fw0 is connected to sw0/p24 fw1 is connected to sw0/p23
I suspect this might be due to the ARP cache on sw0. Hence, when I failover to fw1, sw0 still sends data destined for the gateway IP (virtual) down p24 (to inactive fw0) instead of p23 (to fw1). Is there a recommended configuration for the procurve ports in this way? I have looked at LACP and spanning-tree options, but am a little confused as to the best way to proceed. Initially, I tried to trunk ports 23 + 24, but many hosts were not contactable when I connected p23->fw1, which I suspect was due to sw0 sending some data down p23 and some down p24 whilst only one of the links should have been utilised at any one time. Any help/advice/links will be gratefully received! Nick
Re: Procurve connection to redundant Juniper firewalls
Hello Nick,
your problem doesn't refer to spanning-tree or trunking. I either think that the secondary firewall doesn't send a gratuitous ARP after a failover. Can you provide us a "show running-config" from you switch?
; J9279A Configuration Editor; Created on release #Y.11.01
hostname "sw0" web-management ssl trunk 24 Trk1 Trunk trunk 22 Trk2 Trunk ip default-gateway xxx.xx.xx.129 snmp-server community "public" Unrestricted vlan 1 name "DEFAULT_VLAN" untagged 1-21,23,Trk1-Trk2 ip address x.x.x.176 255.255.255.192 exit vlan 667 name "Management" tagged Trk1 exit vlan 666 name "DMZ" exit fault-finder bad-driver sensitivity high fault-finder bad-transceiver sensitivity high fault-finder bad-cable sensitivity high fault-finder too-long-cable sensitivity high fault-finder over-bandwidth sensitivity high fault-finder broadcast-storm sensitivity high fault-finder loss-of-link sensitivity high fault-finder duplex-mismatch-HDx sensitivity high fault-finder duplex-mismatch-FDx sensitivity high spanning-tree spanning-tree Trk1 priority 4 spanning-tree Trk2 priority 4 password manager password operator --------------snip-----------------
Thank you!! In the meantime, I will investigate whether the Juniper sends gratuitous ARP, although I have configured other networks in this way (albeit not with Procurves). Best regards, Nick
Re: Procurve connection to redundant Juniper firewalls
Hi,
You should be able to check whether it's an arp issue by running a "show arp" on the 2510 after the firewalls have failed over. Have you tried communicating (ping etc) from the backup SSG back to the host network after failover?
Re: Procurve connection to redundant Juniper firewalls
Hello Nick,
there is no need to configure the ports, to which the firewalls are connected, as "trunk". You should change this.
Check the ARP table on the switches after a failover. You can try to ping the firewall from the switch, after a failover. Does this solve the problem or can't you reach the firewall?
