Network Engineering Stack Exchange is a question and answer site for network engineers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples. Please , help to define correct choice and describe what the settings should be on Srx650 and switch ex4200. Also important moment- is it possible connect swithes via fiber-optic ? Three Diagrams below outlines the logical configuration:

Option 1: enter image description here

Option 2: enter image description here

Option 3: enter image description here

share|improve this question
up vote 9 down vote accepted

Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches:

  1. Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure.

    set interface x mtu 9216
  2. Deactivate igmp-snooping for the HA VLAN or if not needed delete it completely. If you leave it enabled the switch will not forward the multicast frames because there are no IGMP messages to tell the switch which port is listening for these frames.

    set protocols igmp-snooping vlan HA-VLAN disable


    delete protocols igmp-snooping

Over which media you connect the switches with each other is not important, you can use copper or fiber as you wish. I would use an ae bundle interface with two or more links to reduce the chance of one link failure killing the whole connection between the switches. Don't forget to enable LACP on the ae bundle. If possible have the two links take different routes to prevent someone cutting both fibers at the same time.

This being said, if possible I would always suggest directly connecting the HA links of any firewall device. This reduces the risk that a problem on the switch (hardware failure, software bug, human error) will cause you a split-brain situation (both firewalls become master) which will certainly ruin your day (BTDT).

share|improve this answer
Thank you! very useful answer! – Vitaliy Mar 14 '14 at 11:06
For branch srx series(for example, srx650) there is only dual fabric links possible. there is no dual control links. Is it true? – Vitaliy Mar 14 '14 at 11:13
Yes, they only support one control link. I don't like that either. – Sebastian Mar 14 '14 at 12:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.