3

I have a project which i'm struggling with and wondered if someone can offer some advise on the best way to achieve my goal (i'm new to Juniper).

At the moment I have 2 juniper srx240, one connected a 100Mb fibre, and the other connected to 10 Mb EFM.

My goal is to set them up to allow for automatic fail over from one ISP to the other.

Idea being if the main 100Mb goes down that the backup automatically kicks back in.

I also need to setup 3 virtual routing instances, and two dmz.

idea being there is one instance for WAN, internet and VOIP traffic.

Attached is a picture to help explain the setup.

Any help would be greatly appreciatedn

Improve this question
3
  • Have you looked at VRRP?
    – Ron Maupin ♦
    Commented Feb 24, 2016 at 16:46
  • Could you describe the public IP addresses range you will use ? (a single IP per provider, or networks routed trough a /30 between the ISP and you , etc...)
    – JFL
    Commented Feb 24, 2016 at 16:52
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 13, 2017 at 18:25

2 Answers 2

Reset to default
1

This is a job for BGP.

You want a single public AS. You will use BGP and each ISP facing router eBGP peers with the ISP.

APNIC When should an AS be created?

An AS needs to be created if a network connects to more than one AS with different routing policies.

Some common examples of Autonomous Systems are networks connected to two or more upstream service providers or exchange points and networks peering locally at exchange points.

Improve this answer
1
  • This solution will copewith partial routes failure of one of your ISP without switching all the 100 Mbit/s interface traffic on the 10 Mbit/s one.
    – athena
    Commented Nov 21, 2016 at 11:55
0

I run this setup with a few clients of mine on varying SRX models. First, I would suggest that you cluster your SRXs, which requires getting them to a matching firmware version (always use JTAC's recommendation for your model).

If you haven't setup a cluster before, here's a link to get you started: http://kb.juniper.net/InfoCenter/index?page=content&id=KB15504&actp=search You can also call JTAC and they'll actually assist you in configuring the cluster and the failover routing if you prefer. Also, to do this properly, you'll want two leads coming from your ISP's box(modem, L3 switch, or whatever it is). If your ISP won't accommodate this, then you can use a switch but that just adds a point of failure. Doing all of this will allow either one of your SRXs to run either one of your ISPs at any given time.

As for the ISP failover/traffic splitting there are varying configuration possiblities. The simplest, is to just modify your static routes to include a qualified-next-hop. Again, there are several ways to configure the actual failover/HA portion between your ISPs but clustering your SRXs and connecting both ISPs to them is the best redundancy you can achieve.

For your traffic routing between ISPs for Voice and Data, are you going to be running your Voice network/subnet across the same physical switch stack as your data network? Basically, you'll need to create a separate interface/sub-interface on your Junipers and then assign that to a separate Security Zone. Once you've done this, you can NAT/route according to your needs.

Improve this answer
5
  • Hi, everyones help is greatly appreciated I've tried using vrrp, however not sure if it's becuase im trying to track a logical as opposed to physical interface but can't seem to get it to work The public IP address range will be 185.70.00/30 I'm going to try the setup of adding a switch, as the ADVA box only has one LAN port for the Leased line Another part i'm unsure of is our subnets, for each instance there will be 6 or 7 vlans, at the moment I have two security zones, trust and untrust would I need to create a new zone for each subnet, create a sub interafce that connect to the telcos
    – Adrian
    Commented Feb 26, 2016 at 12:57
  • @Adrian No, you do not need to create two different security zones. This is assuming that you are going to use the same policy sets with both ISP connections. If you wanted to have separate policy sets for each ISP, then you would want to create a separate security zone for each ISP connection. Otherwise, both of your ISP interfaces will be assigned to your single untrust security zone.
    – Jack Bahou
    Commented Feb 26, 2016 at 15:11
  • That's great, thank you, I've installed a switch now so each router has a connection to both the pri and secondary connection connection, going to give the cluster setup a try.
    – Adrian
    Commented Feb 26, 2016 at 17:05
  • Hi again, company decided they want to use vrrp, i've set it up, however both routers are in a master state, they are sending adverts but not receiving. I suspect there is an issue with the security configuration, but can't seem to find what is is, cans someone take a look as see when i'm going wrong? at this stage i want to standard vrrp on the lan side (172.16 range) then later on use vrrp route instance tracking for the wan config is below:
    – Adrian
    Commented Mar 9, 2016 at 16:08
  • Hi Adrian, At this stage I would recommend contacting JTAC to let them assist you. As long as you have an active support contract with Juniper there is no cost. They will help you configure the SRXs however you wish. For us to troubleshoot this for you could take a while especially without detailed diagrams and SRX configurations. From the US, JTAC's number is 888-314-5822. They will ask for your device's serial number and the version of firmware you're using so good to have those handy when you call.
    – Jack Bahou
    Commented Mar 9, 2016 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.