Search our Knowledge Base sites to find answers to your questions.
Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articlesSRX Getting Started - Configure Chassis Cluster (High Availability) on a SRX220 device
This article describes the basic setup of a Chassis Cluster (High Availability), also known as JSRP, on a SRX 220 device.
For other topics, go to the SRX Getting Started main page.
Configure SRX220 devices as a Chassis Cluster.
The following topology will be used for the configuration:Topology notes:
SRX100 KB15669 SRX210 KB15505 SRX240 KB15504 SRX550 KB25889 SRX650 KB15503 SRX1400 TN10 SRX3000 series TN10 SRX5000 series TN10
a. In the SRX configuration, remove any existing configuration associated with the interfaces that will be transformed into fxp0 (out-of-band management) and fxp1 (control link) when the chassis cluster feature is enabled.
b. Confirm that the HARDWARE on both devices is the same.
root@srx220> show chassis hardware detail Hardware inventory: Item Version Part number Serial number Description Chassis AQ0910AA0016 SRX220H Routing Engine REV 08 750-031175 AABC5162 RE-SRX220H usb0 (addr 1) DWC OTG root hub 0 vendor 0x0000 uhub0 usb0 (addr 2) product 0x005a 90 vendor 0x0409 uhub1 FPC 0 FPC PIC 0 8x GE Base PIC FPC 1 REV 14 750-025184 AABD0705 FPC PIC 0 1x VDSL2 Annex A FPC 2 REV 04 750-023367 AAAZ1730 FPC PIC 0 1x T1E1 mPIM Power Supply 0
For more information, refer to KB16141 - What are the minimum hardware and software requirements for a Chassis Cluster on SRX ?
c. Confirm that the SOFTWARE on both standalone devices is the same Junos OS version.
root> show version
Model: srx220h
JUNOS Software Release [11.4R7.5]
root> show system license
Control link:
On the SRX220 device, connect ge-0/0/7 on device A to ge-0/0/7 on device B. The ge-0/0/7 interface on device B will change to ge-3/0/7 after clustering is enabled in Step 2.
Note: It is strongly recommended that the interfaces used for the control link are connected directly with a cable (instead of a switch). If a switch must be used, then refer to KB25017.
Fabric (Data) link:
On the SRX220 device, connect ge-0/0/5 on device A to ge-0/0/5 on device B. The ge-0/0/5 interface on device B will change to ge-3/0/5 after clustering is enabled in Step 2.
Note: For the Fabric (Data) link, it is recommended to use a GE port. If ge-0/0/5 is not available, you can choose another open port on your devices. The Fabric (Data) link can be any available open port either onboard or gPIM other than ge-0/0/6 and ge-0/0/7.
> set chassis cluster cluster-id <0-15> node <0-1> reboot
For example:On device A:>set chassis cluster cluster-id 1 node 0 reboot
On device B:>set chassis cluster cluster-id 1 node 1 reboot
commit
is done.{primary:node0}
# set groups node0 system host-name <name-node0> -Device A's host name
# set groups node0 interfaces fxp0 unit 0 family inet address <ip address/mask> -Device A's management IP address on fxp0 interface
# set groups node1 system host-name <name-node1> -Device B's host name
# set groups node1 interfaces fxp0 unit 0 family inet address <ip address/mask -Device B's management IP address on fxp0 interface
On device A:
{primary:node0}
-fab0 is node0 (Device A) interface for the data link
# set interfaces fab0 fabric-options member-interfaces ge-0/0/5
-fab1 is node1 (Device B) interface for the data link
# set interfaces fab1 fabric-options member-interfaces ge-3/0/5
Note: There are no configuration commands for the Control link connection. Only the SRX5600 and SRX5800 platforms require configuration commands for the Control link (SPC port).
Configure the Redundancy Group 0 for the Routing Engine failover properties. Also configure Redundancy Group 1 (all the interfaces will be in one Redundancy Group in this example) to define the failover properties for the Reth interfaces.
Note: If you want to use multiple Redundancy Groups for the interfaces, refer to the Security Configuration Guide.
{primary:node0}
# set chassis cluster redundancy-group 0 node 0 priority 100
# set chassis cluster redundancy-group 0 node 1 priority 1
# set chassis cluster redundancy-group 1 node 0 priority 100
# set chassis cluster redundancy-group 1 node 1 priority 1
Configure the interface monitoring. Monitoring the health of the interfaces is one way to trigger Redundancy group failover.
Note: Interface monitoring is not recommended for redundancy-group 0.
{primary:node0}
# set chassis cluster redundancy-group 1 interface-monitor ge-0/0/0 weight 255
# set chassis cluster redundancy-group 1 interface-monitor ge-0/0/1 weight 255
# set chassis cluster redundancy-group 1 interface-monitor ge-3/0/0 weight 255
# set chassis cluster redundancy-group 1 interface-monitor ge-3/0/1 weight 255
Configure the Redundant Ethernet interfaces (Reth interfaces) and assign the Redundant interfaces to a zone. Make sure that you setup your max number of redundant interfaces as follows:
{primary:node0}
# set chassis cluster reth-count <max-number>
-for first interface in the group (on Device A)
# set interfaces <node0-interface-name> gigether-options redundant-parent reth0
-for second interface in the group (on Device B)
# set interfaces <node1-interface-name> gigether-options redundant-parent reth0
-set up redundancy group for interfaces
# set interfaces reth0 redundant-ether-options redundancy-group <group-number>
# set interfaces reth0.0 family inet address <ip address/mask>
# set security zones security-zone <zone> interfaces reth0.0
For example:
{primary:node0}
# set chassis cluster reth-count 2
-for first interface in the group (on Device A)
# set interfaces ge-0/0/1 gigether-options redundant-parent reth1
-for second interface in the group (on Device B)
# set interfaces ge-3/0/1 gigether-options redundant-parent reth1
-set up redundancy group for interfaces
# set interfaces reth1 redundant-ether-options redundancy-group 1
# set interfaces reth1 unit 0 family inet address 192.168.1.1/24
-for first interface in the group (on Device A)
# set interfaces ge-0/0/0 gigether-options redundant-parent reth0
-for second interface in the group (on Device B)
# set interfaces ge-3/0/0 gigether-options redundant-parent reth0
-set up redundancy group for interfaces
# set interfaces reth0 redundant-ether-options redundancy-group 1
# set interfaces reth0 unit 0 family inet address 10.10.10.200/24
# set security zones security-zone untrust interfaces reth0.0
# set security zones security-zone trust interfaces reth1.0
Commit and changes will be copied over to the Secondary Node, Device B.
{primary:node0}
# commit
Chassis Cluster for Security Devices
Refer to the Junos Security Configuration Guide for what these commands mean:show chassis cluster status
show chassis cluster interfaces
show chassis cluster statistics
show chassis cluster control-plane statistics
show chassis cluster data-plane statistics
show chassis cluster status redundancy-group 1
2020-03-25: Article reviewed for accuracy; it is valid and accurate
Related Links
Getting Up and Running with Junos
Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search