SRX

last person joined: 3 days ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  standby node liveliness to be monitored in HA

    Posted 06-25-2019 20:49

    Hi Guys,

     

    we have srx1500s set up in HA. currently our NMS only monitor the liveliness of the active node. is there a way to monitor the back up node to alert us by NMS if it reboots or goes down? thanks 



  • 2.  RE: standby node liveliness to be monitored in HA
    Best Answer

    Posted 06-25-2019 21:29

    Hello,

     

    You should be able monitor the secondary node of a cluster provided FXP IP address and backup router settings are configured properly.

     

    Please find the sample configuration in page 11 in the following document:

     

    https://kb.juniper.net/library/CUSTOMERSERVICE/GLOBAL_JTAC/SRX-cluster-monitoring-best-practices.pdf

     

    Backup router configuration example:

    https://kb.juniper.net/InfoCenter/index?page=content&id=KB15580

     

    Regards,

    Prakash



  • 3.  RE: standby node liveliness to be monitored in HA

    Posted 06-25-2019 23:13

    Hi Prakash,

     

    thanks for that. im a little bit confused about the back up router's config, please help me to understand;

    "set groups node0/1 backup-router <back-up router's ip> destination <admin's subnet>"

     

    what if the SRX is the admin subnet's  gateway and we dont have managment subnet (we use srx reth interface ip to manage it).  what ip should we put on back up router's IP config on each node? can we use the admin's subnet on destination instead of /32 IP?

     



  • 4.  RE: standby node liveliness to be monitored in HA

     
    Posted 06-26-2019 06:47

    Hi K1mffrey,

     

    I think this will help aid your understanding of backup routers. 

     

    https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/backup-router-configuring.html

     

    The 'backup router sample topology' provides a topology of sorts, in terms of where this backup router sits.

     

    Feel free to post questions after.

    Cheers

    Pooja

    Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too!!!



  • 5.  RE: standby node liveliness to be monitored in HA

    Posted 06-27-2019 02:00

    Hello,

     

    Are you meaning that you are not using FXP interface but the reth interface to manage? Please find my answers inline for your other questions.

    what ip should we put on back up router's IP config on each node?

    The IP address of the next-hop to reach the destination NSM device subnet should be the IP address on each node.

     

    can we use the admin's subnet on destination instead of /32 IP?

    Yes you can use admin's subnet. It is just like creating a static route for the nodes to reach any destination using the FXP interface.

     

    If you are planning to use the reth interface, I think you can use Virtual Chassis feature to monitor the cluster. Secondary node will not be able to send any information to NSM and but JSRPD log viewer on the NSM would be able to report the status of the secondary node in the cluster. More information in the link below:

     

    https://kb.juniper.net/InfoCenter/index?page=content&id=KB18228&act=login

     

    Regards,

    Prakash



  • 6.  RE: standby node liveliness to be monitored in HA

     
    Posted 06-28-2019 07:29

    Hi K1mffrey,

     

    Did you get a chance to review the details shared by some of us on here?

    Did you have any further questions?

     

    Cheers

    Pooja

     



  • 7.  RE: standby node liveliness to be monitored in HA

     
    Posted 06-26-2019 08:35

    K1mffrey,

     

    Whenever you access/manage a cluster via a reth interface you will be accessing the SRX acting as the primary node for Redundancy-group 0 (RG0), that represents the Routing-Engines. At any given time only one Routing-Engine will be handling the whole cluster.

     

    The same happens if you do SNMP polling over a reth interface, you end up monitoring only the primary node for RG0. The way of monitoring/accessing the nodes separately is via their fxp0 interfaces and the same applies for SNMP monitoring purposes:

     

    https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-chassis-cluster-management-interfaces.html

    https://forums.juniper.net/t5/SRX-Services-Gateway/SNMP-through-FXP0/td-p/113442

     

    However, the fxp0 interfaces are aimed for networks where there is a out-of-band management network; this is an isolated subnet used exclusively for manage the devices in your network. Based on your comments you dont have this kind of subnet created as of yet because you manage the SRX via a reth interface. Being this the case I can see two possible scenarios:

     

    1. You create this out-of-band network and connect the fxp0 interfaces to it and monitor the SRX via its fxp0 interfaces. Please note that the fxp0 interfaces are for out-of-band management hence you cannot received traffic via a regular port and route it via a fxp0 interface or viceversa. This is usually a concept that people is not familiar with hence I will share some light here:

     

    In-band Management: When you access your devices via the regular production network. This means that your management traffic is competing for bandwidth  with the rest of the production traffic. If there is an outage in your production network (lets say a broadcast storm affecting your switches and routers), you could loose or see affected your ability to manage your networking devices.

     

    Out-of-band Management: When you create a network that is isolated from your production network and that will be used only for managing your networking devices. This way if there is an outage on your production network your ability to manage the devices wont be compromised. Your fxp0 interfaces are designed to be connected to this isolated network.

     

    2. Try the workaround mentioned in the following document. Note that in this example, the SRX is reached via a VPN interface (you can think of it as your reth interface). Bascially you will have to move all your regular interfaces to a virtual-router (because you cannot configure your fxp0 interfaces in a virtual-router) and communicate this new virtual-router with the default routing-instance where we left the fxp0 interfaces. In the example they connect the fxp0s to a switch where reth 2 is connected two and the interfaces shared the same subnet but are in different routing-instances:

     

    https://kb.juniper.net/InfoCenter/index?page=content&id=KB30949&cat=SRX_210&actp=LIST

     

    Hope it helps.