Hallo bro,
Buat anda yang lagi belajar juniper srx, atau anda lagi mendesign juniper dengan redundansi perangkat atau HA, sy rasa tulisan ini cocok buat anda hehe. Design untuk network dengan skala midle to large itu kebanyakan sudah mengadopsi teknik HA. Di Juniper sendiri teknik HA di Firewall SRX di kenal dengan Chassis Cluster. Nah chassis clsuter ini memungkinkan dua device dapat berfungsi atau beroperasi seperti satu perangkat. tentu fungsi HA nya yang kita inginkan. Model design di juniper SRX sebenarnya tidak jauh beda dengan design HA di product security yang lain. Di bawah ini adalah beberapa prerequisite ketika anda mendesign HA juniper SRX.
Prerequisites
a. Model Chassis SRX harus sama
|
1 2 3 4 5 6 7 8 |
root> show chassis hardware Hardware inventory: Item Version Part number Serial number Description Chassis CV2018AF0514 SRX300 Routing Engine REV 0x12 650-065039 CV2018AF0514 RE-SRX300 FPC 0 FPC PIC 0 6xGE,2xGE SFP Base PIC Power Supply 0 |
Misal pada contoh di atas ada SRX300 maka pasangannya nanti juga harus dengan seri SRX300 juga.
b. Versi Junos kedua SRX harus sama
Device SRX 1 dan 2 versi junos nya harus sama persis, anda bisa confirm atau check dengan command show version.
|
1 2 3 4 |
root> show version Model: srx300 Junos: 15.1X49-D140.2 JUNOS Software Release [15.1X49-D140.2] |
c. License kedua device juga harus sama.
Anda bisa confirm dengan command show system license, seperti contoh berikut.
|
1 2 3 4 5 6 7 8 |
root> show system license License usage: Licenses Licenses Licenses Expiry Feature name used installed needed dynamic-vpn 0 2 0 permanent remote-access-ipsec-vpn-client 0 2 0 permanent Licenses installed: none |
Jika anda membeli license untuk SRX Cluster, maka anda perlu membeli nya untuk kedua device tersebut. Tidak bisa anda beli untuk salah satu nya saja.
d. Backup dan delete semua config existing
Saya sarankan anda backup dulu semua config kedua SRX, atau default config nya. lalu anda hapus semua config nya. Kenapa dihapus semua, supaya anda tidak pusing masalah config interface terutama, misal ada perbedaan config atau ada config di salah satu device yang belum dihapus, sehingga proses build HA nya tidak berjalan baik.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
[edit] root# delete This will delete the entire configuration Delete everything under this level? [yes,no] (no) yes [edit] root# set system root-authentication plain-text-password New password: Retype new password: [edit] root# show ## Last changed: 2018-07-15 07:52:24 UTC version 15.1X49-D140.2; system { root-authentication { encrypted-password "$5$OYQz1nil$iEOyHmBQFNLkNJIx7HFml9k7QseI90Ji42cqmL29MD6"; ## SECRET-DATA } } root# commit and-quit commit complete Exiting configuration mode root> |
Jadi anda hanya punya config root password. Selanjutnya anda bisa lakukan hal yang sama pada SRX satu lagi.
HA Configuration
Sbelum anda melangkah lebih jauh, coba anda bukan link berikut https://www.juniper.net/support/tools/srxha/
juniper telah menyediakan tools untuk ha generator,
jika anda execute langkah 7 di atas. maka anda bisa lihat gambar jelasnya sperti berikut:
Itu kira2 gambaran menggunakan ha generator. silakan lanjut dan ikuti tulisan sy dibawah ini 🙂
Setelah anda mengikuti tahapan pra-syarat di atas, maka anda bisa mulai membuild HA nya dengan mengikuti langkah2 berikut.
1. Plug Cable antar device untuk koneksi Control Link dan Fabric Link.
Jadi ada koneksi fisik yang perlu anda hubungkan yaitu koneksi untuk control link dan koneksi untuk data link atau fabric link. Sy coba summary sedikit terkait control link diantaranya untuk heartbeat signal, configuration synchronization. Lalu interface yang akan digunakan untuk control link adalah SPC Port pada seri high-end, sedangkan pada seri branch control link biasa pada revenue port yang biasa dari juniper nya memang sudah di tentukan. lalu fabric link difungsikan untuk transit traffic, session synchronization. Anda bisa refer ke link ini untuk melihat control link juniper srx. link tersebut cukup lengkap sbg referensi buat anda.
Kebetulan lab pada tulisan ini menggunakan SRX300 maka, berikut adalah table berdasarkan link juniper di atas.
2. Enable Chassis Cluster lalu Reboot Perangkat.
Execute command berikut pada kedua SRX anda. Jika SRX-1 di set sbg primary, maka yang SRX-1 yang pertama anda execute. lalu di ikuti SRX-2.
|
1 2 3 4 |
Device SRX-1: >set chassis cluster cluster-id 1 node 0 reboot Device SRX-2: >set chassis cluster cluster-id 1 node 1 reboot |
Cluster-id range nya bisa dari 0-255, untuk node range dari 0-1. Jadi SRX-1 di set jadi node0 dan SRX-2 di set jadi node1.
3. Konfigurasi Fabric Link, Redundancy Group (RG), Reth-count interface
Lakukan konfigurasi fabric sperti contoh berikut ini.
Device SRX-1:
|
1 |
set interfaces fab0 fabric-options member-interfaces ge-0/0/2 |
Device SRX-2:
|
1 |
set interfaces fab1 fabric-options member-interfaces ge-1/0/2 |
command di SRX-2 gk bisa anda input di SRX-1, krena keduanya belum sync. Langkah berikutnya lakukan konfigurasi redundancy-group di device SRX-1
Device SRX-1:
|
1 2 3 4 |
set chassis cluster redundancy-group 0 node 0 priority 200 set chassis cluster redundancy-group 0 node 1 priority 100 set chassis cluster redundancy-group 1 node 0 priority 200 set chassis cluster redundancy-group 1 node 1 priority 100 |
Lakukan konfigurasi reth count juga pada device SRX-1
|
1 |
set chassis cluster reth-count 2 |
Jika sudah selesai step di atas, anda bisa lakukan commit terlebih dahulu supaya HA nya kebentuk.
SRX-1 dan SRX2 :
|
1 |
#commit |
Sekarang harusnya SRX anda HA sudah jadi dan konfigurasi sudah sync, artinya anda bisa melanjutkan ke step berikut nya untuk input konfigurasi yang lain.
4. Konfigurasi interface monitoring, Reth interface revenue, Security Zone, Hostname dan Management inteface.
Sekali lagi konfigurasi di bawah ini anda bisa lakukan di device primary ja.
Interface monitoring:
|
1 2 |
set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255 set chassis cluster redundancy-group 1 interface-monitor ge-1/0/3 weight 255 |
Reth interface revenue, security zone:
|
1 2 3 4 5 6 |
set interfaces ge-0/0/3 gigether-options redundant-parent reth1 set interfaces ge-1/0/3 gigether-options redundant-parent reth1 set interfaces reth1 redundant-ether-options redundancy-group 1 set interfaces reth1 unit 0 family inet address 192.168.1.1/24 set security zones security-zone trust interfaces reth1.0 |
Hostname, interface management:
|
1 2 3 4 5 |
set groups node0 system host-name RC-JKT.A set groups node0 interfaces fxp0 unit 0 family inet address 192.168.10.1/24 set groups node1 system host-name RC-JKT.B set groups node1 interfaces fxp0 unit 0 family inet address 192.168.10.2/24 set apply-groups "${node}" |
Jika sudah anda bisa melakukan commit configuraiton.
|
1 |
#commit |
Anda juga bisa menambah konfigurasi lainnnya sperti contoh berikut.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
set system name-server 8.8.8.8 set system name-server 8.8.4.4 set system services ssh set system services telnet set system services netconf ssh set system syslog archive size 100k set system syslog archive files 10 set system syslog user * any emergency set system syslog file messages any notice set system syslog file messages authorization info set system syslog file interactive-commands interactive-commands any set system max-configurations-on-flash 5 set system max-configuration-rollbacks 49 set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval |
5. Verifikasi
Berikut ini adalah command2 yang bisa anda gunakan untuk verify status HA juniper srx.
|
1 2 |
>show chassis cluster interfaces >show chassis cluster status |
mari kita lihat status HA juniper srx stelah anda konfigurasi di atas,
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
{primary:node0} root@RC-JKT.A> show chassis cluster interfaces Control link status: Up Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Up Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab0 ge-0/0/2 Up / Up Disabled fab0 fab1 ge-1/0/2 Up / Up Disabled fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Up 1 ge-0/0/3 255 Up 1 |
anda bisa lihat, status control link up, fabric link juga up, beserta interface buat revenue juga up. berikut nya mengidentifikasi primary dan secondary node.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 secondary no no None Redundancy group: 1 , Failover count: 1 node0 200 primary no no None node1 100 secondary no no None |
di atas anda bisa lihat bahwa Redundancy Group 0 dan 1, untuk RG-0 itu status redundancy Routing Engine, sedangkan RG-1 adalah untuk data plane atau traffic. Jadi di atas anda bisa lihat bahwa Node0 sbg primary untuk RG0 dan 1
HA Test Failover
Mari kita melangkah ke part berikut nya, yaitu testing HA failover, krena ini part yang sy rasa cukup penting jika anda sedang meng-handle atau akan menghandle HA juniper SRX . Berikut ini adalah contoh beberapa skenario yang bisa terjadi di real world.
Case 1: Interface traffic di node0 as primary di matikan.
Maka berikut ini adalah status nya, jika kita verify.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
{primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 secondary no no None Redundancy group: 1 , Failover count: 2 node0 0 secondary no no IF node1 100 primary no no None |
redundancy group 1 adalah group buat ha di dataplane atau traffic. maka skrng traffic akan lewat di node1, namun routing masih di handle oleh node0 sebagaimana di tunjukkan di RG-0. Anda bisa verify traffic dengan show security flow session.
Case 2: Interface Node0 di naikin lagi.
jika pada case 1, interface yang seblumnya dimatikan atau putus, bagiamana jika anda naikin lagi interface nya.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
{primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 secondary no no None Redundancy group: 1 , Failover count: 2 node0 200 secondary no no None node1 100 primary no no None |
Bisa anda lihat dan pastikan dari status di atas, traffic tidak akan pindah secara otomatis, tapi status interface failure (IF)-seblumnya. skrng sudah hilang (None)
Case 3: Traffic pindah ke node0 atau kembali ke semula.
Jika pada case 2, traffic tidak pindah ke node awal, maka pada case ini kita akan buat SRX akan pindah secara otomatis jika interface yang smpet mati tadi tiba2 up lagi. untuk case ini anda bisa menambahkan konfgurasi preempt sperti berikut.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
{primary:node0}[edit] root@RC-JKT.A# set chassis cluster redundancy-group 1 preempt {primary:node0}[edit] root@RC-JKT.A# commit and-quit node0: configuration check succeeds node1: commit complete node0: commit complete Exiting configuration mode {primary:node0} root@RC-JKT.A> |
maka hasilnya adalah sperti berikut;
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
{primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 secondary no no None Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 100 secondary yes no None |
Jadi anda bisa menambhkan opsi preempt command untuk failover otomatis sisi dataplane nya.
Case 4: Test Control Plane Jika FAB link di matikan.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
{secondary:node1} root@RC-JKT.B> show chassis cluster interfaces Control link status: Up Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Down Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab0 ge-0/0/2 Down / Down Disabled fab0 fab1 ge-1/0/2 Down / Down Disabled fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Up 1 ge-0/0/3 255 Up 1 |
Anda bisa lihat Fabric link status : Down. Dan coba lakukan verify status HA nya, maka beberapa detik kemudian akan muncul status HA berikut.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
root@RC-JKT.B> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 0 node0 200 primary no no None node1 0 secondary no no FL Redundancy group: 1 , Failover count: 2 node0 200 primary yes no None node1 0 ineligible yes no FL |
jadi status HA berubah ke ineligible atau fabric link interface down (FL). Apakah kondisi traffic aman, yes masih aman, bisa anda lihat stattus HA node0 tidak ada perubahan.
Case 5: Fabric Link di colok kembali.
Case 4 dan case 5 berkaitan, jika fab link di naikin lagi maka node1 sempat melakukan soft reset. artinya node1 sbg secondary node tidak sampai melakukan auto reboot. hehehe
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
root@RC-JKT.B> show chassis cluster interfaces Control link status: Up Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Down Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab0 ge-0/0/2 Down / Down Disabled fab0 fab1 fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Down 1 ge-0/0/3 255 Up 1 |
status interface revenue ge-1/0/3 (node1) skrang down, krena smpet reset atomatis, tapi tidak reboot ya 🙂
mari kita lihat hasil berikut nya jika kita terus melakukan verify;
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 |
{secondary:node1} root@RC-JKT.B> show chassis cluster interfaces Control link status: Up Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Down Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab0 ge-0/0/2 Up / Down Disabled fab0 fab1 ge-1/0/2 Up / Down Disabled fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Up 1 ge-0/0/3 255 Up 1 hasil berikut: root@RC-JKT.B> show chassis cluster interfaces Control link status: Up Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Up Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab0 ge-0/0/2 Up / Up Disabled fab0 fab1 ge-1/0/2 Up / Up Disabled fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Up 1 ge-0/0/3 255 Up 1 |
mari kita lihat lagi status HA nya.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 secondary no no None Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 100 secondary yes no None |
yes, skrng sudah kembali normal.
Case 6 : Control Link di matikan.
Bagaimana jika case yang anda temui control link nya bermasalah atau mati. mari kita lihat.
Capture pada Node0:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
{primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 0 lost n/a n/a n/a Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 0 lost n/a n/a n/a |
wow, node lawanya di anggap lost. nah coba kita cek di node1.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
{ineligible:node1} root@RC-JKT.B> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 0 node0 0 lost n/a n/a n/a node1 100 ineligible no no None Redundancy group: 1 , Failover count: 2 node0 0 lost n/a n/a n/a node1 100 ineligible yes no None |
jadi bisa anda pastikan status di atas, traffic hanya akan lewat di node0, di node1 jika di kita verify, statusnya ineligbile dan node0 di anggap lost oleh node1. Dan selama kondisi control link mati, kedua node tidak melakukan soft reset, sperti yang terlihat di bawah ini:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
{ineligible:node1} root@RC-JKT.B> show chassis cluster interfaces Control link status: Down Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Up Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab1 ge-1/0/2 Up / Up Disabled fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Up 1 ge-0/0/3 255 Up 1 |
Case 7 ; Control Link kembali Up
mari kita lihat status nya jika control link kembali up
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 ineligible no no None Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 0 ineligible yes no IF {primary:node0} |
status RG-1 interface monitor nya IF, artinya node1 sempet melakukan soft reset. mari kita lihat jika kita terus verify. maka hasilnya sperti berikut ini;
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 |
{primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 0 lost n/a n/a n/a Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 0 lost n/a n/a n/a status berikut: {primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 disabled no no None Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 0 disabled yes no IF CS {primary:node0} root@RC-JKT.A> show chassis cluster interfaces Control link status: Up Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Down Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab0 ge-0/0/2 Up / Down Disabled fab0 fab1 fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Down 1 ge-0/0/3 255 Up 1 |
Dan berikut ini adalah status terakhir nya.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 |
{primary:node0} root@RC-JKT.A> show chassis cluster interfaces Control link status: Up Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Down Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab0 ge-0/0/2 Up / Down Disabled fab0 fab1 fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Down 1 ge-0/0/3 255 Up 1 {primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 disabled no no None Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 0 disabled yes no IF CS {disabled:node1} root@RC-JKT.B> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 0 node0 200 primary no no None node1 100 disabled no no None Redundancy group: 1 , Failover count: 2 node0 200 primary yes no None node1 0 disabled yes no IF CS |
di atas adalah status terkahir, jika control link up lagi, bisa kita lihat bahwa node1 disable status nya, langkah berikut nya untuk memperabaiki kondisi HA nya. anda harus reboot manual node1.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 |
Solusinya node1 secondary di lakukan reboot: {secondary:node1} root@RC-JKT.B> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 0 node0 200 primary no no None node1 0 secondary no no CF Redundancy group: 1 , Failover count: 0 node0 200 primary yes no None node1 0 secondary yes no CF {secondary:node1} root@RC-JKT.B> show chassis cluster interfaces Control link status: Up Control interfaces: Index Interface Monitored-Status Internal-SA Security 0 fxp1 Up Disabled Disabled Fabric link status: Up Fabric interfaces: Name Child-interface Status Security (Physical/Monitored) fab0 ge-0/0/2 Up / Up Disabled fab0 fab1 ge-1/0/2 Up / Up Disabled fab1 Redundant-ethernet Information: Name Status Redundancy-group reth0 Down Not configured reth1 Up 1 Redundant-pseudo-interface Information: Name Status Redundancy-group lo0 Up 0 Interface Monitoring: Interface Weight Status Redundancy-group ge-1/0/3 255 Up 1 ge-0/0/3 255 Up 1 Last status; {secondary:node1} root@RC-JKT.B> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 0 node0 200 primary no no None node1 100 secondary no no None Redundancy group: 1 , Failover count: 0 node0 200 primary yes no None node1 100 secondary yes no None |
Yes, sudah kembali sperti semula. Harap di perhatikan ya jangan sampai anda melakukan salah reboot node heheh
Case 8: Control Link dan Data Link di matikan secara bersamaan.
Maka berikut ini adalah status nya.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 |
{primary:node1} root@RC-JKT.B> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 0 lost n/a n/a n/a node1 100 primary no no None Redundancy group: 1 , Failover count: 1 node0 0 lost n/a n/a n/a node1 100 primary yes no None {primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 0 lost n/a n/a n/a Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 0 lost n/a n/a n/a |
skrng status HA nya, masing2 node menganggap dirinya sbg primary. ini traffic bisa lewat di node0 atau node1. dan ini cukup berbahya. Sy sarankan jika smpe impact ke traffic, maka node1 secondary dimatikan sementra hingga link bisa diperbaiki. lalu bagaimana jika control link dan data link di colok lagi secara bergantian atau secara bersmaan maka hasilnya sama, capture nya bisa anda lihat sperti berikut ini:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 |
{primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 secondary-hold no no None Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 100 secondary yes no None {secondary-hold:node1} root@RC-JKT.B> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 2 node0 200 primary no no None node1 100 secondary-hold no no None Redundancy group: 1 , Failover count: 2 node0 200 primary yes no None node1 0 secondary yes no CS last status {primary:node0} root@RC-JKT.A> show chassis cluster status Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 1 node0 200 primary no no None node1 100 secondary no no None Redundancy group: 1 , Failover count: 3 node0 200 primary yes no None node1 100 secondary yes no None |
dari capture di atas, node1 smpet melakukan soft reset. Dan sy tidak menemukan kedua node melakukan auto reboot atau soft reset secara bersmaan, jadi dari case skenario di atas, traffic masih bisa lewat. sbg informasi ini sy coba di SRX300 series dengan junos versi 15.1X49-D140.2.
Ok, semoga ini bermanfaat buat anda, good luck selalu 🙂
Komentar