01-19-2012 07:47 AM
I got this back from support:
"There are at least 7 ER’s opened on this problematic issue. (26985, 26983, 25921, 27771, 29840, 29841, 32317). Thus this issue is definitely on the Product Line Managers (PLM) radar. Most of the above ER’s concern a request for fxp0 interface to be placed in
a non-default routing instance. The branch SRX as a JUNOS device is specifically mentioned in many of the ER’s thus I don’t believe an additional ER is going to be appropriate in this case.
Please try to be patient as Juniper considers this issue and works towards an appropriate resolution."
01-19-2012 03:12 PM
And by the looks of it the final solution will involve VRs, just a simpler configuration whereby it is segregated to begin with (which I agree with).
I still don't get folks thinking this is an oversight, it's a normal routing limitation (the actual functions originally required, not the argument over whether to use fxp0 or not). You cannot have traffic concurrently egress from 2 different interfaces to the same host(s) with one routing table, on ANY IP unit. A forwarding table has to include the egress interface. The only way to have multiple forwarding tables is through VRs. And again VRs are very easy to work with on the SRX, changing your config to use them is really just a few minutes of work.
01-20-2012 12:52 PM
Remember to take at look in the KB, TN212: "Best Practices for SRX Series Cluster Management".
There are lots of good discussions around fxp0s, including the trick of a master-only address to send SNMP etc to the active master, and a routing trick to forward syslog streams out a "revenue" interface in the default routing instance.