Screen OS

last person joined: 7 months ago 

This is a legacy community with limited Juniper monitoring.
  • 1.  NSRP through a EX4200 switch

    Posted 04-21-2009 15:36

    Hello,

     

    I have a pair of ISG1000s and a pair of EX4200 switches.

     

    Eth1/2 from the ISG is in the HA zone and NSRP configured (same on both units).  On the EX4200 switch, I have created 2 access ports (just happens to be VLAN500), When I plug eth1/2 from ISG1 to eth1/2 ISG2 NRSP works as it should, when I move each ISG eth1/2 to the EX4200 NSRP fails.  When I look on the EX4200 I can see both ISG mac addresses on the ports I'd expect to see them.  On the EX4200 there are only 2 ports in VLAN500.

     

    On the ISG "set nsrp ha-link probe" is enabled on both.

     

    Anyone have a similar setup and have this working?

     

    Cheers! 



  • 2.  RE: NSRP through a EX4200 switch

    Posted 04-21-2009 19:41

    Hi Smitty,

     

     

    The HA links are not using tags or L3 to transmit, they are expecting to be B2B connected. Link probe is only to send end to end "pings" to make sure that the other end is there, otherwise we would rely on interface status to signal that the other box is down.

     

    Try the EX's native vlan so no tags are required, and see if that works.

     

    Thanks

     



  • 3.  RE: NSRP through a EX4200 switch

    Posted 04-22-2009 17:13

    Actually the link probe is specifically for HA connections via switches. It will help to detect if there is an issue on the other end as the devices are not connected B2B.

     

    Can you run a snoop on the HA interface and debug nsrp.

    That should prove if the firewall is rejecting due to the vlan tags.

     

    snoop filter ethernet interface X

    snoop detail len 1514

    snoop

    debug nsrp

    -> Swap the HA connections to the switch

    get db str (to see output).

     

     



  • 4.  RE: NSRP through a EX4200 switch

    Posted 04-22-2009 18:18

    Right, it pings the other end instead of relying on link status!!!

     

    You might need to disable IGMP snooping on the interfaces too. NSRP traffic is sent with multicast mac I think.

     

    Thanks

     

    Ben 



  • 5.  RE: NSRP through a EX4200 switch

    Posted 04-23-2009 08:43

    Hmm, the nsrp msgs do not actually use a multicast mac address:

     

    579369.0: ethernet0/3(i) len=60:0017cb465d87->0110dbf0f0f0/8133
                  MN:cid=3,flag=0,len=3072,port=7,su=2153596416,du=0
                  01 10 db f0 f0 f0 00 17 cb 46 5d 87 81 33 00 02     .........F]..3..
                  03 00 0c 00 07 00 00 00 00 00 00 00 00 00 80 5d     ...............]
                  46 00 31 00 00 00 00 00 00 00 00 00 00 00 00 00     F.1.............
                  00 00 00 00 00 00 00 00 00 00 00 00                 ............   

    See the snoop above taken from an NSRP setup.  The mac will still carry the Netscreen vendor mac in this case 0110db.

     

    So, I dont think igmp snoop will have any effect though. I think it may be worth more effort to see the debugs and snoops on the firewall to try and figure out why the NSRP packets are not going.

     

     

    Message Edited by WL on 04-23-2009 08:45 AM


  • 6.  RE: NSRP through a EX4200 switch

    Posted 04-23-2009 09:35

    So, I thought what you are doing with the switch is a fairly common thing. many people use this and it should work (after all thats why we have the "link probe" cmd which was implemented specifically for this scenario"

     

    I did a quick test to put 2 FWs together across a switch with a private vlan and it works fine (Im using C... switch though) 🙂

     

    I guess there is some kind of problem either with the communication/ configuration. Switch doesnt need to be configured with the native vlan, any vlan will do.

     

    I used vlan 6 for mine:

    SWC#sh run | b 0/11
    interface FastEthernet0/11
     description G111
     duplex full
     speed 100
     switchport access vlan 6
     spanning-tree portfast
    !

     



  • 7.  RE: NSRP through a EX4200 switch
    Best Answer

    Posted 04-23-2009 09:53

    Solved - the EX4200 had IGMP snooping enabled which affected the NSRP communication.  I thought in the documentation, I saw that NSRP used some sort of layer 2 multicast.  I am a newbie to the EX4200, not sure if the IGMP was enabled by default or by my poking around.  I'll have to test that later but for now, that did the trick.

     

    J