Security

 View Only
last person joined: 4 days ago 

Ask questions and share experiences with Juniper Connected Security. Discuss Advanced Threat Protection, SecIntel, Secure Analytics, Secure Connect, Security Director, and all things related to Juniper security technologies.
  • 1.  SRX HA pair on ESXi

    Posted 06-05-2024 13:46

    Hi, 

    Hoping I could get some help after spending a very unproductive day on this. 

    I've set up 2 vSRXs on ESXi (version 7) both have 5 interfaces assigned to them. I've configured them for a HA pair. which they seem to be in, however the data plane fabric links don't seem to work. Both show as sending probes but not receiving them. 

    I'm using vlan 303 for the data plane and 304 for the control plane. This on ESXi and the switching infrastructure. I can see the MAC address for the interfaces learnt on all the switches.

    I think I have the same/similar issue to this post Security but sadly the fix didn't work for me. 

    Below is some of the relevant output. If anyone has any ideas it would be appreciated. 

    ```

    adamp@srx3.node0.lab> show chassis cluster status
    Monitor Failure codes:
        CS  Cold Sync monitoring        FL  Fabric Connection monitoring
        GR  GRES monitoring             HW  Hardware monitoring
        IF  Interface monitoring        IP  IP monitoring
        LB  Loopback monitoring         MB  Mbuf monitoring
        NH  Nexthop monitoring          NP  NPC monitoring
        SP  SPU monitoring              SM  Schedule monitoring
        CF  Config Sync monitoring      RE  Relinquish monitoring
        IS  IRQ storm

    Cluster ID: 1
    Node   Priority Status               Preempt Manual   Monitor-failures

    Redundancy group: 0 , Failover count: 3
    node0  100      primary              no      no       None
    node1  0        secondary-hold       no      no       FL

    Redundancy group: 1 , Failover count: 1
    node0  0        primary              no      no       CS
    node1  0        secondary            no      no       CS FL
    ```

    ```

    {primary:node0}
    adamp@srx3.node0.lab> show chassis cluster statistics
    Control link statistics:
        Control link 0:
        Heartbeat packets sent: 2234
        Heartbeat packets received: 2106
        Heartbeat packet errors: 0
    Fabric link statistics:
        Child link 0
        Probes sent: 4235
        Probes received: 0
        Child link 1
        Probes sent: 0
        Probes received: 0
    ```

    ```

    adamp@srx3.node0.lab> show chassis cluster interfaces
    Control link status: Up

    Control interfaces:
        Index   Interface   Monitored-Status   Internal-SA   Security
        0       em0         Up                 Disabled      Disabled

    Fabric link status: Down

    Fabric interfaces:
        Name    Child-interface    Status                    Security
                                   (Physical/Monitored)
        fab0    ge-0/0/2           Up   / Down               Disabled
        fab0
        fab1    ge-7/0/2           Up   / Down               Disabled
        fab1

    Redundant-ethernet Information:
        Name         Status      Redundancy-group
        reth0        Up          1
        reth1        Up          1

    Redundant-pseudo-interface Information:
        Name         Status      Redundancy-group
        lo0          Up          0

    Interface Monitoring:
        Interface         Weight    Status                    Redundancy-group
                                    (Physical/Monitored)
        ge-7/0/1          255       Up  /  Up                 1
        ge-7/0/0          255       Up  /  Up                 1
        ge-0/0/0          255       Up  /  Up                 1
        ge-0/0/1          255       Up  /  Up                 1
    ```



    ------------------------------
    Adam Phillips
    ------------------------------


  • 2.  RE: SRX HA pair on ESXi

    Posted 06-05-2024 16:20

    Resolved!

    I'd missed that on the port group on ESXi I needed to set it to allow MAC-changes. Changing that on the VLAN that I'm using for fabric fixed it. 



    ------------------------------
    Adam Phillips
    ------------------------------