I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC: Multinode High Availability (HA)

JNCIP-SEC · Work through your exam, one topic at a time.

All guide sections

Multinode High Availability (HA)

Multinode HA on the SRX is a chassis cluster: two or more nodes sharing a control link, redundant Ethernet interfaces and a synchronized session table, with redundancy groups deciding which node forwards. The exam focuses on failover triggers and on what is and is not synchronized.

Core rules

  • Node identity is set once and reboots the device: set chassis cluster cluster-id 1 node 0 and node 1. Cluster ID 0 / node 0 means standalone.
  • The control link (fab0/fab1) carries heartbeats plus configuration and session synchronization, and must be directly connected on the same subnet.
  • Redundant Ethernet interfaces combine one physical member per node: set interfaces reth0 redundant-ether-options redundancy-group 1, with the address on the reth unit. Members must match in speed, duplex and media type.
  • RG0 runs the control plane and is normally primary on node 0. Data redundancy groups (RG1, RG2 …) carry their own priority, preempt flag and monitored interfaces, so different groups can be active on different nodes.
  • Interface monitoring uses weights: set chassis cluster redundancy-group 1 interface-monitor ge-0/0/1 weight 255, compared against the group's failover threshold. When surviving weight falls below the threshold, the group fails over.
  • IP monitoring can track upstream reachability and trigger failover when pings are lost.
  • Synchronized: sessions, NAT translations and IPsec SAs. Not synchronized: routing adjacencies, which must reconverge, and various per-node caches.

Worked example

RG1 has threshold 255, ge-0/0/1 weight 255 and ge-0/0/2 weight 100. Losing ge-0/0/2 leaves 255, which still meets the threshold, so no failover. Losing ge-0/0/1 leaves 100, below threshold, so node 1 takes RG1, sends gratuitous ARP for the reth addresses, and existing synchronized sessions continue forwarding.

Traps

  • Building a reth from mismatched member interfaces.
  • Routing the control link through a switch that also carries user traffic.
  • Expecting automatic failback without preempt.
  • Trusting show chassis cluster status alone; check show chassis cluster interfaces for reth state.
  • Forgetting that changing cluster-id or node-id requires a reboot.