Routing

Hi All,

Firstly apologies if this is in the wrong category - was unsure whether to class this as routing or ethernet switching

I have got a VPLS connection in place across our network and I can ping the CE devices across it however I am unable to establish VRRP.

The solution goes: CE0---SW---PE0---P---PE1---SW---CE1

CE0&CE1 = SRX300

PE0 = ACX5048

PE1 = SRX340 Packet based mode

SW = Cisco Catalysts

From CE0 GW I can ping CE1 GW and vice versa - see bellow:

CE0 = 10.51.0.2

CE1 = 10.51.0.3

CE0 --> CE1

netadmin@core.srx01.thn ping 10.51.0.3 source 10.51.0.2
PING 10.51.0.3 (10.51.0.3): 56 data bytes
64 bytes from 10.51.0.3: icmp_seq=0 ttl=64 time=17.830 ms
64 bytes from 10.51.0.3: icmp_seq=1 ttl=64 time=2.689 ms
64 bytes from 10.51.0.3: icmp_seq=2 ttl=64 time=17.403 ms
64 bytes from 10.51.0.3: icmp_seq=3 ttl=64 time=14.521 ms

CE1 --> CE0

netadmin@core.srx02.en1> ping 10.51.0.2 source 10.51.0.3
PING 10.51.0.2 (10.51.0.2): 56 data bytes
64 bytes from 10.51.0.2: icmp_seq=0 ttl=64 time=67.586 ms
64 bytes from 10.51.0.2: icmp_seq=1 ttl=64 time=2.712 ms
64 bytes from 10.51.0.2: icmp_seq=2 ttl=64 time=2.565 ms
64 bytes from 10.51.0.2: icmp_seq=3 ttl=64 time=2.675 ms
64 bytes from 10.51.0.2: icmp_seq=4 ttl=64 time=2.598 ms

CE0 Config:

ge-0/0/6 {
    description "INFRA: core.c3750g.thn ge-1/0/26 TRUNK PORT";
    flexible-vlan-tagging;
    encapsulation flexible-ethernet-services;
    unit 600 {
        vlan-id 600;
        family inet {
            address 10.51.0.2/24 {
                vrrp-group 1 {
                    virtual-address 10.51.0.1;
                    priority 90;
                    preempt;
                }
            }
        }
    }

CE1 Config:

ge-0/0/6 {
    description "INFRA: core.c3750g.en1 ge-1/0/26 TRUNK PORT";
    flexible-vlan-tagging;
    encapsulation flexible-ethernet-services;
    unit 600 {
        vlan-id 600;
        family inet {
            address 10.51.0.3/24 {
                vrrp-group 1 {
                    virtual-address 10.51.0.1;
                    preempt;
                }
            }
        }
    }

PE0 Config:

ge-0/0/6 {
    vlan-tagging;
    encapsulation flexible-ethernet-services;
    unit 600 {
        encapsulation vlan-vpls;
        vlan-id 600;
        family vpls;
    }
}
vucp_vpls {
    instance-type vpls;
    vlan-id all;
    interface ge-0/0/6.600;
    route-distinguisher 91.109.40.246:1;
    vrf-target target:59402:20000;
    protocols {
        vpls {
            site-range 10;
            no-tunnel-services;
            site pe-r-00.en1 {
                site-identifier 1;
            }
        }
    }
}

PE1 Config - I am aware of the unsupported statement warning

ge-0/0/25 {
    vlan-tagging;
    encapsulation flexible-ethernet-services;
    unit 600 {
        encapsulation vlan-vpls;
        vlan-id 600;
        family vpls;
    }
}
vucp_vpls {
    description "VPLS for server LAN redudnacy";
    instance-type vpls;
    ##
    ## Warning: statement ignored: unsupported platform (acx5048)
    ##
    vlan-id all;
    interface ge-0/0/25.600;
    route-distinguisher 91.109.40.245:1;
    vrf-target target:59402:20000;
    protocols {
        vpls {
            site-range 10;
            no-tunnel-services;
            site pe-r-01.thn {
                site-identifier 2;
            }
        }
    }
}

Could anyone advise on what troubleshooting steps I should follow to resolve the VRRP not establishing?

If any more info  is required please let me know, your help is greatly apprecaitaed

Kind Regards,

Alex Watson

Hello,

---

@awatson9898 wrote:

 

I have got a VPLS connection in place across our network and I can ping the CE devices across it however I am unable to establish VRRP.

 

VRRP does not "Establish" like BGP. 

Are You are saying You've got both CE0 and CE1 as VRRP masters? Have You allowed VRRP under security zone->host-inbound-traffic in SRX CEs, assuming SRX CEs are in flow mode?

Please share configurations from both CE0 and CE1.

Please share printout 

show vrrp extensive | no-more

- from both CE0 and CE1.

HTH

Thanks

Alex

Hi Alex,

"Establish" Was the wrong word choice for that

Both SRX's are in flow mode and have a valid security zone - for testing I have allowed all

What just clicked after your prompt was that although I had set system-services all BUT stupidly forgot to do protocols all;

Thanks for the prompt on this 

Regards,

Alex