This article answers the question "What is the secondary path option used for in an NSRP environment?"

 

This article applies to ScreenOS 4.0 and later.

A secondary path is a backup path for heartbeats between two devices in an NSRP pair. If the primary and secondary High Availability (HA) link goes down, each device in the cluster will go 'split brain'. This means each device will assume it is the master device, and two devices with identical IP addresses, and different MAC addresses will propagate across the network. This situation can cause severe network problems.

To prevent 'split brain' from occurring, a secondary path is used. With a secondary path enabled, when the HA link is severed, heartbeat packets will traverse across the secondary path, and the current NSRP state that each device is in will be maintained. For example, assume Device A is initially the primary device, and Device B is initially the backup device. When the HA link between the two devices goes down, a secondary path will ensure that Device A stays as the primary device, and Device B stays as the backup device. This gives the administrator time to fix the problems with the HA link.

To enable a secondary path, perform the following steps:

Open the WebUI. For more information about accessing the WebUI, go to KB4317 - [ScreenOS] Accessing your Juniper firewall device using the WebUI.

From the NetScreen options menu, click Network, select NSRP, and then click to select Link.

From the Secondary Link drop-down menu, click to select the interface to use for a secondary path, and then click Apply.

When the NSRP links fail, and the secondary path is used to keep the current NSRP state, no RTO synchronization (sessions, policies, and so on) is done. RTO synchronization will continue when the NSRP links are restored.

 

2020-09-16: Removed old WebUI snapshots and replaced with new ones; article checked for accuracy and found relevant