2

I have two Juniper routers (a SRX340 and a SRX320), each with a leased line, on the same IP range. They are designed to be connected together on specific network ports so that the SRX320 takes over if the SRX340 fails.

I also have two SonicWALL TZ600 firewalls, currently configured in "Active / Standby" high availability mode.

I want to connect the routers to the firewalls in such a way that any one device can fail without the whole system losing internet access. What options do I have, please?

EDIT: I have this working now. I connected the LAN ports from the two routers into a single switch, and then from there into the X1 port on the two firewalls. Each device can be switched off and internet access is maintained (after a minute or so of downtime). All I need to know now is how to eliminate the single switch as a potential single point of failure.

5
  • Which security features do you want from the Juniper devices vs the Sonicwall devices?
    – jonathanjo
    Commented Aug 21, 2018 at 10:00
  • Juniper SRX340 and 320?
    – jonathanjo
    Commented Aug 21, 2018 at 10:06
  • The Juniper devices have been supplied by our ISP, and I don't have access to their configuration. I've corrected the model numbers. Please assume all the security is on the SonicWALL devices.
    – matthewk
    Commented Aug 21, 2018 at 10:19
  • So SRX340 and SRX320 is configured as standalone devices and not joined in a cluster, correct? As far as I know, different models cannot be joined in a cluster. Also, please provide simple schema. Commented Aug 21, 2018 at 11:06
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Commented Dec 25, 2018 at 9:22

2 Answers 2

3

High availability is a big and sometimes tricky topic, depending on what you actually want to achieve. If you want to maintain running TCP connections, for example, with sub 100 ms retransmission, you've got some work to do.

On the other hand, a typical business who wants to maintain internet connectivity might have simpler targets: no single cable, box, or fuse should prevent a new browser connection after a 30 second outage. ("Hmm, that's slow, maybe try refresh, ah ... there it is.") Which is good enough for most business continuity purposes.

Usually the hardest parts to achieve are "divergent path" internet connections which don't actually diverge very much. I've had single trucks hitting single street furniture cause supposedly divergent multiple links to fail. Power supply can be another issue: in most organisations UPS is the only realistic approach. (Two small UPS per rack is what I normally try to use; big UPS can be very inflexible.)

In your case, I'm guessing your ISP has delivered something like VRRP (virtual router redundancy protocol) which delivers a new virtual router with a new IP address. One of the configured pool is elected to operate as this virtual router; if it dies, another takes over. It may have something better, to take into account link state.

Sonicwall on the other hand, operates as an active/passive pair, and the hardware swaps if one becomes defective.

Your layout might look like the following diagram. Note I've drawn servers as multiply connected, perhaps with two IP addresses or with an ethernet card which takes part in spanning tree. User PCs I've shown in two teams, one of which might go out at a time. (Or use wifi with multiple access points to address this.)

layout

With spanning tree throughout your switches, and considering the Juniper devices as a router with a switch, you might implement that like this:

showing switches

Hope that's helpful.

4
  • Thanks. You have suggested connecting each Juniper device to both SonicWALL devices. The problem with that is that, as far as I know, the SonicWALL devices cannot be configured to have a given IP range on more than one port. Happy to be told otherwise, but this is a bit of a stumbling block.
    – matthewk
    Commented Aug 21, 2018 at 14:08
  • Please post a little more detail of what your ISP has configured your Junipers to deliver, and happily will have a more specific think about your problem.
    – jonathanjo
    Commented Aug 21, 2018 at 18:37
  • Thanks, but I'm not sure I have much more detail than I have already posted. It's a /28 which is available over two different leased lines, 1Gbps on the SRX340, failing over to 30Mbps on the SRX320 if the other becomes unavailable.
    – matthewk
    Commented Aug 22, 2018 at 9:18
  • I was meaning there's a single IP address on the top of each Sonicwall, with switchports configured for STP. Certainly not overlapping addresses on different ports.
    – jonathanjo
    Commented Aug 22, 2018 at 9:24
0

In the end I managed to get hold of a network architect at our ISP, who told me what to do, which was:

  • Connect one switch to each Juniper device;
  • Connect each switch to one SonicWALL device;
  • Connect the two switches together.

This is in addition to the Juniper devices already being connected together, and the SonicWALL devices being connected together. Now, as required, any single device can fail without causing loss of connectivity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.