Switching

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

Hi Dmytro, 

In my experience VRRP was not comes up, because of missing rules in ACL for RE (CoPP: lo0.0 family inet filter input PROTECT-RE), I just added a multicast permit:

policy-options {
    ...
    prefix-list LOCALS-v4 {
        apply-path "interfaces <*> unit <*> family inet address <*>";
    }
    ...
    prefix-list PL-VRRP {
        224.0.0.18/32;
    }

firewall {
    family inet {
        filter PROTECT-RE {
            apply-flags omit;
            interface-specific;
            ...
            }
            term VRRP-PERMIT {
                from {
                    source-prefix-list {
                        LOCALS-v4;
                    }
                    destination-prefix-list {
                        PL-VRRP;
                    }
                    protocol [ vrrp ah ];
                }
                then {
                    count vrrp-permit;
                    accept;
                }
            }
            term DEFAULT {
                then {
                    count default-deny;
                    log;
                    discard;
                }
            }
        }

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

I don't use ACL in my switches. And VRRP is up but VIP isn't reachible from VRRP subnetwork.

Hi Dmytro, 

In my experience VRRP was not comes up, because of missing rules in ACL for RE (CoPP: lo0.0 family inet filter input PROTECT-RE), I just added a multicast permit:

policy-options {
    ...
    prefix-list LOCALS-v4 {
        apply-path "interfaces <*> unit <*> family inet address <*>";
    }
    ...
    prefix-list PL-VRRP {
        224.0.0.18/32;
    }

firewall {
    family inet {
        filter PROTECT-RE {
            apply-flags omit;
            interface-specific;
            ...
            }
            term VRRP-PERMIT {
                from {
                    source-prefix-list {
                        LOCALS-v4;
                    }
                    destination-prefix-list {
                        PL-VRRP;
                    }
                    protocol [ vrrp ah ];
                }
                then {
                    count vrrp-permit;
                    accept;
                }
            }
            term DEFAULT {
                then {
                    count default-deny;
                    log;
                    discard;
                }
            }
        }

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

I don't use ACL in my switches. And VRRP is up but VIP isn't reachible from VRRP subnetwork.

------------------------------
DMYTRO OSTAPENKO

Original Message:
Sent: 03-12-2025 03:22
From: Yevgeniy Voloshin
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

Hi Dmytro, 

In my experience VRRP was not comes up, because of missing rules in ACL for RE (CoPP: lo0.0 family inet filter input PROTECT-RE), I just added a multicast permit:

policy-options {
    ...
    prefix-list LOCALS-v4 {
        apply-path "interfaces <*> unit <*> family inet address <*>";
    }
    ...
    prefix-list PL-VRRP {
        224.0.0.18/32;
    }

firewall {
    family inet {
        filter PROTECT-RE {
            apply-flags omit;
            interface-specific;
            ...
            }
            term VRRP-PERMIT {
                from {
                    source-prefix-list {
                        LOCALS-v4;
                    }
                    destination-prefix-list {
                        PL-VRRP;
                    }
                    protocol [ vrrp ah ];
                }
                then {
                    count vrrp-permit;
                    accept;
                }
            }
            term DEFAULT {
                then {
                    count default-deny;
                    log;
                    discard;
                }
            }
        }

------------------------------
Yev

Original Message:
Sent: 03-11-2025 10:37
From: DMYTRO OSTAPENKO
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

------------------------------
DMYTRO OSTAPENKO
------------------------------

>  but VIP isn't reachible from VRRP subnetwork.

is there any way to check the ping from the VRRP subnetwork, from the hosts (10.51.8.4-254/24) and not from a secondary VRRP switch?

After all, VRRP is primarily for the hosts in 10.51.8.4-254/24 and not for VRRP GWs ;)

I don't use ACL in my switches. And VRRP is up but VIP isn't reachible from VRRP subnetwork.

Hi Dmytro, 

In my experience VRRP was not comes up, because of missing rules in ACL for RE (CoPP: lo0.0 family inet filter input PROTECT-RE), I just added a multicast permit:

policy-options {
    ...
    prefix-list LOCALS-v4 {
        apply-path "interfaces <*> unit <*> family inet address <*>";
    }
    ...
    prefix-list PL-VRRP {
        224.0.0.18/32;
    }

firewall {
    family inet {
        filter PROTECT-RE {
            apply-flags omit;
            interface-specific;
            ...
            }
            term VRRP-PERMIT {
                from {
                    source-prefix-list {
                        LOCALS-v4;
                    }
                    destination-prefix-list {
                        PL-VRRP;
                    }
                    protocol [ vrrp ah ];
                }
                then {
                    count vrrp-permit;
                    accept;
                }
            }
            term DEFAULT {
                then {
                    count default-deny;
                    log;
                    discard;
                }
            }
        }

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

I try to ping VIP  from host  10.51.8.21 and it isn't reachible. But I can ping it from another networks.

------------------------------
DMYTRO OSTAPENKO

Original Message:
Sent: 03-12-2025 03:45
From: Yevgeniy Voloshin
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

>  but VIP isn't reachible from VRRP subnetwork.

is there any way to check the ping from the VRRP subnetwork, from the hosts (10.51.8.4-254/24) and not from a secondary VRRP switch?

After all, VRRP is primarily for the hosts in 10.51.8.4-254/24 and not for VRRP GWs ;)

------------------------------
Yev

Original Message:
Sent: 03-12-2025 03:30
From: DMYTRO OSTAPENKO
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

I don't use ACL in my switches. And VRRP is up but VIP isn't reachible from VRRP subnetwork.

------------------------------
DMYTRO OSTAPENKO

Original Message:
Sent: 03-12-2025 03:22
From: Yevgeniy Voloshin
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

Hi Dmytro, 

In my experience VRRP was not comes up, because of missing rules in ACL for RE (CoPP: lo0.0 family inet filter input PROTECT-RE), I just added a multicast permit:

policy-options {
    ...
    prefix-list LOCALS-v4 {
        apply-path "interfaces <*> unit <*> family inet address <*>";
    }
    ...
    prefix-list PL-VRRP {
        224.0.0.18/32;
    }

firewall {
    family inet {
        filter PROTECT-RE {
            apply-flags omit;
            interface-specific;
            ...
            }
            term VRRP-PERMIT {
                from {
                    source-prefix-list {
                        LOCALS-v4;
                    }
                    destination-prefix-list {
                        PL-VRRP;
                    }
                    protocol [ vrrp ah ];
                }
                then {
                    count vrrp-permit;
                    accept;
                }
            }
            term DEFAULT {
                then {
                    count default-deny;
                    log;
                    discard;
                }
            }
        }

------------------------------
Yev

Original Message:
Sent: 03-11-2025 10:37
From: DMYTRO OSTAPENKO
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

------------------------------
DMYTRO OSTAPENKO
------------------------------

> I try to ping VIP  from host  10.51.8.21 and it isn't reachible.

and this .21 host is connected to which switch (closer), SW1 (VRRP Master) or SW2?
Is it possible to ping the host closer to the other switch?

and what does debug/traceoptions actually show?
ICMP requests reach SW1?
Is SW1 responding to SW2 and .21 host?

By the way, do ping to .2 and .3 (to real IP) work?
both from a neighbouring switch and from a .21 host?

> But I can ping it from another networks.
This most likely indicates some kind of restriction in L2/IRB for packets spawned in the same L2 

------------------------------
Yev

Original Message:
Sent: 03-12-2025 04:08
From: DMYTRO OSTAPENKO
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

I try to ping VIP  from host  10.51.8.21 and it isn't reachible. But I can ping it from another networks.

------------------------------
DMYTRO OSTAPENKO

Original Message:
Sent: 03-12-2025 03:45
From: Yevgeniy Voloshin
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

>  but VIP isn't reachible from VRRP subnetwork.

is there any way to check the ping from the VRRP subnetwork, from the hosts (10.51.8.4-254/24) and not from a secondary VRRP switch?

After all, VRRP is primarily for the hosts in 10.51.8.4-254/24 and not for VRRP GWs ;)

------------------------------
Yev

Original Message:
Sent: 03-12-2025 03:30
From: DMYTRO OSTAPENKO
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

I don't use ACL in my switches. And VRRP is up but VIP isn't reachible from VRRP subnetwork.

------------------------------
DMYTRO OSTAPENKO

Original Message:
Sent: 03-12-2025 03:22
From: Yevgeniy Voloshin
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

Hi Dmytro, 

In my experience VRRP was not comes up, because of missing rules in ACL for RE (CoPP: lo0.0 family inet filter input PROTECT-RE), I just added a multicast permit:

policy-options {
    ...
    prefix-list LOCALS-v4 {
        apply-path "interfaces <*> unit <*> family inet address <*>";
    }
    ...
    prefix-list PL-VRRP {
        224.0.0.18/32;
    }

firewall {
    family inet {
        filter PROTECT-RE {
            apply-flags omit;
            interface-specific;
            ...
            }
            term VRRP-PERMIT {
                from {
                    source-prefix-list {
                        LOCALS-v4;
                    }
                    destination-prefix-list {
                        PL-VRRP;
                    }
                    protocol [ vrrp ah ];
                }
                then {
                    count vrrp-permit;
                    accept;
                }
            }
            term DEFAULT {
                then {
                    count default-deny;
                    log;
                    discard;
                }
            }
        }

------------------------------
Yev

Original Message:
Sent: 03-11-2025 10:37
From: DMYTRO OSTAPENKO
Subject: VRRP between 2 QFX. Couln't reach VIP from the same network.

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

------------------------------
DMYTRO OSTAPENKO
------------------------------

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

In our case VLAN names are the same on both switches.

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

In our case VLAN names are the same on both switches.

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

In our case VLAN names are the same on both switches.

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

I think it looks like a bug. I configure the same VRRP settings  on EX4100 pair and it works properly. But in QFX case we have LACP aggregated  link  between switches (with MC-LAG settings but without configured aggregated ports across switches) and in EX is only one link between switches.

In our case VLAN names are the same on both switches.

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

I think it looks like a bug. I configure the same VRRP settings  on EX4100 pair and it works properly. But in QFX case we have LACP aggregated  link  between switches (with MC-LAG settings but without configured aggregated ports across switches) and in EX is only one link between switches.

In our case VLAN names are the same on both switches.

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

I  removed MC-LAG configuration for test but issue with VRRP isn't resolved.

I think it looks like a bug. I configure the same VRRP settings  on EX4100 pair and it works properly. But in QFX case we have LACP aggregated  link  between switches (with MC-LAG settings but without configured aggregated ports across switches) and in EX is only one link between switches.

In our case VLAN names are the same on both switches.

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

I  removed MC-LAG configuration for test but issue with VRRP isn't resolved.

I think it looks like a bug. I configure the same VRRP settings  on EX4100 pair and it works properly. But in QFX case we have LACP aggregated  link  between switches (with MC-LAG settings but without configured aggregated ports across switches) and in EX is only one link between switches.

In our case VLAN names are the same on both switches.

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01

I  removed MC-LAG configuration for test but issue with VRRP isn't resolved.

I think it looks like a bug. I configure the same VRRP settings  on EX4100 pair and it works properly. But in QFX case we have LACP aggregated  link  between switches (with MC-LAG settings but without configured aggregated ports across switches) and in EX is only one link between switches.

In our case VLAN names are the same on both switches.

Yes, it's the same on both switches:

set vlans DC-D-SERVICES vlan-id 519
set vlans DC-D-SERVICES l3-interface irb.519

Do you have under vlans section,  a L3-interface irb.519 statement for that vlan ?  

I have 2 QFX switches (QFX5120-48YM-8C  Junos: 20.4R1.12 flex) and try to configure VRRP.

My config:

IF-SW-DC-01