Configure Active/Passive High Availability (NSRP)

By | December 26, 2013

The basic configuration steps for the following topology are documented in this solution.


Minimum software and hardware requirements for configuring Active/ Passive NSRP:

  • Firewall’s with identical ScreenOS versions and license keys
  • Firewall’s with identical hardware
  • At least one interface on each firewall to be configured in the HA zone, which will be used for carrying control channel information

SOLUTION:

For assistance with configuring a pair of firewalls for NSRP, follow the steps below.

Step 1  Perform basic configuration on Firewall-A.  Bind the interfaces to the zones desired, and configure an IP address on the interfaces.

set interface ethernet0/3 zone untrust
set interface ethernet0/1 zone trust
set interface ethernet0/3 ip 10.1.1.2/24
set interface ethernet0/1 ip 1.1.1.1/24

It is also possible to do minimal configuration as above and proceed onto the next step to configure NSRP.  Then once the Active/Passive pair is configured for NSRP, subsequent configuration commands (policies, VPNs, etc) will be automatically sync’d to the other firewall.

Step 2  Start configuring NSRP by choosing the interface(s) for HA. In our example, it is eth0/4. For more information on assigning the HA ports,

set interface ethernet0/4 zone H
Step 3  Configure the NSRP cluster id:

set nsrp cluster id 1

Both firewalls in the cluster must have the same Cluster ID number.

Important:  Other NSRP firewall pairs on the same segment must have a different set of cluster ids.
Once the cluster id is set to a value, all the security interfaces will become part of the VSD-group 0, by default.
Step 4  [Optional]  Configure cluster name for NSRP:

Each NSRP cluster member can have different host names. In situations with SNMP or IPSec configured, a failover of the NSRP device can mean a disruption in communication for SNMP or IPSec. Defining a single name for all cluster members allows SNMP communication and digital certificates use to be continued without interruption after failover.

To define a single name for all cluster members, type the following CLI command:

set nsrp cluster name <name_str>

Use the cluster name when configuring the SNMP host name for the Juniper firewall device (set snmp name name_str) and when defining the common name in a PKCS10 certificate request file.
Step 5  [Recommended]  Configure NSRP monitoring to trigger failover if an interface goes down.

set nsrp monitor interface eth0/1
set nsrp monitor interface eth0/3

By adding the monitor command we will monitor the physical state of the interface eth0/1 and eth0/3.  In the event that either one of the interfaces goes down, Firewall-A will initiate a fail over to Firewall-B, and Firewall-B will continue to pass traffic.

Step 6  Configure NTP command, if applicable.  Are your firewalls configured with an NTP (Network Time Protocol) server?

No   - Continue with Step 7.Yes - Enter the command:  set ntp no-ha-sync
Step 7  Repeat steps 2 – 6 for Firewall-B.

 

Step 8  Synchronize the configurations from the Backup firewall.  On Firewall-B, enter the following CLI command:

firewall-B-> exec nsrp sync global-config save

The following will be reported shortly after you enter the above command:

load peer system config to save
firewall-B(B)-> Save global configuration successfully.
firewall-B(B)-> Save local configuration successfully.
firewall-B(B)-> Done.
firewall-B(B)-> Please reset your box to let cluster configuration to take effect!

Step 9  Reset Firewall-B.

If you are prompted to save the configuration after you enter the reset command, answer n (No).  Then, proceed with the reboot by answering y (Yes).

firewall-B(B)-> reset
firewall-B(B)-> Configuration modified.  Save? [y]/n n
firewall-B(B)-> System reset.  Are you sure? y/[n] y
 

Step 10   After the boxes have rebooted, synchronize the RTOs (Run-Time Objects):

firewall-A(M)-> set nsrp rto-mirror sync

After entering the “rto-mirror” sync, the Master and backup firewall’s will start to synchronize the real time sessions informations.  On the master device, the console will have the following:

firewall-A(M)-> Begin to sync all run-time-object to peer ...Done
firewall-A(M)->

On the backup device, the console will have the following:

firewall-B(B)-> configuration in sync (local checksum 1545829970 == remote checksum 145829970)
Received all run-time-object from peer.

Step 11  [Recommended]  Configure priority and preempt for selecting which device in the cluster should be the preferred master:

The firewall with the lowest priority will be the master. By default the ScreenOS sets the priority to 100.  This can be modified by the following command to select the Master device:

firewall-A(M)-> set nsrp vsd-group id 0 priority 50

To set the preempt option, enter the following command always on the device which has the lowest priority value. You should add this command on only one device, the device that you want to be always Master:

firewall-A(M)-> set nsrp vsd-group id 0 preempt

 

Step 12  [Recommended]  Configure the NSRP clusters for management by adding a mange-ip on the VSI interface:

When configured in the Active/Passive HA setup,  there are situations where we need to manage both the Master and Backup firewall at the same time.  To achieve this, we need to configure a manage-ip on the VSI interface of the Master and Backup firewall; this address must be a unique IP from the same subnet as the VSI interface network.

 firewall-A(M)-> set interface e0/1 manage-ip 1.1.1.2

On the backup firewall, you can configure IP 10.1.1.3:

   firewall-B(B)-> set interface e0/1 manage-ip 1.1.1.