Screen OS

 View Only
last person joined: 10 months ago 

This is a legacy community with limited Juniper monitoring.
  • 1.  a problem: the nsrp ha data link does not forwarding packet between two units.

    Posted 06-11-2009 20:20



    Two ISG1000 firewalls were deployed active/passive mode.  two  ha link ,one for control ,one for data link. All interface were in route mode.


     I find the passive firewall received lots of  packets but not passed these data to active firewall.

    Why ? Anyone could help me ?


    After  read the manual, I have a doubt the data link is only ready for active/active mode ?  thanks !



    get ha

    nsrp version: 2.0

    cluster info:
    cluster id: 1, no name
    local unit id: 9277440
    active units discovered:
    index: 0, unit id:   9277440, ctrl mac: 0010db8d9007, data mac: 0010db8d9008
    index: 1, unit id:   9281280, ctrl mac: 0010db8d9f07, data mac: 0010db8d9f08
    total number of units: 2

    VSD group info:
    init hold time: 5
    heartbeat lost threshold: 3
    heartbeat interval: 1000(ms)
    master always exist: disabled
    group priority preempt holddown inelig   master       PB other members
        0       50 no             3 no      9281280   myself
    total number of vsd groups: 1
    Total iteration=1916,time=2833949,max=12271,min=274,average=1479

    RTO mirror info:
    run time object sync:   enabled
    ping session sync: enabled
    coldstart sync done
    nsrp data packet forwarding is enabled

    nsrp link info:
    control   channel: ethernet1/1 (ifnum: 7)  mac: 0010db8d9007 state: up
    data      channel: ethernet1/2 (ifnum: 😎  mac: 0010db8d9008 state: up
    ha secondary path link not available

    NSRP encryption: disabled
    NSRP authentication: disabled
    device based nsrp monitoring threshold: 255, weighted sum: 0, not failed
    device based nsrp monitor interface: ethernet2/2(weight 255, UP) ethernet2/1(weight 255, UP)
    device based nsrp monitor zone:
    device based nsrp track ip: (weight: 255, disabled)
    number of gratuitous arps: 5
    config sync: enabled

    track ip: disabled
    Nsrp arp counts: 5, interval: 1
    Nsrp VSD group counts:
    group st_chg to ms    pb    bk  inop ineli  init dup_ms dup_pb hb_tx hb_rx
        0      4     1     2     0     1     0     0      0      0  1718  1665

    RTO mirror group has not been defined








  • 2.  RE: a problem: the nsrp ha data link does not forwarding packet between two units.
    Best Answer

    Posted 06-11-2009 20:37

    Yes, the data forwarding only kicks in when firewalls are in A/A mode. For A/P the data forwarding does not really work as all interfaces on the Passive firewall are assumed to be not passing traffic.


    I think you need to check on the switches why the traffic is being sent to the backup instead of the master. The master has a specific special mac address which the switches should have been forwarding to.