SRX HA Configuration Generator

What will this tool do?

It will generate configuration and diagram from the user input. Most user input is optional and defaults are used.

On the left you see the pure Chassis Cluster configuration part. On the right side there is the security zones and logical interfaces and IP addresses part, which is needed to have basic connectivity (i.e. ping to directly connected hosts).

The resulting config is to be added to the cluster with an empty configuration (not a merge to existing config).

Notable Features:

• reth-count is calculated automatically (won't be needed in later Junos release anymore though)
• multiple reth interfaces can be used (no limit)
• multiple logical interfaces can be used on a reth interface and vlan tags can be specified.
• multiple security zones can be added (no limit) and assigned to logical interfaces
• fully functional configuration will be generated (in 'set' based notation)
• handy printable diagram will be generated which clearly shows which ports to connect where
• for each platform, the correct ports for fxp0 and control link are automatically populated
• for each platform, the correct ports available for fabric link and reth members are available in drop-down pickers
• for each platform, the correct node1 interface port numbers are automatically populated when node0 is filled in.

Limitations:

• only SRX Branch models supported (no SRX-HE yet)
• no advanced features such as IP monitoring, interface monitor etc.
• only A/P setup, only one dataplane redundancy-group, with fixed priorities (node0 highest priority)
• no preempt enabled
• only one control link and one and fabric link can be configured
• each reth can have only one physical member port per node (no link aggregation)

Terminology:

node 0/node 1	Setting the node number distinguishes which SRX is which. Regardless of failover state, node 0 will always remain node 0 and node 1 will always be node 1. The firewalls can take turns being primary and secondary.
fxp0	This interface is used to manage the devices.
reth1	Redundant Pseudo Interface. A number of reth interfaces can be configured. This is a pseudo interface which will create a virtual mac address. It will normally contain 1 physical interface on each node which are called children nodes. When sending traffic to the reth interface IP, the traffic will be picked up by the primary node.