it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples. Please , help to define correct choice and describe what the settings should be on Srx650 and switch ex4200. Also important moment- is it possible connect swithes via fiber-optic ? Three Diagrams below outlines the logical configuration:

Option 1: enter image description here

Option 2: enter image description here

Option 3: enter image description here

1 Answer 1


Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches:

  1. Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure.

    set interface x mtu 9216
  2. Deactivate igmp-snooping for the HA VLAN or if not needed delete it completely. If you leave it enabled the switch will not forward the multicast frames because there are no IGMP messages to tell the switch which port is listening for these frames.

    set protocols igmp-snooping vlan HA-VLAN disable


    delete protocols igmp-snooping

Over which media you connect the switches with each other is not important, you can use copper or fiber as you wish. I would use an ae bundle interface with two or more links to reduce the chance of one link failure killing the whole connection between the switches. Don't forget to enable LACP on the ae bundle. If possible have the two links take different routes to prevent someone cutting both fibers at the same time.

This being said, if possible I would always suggest directly connecting the HA links of any firewall device. This reduces the risk that a problem on the switch (hardware failure, software bug, human error) will cause you a split-brain situation (both firewalls become master) which will certainly ruin your day (BTDT).

  • For branch srx series(for example, srx650) there is only dual fabric links possible. there is no dual control links. Is it true?
    – Vitaliy
    Mar 14, 2014 at 11:13
  • Yes, they only support one control link. I don't like that either. Mar 14, 2014 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.