Loopback interface for chassis cluster VPN-This feature is supported on all
high-end SRX Series devices.
An Internet Key Exchange (IKE) gateway needs an external interface to
communicate with a peer device. In a chassis cluster setup, the node on
which the external interface is active selects a Services Processing Unit
(SPU) to support the VPN tunnel. IKE and IPsec packets are processed on that
SPU. Therefore, the active external interface determines the anchor SPU.
In a chassis cluster setup, this external interface can be the redundant
Ethernet interface or a standalone interface. These interfaces can go down
when the physical interfaces are down. Therefore, loopback interfaces can be
used to reach the peer gateway because the loopback interfaces are alternate
physical interfaces.
This feature allows the loopback interface to be configured for any
redundancy group. This redundancy group configuration is only checked for
VPN packets, because only VPN packets must find the anchor SPU through the
active interface.
On high-end SRX Series devices, the lo0 pseudointerface cannot be configured
in RG0 when it is used as an IKE gateway external interface. Because a VPN
is only supported in an active/passive chassis cluster environment on
high-end SRX Series devices, the lo0 pseudointerface can be configured in
such a setup for RG1. In a chassis cluster setup, the node on which the
external interface is
https://www.juniper.net/techpubs/en_US/junos12.1x44/information-products/topic-collections/release-notes/12.1x44-d10/topic-72756.html#jd0e7482
Thanks
Alex
----- Original Message -----
From: "OBrien, Will" <obri...@missouri.edu>
To: "juniper-nsp" <juniper-nsp@puck.nether.net>
Sent: Wednesday, April 03, 2013 9:12 PM
Subject: [j-nsp] ike túnnel termination on 5800s
Hey guys, I'm building a new cluster of SRX 5800s and prepping to move
several VPN tunnels to it. All of them are ike/ipsec.
I built a test site on a SRX210 and configured a tunnel between it and my
cluster. My tunnels aren't coming up on the 5800 side at all.
I'm using Agg Eth interfaces on each chassis cluster member since they are
in diverse locations and the ciscos they connect to aren't configured for
VPC pairing.
Basically, I've got a 20Gb Agg link up and down from each cluster member.
Up heads to my DMZ/Internet and Down goes to the client core. (and a 20Gb
lane between the cluster members)
In checking my documentation on VPN tunnels, I found this gem:
http://kb.juniper.net/InfoCenter/index?page=content&id=KB19829&actp=search&viewlocale=en_US&searchid=1365002153257
Apparently, high end SRX isn't supporting IKE unless it's via a RETH
interface. <RANT> WHAT THE FREAKING HELL</RANT>
So, after some work with JTAC to validate my working plan, we configured
our agg links as reth interfaces, which have two members off the same
chassis to work around the restriction.
I now have tunnels talking to my new "reth" interfaces, but I'm incredibly
displeased that I can't just terminate those on a loopback.
Are there any angles I'm missing on this? I can mostly live with the
altered configuration. Luckily I planned to transition my vpn tunnels
first, so I was able to reconfigure my DMZ uplinks without incurring an
outage.
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp
