SRX Services Gateway
Showing results for 
Search instead for 
Do you mean 
Reply
Contributor
Posts: 45
Registered: ‎09-28-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

hello marschallc ,

 

i see this in a configuration that you've posted in a previous post:

 

  interfaces {

    ge-0/0/0 {

        unit 0;

    }

 

 

 

interfaces {

                ge-0/0/0.0 {

                    host-inbound-traffic {

                        system-services {

                            http;

                            https;

                            ssh;

                            telnet;

                            dhcp;

 

is for this that i think that this can be a part of the problem. i hope you can fix you problem. good luck!

 

are your devices upgraded to JUNOS 9.6?

 

regards. 

Contributor
Posts: 12
Registered: ‎10-07-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

Hello,

 

Yes I have already deleted this, as I read these thread. But without success. Yes both devices are 9.6

 

br,

Christian

Contributor
Posts: 45
Registered: ‎09-28-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

hello marschallc,

 

can you put a computer in 10.12.64.0/24 subnet and try to ping the both fxp interfaces? you can connect the two fxp interfaces and the computer to a switch, if this works, it's possible that you have a routing problem.

 

regards. 

Contributor
Posts: 12
Registered: ‎10-07-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

Hello,

 

I don't think that it is a routing issue because I can see the packets if I do a tcpdump:

 

root@srx650-1% tcpdump host 10.250.0.203
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes

Reverse lookup for 10.250.0.203 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use <no-resolve> to avoid reverse lookups on IP addresses.

17:03:43.102748  In IP 10.250.0.203 > 10.12.64.3: ICMP echo request, id 2048, seq 14336, length 40
17:03:48.289395  In IP 10.250.0.203 > 10.12.64.3: ICMP echo request, id 2048, seq 14592, length 40
17:03:53.790422  In IP 10.250.0.203 > 10.12.64.3: ICMP echo request, id 2048, seq 14848, length 40
17:03:59.287153  In IP 10.250.0.203 > 10.12.64.3: ICMP echo request, id 2048, seq 15104, length 40

 

 

If I am in the same subnet, everthing works fine, but if i want to route traffic betweeen machines and the fxps it doesn't work

 

br,

Christian

Contributor
Posts: 45
Registered: ‎09-28-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

is your fab link working ok? the chassis is formed correctly? can you paste the output of this commands:

 

show chassis cluster status

show chassis cluster statistics

 

it's is possible that your routing engine is not working?

 

regards 

Contributor
Posts: 12
Registered: ‎10-07-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

Hello,

 

I think its working fine:

 

Cluster ID: 1
Node name                  Priority     Status    Preempt  Manual failover

Redundancy group: 0 , Failover count: 1
    node0                   100         primary   no       no
    node1                   1           secondary no       no

Redundancy group: 1 , Failover count: 1
    node0                   100         primary   no       no
    node1                   0           secondary no       no

 

 

Control link statistics:
    Heartbeat packets sent: 2880
    Heartbeat packets received: 2864
Fabric link statistics:
    Probes sent: 2877
    Probes received: 2838

 

br,

Christian

 

 

Contributor
Posts: 45
Registered: ‎09-28-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

hello, 

 

Redundancy group: 1 , Failover count: 1
    node0                   100         primary   no       no
    node1                   0           secondary no       no

 

 i think that the redundancy group 1 cannot see the node 1, but i don't have idea if this is the problem.

 

regards 

Contributor
Posts: 45
Registered: ‎09-28-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

hello,

 

it's possible that the srx don't know how to return the packet, there are your routes:

 

static {

        route 10.250.0.88/32 next-hop 10.12.64.250;

        route 10.10.10.0/24 next-hop 10.12.64.250;

        route 20.20.20.0/24 next-hop 10.250.0.254; 

 

 and the ping source IP is 10.250.0.203 can you add a route to reach 10.250.0.x network? you have a route for 10.250.0.88 but not for the rest of the subnet.

 

regards. 

 

Trusted Contributor
Posts: 60
Registered: ‎09-09-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

Hi Christian,

 

so you can reach the secondary node now. Thats fine.

 

let me try to explain it.

 

The primary node 0 for RG0 uses the routing table from the default VR.

The secondary node for RG0 has no running Route daemon and therefor uses the backup router.

 

This means you have to configure routing for management in both instances.

 

Jmartinez is right. To get acces to the primary node you have to add

 

set routing-options static route 10.250.0.0/24 next-hop 10.12.64.250

 

than you should reach bothe nodes from your 10.250.0.0 network

 

If this worked for you please flag my post as an "Accepted Solution" so others can benefit.
A kudo would be cool if you think I earned it.

 

 

 

Contributor
Posts: 12
Registered: ‎10-07-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

Hello,

 

Yes thats right if I would add a route like this: 10.250.0.0/24 via 10.12.64.250 I would reach both devices. The route for 10.250.0.88 is for testing purposes. But if I would do that every traffic from 10.250.0.0/24 will be routed back over fxp0 interface and this cannot be the solution.

 

br,


Christian

Contributor
Posts: 45
Registered: ‎09-28-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

Hello Christian,

 

i cannot understand your problem now, what's the problem about adding the route and all the traffic from 10.250.0.0/24 be routed back to fxp0 interface? if you need  to route only a few host then you can add a /32 route.

 

regards. 

Contributor
Posts: 12
Registered: ‎10-07-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

Hello,

 

Yes there was a missunderstood. But think about that scenario  

 

Untrust some ip address

Trust 10.250.0.112/24

fxp 10.12.64.3 and .4 / 24

 

Between Trust and fxp Lan a router with 10.12.64.250 and 10.250.0.250. Nsm with ip 10.250.0.88/24.

 

Now I am adding a system wide route to the SRX which is like 10.250.0.88/32 via 10.12.64.250 interface fxp0.

 

The NSM has a route that he can reach 10.12.64.0/24 over 10.250.0.250.

 

So the request from NSM goes to 10.250.0.250 which routes the traffic to 10.12.64.3 for example. But the replie goes out over Trust interface because destination is 10.250.0.88 and Trust interface is connected directly which means a better metric. So we have asymmetric routing.

 

I have to tell the box that it should route traffic coming to the fxp, is routed back to the router defined by the backup router command (for that is the command I thought).

 

Can you understand the problem?

 

br,

Christian

 

 

Contributor
Posts: 45
Registered: ‎09-28-2009
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

[ Edited ]

Hello Christian,

 

i understand your problem now, it's so difficult, the firts thing that i think is to change the fxp0 IP for one in the 10.250.0.0/24 subnet, if this is not possible, i'll try a source based-routing, routing all the traffic that comes from 10.250.0.0/24 subnet to interface fxp0, in SCREENOS that was possible but i don´t know if you can do it with JUNOS.

 

regards 

 

 P.S. if you find a solution, let us know!

Message Edited by jmartinez on 10-08-2009 01:34 AM
Highlighted
Super Contributor
Posts: 222
Registered: ‎12-16-2008
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

We've been struggling with the same problem for several projects as well. An easy way to solve this is to add a /32 route to reach the NSM via the fxp0 interface, or install the NSM in the management network. But that way it can no longer reach the internet for IDP/schema updates. Even worse, it can't be used to manage remote devices anymore. So thats not really an option in most cases.

 

On netscreens this can easily be fixed because the devices can be managed inline (manage-ip) or the management interface can be moved to a different virtual router. Neither are possible on the SRX to my knowledge.

Moving all data interfaces to a different virtual router and using the default vr only for management traffic as we had to do on older netscreen versions doesn't work either as VPNs can only be terminated in inet.0 (another annoying limitation for branch deployments).

 

If anyone has any idea on how to fix this, I'd love to hear it. The usual response is "thats an interesting problem" Smiley Wink

 

Visitor
Posts: 7
Registered: ‎02-21-2010
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

[ Edited ]

Hi, Does everything find a solution already?Same problem....: All my Netscreen VPN devices which are connected to our SRX cluster needs to be monitored/managed by NSM are routed via the fxp0 interface and routed back to the trust zone on which the packets are denied. If I login on our SA 6000 (sslvpn) which is connected on one of the zones, then I am not able to run the NSM client on my machine. I guess source routing is the only option....anyone?

Regular Visitor
Posts: 10
Registered: ‎03-31-2010
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

 

Still looks like a problem today with 10.0 and 10.3.  I don't want my management routes in my inet.0 table, but I can't seem to make it work any other way.

 

Super Contributor
Posts: 222
Registered: ‎12-16-2008
0 Kudos

Re: Problem with configuration sync on SRX chassis cluster, and management IP

FYI, with NSM 2010.3 and JUNOS 10.1 (iirc) you can manage the devices in-line.

 

Other workarounds are of course possible with multiple routing instances - I have several set up that way.