Konfigurasi High Availability Juniper SRX Firewall dan HA Testing Failover

Hallo bro,

Buat anda yang lagi belajar juniper srx, atau anda lagi mendesign juniper dengan redundansi perangkat atau HA, sy rasa tulisan ini cocok buat anda hehe. Design untuk network dengan skala midle to large itu kebanyakan sudah mengadopsi teknik HA. Di Juniper sendiri teknik HA di Firewall SRX di kenal dengan Chassis Cluster. Nah chassis clsuter ini memungkinkan dua device dapat berfungsi atau beroperasi seperti satu perangkat. tentu fungsi HA nya yang kita inginkan.  Model design di juniper SRX sebenarnya tidak jauh beda dengan design HA di product security yang lain. Di bawah ini adalah beberapa prerequisite ketika anda mendesign HA juniper SRX.

Prerequisites

a. Model Chassis SRX harus sama

root> show chassis hardware
Hardware inventory:
Item             Version  Part number  Serial number     Description
Chassis                                CV2018AF0514      SRX300
Routing Engine   REV 0x12 650-065039   CV2018AF0514      RE-SRX300
FPC 0                                                    FPC
  PIC 0                                                  6xGE,2xGE SFP Base PIC
Power Supply 0

Misal pada contoh di atas ada SRX300 maka pasangannya nanti juga harus dengan seri SRX300 juga.

b. Versi Junos kedua SRX harus sama

Device SRX 1 dan 2 versi junos nya harus sama persis, anda bisa confirm atau check dengan command show version.

root> show version
Model: srx300
Junos: 15.1X49-D140.2
JUNOS Software Release [15.1X49-D140.2]

c. License kedua device juga harus sama.

Anda bisa confirm dengan command show system license, seperti contoh berikut.

root> show system license
License usage:
                                 Licenses     Licenses    Licenses    Expiry
  Feature name                       used    installed      needed
  dynamic-vpn                           0            2           0    permanent
  remote-access-ipsec-vpn-client        0            2           0    permanent

Licenses installed: none

Jika anda membeli license untuk SRX Cluster, maka anda perlu membeli nya untuk kedua device tersebut. Tidak bisa anda beli untuk salah satu nya saja.

d. Backup dan delete semua config existing

Saya sarankan anda backup dulu semua config kedua SRX, atau default config nya. lalu anda hapus semua config nya. Kenapa dihapus semua, supaya anda tidak pusing masalah config interface terutama, misal ada perbedaan config atau ada config di salah satu device yang belum dihapus, sehingga proses build HA nya tidak berjalan baik.

[edit]
root# delete
This will delete the entire configuration
Delete everything under this level? [yes,no] (no) yes


[edit]
root# set system root-authentication plain-text-password
New password:
Retype new password:

[edit]
root# show
## Last changed: 2018-07-15 07:52:24 UTC
version 15.1X49-D140.2;
system {
    root-authentication {
        encrypted-password "$5$OYQz1nil$iEOyHmBQFNLkNJIx7HFml9k7QseI90Ji42cqmL29MD6"; ## SECRET-DATA
    }
}
root# commit and-quit
commit complete
Exiting configuration mode
root>


Jadi anda hanya punya config root password. Selanjutnya anda bisa lakukan hal yang sama pada SRX satu lagi.

HA Configuration

Sbelum anda melangkah lebih jauh, coba anda bukan link berikut https://www.juniper.net/support/tools/srxha/

juniper telah menyediakan tools untuk ha generator,

jika anda execute langkah 7 di atas. maka anda bisa lihat gambar jelasnya sperti berikut:

Itu kira2 gambaran menggunakan ha generator. silakan lanjut dan ikuti tulisan sy dibawah ini 🙂

Setelah anda mengikuti tahapan pra-syarat di atas, maka anda bisa mulai membuild HA nya dengan mengikuti langkah2 berikut.

1.  Plug Cable antar device untuk koneksi Control Link dan Fabric Link.

Jadi ada koneksi fisik yang perlu anda hubungkan yaitu koneksi untuk control link dan koneksi untuk data link atau fabric link. Sy coba summary sedikit terkait control link diantaranya untuk heartbeat signal, configuration synchronization. Lalu interface yang akan digunakan untuk control link adalah SPC Port pada seri high-end, sedangkan pada seri branch control link biasa pada revenue port yang biasa dari juniper nya memang sudah di tentukan. lalu fabric link difungsikan untuk transit traffic, session synchronization. Anda bisa refer ke link ini untuk melihat control link juniper srx. link tersebut cukup lengkap sbg referensi buat anda.

Kebetulan lab pada tulisan ini menggunakan SRX300 maka, berikut adalah table berdasarkan link juniper di atas.

2. Enable Chassis Cluster lalu Reboot Perangkat.

Execute command berikut pada kedua SRX anda. Jika SRX-1 di set sbg primary, maka yang SRX-1 yang pertama anda execute. lalu di ikuti SRX-2.

Device SRX-1:
>set chassis cluster cluster-id 1 node 0 reboot
Device SRX-2:
>set chassis cluster cluster-id 1 node 1 reboot

Cluster-id range nya bisa dari 0-255, untuk node range dari 0-1. Jadi SRX-1 di set jadi node0 dan SRX-2 di set jadi node1.

3. Konfigurasi Fabric Link, Redundancy Group (RG), Reth-count interface

Lakukan konfigurasi fabric sperti contoh berikut ini.

Device SRX-1:

set interfaces fab0 fabric-options member-interfaces ge-0/0/2

Device SRX-2:

set interfaces fab1 fabric-options member-interfaces ge-1/0/2

command di SRX-2 gk bisa anda input di SRX-1, krena keduanya belum sync. Langkah berikutnya lakukan konfigurasi redundancy-group di device SRX-1

Device SRX-1:

set chassis cluster redundancy-group 0 node 0 priority 200
set chassis cluster redundancy-group 0 node 1 priority 100
set chassis cluster redundancy-group 1 node 0 priority 200
set chassis cluster redundancy-group 1 node 1 priority 100

Lakukan konfigurasi reth count juga pada device SRX-1

set chassis cluster reth-count 2

Jika sudah selesai step di atas, anda bisa lakukan commit terlebih dahulu supaya HA nya kebentuk.

SRX-1 dan SRX2 :

#commit

Sekarang harusnya SRX anda HA sudah jadi dan konfigurasi sudah sync, artinya anda bisa melanjutkan ke step berikut nya untuk input konfigurasi yang lain.

4. Konfigurasi interface monitoring, Reth interface revenue, Security Zone, Hostname dan Management inteface.

Sekali lagi konfigurasi di bawah ini anda bisa lakukan di device primary ja.

Interface monitoring:

set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-1/0/3 weight 255

Reth interface revenue, security zone:

set interfaces ge-0/0/3 gigether-options redundant-parent reth1
set interfaces ge-1/0/3 gigether-options redundant-parent reth1

set interfaces reth1 redundant-ether-options redundancy-group 1      
set interfaces reth1 unit 0 family inet address 192.168.1.1/24
set security zones security-zone trust interfaces reth1.0

Hostname, interface management:

set groups node0 system host-name RC-JKT.A
set groups node0 interfaces fxp0 unit 0 family inet address 192.168.10.1/24
set groups node1 system host-name RC-JKT.B
set groups node1 interfaces fxp0 unit 0 family inet address 192.168.10.2/24
set apply-groups "${node}"

Jika sudah anda bisa melakukan commit configuraiton.

#commit

Anda juga bisa menambah konfigurasi lainnnya sperti contoh berikut.

set system name-server 8.8.8.8
set system name-server 8.8.4.4
set system services ssh
set system services telnet
set system services netconf ssh
set system syslog archive size 100k
set system syslog archive files 10
set system syslog user * any emergency
set system syslog file messages any notice
set system syslog file messages authorization info
set system syslog file interactive-commands interactive-commands any
set system max-configurations-on-flash 5
set system max-configuration-rollbacks 49
set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval

5. Verifikasi

Berikut ini adalah command2 yang bisa anda gunakan untuk verify status HA juniper srx.

>show chassis cluster interfaces
>show chassis cluster status

mari kita lihat status HA juniper srx stelah anda konfigurasi di atas,

{primary:node0}
root@RC-JKT.A> show chassis cluster interfaces
Control link status: Up

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Up

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab0    ge-0/0/2           Up   / Up                 Disabled
    fab0
    fab1    ge-1/0/2           Up   / Up                 Disabled
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Up        1
    ge-0/0/3          255       Up        1

anda bisa lihat, status control link up, fabric link juga up, beserta interface buat revenue juga up. berikut nya mengidentifikasi primary dan secondary node.

root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      secondary      no      no       None

Redundancy group: 1 , Failover count: 1
node0  200      primary        no      no       None
node1  100      secondary      no      no       None

di atas anda bisa lihat bahwa Redundancy Group 0 dan 1, untuk RG-0 itu status redundancy Routing Engine, sedangkan RG-1 adalah untuk data plane atau traffic. Jadi di atas anda bisa lihat bahwa Node0 sbg primary untuk RG0 dan 1

HA Test Failover

Mari kita melangkah ke part berikut nya, yaitu testing HA failover, krena ini part yang sy rasa cukup penting jika anda sedang meng-handle atau akan menghandle HA juniper SRX . Berikut ini adalah contoh beberapa skenario yang bisa terjadi di real world.

Case 1: Interface traffic di node0 as primary di matikan.

Maka berikut ini adalah status nya, jika kita verify.

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      secondary      no      no       None

Redundancy group: 1 , Failover count: 2
node0  0        secondary      no      no       IF
node1  100      primary        no      no       None

redundancy group 1 adalah group buat ha di dataplane atau traffic. maka skrng traffic akan lewat di node1, namun routing masih di handle oleh node0 sebagaimana di tunjukkan di RG-0. Anda bisa verify traffic dengan show security flow session.

Case 2: Interface Node0 di naikin lagi.

jika pada case 1, interface yang seblumnya dimatikan atau putus, bagiamana jika anda naikin lagi interface nya.

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      secondary      no      no       None

Redundancy group: 1 , Failover count: 2
node0  200      secondary      no      no       None
node1  100      primary        no      no       None

Bisa anda lihat dan pastikan dari status di atas, traffic tidak akan pindah secara otomatis, tapi status interface failure (IF)-seblumnya. skrng sudah hilang (None)

Case 3:  Traffic pindah ke node0 atau kembali ke semula.

Jika pada case 2, traffic tidak pindah ke node awal, maka pada case ini kita akan buat SRX akan pindah secara otomatis jika interface yang smpet mati tadi tiba2 up lagi. untuk case ini anda bisa menambahkan konfgurasi preempt sperti berikut.

{primary:node0}[edit]
root@RC-JKT.A# set chassis cluster redundancy-group 1 preempt

{primary:node0}[edit]
root@RC-JKT.A# commit and-quit
node0:
configuration check succeeds
node1:
commit complete
node0:
commit complete
Exiting configuration mode

{primary:node0}
root@RC-JKT.A>

maka hasilnya adalah sperti berikut;

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      secondary      no      no       None

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  100      secondary      yes     no       None

Jadi anda bisa menambhkan opsi preempt command untuk failover otomatis sisi dataplane nya.

Case 4:  Test Control Plane Jika FAB link di matikan.

{secondary:node1}
root@RC-JKT.B> show chassis cluster interfaces
Control link status: Up

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Down

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab0    ge-0/0/2           Down / Down               Disabled
    fab0
    fab1    ge-1/0/2           Down / Down               Disabled
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Up        1
    ge-0/0/3          255       Up        1

Anda bisa lihat Fabric link status : Down. Dan coba lakukan verify status HA nya, maka beberapa detik kemudian akan muncul status HA berikut.

root@RC-JKT.B> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 0
node0  200      primary        no      no       None
node1  0        secondary      no      no       FL

Redundancy group: 1 , Failover count: 2
node0  200      primary        yes     no       None
node1  0        ineligible     yes     no       FL

jadi status HA berubah ke ineligible atau fabric link interface down (FL). Apakah kondisi traffic aman, yes masih aman, bisa anda lihat stattus HA node0 tidak ada perubahan.

Case 5: Fabric Link di colok kembali.

Case 4 dan case 5 berkaitan, jika fab link di naikin lagi maka node1 sempat melakukan soft reset. artinya node1 sbg secondary node tidak sampai melakukan auto reboot. hehehe

root@RC-JKT.B> show chassis cluster interfaces
Control link status: Up

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Down

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab0    ge-0/0/2           Down / Down               Disabled
    fab0
    fab1
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Down      1
    ge-0/0/3          255       Up        1

status interface revenue ge-1/0/3 (node1) skrang down, krena smpet reset atomatis, tapi tidak reboot ya 🙂

mari kita lihat hasil berikut nya jika kita terus melakukan verify;

{secondary:node1}
root@RC-JKT.B> show chassis cluster interfaces
Control link status: Up

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Down

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab0    ge-0/0/2           Up   / Down               Disabled
    fab0
    fab1    ge-1/0/2           Up   / Down               Disabled
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Up        1
    ge-0/0/3          255       Up        1

hasil berikut:
root@RC-JKT.B> show chassis cluster interfaces
Control link status: Up

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Up

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab0    ge-0/0/2           Up   / Up                 Disabled
    fab0
    fab1    ge-1/0/2           Up   / Up                 Disabled
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Up        1
    ge-0/0/3          255       Up        1

mari kita lihat lagi status HA nya.

root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      secondary      no      no       None

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  100      secondary      yes     no       None

yes, skrng sudah kembali normal.

Case 6 : Control Link di matikan.

Bagaimana jika case yang anda temui control link nya bermasalah atau mati. mari kita lihat.

Capture pada Node0:

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  0        lost           n/a     n/a      n/a

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  0        lost           n/a     n/a      n/a

wow, node lawanya di anggap lost. nah coba kita cek di node1.

{ineligible:node1}
root@RC-JKT.B> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 0
node0  0        lost           n/a     n/a      n/a
node1  100      ineligible     no      no       None

Redundancy group: 1 , Failover count: 2
node0  0        lost           n/a     n/a      n/a
node1  100      ineligible     yes     no       None

jadi bisa anda pastikan status di atas, traffic hanya akan lewat di node0, di node1 jika di kita verify, statusnya ineligbile dan node0 di anggap lost oleh node1. Dan selama kondisi control link mati, kedua node tidak melakukan soft reset, sperti yang terlihat di bawah ini:

{ineligible:node1}
root@RC-JKT.B> show chassis cluster interfaces
Control link status: Down

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Up

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab1    ge-1/0/2           Up   / Up                 Disabled
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Up        1
    ge-0/0/3          255       Up        1

Case 7 ; Control Link kembali Up

mari kita lihat status nya jika control link kembali up

root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      ineligible     no      no       None

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  0        ineligible     yes     no       IF

{primary:node0}

status RG-1 interface monitor nya IF, artinya node1 sempet melakukan soft reset. mari kita lihat jika kita terus verify. maka hasilnya sperti berikut ini;

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  0        lost           n/a     n/a      n/a

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  0        lost           n/a     n/a      n/a

status berikut:
{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      disabled       no      no       None

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  0        disabled       yes     no       IF CS


 {primary:node0}
root@RC-JKT.A> show chassis cluster interfaces
Control link status: Up

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Down

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab0    ge-0/0/2           Up   / Down               Disabled
    fab0
    fab1
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Down      1
    ge-0/0/3          255       Up        1

Dan berikut ini adalah status terakhir nya.

{primary:node0}
root@RC-JKT.A> show chassis cluster interfaces
Control link status: Up

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Down

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab0    ge-0/0/2           Up   / Down               Disabled
    fab0
    fab1
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Down      1
    ge-0/0/3          255       Up        1

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      disabled       no      no       None

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  0        disabled       yes     no       IF CS


 {disabled:node1}
root@RC-JKT.B> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 0
node0  200      primary        no      no       None
node1  100      disabled       no      no       None

Redundancy group: 1 , Failover count: 2
node0  200      primary        yes     no       None
node1  0        disabled       yes     no       IF CS

di atas adalah status terkahir, jika control link up lagi, bisa kita lihat bahwa node1 disable status nya, langkah berikut nya untuk memperabaiki kondisi HA nya. anda harus reboot manual node1.

Solusinya node1 secondary di lakukan reboot:
{secondary:node1}
root@RC-JKT.B> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 0
node0  200      primary        no      no       None
node1  0        secondary      no      no       CF

Redundancy group: 1 , Failover count: 0
node0  200      primary        yes     no       None
node1  0        secondary      yes     no       CF


{secondary:node1}
root@RC-JKT.B> show chassis cluster interfaces
Control link status: Up

Control interfaces:
    Index   Interface   Monitored-Status   Internal-SA   Security
    0       fxp1        Up                 Disabled      Disabled

Fabric link status: Up

Fabric interfaces:
    Name    Child-interface    Status                    Security
                               (Physical/Monitored)
    fab0    ge-0/0/2           Up   / Up                 Disabled
    fab0
    fab1    ge-1/0/2           Up   / Up                 Disabled
    fab1

Redundant-ethernet Information:
    Name         Status      Redundancy-group
    reth0        Down        Not configured
    reth1        Up          1

Redundant-pseudo-interface Information:
    Name         Status      Redundancy-group
    lo0          Up          0

Interface Monitoring:
    Interface         Weight    Status    Redundancy-group
    ge-1/0/3          255       Up        1
    ge-0/0/3          255       Up        1

Last status;
{secondary:node1}
root@RC-JKT.B> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 0
node0  200      primary        no      no       None
node1  100      secondary      no      no       None

Redundancy group: 1 , Failover count: 0
node0  200      primary        yes     no       None
node1  100      secondary      yes     no       None

Yes, sudah kembali sperti semula. Harap di perhatikan ya jangan sampai anda melakukan salah reboot node heheh

Case 8: Control Link dan Data Link di matikan secara bersamaan.

Maka berikut ini adalah status nya.

{primary:node1}
root@RC-JKT.B> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  0        lost           n/a     n/a      n/a
node1  100      primary        no      no       None

Redundancy group: 1 , Failover count: 1
node0  0        lost           n/a     n/a      n/a
node1  100      primary        yes     no       None

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  0        lost           n/a     n/a      n/a

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  0        lost           n/a     n/a      n/a

skrng status HA nya, masing2 node menganggap dirinya sbg primary. ini traffic bisa lewat di node0 atau node1. dan ini cukup berbahya. Sy sarankan jika smpe impact ke traffic, maka node1 secondary dimatikan sementra hingga link bisa diperbaiki. lalu bagaimana jika control link dan data link di colok lagi secara bergantian atau secara bersmaan maka hasilnya sama, capture nya bisa anda lihat sperti berikut ini:

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      secondary-hold no      no       None

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  100      secondary      yes     no       None

{secondary-hold:node1}
root@RC-JKT.B> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 2
node0  200      primary        no      no       None
node1  100      secondary-hold no      no       None

Redundancy group: 1 , Failover count: 2
node0  200      primary        yes     no       None
node1  0        secondary      yes     no       CS

last status

{primary:node0}
root@RC-JKT.A> show chassis cluster status
Monitor Failure codes:
    CS  Cold Sync monitoring        FL  Fabric Connection monitoring
    GR  GRES monitoring             HW  Hardware monitoring
    IF  Interface monitoring        IP  IP monitoring
    LB  Loopback monitoring         MB  Mbuf monitoring
    NH  Nexthop monitoring          NP  NPC monitoring
    SP  SPU monitoring              SM  Schedule monitoring
    CF  Config Sync monitoring      RE  Relinquish monitoring

Cluster ID: 1
Node   Priority Status         Preempt Manual   Monitor-failures

Redundancy group: 0 , Failover count: 1
node0  200      primary        no      no       None
node1  100      secondary      no      no       None

Redundancy group: 1 , Failover count: 3
node0  200      primary        yes     no       None
node1  100      secondary      yes     no       None

dari capture di atas, node1 smpet melakukan soft reset. Dan sy tidak menemukan kedua node melakukan auto reboot atau soft reset secara bersmaan, jadi dari case skenario di atas, traffic masih bisa lewat. sbg informasi ini sy coba di SRX300 series dengan junos versi 15.1X49-D140.2.

Ok, semoga ini bermanfaat buat anda, good luck selalu 🙂

About the author
Bunyamin

Routecloud Networks

Information about Server, Linux and Computer Network.

Great! You’ve successfully signed up.

Welcome back! You've successfully signed in.

You've successfully subscribed to Routecloud Networks.

Success! Check your email for magic link to sign-in.

Success! Your billing info has been updated.

Your billing was not updated.