Example: Configuring an Active/Active Layer 3 Cluster Deployment

Step-by-Step Procedure

Configure the control port for each device.

Select FPC 1 and FPC 13, because the central point (CP) is always on the lowest SPC/SPU in the cluster (for this example, it is slot 0). For maximum reliability, place the control ports on a separate SPC from the central point (this example uses the SPC in slot 1).

Note:

Control port configuration is required only for SRX5600 and SRX5800 devices.

1. Configure the control ports and commit the configuration:

Step-by-Step Procedure

Assign a cluster ID and node ID to each device.

Set the two devices to cluster mode by adding a cluster ID and node ID on each and rebooting. You can configure the system to boot automatically by including the reboot parameter in the set command.

Note:

Since there is only a single cluster on the segments, this example uses cluster ID 1 with Device SRX5800-1 as node 0 and Device SRX5800-2 as node 1.

To set the two devices in cluster mode:

1. Enable cluster mode on SRX5800-1 (node 0).

2. Enable cluster mode on SRX5800-2 (node 1).

   Note:

   If you have multiple SRX device clusters on a single broadcast domain, make sure that you assign different cluster IDs to each cluster to avoid MAC address conflicts.

   When the system reboots, the nodes come up as a cluster. From this point forward, configuration of the cluster is synchronized between the node members, and the two separate devices function as one device.

Step-by-Step Procedure

Note:

In cluster mode, all commands and configuration are applied to both nodes.

To configure chassis cluster settings:

1. Configure a fabric (data) port on each device to enable traffic to pass from one device to the other for cases where traffic arrives on an ingress interface on one node but leaves on another node.

   Note:

   A 10-Gigabit Ethernet connection is recommended for active/active deployments.

2. Configure each device’s fxp0 interface for out-of-band management. Assign a separate IP address for each device (control plane) of the cluster.

   Because the SRX Services Gateway chassis cluster configuration is contained within a single common configuration, to assign some elements of the configuration to a specific member only, use the Junos OS node-specific configuration method called groups. The set apply-groups ${node} command uses the node variable to define how the groups are applied to the nodes. Each node recognizes its number and accepts the configuration accordingly.

3. Configure redundancy groups for chassis clustering.

   Each node has interfaces in a redundancy group. Redundancy group 0 controls the control plane, it defines which node will be the primary. Redundancy group 1+ controls the data plane and includes the data plane ports. This active/active clustering mode example uses 2 reth interfaces with redundancy groups 0, 1, and 2.

   As part of redundancy group configuration, you must also define the priority for control plane and data plane—which device is preferred for the control plane, and which device is preferred for the data plane. (For chassis clustering, higher priority is preferred.)

   Note:

   The control plane (redundancy group 0) and data plane (redundancy group 1+) can each be active on a different chassis. However, for this example, we recommend having both the control and data plane active on the same chassis member. Redundancy group 0 (RG0) and redundancy group 1 (RG1) default to the active state on node 0, whereas, redundancy group 2 (RG2) defaults to active state on node 1.

4. Configure the data interfaces on the platform so that in the event of a data plane failover, the other chassis cluster member can take over the connection seamlessly.

   Define the following items:

   • The maximum number of reth interfaces for the cluster, so that the system can allocate the appropriate resources for them.

   • The reth interface information such as the IP address of the interface.

   • Membership information of the member interfaces to reth interfaces.

   • The mapping of reth interfaces to redundancy groups.

5. Configure the behavior in case of a failure.

   Each interface is configured with a weight value that is deducted from the redundancy group threshold of 255 upon a link loss. When a redundancy group threshold reaches 0, that redundancy group fails over to the secondary node.

   Note:

   If the control-link-recovery feature is not enabled, a manual reboot is required to bring the secondary node back into sync with the primary node.

   Note:

   Individual VLANs on an interface are not monitored. Only interfaces as a whole are monitored.

   This step completes the chassis cluster configuration.

6. Configure other interfaces that do not belong to the reth interfaces. These are the upstream interfaces towards the ISPs.

   The following sections describe how to configure zones, security policies, NAT, routing, and the EX8208 Core Switches to complete the deployment scenario.

Step-by-Step Procedure

Configure and connect the reth interfaces to the appropriate zones and define a security policy that permits outbound traffic. Also, for this example we will use a default route and NAT to enable end hosts to reach the Internet.

To configure zones, policies, NAT, and routes:

1. Assign the interfaces to the appropriate zones.

2. Configure a policy to allow traffic from the hosts in the trust zone to the Internet.

3. Configure source NAT for outbound traffic.

4. Define a default static route to enable hosts to reach the Internet.

5. Configure OSPF.

Step-by-Step Procedure

For the EX9214, the following commands provide configuration only as it pertains to this active/active example for the SRX5800, most notably the VLANs, routing, and interface configuration.

1. Configure the interfaces.

   Note:

   The end host is sending untagged traffic.

2. Configure the VLANs.

3. Enable RSTP.

   Note:

   In this example, RSTP is not strictly required as there is no Layer 2 loop. However, a typical environment would likely have more switches, which would require the protocol to be enabled.

Step-by-Step Procedure

To configure the EX9214-2:

1. Configure the interfaces.

   Note:

   The end host is sending untagged traffic.

2. Configure the VLANs.

3. Enable RSTP.

   Note:

   In this example, RSTP is not strictly required as there is no Layer 2 loop. However, a typical environment would likely have more switches, which would require the protocol to be enabled.