SRX

Good day everybody.

 

I have an issue with a cluster of srx220

I've made cluster step-by-step based on https://kb.juniper.net/library/CUSTOMERSERVICE/GLOBAL_JTAC/NT260/SRX_HA_Deployment_Guide.pdf

 

I have a ssh sessions on reth

So when data plane failover in primary node

 

request chassis cluster failover redundancy-group 1 node 0

 

Data plane changed to second node. Ssh session (on reth 2 wich belongs redound group1) still alive and I can work with device using it

 

If I change control plane on nodes - ssh sessions interrupts. Sure I can reconnect it but as I understand tcp sessions must stay alive at second node ( when primary fail ) without disconnect.

 

As I see the sessions is synchronized

 

 

Session ID: 24, Policy name: self-traffic-policy/1, State: Active, Timeout: 1364, Valid

  In: 192.168.1.100/5725 --> 192.168.1.200/22;tcp, If: reth2.0, Pkts: 1, Bytes: 40

  Out: 192.168.1.200/22 --> 192.168.1.100/5725;tcp, If: .local..0, Pkts: 1, Bytes: 40

 

Session ID: 25, Policy name: self-traffic-policy/1, State: Active, Timeout: 1800, Valid

  In: 192.168.1.100/5727 --> 192.168.1.200/22;tcp, If: reth2.0, Pkts: 269, Bytes: 21272

  Out: 192.168.1.200/22 --> 192.168.1.100/5727;tcp, If: .local..0, Pkts: 289, Bytes: 40916

Total sessions: 2

 

node1:

--------------------------------------------------------------------------

 

Session ID: 13376, Policy name: self-traffic-policy/1, State: Backup, Timeout: 44, Valid

  In: 192.168.1.100/5725 --> 192.168.1.200/22;tcp, If: reth2.0, Pkts: 22, Bytes: 3856

  Out: 192.168.1.200/22 --> 192.168.1.100/5725;tcp, If: .local..0, Pkts: 20, Bytes: 4937

 

Session ID: 13385, Policy name: self-traffic-policy/1, State: Backup, Timeout: 1332, Valid

  In: 192.168.1.100/5727 --> 192.168.1.200/22;tcp, If: reth2.0, Pkts: 228, Bytes: 17024

  Out: 192.168.1.200/22 --> 192.168.1.100/5727;tcp, If: .local..0, Pkts: 246, Bytes: 33177

Total sessions: 2

 

But if physical interface from primary node for contol plane ( Redundancy group: 0) is fail or node is down all tcp traffic is interrupted.

 

To tell the truth I don't care about ssh. But I want create ipsec tunnels with ospf inside on this reth. Will it broken in the same way ?

Or I do something wrong ?

 

 

#ClusterSRXTCP

Hi trushchelev@vmcity.ru<TRUSHCHELEV>,

If the control plane failsover, we do experience a flap.
Any traffic involving ALG, routing daemons etc are restarted as the daemons running on node 0 exit and are started on node 1 when the cluster fails over from Node 0 to Node 1.

You could experience a flap when the failover happens.
However, in my experience, VPN flap usually is not seen due to the time for the daemon to start is small.

HTH</TRUSHCHELEV>

Hi trushchelev@vmcity.ru<TRUSHCHELEV>,

If the control plane failsover, we do experience a flap.
Any traffic involving ALG, routing daemons etc are restarted as the daemons running on node 0 exit and are started on node 1 when the cluster fails over from Node 0 to Node 1.

You could experience a flap when the failover happens.
However, in my experience, VPN flap usually is not seen due to the time for the daemon to start is small.

HTH</TRUSHCHELEV>

Thanks snn and joses

 

It's a pitty that all the session will be reinitiated.

 

In that way I can't see big different between cluster and 2 srx with aggregated links. I mean I can make 2 srx with aggreg. links and have 2 ipsec tunnel with balanced ospf. So I can use ALL control planes from each nodes. If one srx fail the time recovery - is ospf timeout.

 

So I do not see big benefits in cluster design instead 2 srx with aggregated links.

Sure if I have nat or mapping cluster is better, but. I don't know. Tell me somebody should I make a cluster.

You know I've always thought cluster is a best solution. Was I wrong ?

P/s/

I've started testing cluster for 2 days ago and maybe there are a lot of things I dont's know yet.

 

 

Problem solved by

Hi trushchelev@vmcity.ru<TRUSHCHELEV>,

I would still recommend to have the cluster configured as it gives you a redundancy even though there may be a few drops.
The services continue instead of being lost in case you only have a single box which may have gone down.</TRUSHCHELEV>

The services continue instead of being lost in case you only have a single box which may have gone down.

 

Yeah, it's true if I have one bos. But I mean 2 box with aggrageted links. Connected each other with OSPF

Among the services only ipsec + ospf.

I 've attached scheme to clearly understand.

 

Hello ,

 

Your observation is correct that when RG-0 fails all the session (TCP/VPN/Dynamic routing protocol ) will be reinitiated .

This is only in case of RG-0 failover which is the control plane . dataPlane will failover seemless .