Chassis Cluster Management Interfaces
This topic explains how management interfaces provide out‑of‑band access and network management capabilities for each node in the cluster.
Use Feature Explorer to confirm platform and release support for specific features.
Review the Platform-Specific Management Interface Behavior section for notes related to your platform.
Understanding Management Interface
Most Firewalls include an fxp0 interface. The fxp0 interface functions as a standard management interface and provides network access to each node in the cluster.
Management interfaces are the primary means of remotely accessing a device. Typically, a management interface is not connected to the in-band network; instead, it is connected to the device's internal management network. Through a management interface, you can access and configure the device over the network using utilities such as SSH and Telnet, regardless of the device's physical location. SNMP can also use the management interface to collect statistics from the device. Management interfaces allow authorized users and management systems to connect to and manage the device over the network.
Some Firewalls have a dedicated management port on the front panel. On other platforms, you can configure a management interface on one of the network interfaces. This interface can be dedicated solely to management traffic or shared with other traffic. Before users can access the management interface, it must be configured. Required configuration information includes the IP address and prefix.
On many Junos OS devices, and in recommended configurations) routing traffic between the management interface and other ports is not supported. Therefore, you must assign the management interface an IP address from a separate logical network with a distinct prefix (netmask).
When you assign individual fxp0 IP addresses to each node (as
shown in Example: Configure the Chassis Cluster Management Interface),
syslog messages and other management traffic from each node are sourced from that node's own
IP address. If your security management platform requires logs from a single,
consistent source IP address, consider using the master-only statement with
the mgmt_junos (set system management-instance) routing
instance. Control-plane system logs and event-mode security logs use the primary or fxp0
master-only IP. Stream-mode security logs are sent directly from the data plane and use the
configured security-log source-address; they do not originate from fxp0.
The master-only option ensures that the management IP address is active
only on the current primary node for the redundancy group. This approach allows management
traffic, including log forwarding (event-mode logs), to follow the primary node during
failover events. However, when using master-only, direct management access
to the secondary node through fxp0 is not available while it is in the secondary role.
Example: Configure the Chassis Cluster Management Interface
This example shows how to provide network management access to a chassis cluster.
Requirements
Before you begin, set the chassis cluster node ID and cluster ID. See Example: Setting the Chassis Cluster Node ID and Cluster ID.
Overview
Each cluster node must have
a unique IP address
for network
management access. Although the configuration is
synchronized
clusterwide, apply-groups "${node}" ensures that each node uses its
own node-specific
IP
address.
If you attempt to access the cluster over the network before configuring the fxp0 management interface, you will lose network access to the cluster.
In this example, the following IPv4 configuration is used:
Node 0 name:node0-router
IP address assigned to node 0:10.1.1.1/24
Node 1 name:node1-router
IP address for node 1:10.1.1.2/24
In this example, you configure the following information for IPv6:
Node 0 name:node0-router
IP address assigned to node 0:2001:db8:1::2/32
Node 1 name:node1-router
IP address assigned to node 1:2001:db8:1::3/32
Configuration
- Configure the Chassis Cluster Management Interface with IPv4 Addresses
- Verify the Chassis Cluster Management Interface Configuration (IPv4 Addresses)
- Configure the Chassis Cluster Management Interface with IPv6 Addresses
Configure the Chassis Cluster Management Interface with IPv4 Addresses
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy
level, and then enter commit from configuration mode.
To configure a chassis cluster management interface for IPv4:
{primary:node0}[edit]
user@host#
set groups node0 system host-name node0-router
set groups node0 interfaces fxp0 unit 0 family inet address 10.1.1.1/24
set groups node1 system host-name node1-router
set groups node1 interfaces fxp0 unit 0 family inet address 10.1.1.2/24
set apply-groups “${node}”
Step-by-Step Procedure
To configure a chassis cluster management interface for IPv4:
Configure the name of node 0 and assign an IP address.
{primary:node0}[edit] user@host# set groups node0 system host-name node0-router user@host# set groups node0 interfaces fxp0 unit 0 family inet address 10.1.1.1/24Configure the name of node 1 and assign an IP address.
{primary:node0}[edit] user@host# set groups node1 system host-name node1-router user@host# set groups node1 interfaces fxp0 unit 0 family inet address 10.1.1.2/24Apply the groups configuration to the nodes.
{primary:node0}[edit] user@host# set apply-groups “${node}”If you are done configuring the device, commit the configuration.
{primary:node0}[edit] user@host# commit
Results
From configuration mode, confirm your configuration
by entering the show groups and show apply-groups commands. If the output does not display the intended configuration,
repeat the configuration instructions in this example to correct it.
{primary:node0}[edit]
user@host# show groups
node0 {
system {
host-name node0-router;
}
interfaces {
fxp0 {
unit 0 {
family inet {
address 10.1.1.1/24;
}
}
}
}
}
node1 {
system {
host-name node1-router;
}
interfaces {
fxp0 {
unit 0 {
family inet {
address 10.1.1.2/24;
}
}
}
}
}
{primary:node0}[edit]
user@host# show apply-groups
## Last changed: 2010-09-16 11:08:29 UTC
apply-groups "${node}";If you are done configuring the device, enter commit from configuration mode.
Verify the Chassis Cluster Management Interface Configuration (IPv4 Addresses)
Purpose
Verify the chassis cluster management interface configuration.
Action
To verify the configuration is working properly, enter
the show interfaces terse, show configuration groups
node node0 interfaces and show configuration groups node
node1 interfaces commands.
{primary:node0} [edit]user@host> show interfaces terse | match fxp0fxp0 up up fxp0.0 up up inet 10.1.1.1/24
{primary:node0} [edit]user@host> show configuration groups node0 interfacesfxp0 { unit 0 { family inet { address 10.1.1.1/24; } } }
{primary:node0} [edit]user@host> show configuration groups node1 interfacesfxp0 { unit 0 { family inet { address 10.1.1.2/24; } } }
Meaning
The output displays the management interface information with their status.
Configure the Chassis Cluster Management Interface with IPv6 Addresses
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy
level, and then enter commit from configuration mode.
To configure a chassis cluster management interface for IPv6:
{primary:node0}[edit]
user@host#
set groups node0 system host-name node0-router
set groups node0 interfaces fxp0 unit 0 family inet6 address 2001:db8:1::2/32
set groups node1 system host-name node1-router
set groups node1 interfaces fxp0 unit 0 family inet6 address 2001:db8:1::3/32
Step-by-Step Procedure
To configure a chassis cluster management interface for IPv6:
Configure the name of node 0 and assign an IP address.
{primary:node0}[edit] user@host# set groups node0 system host-name node0-router user@host# set groups node0 interfaces fxp0 unit 0 family inet6 address 2001:db8:1::2/32Configure the name of node 1 and assign an IP address.
{primary:node0}[edit] user@host# set groups node1 system host-name node1-router user@host# set groups node1 interfaces fxp0 unit 0 family inet6 address 2001:db8:1::3/32If you are done configuring the device, commit the configuration.
{primary:node0}[edit] user@host# commit
Results
From configuration mode, confirm your configuration
by entering the show groups and show apply-groups commands. If the output does not display the intended configuration,
repeat the configuration instructions in this example to correct it.
{primary:node0}[edit]
user@host# show groups
node0 {
system {
host-name node0-router;
}
interfaces {
fxp0 {
unit 0 {
family inet6 {
address 2001:db8:1::2/32;
}
}
}
}
}
node1 {
system {
host-name node1-router;
}
interfaces {
fxp0 {
unit 0 {
family inet6 {
address 2001:db8:1::3/32;
}
}
}
}
}
{primary:node0}[edit]
user@host# show apply-groups
## Last changed: 2010-09-16 11:08:29 UTC
apply-groups "${node}";If you are done configuring the device, enter commit from configuration mode.
Verification
Verify the Chassis Cluster Management Interface Configuration (IPV6 Addresses)
Purpose
Verify the chassis cluster management interface configuration.
Action
To verify the configuration is working properly, enter
the show interfaces terse and show configuration groups
node0 interfaces commands.
{primary:node0} [edit]user@host> show interfaces terse | match fxp0fxp0 up up fxp0.0 up up inet 2001:db8:1::2/32
{primary:node0} [edit]user@host> show configuration groups node0 interfacesfxp0 { unit 0 { family inet { address 2001:db8:1::2/32; } } }
{primary:node0} [edit]user@host> show configuration groups node1 interfacesfxp0 { unit 0 { family inet { address 2001:db8:1::3/32; } } }
Meaning
The output displays the management interface information along with its status.
Platform-Specific Management Interface Behavior
Use Feature Explorer to confirm platform and release support for specific features.
Use the following table to review platform-specific behaviors for your platforms.
|
Platform |
Difference |
|---|---|
|
SRX Series |
For most Firewalls, the fxp0 interface is a dedicated port. SRX340 and SRX345 Firewalls include a dedicated fxp0 interface, while SRX300 and SRX320 Firewalls do not have a dedicated fxp0 port. On SRX300 and SRX320 Firewalls, the fxp0 interface is repurposed from a built-in interface. The fxp0 interface is created when the system reboots after you designate one node as the primary device and the other as the secondary device. We recommend assigning a unique IP address to the fxp0 management interface on each node in a chassis cluster. This approach enables independent management of each node. |