary:node1}user@host# set security zones security-zone Trust host-inbound-traffic protocols all{primary:node1}user@host# set security zones security-zone Trust interfaces reth0.0{primary:node1}user@host# set security zones security-zone vpn host-inbound-traffic system-services all{primary:node1}user@host# set security zones security-zone vpn host-inbound-traffic protocols all{primary:node1}user@host# set security zones security-zone vpn interfaces st0.0
9. Security policies
   {primary:node1}user@host# set security policies from-zone Trust to-zone Untrust policy ANY match source-address any{primary:node1}user@host# set security policies from-zone Trust to-zone Untrust policy ANY match destination-address any{primary:node1}user@host# set security policies from-zone Trust to-zone Untrust policy ANY match application any{primary:node1}user@host# set security policies from-zone Trust to-zone vpn policy ANY then permit

Related Topics

• JUNOS Software Feature Support Reference for SRX Series and J Series Devices
• Understanding Active/Passive Chassis Cluster Deployment with an IPsec Tunnel
• Example: Configuring an Active/Passive Chassis Cluster Pair with an IPsec Tunnel (J-Web)
• Understanding What Happens When Chassis Cluster Is Enabled
• Understanding Chassis Cluster Formation