close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
- play_arrow Services Overview
  - Adaptive Services and Multiservices Interfaces Overview
  - Packet Flow Through the Adaptive Services or Multiservices PIC
- play_arrow Services Configuration Overview
play_arrow Network Address Translation
- play_arrow NAT Overview
- play_arrow Stateful NAT64
  - Stateful NAT64
- play_arrow Static Source NAT
  - Static Source NAT
- play_arrow Static Destination NAT
  - Static Destination NAT
- play_arrow Network Address Port Translation
  - Network Address Port Translation
- play_arrow Deterministic NAT
  - Deterministic NAT
- play_arrow NAT Protocol Translation
  - NAT Protocol Translation
  - Example: Configuring the DNS ALG Application on MX-SPC3 service card
- play_arrow IPv4 Connectivity Across IPv6-Only Network Using 464XLAT
  - IPv4 Connectivity Across IPv6-Only Network Using 464XLAT
- play_arrow Port Control Protocol
  - Port Control Protocol
- play_arrow Secured Port Block Allocation
  - Secured Port Block Allocation
  - Secured Port Block Allocation Interim Logging
- play_arrow Port Forwarding
  - Port Forwarding
- play_arrow Dynamic Address-Only Source Translation
  - Dynamic Address-Only Source Translation
- play_arrow Inline NAT
  - Inline NAT
- play_arrow Stateless Source Network Prefix Translation for IPv6
  - Stateless Source Network Prefix Translation for IPv6
- play_arrow Monitoring NAT
  - Monitoring NAT
- play_arrow Packet Translation and GRE Tunneling
  - Packet Translation and GRE Tunneling
play_arrow Transitioning to IPv6 Using MAP-E and MAP-T
- play_arrow Transitioning to IPv6 Using MAP-E and MAP-T
  - Mapping of Address and Port with Encapsulation (MAP-E)
  - Equal Cost Multiple Path (ECMP) support for Mapping of Address and Port with Encapsulation (MAP-E)
- Mapping of Address and Port with Translation (MAP-T)
play_arrow Transition to IPv6 With Softwires
- play_arrow Transition to IPv6 With 6to4 Softwires
  - Softwires Configuration Overview
  - 6to4 Softwires
- play_arrow Transition to IPv6 With DS-Lite Softwires
  - DS-Lite Softwires
- play_arrow Transition to IPv6 With 6rd Softwires
  - Configuring a 6rd Softwire
- play_arrow Transition to IPv6 With Inline Softwires
  - Inline 6rd and 6to4 Softwires
- play_arrow Monitoring and Troubleshooting Softwires
  - Monitoring and Troubleshooting Softwires
play_arrow ALGs
- play_arrow ALGs
  - ALG Overview
  - ALG Applications
play_arrow Access Security
- play_arrow Stateful Firewalls
  - Stateful Firewalls
  - Monitoring Stateful Firewalls
- play_arrow IDS on MS-DPC
  - IDS on MS-DPC
- play_arrow Network Attack Protection on MS-MPC and MS-MIC
  - Network Attack Protection on MS-MPC and MS-MIC
play_arrow IPsec Tunnels
- play_arrow IPsec Overview
  - IPsec Overview
- play_arrow Inline IPsec
  - Inline IPsec
- play_arrow IPsec Tunnels With Static Endpoints
- play_arrow IPsec Tunnels With Dynamic Endpoints
  - IPsec Tunnels With Dynamic Endpoints
- - Inline IPsec
play_arrow CoS on Services Cards
- play_arrow CoS on Services Cards
  - Class of Service on Services Interfaces
- play_arrow Class of Service on Link Services Interfaces
  - Class of Service on Link Services Interfaces
play_arrow Inter-Chassis Redundancy for NAT and Stateful Firewall Flows
- play_arrow Configuring Inter-Chassis MS-MPC and MS-MIC for NAT and Stateful Firewall (Release 16.1 and later)
  - Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)
  - Service Redundancy Daemon
- play_arrow Configuring Inter-Chassis Stateful Synchronization for NAT and Stateful Firewall (Release 15.1 and earlier)
  - Inter-Chassis High Availability for MS-MIC and MS-MPC (Release 15.1 and earlier)
play_arrow Multilinks
- play_arrow Link Services Interface Redundancy
  - Link Services Interface Redundancy
- play_arrow Link Bundling
  - Inline Multlink Services
play_arrow Traffic Load Balancer
- play_arrow Traffic Load Balancer
  - Traffic Load Balancer
play_arrow Services Card Redundancy
- play_arrow Services Card Redundancy for MS-MPC and MS-MIC
  - Load Balancing and High Availability With Aggregated Multiservices Interfaces on MS-MPC and MS-MIC
- play_arrow Services Card Redundancy for Multiservices PIC
  - Configuring AS or Multiservices PIC Redundancy
play_arrow Voice Services
- play_arrow Voice Services
  - Voice Services
play_arrow Layer 2 PPP Tunnels
- play_arrow Layer 2 Tunneling of PPP Packets
  - Layer 2 Tunneling of PPP Packets
play_arrow URL Filtering
- play_arrow URL Filtering
  - URL Filtering
play_arrow Configuration Statements and Operational Commands
- [OBSOLETE] unidirectional-session-refreshing
- Junos CLI Reference Overview

list Table of Contents

English

Configuring Inter-chassis MS-MPC and MS-MIC Redundancy for NAT and Stateful Firewall Overview (Release 16.1 and later)
Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) Overview (Release 16.1 and later)
Configuring Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)
Example: Inter-Chassis Stateful Synchronization for Long-Lived NAT and Stateful Firewall Flows (MS-MIC, MS-MPC) (Release 16.1 and later)

keyboard_arrow_right

Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)

date_range 24-Nov-23

arrow_backward

arrow_forward

Configuring Inter-chassis MS-MPC and MS-MIC Redundancy for NAT and Stateful Firewall Overview (Release 16.1 and later)

Note:

This topic applies to Junos OS release 16.1 and higher. (For Junos OS release 15.1 and earlier, see Inter-Chassis High Availability for MS-MIC and MS-MPC (Release 15.1 and earlier)).

Carrier-grade NAT (CGN) and stateful firewall deployments can use a dual-chassis implementation to provide a redundant data path and redundancy for key components in the router. Although intra-chassis high availability can be used in an MX Series device by employing the AMS interfaces, this method only deals locally with service PIC and full MS-MPC or MS-MIC card failures. If for any reason traffic is switched to a backup router due to some other failure in the router, the session state from the Service PICs is lost. Inter-chassis high availability offers a more robust solution by preserving the session state of NAT and stateful firewalls from the services PICs. This technology is a primary-secondary model, not an active-active cluster. Traffic to be serviced by the services PICs that are configured for inter-chassis high availability only flows through the MX Series device that is currently the primary in the pair.

To configure interchassis redundancy for NAT and stateful firewall, you configure:

Stateful synchronization, which replicates the session state from the services PICs on the primary chassis to the backup chassis. For more information, see Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) Overview (Release 16.1 and later).
The service redundancy daemon, which allows primary-role switchover to occur based on a monitored event. Most operators would not want to employ stateful synchronization without also implementing the service redundancy daemon. For more information, see Service Redundancy Daemon Overview

Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) Overview (Release 16.1 and later)

Note:

This topic applies to Junos OS release 16.1 and higher. (For Junos OS release 15.1 and earlier, see Inter-Chassis High Availability for MS-MIC and MS-MPC (Release 15.1 and earlier)).

Stateful synchronization synchronizes long-lived sessions between the primary and backup MX Series chassis in the high availability pair. By default, long lived sessions are stateful firewall, NAT, and IDS sessions that have been active on the services PIC for 180 seconds, though you can configure this to be a higher or lower value. Stateful firewall sessions, NAT sessions, and IDS sessions are the session types that can be synchronized.

Inter-chassis high availability works with ms- service interfaces configured on MS-MIC or MS-MPC interface cards. An ms- interface unit other than unit 0 must be configured with the ip-address-owner service-plane option.

The following NAT translation types and sessions support stateful synchronization:

basic-nat44
dynamic-nat44
napt-44
napt-44 with endpoint-independent mapping (EIM), or endpoint-independent filters (EIF)
dnat-44
twice-nat
stateful-nat64

The following restrictions apply:

Replicating state information for the port block allocation (PBA), endpoint-independent mapping (EIM), or endpoint-independent filters (EIF) features is not supported.
When configuring a service set for NAT or stateful firewall that belongs to a stateful synchronization setup, - the NAT and stateful firewall configurations for the service set must be identical on both MX Series devices.
Application Layer Gateway (ALG) sessions do not support stateful synchronization.

Figure 1 shows the inter-chassis high availability topology.

Figure 1: Stateful Sync Topology

Configuring Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)

Note:

This topic applies to Junos OS release 16.1 and higher. (For Junos OS release 15.1 and earlier, see Inter-Chassis High Availability for MS-MIC and MS-MPC (Release 15.1 and earlier)).

To configure stateful synchronization inter-chassis high availability for stateful firewall and NAPT44 on MS-MIC or MS-MPC service PICs, perform the following configuration steps on each chassis of the high availability pair.

Configure the services ms- interface.
1. Specify the IPv4 address of the local services card. This address is used by the TCP channel between the HA pairs.
  [edit interfaces interface-name redundancy-options] user@host# set redundancy-local data-address address
  When you configure the other chassis, this is the address you use for the redundancy-peer ipaddress.
2. Specify the IPv4 address of the remote services card. This address is used by the TCP channel between the HA pairs.
  [edit interfaces interface-name redundancy-options] user@host# set redundancy-peer ipaddress address
  When you configure the other chassis, this is the address you use for the redundancy-local data-address.
3. Configure the length of time that the flow remains active for replication, in seconds.
  [edit interfaces interface-name redundancy-options] user@host# set replication-threshold seconds
4. Configure a unit other than 0 with the ip-address-owner service-plane option.
  [edit interfaces interface-name] user@host# set unit logical-unit-number ip-address-owner service-plane
5. For the unit configured with the ip-address-owner service-plane option, assign the IPv4 address of the local services card that you configured with the redundancy-local data-address option.
  [edit interfaces interface-name unit logical-unit-number] user@host# set family inet addressaddress
6. Configure the inside and outside interface units, which are used by the next-hop service set. Use different unit numbers for the inside and outside units, and do not use 0 or the unit number used with the ip-address-owner service-plane option.
  [edit] user@host# set interfaces interface-name unit logical-unit-number family inet user@host# set interfaces interface-name unit logical-unit-number service-domain inside user@host# set interfaces interface-name unit logical-unit-number family inet user@host# set interfaces interface-name unit logical-unit-number service-domain outside
Configure the next-hop service set that contains the NAT rules or stateful firewall rules. The service set must be configured identically on each chassis of the high availability pair. The NAT rules and stateful firewall rules must also be configured identically on each chassis.
For ease of management, we recommend you create a special routing instance with instance-type vrf to host the HA synchronization traffic between the MX Series high availability pair. Then specify the name of the special routing instance to apply to the HA synchronization traffic between the high availability pair.
```
[edit interfaces interface-name redundancy-options]
user@host# set routing-instance instance-name
```
Repeat these steps for the other chassis of the high availability pair.

Example: Inter-Chassis Stateful Synchronization for Long-Lived NAT and Stateful Firewall Flows (MS-MIC, MS-MPC) (Release 16.1 and later)

This example shows how to configure inter-chassis high availability for NAT services.

Requirements
Overview
Configuration

Requirements

This example uses the following hardware and software components:

Two MX480 routers with MS-MPC line cards
Junos OS Release 16.1 or later

Overview

Two MX Series routers are identically configured to facilitate stateful failover for NAT services in case of a chassis failure.

Configuration

To configure inter-chassis high availability for this example, perform these tasks:

CLI Quick Configuration
Configuring Interfaces for Chassis 1
Configure Routing Information for HA Synchronization Traffic Between MX Series Routers for Chassis 1
Configuring NAT for Chassis 1
Configuring the Service Set
Configuring Interfaces for Chassis 2
Configure Routing Information for HA Synchronization Traffic Between MX Series Routers for Chassis 2

CLI Quick Configuration

To quickly configure this example on the routers, copy the following commands and paste them into the router terminal window after removing line breaks and substituting interface information specific to your site.

Note:

The following configuration is for chassis 1.

content_copy zoom_out_map
[edit]
set interfaces ms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.2
set interfaces ms-4/0/0 redundancy-options redundancy-local data-address 5.5.5.1
set interfaces ms-4/0/0 redundancy-options routing-instance HA
set interfaces ms-4/0/0 redundancy-options replication-threshold 180
set interfaces ms-4/0/0 unit 10 ip-address-owner service-plane
set interfaces ms-4/0/0 unit 10 family inet address 5.5.5.1/32
set interfaces ms-4/0/0 unit 20 family inet
set interfaces ms-4/0/0 unit 20 service-domain inside
set interfaces ms-4/0/0 unit 30 family inet
set interfaces ms-4/0/0 unit 30 service-domain outside
set interfaces ge-2/0/0 vlan-tagging
set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.1/24
set policy-options policy-statement dummy term 1 then reject 
set routing-instances HA instance-type vrf
set routing-instances HA interface ge-2/0/0.0
set routing-instances HA interface ms-4/0/0.10
set routing-instances HA route-distinguisher 1:1
set routing-instances HA vrf-import dummy
set routing-instances HA vrf-export dummy
set routing-instances HA routing-options static route route 5.5.5.1/32 next-hop ms-4/0/0.10
set routing-instances HA routing-options static route route 5.5.5.2/32 next-hop 20.1.1.2
set routing-options static-route 100.100.100.0/24 next-hop ms-4/0/0.20
set services nat pool p2 address 32.0.0.0/24
set services nat pool p2 port automatic random-allocation
set services nat pool p2 address-allocation round-robin
set services nat rule r2 match-direction input
set services nat rule r2 term t1 from source-address 129.0.0.0/8
set services nat rule r2 term t1 from source-address 128.0.0.0/8
set services nat rule r2 term t1 then translated source-pool p2
set services nat rule r2 term t1 then translated translation-type napt-44
set services nat rule r2 term t1 then translated address-pooling paired
set services nat rule r2 term t1 then syslog
set services service-set ss2 nat-rules r2
set services service-set ss2 next-hop-service inside-service-interface ms-4/0/0.20
set services service-set ss2 next-hop-service outside-service-interface ms-4/0/0.30
set services service-set ss2 syslog host local class session-logs
set services service-set ss2 syslog host local class nat-logs

Note:

The following configuration is for chassis 2. NAT and service set information must be identical for chassis 1 and 2.

content_copy zoom_out_map
set interfaces ms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.1 
set interfaces ms-4/0/0 redundancy-options redundancy-local data-address 5.5.5.2
set interfaces ms-4/0/0 redundancy-options routing-instance HA
set interfaces ms-4/0/0 redundancy-options replication-threshold 180
set interfaces ms-4/0/0 unit 10 ip-address-owner service-plane
set interfaces ms-4/0/0 unit 10 family inet address 5.5.5.2/32
set interfaces ms-4/0/0 unit 20 family inet
set interfaces ms-4/0/0 unit 20 service-domain inside
set interfaces ms-4/0/0 unit 30 family inet
set interfaces ms-4/0/0 unit 30 service-domain outside
set interfaces ge-2/0/0 vlan-tagging
set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.2/24
set policy-options policy-statement dummy term 1 then reject 
set routing-instances HA instance-type vrf
set routing-instances HA interface ge-2/0/0.0
set routing-instances HA interface ms-4/0/0.10
set routing-instances HA route-distinguisher 1:1
set routing-instances HA vrf-import dummy
set routing-instances HA vrf-export dummy
set routing-instances HA routing-options static route 5.5.5.2/32 next-hop ms-4/0/0.10
set routing-instances HA routing-options static route 5.5.5.1/32 next-hop 20.1.1.1
set routing-options static-route 100.100.100.0/24 next-hop ms-4/0/0.20
set services nat pool p2 address 32.0.0.0/24
set services nat pool p2 port automatic random-allocation
set services nat pool p2 address-allocation round-robin
set services nat rule r2 match-direction input
set services nat rule r2 term t1 from source-address 129.0.0.0/8
set services nat rule r2 term t1 from source-address 128.0.0.0/8
set services nat rule r2 term t1 then translated source-pool p2
set services nat rule r2 term t1 then translated translation-type napt-44
set services nat rule r2 term t1 then translated address-pooling paired
set services nat rule r2 term t1 then syslog
set services service-set ss2 nat-rules r2
set services service-set ss2 next-hop-service inside-service-interface ms-4/0/0.20
set services service-set ss2 next-hop-service outside-service-interface ms-4/0/0.30
set services service-set ss2 syslog host local class session-logs
set services service-set ss2 syslog host local class nat-logs

Step-by-Step Procedure

The interfaces for each of the HA pair of routers are configured identically with the exception of the following service PIC options:

The redundancy-options redundancy-peer ipaddress address must be different on each chassis and must point to the redundancy-options redundancy-local data-address data-address on the peer chassis.
The unit unit-number family inet address address of a unit, other than 0, that contains the ip-address-owner service-plane option must be different on each chassis.

To configure interfaces:

Configure the redundant service PIC on chassis 1.

content_copy zoom_out_map
[edit interfaces}
user@host# set interfaces ms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.2
user@host# set interfaces ms-4/0/0 redundancy-options redundancy-local data-address 5.5.5.1
user@host# set interfaces ms-4/0/0 redundancy-options routing-instance HA
user@host# set interfaces ms-4/0/0 redundancy-options replication-threshold 180
user@host# set interfaces ms-4/0/0 unit 10 ip-address-owner service-plane
user@host# set interfaces ms-4/0/0 unit 10 family inet address 5.5.5.1/32
user@host# set interfaces ms-4/0/0 unit 20 family inet
user@host# set interfaces ms-4/0/0 unit 20 service-domain inside
user@host# set interfaces ms-4/0/0 unit 30 family inet
user@host# set interfaces ms-4/0/0 unit 30 service-domain outside

Configure the interfaces for chassis 1 that are used as interchassis links for synchronization traffic.

content_copy zoom_out_map
user@host# set interfaces ge-2/0/0 vlan-tagging
user@host# set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.1/24

Configure remaining interfaces as needed.

Results

content_copy zoom_out_map
user@host# show interfaces

ge-2/0/0 {
    vlan-tagging;
    unit 0 {
        vlan-id 100;
        family inet {
             address 20.1.1.1/24;
        }
    }
}
ms-4/0/0 {
    redundancy-options {
        redundancy-peer {
            address 5.5.5.2;
        }
        redundancy-local {
            data-address 5.5.5.1;
        }
        routing-instance HA;
    }
    unit 10 {
        ip-address-owner service-plane;
        family inet {
            address 5.5.5.1/32;
        }
    }
    unit 20 {
        family inet;
        family inet6;
        service-domain inside;
    }
    unit 30 {
        family inet;
        family inet6;
        service-domain outside;
    }
}

Configure Routing Information for HA Synchronization Traffic Between MX Series Routers for Chassis 1

Step-by-Step Procedure
Results

Step-by-Step Procedure

Detailed routing configuration is not included for this example. A routing instance is required for the HA synchronization traffic between the chassis as follows:

To configure the routing instances for chassis 1:

Specify a dummy policy statement. This statement is referenced in the routing instance configuration.
```
user@host# set policy-options policy-statement dummy term 1 then reject 
```

Specify the options for the routing instance.

content_copy zoom_out_map
user@host# set routing-instances HA instance-type vrf
user@host# set routing-instances HA interface ge-2/0/0.0
user@host# set routing-instances HA interface ms-4/0/0.10
user@host# set routing-instances HA route-distinguisher 1:1
user@host# set policy-options policy-statement dummy term 1 then reject
user@host# set routing-instances HA vrf-import dummy
user@host# set routing-instances HA vrf-export dummy
@user@host# set routing-instances HA routing-options static route 5.5.5.1/32 next-hop ms-4/0/0.10
user@host# set routing-instances HA routing-options static route 5.5.5.2/32 next-hop 20.1.1.2

Specify the next-hop traffic to which the service set is applied.
```
user@host# set routing-options static-route 100.100.100.0/24 next-hop ms-4/0/0.20
```

Results

content_copy zoom_out_map
@user@host# show routing-instances
HA {
    instance-type vrf;
    interface ge-2/0/0.0;
    interface ms-4/0/0.10;
    route-distinguisher 1:1;
    vrf-import dummy;
    vrf-export dummy;
    routing-options {
        static {
            route 5.5.5.1/32 next-hop ms-4/0/0.10;
            route 5.5.5.2/32 next-hop 20.1.1.2;
        }
    }
}

Configuring NAT for Chassis 1

Step-by-Step Procedure
Results

Step-by-Step Procedure

Configure NAT identically on both routers.

To configure NAT:

Specify NAT pool and rule information..

content_copy zoom_out_map
user@host# set services nat pool p2 address 32.0.0.0/24
user@host# set services nat pool p2 port automatic random-allocation
user@host# set services nat pool p2 address-allocation round-robin
user@host# set services nat rule r2 match-direction input
user@host# set services nat rule r2 term t1 from source-address 129.0.0.0/8
user@host# set services nat rule r2 term t1 from source-address 128.0.0.0/8
user@host# set services nat rule r2 term t1 then translated source-pool p2
user@host# set services nat rule r2 term t1 then translated translation-type napt-44
user@host# set services nat rule r2 term t1 then translated address-pooling paired
user@host# set services nat rule r2 term t1 then syslog

Results

content_copy zoom_out_map
user@host# show services nat
nat {
    pool p2 {
        address 32.0.0.0/24;
        port {
            automatic {
                random-allocation;
            }
        }
        address-allocation round-robin;
    }
    rule r2 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    129.0.0.0/8;
                    128.0.0.0/8;
                }
            }
            then {
                translated {
                    source-pool p2;
                    translation-type {
                        napt-44;
                    }
                    address-pooling paired;
                }
                syslog;
            }
        }
    }
}

Configuring the Service Set

Step-by-Step Procedure
Results

Step-by-Step Procedure

Configure the service set identically on both routers. To configure the service set:

(Optional) Service sets are replicated by default. To exclude a service set from replication using the following option.
```
user@host# set services service-set ss2 replicate-services  disable-replication-capability
```
Configure references to NAT rules for the service set.
```
user@host# set services service-set ss2 nat-rules r2
```

Configure next-hop service interface on the MS-PIC.

content_copy zoom_out_map
user@host# set services service-set ss2 next-hop-service inside-service-interface ms-4/0/0.20
user@host# set services service-set ss2 next-hop-service outside-service-interface ms-4/0/0.30

Configure desired logging options.

content_copy zoom_out_map
user@host# set services service-set ss2 syslog host local class session-logs
user@host# set services service-set ss2 syslog host local class nat-logs

Results

content_copy zoom_out_map
user@host# show services service-set ss2
syslog {
   host local {
        class {
            session-logs;
            inactive:
            nat-logs;
        }
    }
    replicate-services {
        replication-threshold 180; 
        inactive: disable-replication-capability; 
    }
    nat-rules r2;
    next-hop-service {
        inside-service-interface ms-3/0/0.20;
        outside-service-interface ms-3/0/0.30;
    }
}

Configuring Interfaces for Chassis 2

Step-by-Step Procedure
Results

Step-by-Step Procedure

The interfaces for each of the HA pair of routers are configured identically with the exception of the following service PIC options:

redundancy-options redundancy-peer ipaddress address
unit unit-number family inet address address of a unit, other than 0, that contains the ip-address-owner service-plane option

Configure the redundant service PIC on chassis 2.

The redundancy-peer ipaddress points to the address of the unit (unit 10) on ms-4/0/0 on chassis on chassis 1 that contains the ip-address-owner service-plane statement.

content_copy zoom_out_map
[edit interfaces}
set interfaces ms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.1 
user@host# set interfaces ms-4/0/0 redundancy-options redundancy-local data-address 5.5.5.2
user@host# set interfaces ms-4/0/0 redundancy-options replication-threshold 180
user@host# set interfaces ms-4/0/0 redundancy-options routing-instance HA
user@host# set interfaces ms-4/0/0 unit 10 ip-address-owner service-plane
user@host# set interfaces ms-4/0/0 unit 10 family inet address 5.5.5.2/32
user@host# set interfaces ms-4/0/0 unit 20 family inet
user@host# set interfaces ms-4/0/0 unit 20 service-domain inside
user@host# set interfaces ms-4/0/0 unit 30 family inet
user@host# set interfaces ms-4/0/0 unit 30 service-domain outside

Configure the interfaces for chassis 2 that are used as interchassis links for synchronization traffic

content_copy zoom_out_map
user@host# set interfaces ge-2/0/0 vlan-tagging
user@host# set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.2/24

Configure remaining interfaces for chassis 2 as needed.

Results

content_copy zoom_out_map
user@host# show interfaces
ms-4/0/0 {
    redundancy-options {
        redundancy-peer {
            address 5.5.5.1;
        }
        redundancy-local {
            data-address 5.5.5.2;
        }
        routing-instance HA;
    }
    unit 0 {
        family inet;
    }
    unit 10 {
        ip-address-owner service-plane;
        family inet {
            address 5.5.5.2/32;
        }
    }
}
ge-2/0/0 {
    vlan-tagging;
    unit 0 {
        vlan-id 100;
        family inet {
             address 20.1.1.2/24;
        }
    }
    unit 10 {
        vlan-id 10;
        family inet {
            address 2.10.1.2/24;
        }
    }
}

Configure Routing Information for HA Synchronization Traffic Between MX Series Routers for Chassis 2

Step-by-Step Procedure
Results

Step-by-Step Procedure

Detailed routing configuration is not included for this example. A routing instance is required for the HA synchronization traffic between the two chassis and is included here.

Configure routing instances for chassis 2.

content_copy zoom_out_map
user@host# set routing-instances HA instance-type vrf
user@host# set routing-instances HA interface ge-2/0/0.0
user@host# set routing-instances HA interface ms-4/0/0.10
user@host# set routing-instances HA route-distinguisher 1:1
user@host# set policy-options policy-statement dummy term 1 then reject 
user@host# set routing-instances HA vrf-import dummy
user@host# set routing-instances HA vrf-export dummy
user@host# set routing-instances HA routing-options static route 5.5.5.2/32 next-hop ms-4/0/0.10
user@host# set routing-instances HA routing-options static route 5.5.5.1/32 next-hop 20.1.1.1
user@host# set routing-options static-route 100.100.100.0/24 next-hop ms-4/0/0.20

Note:

The following configuration steps are identical to the steps shown for chassis 1.

Configuring NAT
Configuring the Service Set

Results

content_copy zoom_out_map
@user@host# show services routing-instances
HA {
    instance-type vrf;
    interface xe-2/2/0.0;
    interface ms-4/0/0.10;
    route-distinguisher 1:1;
    vrf-import dummy;
    vrf-export dummy;
    routing-options {
        static {
            route 5.5.5.2/32 next-hop ms-4/0/0.10;
            route 5.5.5.1/32 next-hop 20.1.1.1;
        }
    }
}

arrow_backward PREVIOUS Class of Service on Link Services Interfaces

NEXT arrow_forward Service Redundancy Daemon

Adaptive Services Interfaces User Guide for Routing Devices

ON THIS PAGE

Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)

Configuring Inter-chassis MS-MPC and MS-MIC Redundancy for NAT and Stateful Firewall Overview (Release 16.1 and later)

Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) Overview (Release 16.1 and later)

Configuring Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)

Example: Inter-Chassis Stateful Synchronization for Long-Lived NAT and Stateful Firewall Flows (MS-MIC, MS-MPC) (Release 16.1 and later)

Requirements

Overview

Configuration

CLI Quick Configuration

Configuring Interfaces for Chassis 1

Step-by-Step Procedure

Results

Configure Routing Information for HA Synchronization Traffic Between MX Series Routers for Chassis 1

Step-by-Step Procedure

Results

Configuring NAT for Chassis 1

Step-by-Step Procedure

Results

Configuring the Service Set

Step-by-Step Procedure

Results

Configuring Interfaces for Chassis 2

Step-by-Step Procedure

Results

Configure Routing Information for HA Synchronization Traffic Between MX Series Routers for Chassis 2

Step-by-Step Procedure

Results

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry