CloudLabBox
Try the free demo

JNCIA-SEC and JNCIS-SEC lab 9 of 16

Chassis cluster build

Turn two vSRX firewalls into a chassis cluster: enable it, renumber your thinking, add node groups, fabric links, redundancy groups and reth interfaces, then read the session copied to the standby node.

Run this lab

It needs Standard: its 4 nodes are set to 6 vCPU and 10,240 MB in total.

In your workspace: Shared, then JNCIA-SEC and JNCIS-SEC SRX security guided labs, then 09 - Chassis cluster build

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 6 vCPU and 10,240 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 80 minutes
Nodes need
6 vCPU, 10,240 MB
Smallest plan
Standard

The scenario

Hartwell's Poole office can't afford to lose its firewall during a refit, so a second SRX has arrived. You'll join the two into a chassis cluster: one logical firewall with two nodes, where traffic moves to the survivor if one fails.

DeviceInterfaceAddressNotes
Clusterreth0.010.10.10.1/24Zone trust
Clusterreth1.0203.0.113.1/24Zone untrust
LAN-PCeth010.10.10.10/24Gateway 10.10.10.1
OUTeth0203.0.113.10/24Gateway 203.0.113.1

Ports change their names once clustering is on. Keep this table beside you:

Port in EVE (before clustering)After clustering, node0After clustering, node1Used for
first data port (ge-0/0/0)em0em0Control link
second (ge-0/0/1)ge-0/0/0ge-7/0/0Fabric link
third (ge-0/0/2)ge-0/0/1ge-7/0/1reth0, the office LAN
fourth (ge-0/0/3)ge-0/0/2ge-7/0/2reth1, the internet

The cabling on the canvas is already done. Both firewalls have only a hostname and a login.

What you’ll practise

  • Explain control and fabric links, redundancy groups and reth interfaces
  • Enable a chassis cluster and handle the renumbered ports
  • Use node groups for node-specific settings
  • Configure fabric links, priorities and reth interfaces
  • Prove that session state reaches the standby node

The tasks

  1. What a cluster is
  2. Enable clustering
  3. Node-specific settings
  4. Fabric links
  5. Redundancy groups and reth interfaces
  6. Zones and policy, as on one firewall
  7. Read the cluster

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Chassis cluster build4 nodes and 2 networks, 8 links. Every link is listed as text below the diagram.SRX-ASRX-BLAN-PCOUTLANWANeth0ge-0/0/3ge-0/0/3eth0ge-0/0/2ge-0/0/2ge-0/0/0ge-0/0/0ge-0/0/1ge-0/0/1
4 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SRX-A ge-0/0/0 to SRX-B ge-0/0/0
  • SRX-A ge-0/0/1 to SRX-B ge-0/0/1
  • SRX-A ge-0/0/2 to LAN (network)
  • SRX-B ge-0/0/2 to LAN (network)
  • SRX-A ge-0/0/3 to WAN (network)
  • SRX-B ge-0/0/3 to WAN (network)
  • LAN-PC eth0 to LAN (network)
  • OUT eth0 to WAN (network)
Nodes in Chassis cluster build, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SRX-AJuniper vSRX NextGen templatevsrxng-24.4R1.92 vCPU, 4,096 MB
SRX-BJuniper vSRX NextGen templatevsrxng-24.4R1.92 vCPU, 4,096 MB
LAN-PCEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
OUTEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIA-SEC and JNCIS-SEC SRX security guided labs.

  3. Open 09 - Chassis cluster build and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More JNCIA-SEC and JNCIS-SEC labs

All JNCIA-SEC and JNCIS-SEC labs

Related labs in other courses

CloudLabBox is independent of Cisco and Juniper Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.