SRX 650 HA configuration

[How to run the NSM GUI under Mac OS X]

How to run the NSM GUI under Mac OS X
How to setup a route-based VPN on a NetScreen
How to make your PPTP VPN client work through a NetScreen/SSG
Setting up a dial-up VPN and NetScreen Remote
How the Global Zone Works (It's probably not what you think)
How to configure NetScreen/SSG devices to work with the built in Mac OS X VPN client
How to Configure Dial-up VPN with route-based tunnels, XAuth, and use IPSecuritas

[salsak]

Hi

I'm pretty new to the whole Junos configuration so this might be a simple question. I have two srx 650 devices and I'm trying to configure chassis cluster on them according to this guide: http://kb.juniper.net/KB15503

I can't get any further than the first two commands:

On device A:    >set chassis cluster cluster-id 1 node 0 reboot
On device B:    >set chassis cluster cluster-id 1 node 1 reboot

After the reboot I get this error message "ha control port cannot be configured" and I'm stuck with that.

All I did before this was that I set the default gateway and passwords for the devices and ip-addresses for ge-0/0/1 interfaces and added them to the trust zone(I couldn't even connect to them).

Any help would be appreciated.

[Junacer]

Make sure you remove the vlans and such before trying to cluster these.  The default 10.0r1.8 comes with these, and I was getting the same thing.

I have a 240 but mine was acting the same way before I followed http://www.juniper.net/techpubs/software/junos-security/junos-security10.1/junos-security-swconfig-security/topic-43896.html

[salsak]

Thanks for you reply.

The srx 650 doesn't have any vlans defined by default. I went through these and it didn't help. Actual what i realized was that when i ran the command: "show chassis alarms" the output said that there is no route for the node.

So, the both devices are on the same subnet connected to each other, how am I suppose to configure the route? I suppose this is a really simple problem but I can't understand how to route two devices together if they are already on the same subnet..

[salsak]

Ok, this is really starting to get frustrating. Can someone please advice me how to configure the cluster. In the factory settings the interface ge-/0/0/1 has the ip 192.168.1.1 and the ge-0/0/2 interface has he 192.168.2.1. So this is the starting situation on both of the devices. If i want to keep the devices on the same subnet what are the steps that I have to take? Can I just set the ip addresses on the second device to 192.168.1.2 and 192.168.2.2 and connect the ge-0/0/1 ports and ge-0/0/2 port together. Do I have to configure the backup routers for the devices?

I've tried creating the cluster many times with different configurations but when i run this command: "set chassis cluster cluster-id 1 node 0 reboot" after the reboot i see an error message: "HA control port cannot be configured" Btw is there some way to see why It can't be configured? That message isn't very informative. After this the devices can't even ping each other and the "show chassis alarms" command gives the no route to node error.

Any kind of working configuration would be nice to see.
 

[salsak]

I just noticed that when I enable the cluster and boot the devices, the routing subsystem isn't running one either on of them. Is this normal behaviour for the devices if the configuration is wrong? I'm totally stuck with this, please give me some advice.

[aweck]

Try removing the interface configuration before enabling the chassis cluster.  ge-0/0/0 will become your management port (i.e. fxp0).  ge-0/0/1 needs to be connected back-to-back between nodes as this will become your chassis control port (i.e. fxp1).

The routing subsystem will only run on the active RG0 chassis cluster member.

•      Forum/Home
•      Store
•      Articles
•        Tech Articles
•        Industry News
•        Site News
•      Knowledgebase
•        JUNOS/Routing
•        NS/ISG/SSG/NSM
•        SSL VPN
•      Downloads

Please consider donating if we've saved you time or money. It helps pay for the bandwidth, equipment, and hosting charges to keep this site running

Submit Article/KB - Do not submit questions here.

[Today]

• Screening Spam by Joe Vallender [Today at 07:03:09 AM]
• Intrazone Policies by mknll [Today at 06:34:20 AM]
• Two ISPs and one DMZ by mulopaari2 [Today at 06:21:05 AM]
• Problem logging into my n... by fujisan [Today at 04:51:24 AM]
• VPN to cisco pix with two... by Watcher60 [Today at 04:38:27 AM]
• www.nikeincome.com cheap ... by xu_zhongying100 [Today at 02:30:17 AM]
• www.nikeincome.com cheap ... by xu_zhongying100 [Today at 02:29:08 AM]
• www.nikeincome.com cheap ... by xu_zhongying100 [Today at 02:27:32 AM]
• sell nike jordan fusion ... by xu_zhongying100 [Today at 02:25:15 AM]
• sell nike jordan fusion ... by xu_zhongying100 [Today at 02:22:32 AM]

Members

• Total Members: 22514
• Latest: Deepy

Stats

• Total Posts: 40575
• Total Topics: 11249
• Online Today: 77
• Online Ever: 393
• (August 06, 2008, 07:40:57 AM)

Users Online

Users: 3
Guests: 43
Total: 46

Deepy
tauron23
StefanS