3

I'm looking to see if it is possible to have one VLAN span multiple reth interfaces without needing to do intra-zone security policies (from-zone A to-zone A). The idea is that I have the SRX240 cluster connected to two switches via two separate reth interfaces (reth0 and reth1). I have a management VLAN (VLAN 10) and I would like the SRX to act as the gateway (192.168.2.1/26) via an RVI. The SRX would then be able to provide access to both RVIs configured on the switches (192.168.2.2/26 on switch A and 192.168.2.3/26 on switch B).

Reading Junipers documentation on ethernet-switching on SRX clusters I see that, "Layer3 routing from L2 ethernet-switching network via L3-interface Vlan.X in chassis cluster deployment is supported as of Junos OS 12.1X44-D20, 12.1X45-D10 and higher versions." which seems to be a promising idea but I am unable to find further documentation on it.

I would like to see if it is at all possible to do via reth interfaces as using switch fabric will cause an outage defeating the purpose, to an extent, of having the cluster.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 8, 2017 at 21:42

1 Answer 1

Reset to default
2

Ethernet switching on Juniper SRX firewalls in Chassis Cluster is not done through reth interfaces, but by creating a "switching fabric" accross the cluster. In this switching fabric you can create vlans and RVI's as ususal, but this does require a sslight redesign of your configuration. You would need to:

  1. Create an additional link between the nodes: swfab interface. This link carries the switching fabric traffic between the nodes, and is in addition to the control- and fabric-links between the nodes.
  2. Add vlans.
  3. Change your reth.X interfaces (redundant ethernet) to vlan.X interfaces (RVI).

Juniper explains this a lot better than I do, in KB21422 (http://kb.juniper.net/InfoCenter/index?page=content&id=KB21422)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.