Hi Aaron, On Sun, Jun 26, 2016 at 11:19 AM, Aaron Dewell <[email protected]> wrote: > > You are correct - RG0 will always be active/passive. A full control plane failover will always be painful. > > SRX active/active is more about the interfaces in use. You can arrange for half of your traffic to prefer FW1 vs. FW2 and achieve active/active in that way so you’ll take less of a hit when an interface fails (or a neighbor device goes down). So that’s really what you are protecting against, which seems like you’ve done that. >
Thanks for your feedback. It will be a lot of configuration, but was thinking I could do the following to limit RG0 failure (or southbound Core failure): - /31 transit VLAN per link (per VRF). So the total number of /31 transit's needed will be 4 * # of VRFs (28 /31's in my case). - Graceful restart configured on the SRX to limit RG0 failure. - Core1 failure (or Core2 failure) should be limited with graceful restart and all uplinks having an OSPF adjacencies. Anyways, just wondering your thoughts on this. I will probably just have to lab it to see how it performs. If active/active is not a good way, I might have to add in two MX border routers... That seems like a waste since I just need a default route via BGP. Thanks. /bs >> On Jun 26, 2016, at 12:15 PM, Brian Spade <[email protected]> wrote: >> >> Hi, >> >> I'm trying to figure out the best way to setup an SRX cluster as >> active/active. I have attached a diagram of the topology, but it's a >> full mesh of links. The ISP links are local interfaces and the >> southbound interfaces to the core routers are reth's. Core1 is HSRP >> primary for all VLANs. FW1 is primary for RG1 and FW2 is primary for >> RG2. The IGP is OSPF but have many VRFs that are connected to the FW >> with transit VLANs to bind the sub-interface to virtual router & zone. >> >> The issue I have is Core2 has no active OSPF neighbors in this setup. >> Therefore, if Core1 fails, there will be a control outage as Core2 >> establishes OSPF adjacencies. >> >> So I'm thinking it might be better to remove the reth's and use local >> interfaces on the FW/CORE links. This way I can have a full mesh of >> OSPF adjacencies and no control plane loss when Core1 fails. >> >> Does anyone have thoughts on this or recommend the best way to achieve >> this active/active full mesh setup? If there's good reason to not use >> active/active, I'd welcome the feedback. >> >> Thanks. >> /bs >> _______________________________________________ >> juniper-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/juniper-nsp > _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
