On Fri, Aug 29, 2008 at 6:31 AM, Sidney Boumendil <[EMAIL PROTECTED]> wrote: > On 8/29/08, SunnyDay <[EMAIL PROTECTED]> wrote: >> Im not going to use cerificates just policy based vpn or route-based >> is there any issue on these? > > As long as your cluster is well configured (rto mirror sync, config > sync, etc), I can't thing of anything else. > > B.R > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp >
Hmmm... a couple additional things come to mind. By default NSRP contains a mechanism which ensures that the system clocks on both systems within the NSRP cluster remain synchronized. However, if you are also using NTP to set the system clocks, the time between the cluster members can become unsynchronized. In this case, you will want to disable the NSRP time synchronization between the two cluster members because NTP has much better time resolution in sub-seconds, versus NSRP resolution in seconds. Enter the following command on your cluster if you are also doing NTP on your cluster members: set ntp no-ha-sync As Sidney mentioned, you are going to want to make sure you enable Run-Time Object synchonization, lest your sessions, ARP cache entries, and IPSec SAs will not be synchronized and will need to be reestablished again after a failure scenario. Enter the following command to ensure that you have enabled RTO synchronization set nsrp rto-mirror sync While we are on the subject, might I suggest going to Active/Passive? A/P is much easier, less prone to problems, and also promotes deterministic performance during failure scenarios. People will always use the excess bandwidth provided during normal A/A operation and become used to it... then when a failure occurs you effectively halve your performance... people start grumbling ;) -- Stefan Fouant Principal Network Engineer NeuStar, Inc. - http://www.neustar.biz GPG Key ID: 0xB5E3803D _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
