This article provides information about Ethernet switching support in cluster mode for SRX Branch devices and SRX1500 Series devices.
Understanding Layer 2 Ethernet Switching Capability in Chassis Cluster on SRX-Branch
Ethernet ports support various Layer 2 features such as Spanning Tree Protocols (xSTP), DOT1X, Link Aggregation (LAG), Internet Group Membership Protocol (IGMP), GARP, VLAN Registration Protocol (GVRP), Link Layer Discovery Protocol (LLDP), and snooping. The enhanced feature extends Layer 2 switching capability to devices in a chassis cluster.
This feature allows users to use Ethernet switching features on both nodes of a chassis cluster. The Ethernet ports on either of the nodes can be configured for family Ethernet switching. Users can configure a Layer 2 VLAN domain with member ports from both of the nodes and the Layer 2 switching protocols on both of the devices. To ensure that Layer 2 switching works seamlessly across chassis cluster nodes, a dedicated physical link connecting the nodes is required. This type of link is called a switching fabric interface (swfab). Its function is to transmit Layer 2 traffic between the nodes.
Note:
-
Configuring a LAG with family ethernet switching is not supported.
-
Configuring a Reth with family ethernet switching is not supported. This is only supported in Transparent mode.
-
Behavior of the nodes may be unpredictable, if the Ethernet switching-related features are configured before configuring the swfab interface on both the nodes.
When chassis cluster failover occurs, a new primary node is elected and the Ethernet Switching Daemon (ESWD) runs in a different node. During failover, chassis control subsystem is restarted, and the traffic outage occurs until the PICs are up and the VLAN entries are re-programmed. After fail over, all Layer 2 protocols re-converge, because Layer 2 protocols states are not maintained in the secondary node.
Note: The Ethernet-switching subsystem runs only in the primary node.
The physical link used as the switch fabric members must be directly connected. Switching supported ports must be used for swfab interfaces. For SRX650, the swfab member ports must belong to the same GPIM. Members spanning across multiple GPIMs are not supported. New pseudo interfaces - swfab0 and swfab1 are created for Layer 2 fabric functionality. Users need to configure dedicated Ethernet ports on each side of the node to be associated with the swfab interface.
To configure swfab interfaces:
Note: swfab0 corresponds to node 0 and swfab1 corresponds to node 1.
Sample configuration on SRX650

ge-0/0/0, ge-9/0/0 are fxp0 (out-of-band management)
ge-0/0/1,ge-9/0/1 are fxp1 (control link)
ge-0/0/2, ge-9/0/2 are fab links and ge-2/0/5 and ge-11/0/5 are swfab members.
ge-2/0/0,ge-11/0/0 are part of VLAN A and ge-2/0/1,ge-11/0/1 are part of VLAN B
CLI Configuration
interfaces {
ge-2/0/0 {
unit 0 {
family ethernet-switching {
vlan {
members A;
}
}
}
}
ge-2/0/1 {
unit 0 {
family ethernet-switching {
vlan {
members B;
}
}
}
}
ge-11/0/0 {
unit 0 {
family ethernet-switching {
vlan {
members A;
}
}
}
}
ge-11/0/1 {
unit 0 {
family ethernet-switching {
vlan {
members B;
}
}
}
}
fab0 {
fabric-options {
member-interfaces {
ge-0/0/2;
}
}
}
fab1 {
fabric-options {
member-interfaces {
ge-9/0/2;
}
}
}
swfab0 {
fabric-options {
member-interfaces {
ge-2/0/5;
}
}
}
swfab1 {
fabric-options {
member-interfaces {
ge-11/0/5;
}
}
}
}
vlans {
A {
vlan-id 100;
}
B {
vlan-id 200;
}
}
Verification
-
Use show chassis cluster ethernet-switching interfaces
command to view the appropriate member interfaces.
{primary:node1}[edit]
root@SRX-650# run show chassis cluster ethernet-switching interfaces
swfab0:
Name Status
ge-2/0/5 up
swfab1:
Name Status
ge-11/0/5 up
-
Use show chassis cluster ethernet-switching status
to display chassis cluster Ethernet switching status (probe status and switching domain).
{primary:node1}[edit]
root@SRX-650# run show chassis cluster ethernet-switching status
Cluster ID: 1
Node Priority Status Preempt Manual failover
Redundancy group: 0 , Failover count: 0
node0 100 primary no no
node1 1 secondary no no
Redundancy group: 1 , Failover count: 0
node0 100 primary no no
node1 1 secondary no no
Ethernet switching status:
Probe state is UP. Both nodes are in single Ethernet switching domain(s). If proper interface for swfab purpose (such as on-board interfaces on SRX650), and Ethernet-switching is not used, the status is displayed as Probe state is DOWN. Both nodes are in separate Ethernet switching domain(s).
-
Use show chassis cluster ethernet-switching statistics
to display chassis cluster switch fabric probe statistics.
{primary:node1}[edit]
root@SRX-650# run show chassis cluster ethernet-switching statistics
Switch fabric link statistics:
Probe state : UP
Probes sent: 1866
Probes received: 1871
Probe recv errors: 0
Probe send errors: 0
Technical Documentation
For additional information and examples, refer to the Technical Documentation, Ethernet Switching on Chassis Cluster
Note: Layer3 routing from L2 ethernet-switching network via L3-interface Vlan.X in chassis cluster deployment is supported as of Junos OS 12.1X44-D20, 12.1X45-D10 and higher versions.
2019-07-22: Technical Documentation link updated
2020-12-04: Removed references of EOS Junos versions, added SRX1500, other minor non-technical changes