Quantcast
Channel: All SRX Services Gateway posts
Viewing all articles
Browse latest Browse all 17645

SRX to Two ISP failover configuration

$
0
0

Good evening 

 

We have the following setup:

 

SRX HA Cluster 1500

 

Site A:                                              HQ:

SRX Node 0 ----> ISP 1---->MX-104 primary 

SRX Node 1 ----> ISP2------MX-104 backup

 

Site A have two IPSEC tunnels st0.0 and st0.1. st0.0 connect to MX-104 primary and st0.1 will connect to the MX-14 backup router. 

 

Site A: ISP1 is the primary link and ISP2 is the backup link to be use ONLY if the primary ISP1 fail. 

 

The site is currently using static routes on a Cisco router. We bought the SRX 1500 to replace the Cisco router currently in the Site A. 

 

I am currently testing the SRX-1500 in the lab and using two additional SRXs to simluate the MX. The currently MX-104 are in production. 

 

Site A have the following static routes:

 

set routing-options static route 0.0.0.0/0 next-hop 137.52.47.2
set routing-options static route 0.0.0.0/0 qualified-next-hop 137.52.79.2 preference 10
set routing-options static route 1.1.1.1/32 next-hop st0.0
set routing-options static route 137.52.70.0/24 next-hop 137.52.47.2
set routing-options static route 2.2.2.2/32 next-hop st0.1
set routing-options static route 137.52.0.0/24 next-hop st0.0

RPM configured:

set services rpm probe example test test-name target address 137.52.47.2
set services rpm probe example test test-name probe-count 3
set services rpm probe example test test-name probe-interval 15
set services rpm probe example test test-name test-interval 10
set services rpm probe example test test-name thresholds successive-loss 3
set services rpm probe example test test-name thresholds total-loss 3
set services rpm probe example test test-name destination-interface ge-0/0/0.0
set services rpm probe example test test-name hardware-timestamp
set services rpm probe example test test-name next-hop 137.52.47.2
set services ip-monitoring policy test match rpm-probe example
set services ip-monitoring policy test then preferred-route route 137.52.0.0/24 next-hop st0.1
set services ip-monitoring policy test then preferred-route route 10.0.0.0/8 next-hop st0.1

 

The problem i am having is that when i simulate failure in ISP1 uplink interface (manually disable the uplink interface). The st0 tunnels stay up and do not failover to st0.1  

 

No failure in ISP1 routing table:

 

root@sanjuan-fw01-n0> show route protocol static            

inet.0: 31 destinations, 32 routes (31 active, 0 holddown, 0 hidden)
Restart Complete
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 00:00:30
                    > to 137.52.47.2 via ge-0/0/0.0
                    [Static/10] 1d 01:31:26> to 137.52.79.2 via ge-7/0/0.0
1.1.1.1/32         *[Static/5] 00:00:27> via st0.0
2.2.2.2/32         *[Static/5] 04:49:40> via st0.1
137.52.0.0/24      *[Static/5] 00:00:27> via st0.0
137.52.70.0/24     *[Static/5] 00:00:30> to 137.52.47.2 via ge-0/0/0.0

ISP1 Fail:

 

root@sanjuan-fw01-n0> show route protocol static    

inet.0: 30 destinations, 31 routes (30 active, 0 holddown, 0 hidden)
Restart Complete
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/10] 1d 01:33:35
                    > to 137.52.79.2 via ge-7/0/0.0
1.1.1.1/32         *[Static/5] 00:02:36> via st0.0
2.2.2.2/32         *[Static/5] 04:51:49> via st0.1
10.0.0.0/8         *[Static/1] 00:00:07> via st0.1
137.52.0.0/24      *[Static/1] 00:00:07> via st0.1
                    [Static/5] 00:02:36> via st0.0
root@sanjuan-fw01-n0> show services ip-monitoring status 

Policy - test (Status: FAIL)
  RPM Probes:
    Probe name             Test Name       Address          Status   
    ---------------------- --------------- ---------------- ---------
    example                test-name       137.52.47.2      FAIL     
  Route-Action:
    route-instance    route             next-hop         state
    ----------------- ----------------- ---------------- ------------- 
    inet.0            137.52.0.0/24     st0.1            APPLIED      
    inet.0            10.0.0.0/8        st0.1            APPLIED   
root@sanjuan-fw01-n0> show security ipsec security-associations 
node0:
--------------------------------------------------------------------------
  Total active tunnels: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway   <131074 ESP:aes-cbc-128/sha1 4eba255b 3095/ unlim U root 500 137.52.79.2     >131074 ESP:aes-cbc-128/sha1 4e50a5eb 3095/ unlim U root 500 137.52.79.2  

The problem i am facing is that the st0.0 static routes are not being removed when the st0.0 goes down. 

 

I need to make sure the failover occur when the ISP1 port goes down in addition when there is no internet connection. 

 


Viewing all articles
Browse latest Browse all 17645

Trending Articles