SD-WAN

Hi,

SSR HA documentation states:

"Non-revertible failover is recommended for all configurations using VRRP."

It also explains why: after a node failure, the shared interface on the returning primary may become available before the routing stack has rebuilt its RIB, so preserving the interface state on the newly active node avoids an unnecessary second failover.

This is conceptually similar to how other HA implementations handle preemption:

• FortiGate VRRP: preempt disable
• Palo Alto Active/Passive HA: Preemptive disabled

In both cases, the node that became active remains active when the preferred/primary node returns.

In a Mist-managed SSR Dual Node HA configuration, however, I cannot find an equivalent setting for the shared VRRP interface.

I can see session-resiliency revertible-failover under the service policy, but the documentation describes that as failing traffic back to the preferred service route, which appears to be a different function.

So, what is the SSR equivalent of VRRP preempt disable / HA non-preemptive behavior?

Where can we configure or verify that the shared VRRP interface is non-revertible in:

• Mist-managed SSR?
• Native SSR / Conductor?

This is particularly relevant because we have observed a returning SSR node advertise the shared VIP with a Gratuitous ARP before VRRP is operational. If the HA design is intended to be non-revertible, the returning node should presumably not attempt to reclaim or advertise the shared interface at that stage.

Thanks,
Hannu

------------------------------
Hannu Rokka
Senior Advisor (DataCom)
------------------------------

------------------------------
Kevin Kueper
------------------------------

------------------------------
Hannu Rokka
Senior Advisor (DataCom)
------------------------------

Original Message:
Sent: 08-27-2026 03:07
From: Kevin Kueper
Subject: SSR Dual Node HA with VRRP – How to Configure Non-Revertible Failover?

Hi,

This topic is very interesting to me too, as we may be experiencing a possibly related issue in a Conductor managed dual-node deployment.

 

We use VRRP on the LAN interfaces. Following a failover (it happened quite often during firmware upgrades), we occasionally observe routes that are present in the BGP table but are not selected as the best path (>). Interestingly, no alternative route is marked as the best path either, and consequently the affected prefix is not installed in the RIB.

 

So far, this behavior appears to affect only routes imported through route leaking between VRFs. The same route is correctly selected and active in its original VRF, but the leaked route is not selected in the destination VRF. This happens only for directly connected networks, or static routes, that point to the LAN interface with the configured VRRP.

 

Reloading the BGP configuration, for example by changing an irrelevant value and immediately reverting it, causes the affected routes to be evaluated again and installed correctly.

 

I am therefore wondering whether this could be related to the timing described in the HA documentation: VRRP and the shared interface may become operational before the routing stack has completely rebuilt its RIB following a failover. https://www.juniper.net/documentation/us/en/software/session-smart-router/docs/concepts-ha-options/

Perhaps the leaked routes are evaluated before the required routing state or next-hop resolution is fully available and are not reevaluated afterwards. Could also be a synchronization issue between the SSR routing stack and routing manager, with the underlaying FRR. 

 

Therefore, it would be very helpful to know how non-revertible VRRP failover could be configured and if it has any impact. 

Best regards

------------------------------
Kevin Kueper
------------------------------

To change SSR VRRP behavior to non-revertive you should set identical priorities on both interfaces in the redundant pair.  There is a caveat to this.  If there is a fault in the broadcast domain which results in both interfaces being active, a split brain condition, coming back from it properly when the network heals requires you to set "use-uptime-tiebreaker" to "true".   By default it's set to "false".   With this setting the interface with longest uptime will win.  This config element is currently available in releases 6.2.14GA and 7.0.5GA.  

------------------------------
Gene Shtirmer
Sr. Consulting Engineering Specialist
------------------------------

@Hannu I got this from Juniper support

In a VRRP environment service policies with "session-resiliency  failover" should be used instead of "session-resiliency revertible-failover". However, for my understanding, this has nothing to do with VRRP interface taking over before the node is fully operational. 

The idea to use same VRRP prios in conjunction with "use-uptime-tiebreaker true" sounds feasible and could prevent interfaces taken over too eraly. That said, in my previous experience, identical VRRP priorities caused more problems than they solved. Since this is also a relatively new feature, it should be used carefully. Least you want is a split brain.  

@Gene where did you got the info about this feature? There is no indication in the release notes. Only thing I found is

in the 7.0.5 release. But that could mean anything. 

------------------------------
Kevin Kueper
------------------------------

Original Message:
Sent: 08-27-2026 18:45
From: Gene
Subject: SSR Dual Node HA with VRRP – How to Configure Non-Revertible Failover?

To change SSR VRRP behavior to non-revertive you should set identical priorities on both interfaces in the redundant pair.  There is a caveat to this.  If there is a fault in the broadcast domain which results in both interfaces being active, a split brain condition, coming back from it properly when the network heals requires you to set "use-uptime-tiebreaker" to "true".   By default it's set to "false".   With this setting the interface with longest uptime will win.  This config element is currently available in releases 6.2.14GA and 7.0.5GA.  

------------------------------
Gene Shtirmer
Sr. Consulting Engineering Specialist
------------------------------

Thanks - This should reduce unnecessary failback after the original node returns, although it would not, by itself, prevent the boot-time unsolicited ARP/GARP issue described above. (The issue is a premature GARP during SSR boot. The returning node advertises the shared VRRP VIP using its physical MAC before VRRP ownership and routing are fully ready. The ISP router learns this incorrect mapping and may forward traffic to the returning node, causing a temporary outage until the correct VRRP MAC is relearned.) (P.S Where is use-uptime-tiebreaker configured on a Mist-managed SSR?

------------------------------
Hannu Rokka
Senior Advisor (DataCom)
------------------------------

Original Message:
Sent: 08-27-2026 18:45
From: Gene
Subject: SSR Dual Node HA with VRRP – How to Configure Non-Revertible Failover?

To change SSR VRRP behavior to non-revertive you should set identical priorities on both interfaces in the redundant pair.  There is a caveat to this.  If there is a fault in the broadcast domain which results in both interfaces being active, a split brain condition, coming back from it properly when the network heals requires you to set "use-uptime-tiebreaker" to "true".   By default it's set to "false".   With this setting the interface with longest uptime will win.  This config element is currently available in releases 6.2.14GA and 7.0.5GA.  

------------------------------
Gene Shtirmer
Sr. Consulting Engineering Specialist
------------------------------

Here is the data model example:

------------------------------
Gene Shtirmer
Sr. Consulting Engineering Specialist
------------------------------

Original Message:
Sent: 08-31-2026 01:27
From: Hannu
Subject: SSR Dual Node HA with VRRP – How to Configure Non-Revertible Failover?

Thanks - This should reduce unnecessary failback after the original node returns, although it would not, by itself, prevent the boot-time unsolicited ARP/GARP issue described above. (The issue is a premature GARP during SSR boot. The returning node advertises the shared VRRP VIP using its physical MAC before VRRP ownership and routing are fully ready. The ISP router learns this incorrect mapping and may forward traffic to the returning node, causing a temporary outage until the correct VRRP MAC is relearned.) (P.S Where is use-uptime-tiebreaker configured on a Mist-managed SSR?

------------------------------
Hannu Rokka
Senior Advisor (DataCom)
------------------------------


Original Message:
Sent: 08-27-2026 18:45
From: Gene
Subject: SSR Dual Node HA with VRRP – How to Configure Non-Revertible Failover?

To change SSR VRRP behavior to non-revertive you should set identical priorities on both interfaces in the redundant pair.  There is a caveat to this.  If there is a fault in the broadcast domain which results in both interfaces being active, a split brain condition, coming back from it properly when the network heals requires you to set "use-uptime-tiebreaker" to "true".   By default it's set to "false".   With this setting the interface with longest uptime will win.  This config element is currently available in releases 6.2.14GA and 7.0.5GA.  

------------------------------
Gene Shtirmer
Sr. Consulting Engineering Specialist
------------------------------