Minimum NSRP configuration for a pair of Juniper firewall devices

How do I configure a pair of Juniper firewall's for Active/Passive High Availability (NSRP)? 
What are the minimum NSRP commands required?

The basic configuration steps for the following topology are documented in this solution.

Minimum software and hardware requirements for configuring Active/ Passive NSRP:

• Firewall's with identical ScreenOS versions and license keys
• Firewall's with identical hardware
• At least one interface on each firewall to be configured in the HA zone, which will be used for carrying control channel information

For more information on the software and hardware requirements for NSRP, refer to KB11432.

 

For assistance with configuring a pair of firewalls for NSRP, follow the steps below.  

These instructions were performed on a SSG-500.  The same concept applies to the other models that support NSRP; the difference being the interface notation or dedicated HA port. 

  Perform basic configuration on Firewall-A.  Bind the interfaces to the zones desired, and configure an IP address on the interfaces.  

set interface ethernet0/3 zone untrust
set interface ethernet0/1 zone trust
set interface ethernet0/3 ip 10.1.1.2/24
set interface ethernet0/1 ip 1.1.1.1/24


You may also configure policies, VPNs, etc, and get the firewall working as designed.   Then proceed to the next step when ready to configure NSRP.
            OR
It is also possible to do minimal configuration as above and proceed onto the next step to configure NSRP.  Then once the Active/Passive pair is configured for NSRP, subsequent configuration commands (policies, VPNs, etc) will be automatically sync'd to the other firewall.


  Start configuring NSRP by choosing the interface(s) for HA. In our example, it is eth0/4. For more information on assigning the HA ports, refer to KB11296.

set interface ethernet0/4 zone HA



  Configure the NSRP cluster id:

set nsrp cluster id 1

Both firewalls in the cluster must have the same Cluster ID number.

Important:  Other NSRP firewall pairs on the same segment must have a different set of cluster ids. 
Once the cluster id is set to a value, all the security interfaces will become part of the VSD-group 0, by default.

  [Optional]  Configure cluster name for NSRP:

Each NSRP cluster member can have different host names. In situations with SNMP or IPSec configured, a failover of the NSRP device can mean a disruption in communication for SNMP or IPSec. Defining a single name for all cluster members allows SNMP communication and digital certificates use to be continued without interruption after failover.

To define a single name for all cluster members, type the following CLI command:

set nsrp cluster name <name_str>

Use the cluster name when configuring the SNMP host name for the Juniper firewall device (set snmp name name_str) and when defining the common name in a PKCS10 certificate request file. 

Note:  Only one digital certificate is required for an NSRP cluster.

  [Recommended]  Configure NSRP monitoring to trigger failover if an interface goes down. 

By adding the monitor command we will monitor the physical state of the interface eth0/1 and eth0/3.  In the event that either one of the interfaces goes down, Firewall-A will initiate a fail over to Firewall-B, and Firewall-B will continue to pass traffic. 
NOTE:  Only specify the interfaces that have an active link.  Otherwise, the firewall will go to the (I) Inoperable state; for more information, see KB11327.

  Configure NTP command, if applicable.  Are your firewalls configured with an NTP (Network Time Protocol) server?

  Repeat steps 2 - 6 for Firewall-B.

  Synchronize the configurations from the Backup firewall.  On Firewall-B, enter the following CLI command:

firewall-B-> exec nsrp sync global-config save


The following will be reported shortly after you enter the above command:

load peer system config to save
firewall-B(B)-> Save global configuration successfully.
firewall-B(B)-> Save local configuration successfully.
firewall-B(B)-> Done.
firewall-B(B)-> Please reset your box to let cluster configuration to take effect!

For more information on synchronizing the configurations, refer to KB6351.


  Reset Firewall-B.

IMPORTANT:  If you are prompted to save the configuration after you enter the reset command, answer n (No).  Then, proceed with the reboot by answering y (Yes).

firewall-B(B)-> reset
firewall-B(B)-> Configuration modified.  Save? [y]/n n
firewall-B(B)-> System reset.  Are you sure? y/[n] y

   After the boxes have rebooted, synchronize the RTOs (Run-Time Objects):

firewall-A(M)-> set nsrp rto-mirror sync

After entering the "rto-mirror" sync, the Master and backup firewall's will start to synchronize the real time sessions informations.  On the master device, the console will have the following:

firewall-A(M)-> Begin to sync all run-time-object to peer ...Done
firewall-A(M)->

On the backup device, the console will have the following:

firewall-B(B)-> configuration in sync (local checksum 1545829970 == remote checksum 145829970)
Received all run-time-object from peer.

NOTE:  Steps 11 and 12 can be performed before step 7, however, for simplicity, they are performed at this point.

  [Recommended]  Configure priority and preempt for selecting which device in the cluster should be the preferred master:

The firewall with the lowest priority will be the master. By default the ScreenOS sets the priority to 100.  This can be modified by the following command to select the Master device:

firewall-A(M)-> set nsrp vsd-group id 0 priority 50



To set the preempt option, enter the following command always on the device which has the lowest priority value. You should add this command on only one device, the device that you want to be always Master:

firewall-A(M)-> set nsrp vsd-group id 0 preempt

In the case of a failover scenario, let's say Firewall-B becomes the master.  Later if the original Master, Firewall-A (which has a lower priority and preempt configured) recovers, Firewall-A will take back the Master role.  For more information on the priority and preempt commands, refer to KB11373.

  [Recommended]  Configure the NSRP clusters for management by adding a mange-ip on the VSI interface: 

When configured in the Active/Passive HA setup,  there are situations where we need to manage both the Master and Backup firewall at the same time.  To achieve this, we need to configure a manage-ip on the VSI interface of the Master and Backup firewall; this address must be a unique IP from the same subnet as the VSI interface network.

        firewall-A(M)-> set interface e0/1 manage-ip 1.1.1.2

On the backup firewall, you can configure IP 10.1.1.3:

   firewall-B(B)-> set interface e0/1 manage-ip 1.1.1.3

For more information on configuring a manage IP, see KB4059.

Configuration