O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

18.6. Configure an Active-Active NSRP Cluster

Problem

You need to use both devices in an NSRP pair to forward traffic.

Solution

Configure an active-active NSRP cluster:

	FIREWALL-A-> set nsrp cluster id 1
	FIREWALL-A(M)-> set nsrp cluster name FWCLUSTER
	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group id 0 priority 10

	FIREWALL-B-> set nsrp cluster id 1
	FIREWALL-B(B)-> set nsrp vsd-group id 1 priority 10
	FWCLUSTER:FIREWALL-B(B)-> save
	FWCLUSTER:FIREWALL-B(B)-> exec nsrp sync global-config saved
	FWCLUSTER:FIREWALL-B(B)->reset

Once FIREWALL-B comes back online, continue the configuration by enabling RTO synchronization, configuring timers, and setting up monitoring parameters:

	FWCLUSTER:FIREWALL-A(M)-> set nsrp rto-mirror sync
	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group hb-interval 200
	FWCLUSTER:FIREWALL-A(M)-> set nsrp data-forwarding
	FWCLUSTER:FIREWALL-A(M)-> set nsrp monitor interface ethernet0/1
	FWCLUSTER:FIREWALL-A(M)-> set nsrp monitor interface ethernet0/3
	FWCLUSTER:FIREWALL-B(M)-> set nsrp monitor interface ethernet0/1
	FWCLUSTER:FIREWALL-B(M)->set nsrp monitor interface ethernet0/3

Finally, ensure that the two devices remain active, when possible, by configuring preempt for the appropriate groups, and setting master-always-exist:

	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group id 0 preempt
	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group id 0 preempt hold-down 90
	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group master-always-exist
	FWCLUSTER:FIREWALL-B(M)-> set nsrp vsd-group id 1 preempt FWCLUSTER:FIREWALL-B(M)-> ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required