Data Center

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

The other problem is that I have a virtual network (vlan)  that needs to connect to the FW cluster. I have configured a tagged subinterface on the FW for that vlan, but I cannot ping from the border leafs to the firewall on that vlan.  The route on the border leaf for the FW IP points to the local irb, not to the directly connected interface to the firewall.

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Thank you Greg...The part that I am struggling with is that I have two border leafs connecting to the SRX cluster. How should I connect each border to the cluster? On the SRX cluster side, I do have one single reth interface with lacp active...

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Referring back to the graphic showing the Supported Configuration in the KB I referenced earlier, if we think of that EX4200 as our data center fabric:

• Interfaces ge-0/0/0 (member of ae1) and ge-0/01 (member of ae2) are interfaces on Border Leaf 1
• Interfaces ge-0/0/2 (ae1) and ge-0/0/3 (ae2) are interfaces on Border Leaf 2

Thank you Greg...The part that I am struggling with is that I have two border leafs connecting to the SRX cluster. How should I connect each border to the cluster? On the SRX cluster side, I do have one single reth interface with lacp active...

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Tried that…I am currently dropping about 50% of traffic between border leafs and firewall cluster…is there any body that can help with an actual configuration ? Again, it is very hard to believe that among all the customers that implemented Apstra , none has the same case, ie firewall cluster connected to a pair of leaf devices…why is it so difficult for all the smart  Apstra SMEs to step in and answer? If this is a real community….

Referring back to the graphic showing the Supported Configuration in the KB I referenced earlier, if we think of that EX4200 as our data center fabric:

• Interfaces ge-0/0/0 (member of ae1) and ge-0/01 (member of ae2) are interfaces on Border Leaf 1
• Interfaces ge-0/0/2 (ae1) and ge-0/0/3 (ae2) are interfaces on Border Leaf 2

Thank you Greg...The part that I am struggling with is that I have two border leafs connecting to the SRX cluster. How should I connect each border to the cluster? On the SRX cluster side, I do have one single reth interface with lacp active...

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Your initial ask was about how to connect an SRX cluster to an Apstra-managed fabric.  We've answered that question, with a link to a KB that describes the proper configuration of the RETH and LAGs at each end.  If you're now at a point where you're losing packets between the border leaf pair and the firewall cluster, then I'd recommend reaching out to your account team and/or JTAC for additional support specific to your deployment.

Tried that…I am currently dropping about 50% of traffic between border leafs and firewall cluster…is there any body that can help with an actual configuration ? Again, it is very hard to believe that among all the customers that implemented Apstra , none has the same case, ie firewall cluster connected to a pair of leaf devices…why is it so difficult for all the smart  Apstra SMEs to step in and answer? If this is a real community….

Referring back to the graphic showing the Supported Configuration in the KB I referenced earlier, if we think of that EX4200 as our data center fabric:

• Interfaces ge-0/0/0 (member of ae1) and ge-0/01 (member of ae2) are interfaces on Border Leaf 1
• Interfaces ge-0/0/2 (ae1) and ge-0/0/3 (ae2) are interfaces on Border Leaf 2

Thank you Greg...The part that I am struggling with is that I have two border leafs connecting to the SRX cluster. How should I connect each border to the cluster? On the SRX cluster side, I do have one single reth interface with lacp active...

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Tried that…I am currently dropping about 50% of traffic between border leafs and firewall cluster…is there any body that can help with an actual configuration ? Again, it is very hard to believe that among all the customers that implemented Apstra , none has the same case, ie firewall cluster connected to a pair of leaf devices…why is it so difficult for all the smart  Apstra SMEs to step in and answer? If this is a real community….

Referring back to the graphic showing the Supported Configuration in the KB I referenced earlier, if we think of that EX4200 as our data center fabric:

• Interfaces ge-0/0/0 (member of ae1) and ge-0/01 (member of ae2) are interfaces on Border Leaf 1
• Interfaces ge-0/0/2 (ae1) and ge-0/0/3 (ae2) are interfaces on Border Leaf 2

Thank you Greg...The part that I am struggling with is that I have two border leafs connecting to the SRX cluster. How should I connect each border to the cluster? On the SRX cluster side, I do have one single reth interface with lacp active...

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html

Mourad.

Please reach out to your local Juniper account team for assistance so we can determine your precise requirements a little better. This community page is only really designed to assist with generic Q&A. 

BR

Andy

Tried that…I am currently dropping about 50% of traffic between border leafs and firewall cluster…is there any body that can help with an actual configuration ? Again, it is very hard to believe that among all the customers that implemented Apstra , none has the same case, ie firewall cluster connected to a pair of leaf devices…why is it so difficult for all the smart  Apstra SMEs to step in and answer? If this is a real community….

Referring back to the graphic showing the Supported Configuration in the KB I referenced earlier, if we think of that EX4200 as our data center fabric:

• Interfaces ge-0/0/0 (member of ae1) and ge-0/01 (member of ae2) are interfaces on Border Leaf 1
• Interfaces ge-0/0/2 (ae1) and ge-0/0/3 (ae2) are interfaces on Border Leaf 2

Thank you Greg...The part that I am struggling with is that I have two border leafs connecting to the SRX cluster. How should I connect each border to the cluster? On the SRX cluster side, I do have one single reth interface with lacp active...

Hi Mourad,

Are you operating the SRX pair as older-style chassis cluster or newer MNHA?  You used the term "cluster" in your original question, so I'll assume old-style for now.

There's an old KB that describes how to create a RETH on an SRX cluster that's comprised of multiple links from each node:
https://supportportal.juniper.net/s/article/SRX-EX-Link-aggregation-LACP-supported-non-supported-configurations-on-SRX-and-EX?language=en_US

In  the topology example, imagine the EX4200 replaced by an EVPN/VXLAN fabric.

Key points:

1. All 4 links from the SRX chassis cluster can be part of the same RETH
2. On the border leaf side, the links that connect to node0 are treated as one LAG, while the links that connect to node 1 are treated as a different LAG.
3. I would strongly recommend using LACP in this design, and setting it for periodic fast if you're using something larger than a branch SRX.

Once the LAG bundles are set correctly in Apstra, you can assign the appropriate Connectivity Templates to each.

The silence is deafening...It is very strange that no SME has stepped forward to help with this request. There are many people out there trying to set up a firewall cluster in an Apstra-driven datacenter and the absence of documentation (as far as I can tell) is very frustrating. Can someone from the Apstra team please help?

Ben, Thank you for your reply. However, beyond the generic explanation, what would really help is how to configure the links to the SRX cluster in Apstra, on one side, and how to do it on the SRX cluster. Are we using one reth interface or two reths interfaces on the cluster? how to physically attach the links from the border leafs to the SRX cluster? from each border leaf is one link going to node0 and the other link to node1, or both links going to the same node0 on the firewall side? same for the second border leaf...

That would be very helpful if we get responses to those questions or if someone could point us to the right documentation. I looked everywhere and I could not find anything. This is a very common deployment for datacenter customers and I am surprised to find no related documentation from Juniper which owns both technologies...

Hi Mourad,

If you want to use an LACP LAG on an SRX cluster, then you will need to configure a distinct LAG to each SRX node (so 2 LAGs).  In a typical deployment, when the primary SRX node is active, traffic will only be forwarded by the primary node, so you don't want your switches sending traffic to the secondary node at all (which would happen if you used a single LACP bundle - traffic would eventually be hashed across the links connected to the secondary node) otherwise it will be dropped.  

In an SRX chassis cluster if you configure a reth interface (with two physical ports bound to it on each node), then enable LACP on it,  the SRX will automatically create sub-LAGs - essentially two distinct LACP bundles, one from each node.  These will both be in an active state, and then the SRX will use GARP towards the switch in order to hint at which link is currently active.

You can read more about this at the link[1] below.

[1] https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-redundant-ethernet-lag-interfaces.html