Firewall – How to Configure Juniper SRX300 Cluster

firewalljuniperjuniper-junosjuniper-srx

I'm trying to set up chassis cluster on Juniper SRX300 (Junos 15.1X49-D45).

And I wasn't able to find any documentation on this matter.

I was able to run the command:

set chassis cluster cluster-id 0 node 0[1] reboot

on both nodes, but after the reboot cluster is not enabled:

root> show chassis cluster status
error: Chassis cluster is not enabled.

Is the anything else I should do?

Is there any special license required?

Best Answer

You can find full documentation here.

You're on the right track, but cluster-id should be greater than 0. From the documentation:

Setting a cluster ID to 0 is equivalent to disabling a cluster. A cluster ID greater than 15 can only be set when the fabric and control link interfaces are connected back-to-back.

Keep in mind that you need to connect the two SRX300 devices on port ge-0/0/1 (for the control link). In the factory default configuration, this interface is already configured and part of a security zone; you need to remove all configuration relating to this interface before the chassis cluster will form.

Related Solutions

Juniper SRX Issue – No Traffic After 17 Minutes

I solved this problem finally. By capturing and comparing DHCP Discover packets sent from JunOS and Cisco, I found Cisco sends Option 64 Client Identifier and Option 12 Host Name by default. However, JunOS will not send them without explicit instructions.

I think my ISP sets up a filter or something on their side. The above two options are mandatory. When I configure my SRX to send them, everything went through.

Juniper – Troubleshooting Unstable Uplink on SRX240 with VPN

With help from our service provider we've been able to localise the problem. The idea I had in my last comment proved correct: the difference between fast ethernet and gigabit ethernet was the source of the problem.

The reason for dropping connections, undeliverable packets and segmented packets was a mismatch in link mode between the fiber switch and the SRX - they hardcoded their port to 100m full duplex, but the SRX had automatic negotiation, which resolved to 100m half duplex.

The problem was further complicated by Juniper's odd configuration of speed and link mode. Just setting these configuration options wasn't enough:

speed 100m;
link-mode full-duplex;

This configuration was accepted, but when running show interfaces ge-0/0/0, it still showed:

Link-level type: Ethernet, MTU: 1514, Link-mode: Half-duplex, Speed: 100mbps,

Apparently, you have to explicitly disable auto-negotiation:

speed 100m;
link-mode full-duplex;
gigether-options {
    no-auto-negotiation;
}

In the end, I found that this guy had the exact same problem (and the solution!)

Thanks for all your help.

Best Answer

Related Solutions

Juniper SRX Issue – No Traffic After 17 Minutes

Juniper – Troubleshooting Unstable Uplink on SRX240 with VPN

Related Topic