it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples. Please , help to define correct choice and describe what the settings should be on Srx650 and switch ex4200. Also important moment- is it possible connect swithes via fiber-optic ? Three Diagrams below outlines the logical configuration:
Option 1:
Option 2:
Option 3:
Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches:
Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure.
set interface x mtu 9216
Deactivate igmp-snooping for the HA VLAN or if not needed delete it completely. If you leave it enabled the switch will not forward the multicast frames because there are no IGMP messages to tell the switch which port is listening for these frames.
set protocols igmp-snooping vlan HA-VLAN disable
or
delete protocols igmp-snooping
Over which media you connect the switches with each other is not important, you can use copper or fiber as you wish. I would use an ae bundle interface with two or more links to reduce the chance of one link failure killing the whole connection between the switches. Don't forget to enable LACP on the ae bundle. If possible have the two links take different routes to prevent someone cutting both fibers at the same time.
This being said, if possible I would always suggest directly connecting the HA links of any firewall device. This reduces the risk that a problem on the switch (hardware failure, software bug, human error) will cause you a split-brain situation (both firewalls become master) which will certainly ruin your day (BTDT).
