Description

Customer spoke site (SiteA) has two internet wan links as shown in below diagram. WAN1 has additional hops before breaking out to internet.




LIBO traffic (local brekaout) load balance on both WAN links. Whenever there is an link issue between the ISP1 provider's PE and the router (ISP1_GW) at SITEA-NODE1 location, LIBO traffic is still sent towards ISP1_CPE router . As per CSO design RPM probe and ip-monitoring policy monitors connectivity with the immediate next hop . Due to this traffic will get blackholed at ISP1_GW router when there is a link failure between ISP1_core router and ISP1_GW router.


This article provides the sample configuration for rpm probe and ip-monitoring policy for this scenario.

Symptoms

  • Customer onboarded Dual SRX site with 2 internet wan links.
  • One of the internet WAN link has additional hops before breaking out traffic to internet.
  • CSO will not monitor the link failures post immediate next hop router.

Solution

Here is the sample configuration that can be applied in the SRX CLI for the topology shown in description. With the below configuraiton whenever there is link failure between ISP1_PE router and ISP1_GW router default route metric pointing to ISP2_Core router (WAN_0 GW) will be changed to attract all LIBO traffic. 

 

set groups srx-gwr-site-routing-config-ISP1 services rpm probe lbo-probe-WAN_1-upstream-ISP1 test icmp-10.30.97.108 target address 10.30.97.108

set groups srx-gwr-site-routing-config-ISP1 services rpm probe lbo-probe-WAN_1-upstream-ISP1 test icmp-10.30.97.108 source-address 10.35.7.202

set groups srx-gwr-site-routing-config-ISP1 services rpm probe lbo-probe-WAN_1-upstream-ISP1 test icmp-10.30.97.108 routing-instance WAN_1

set groups srx-gwr-site-routing-config-ISP1 services rpm probe lbo-probe-WAN_1-upstream-ISP1 test icmp-10.30.97.108 probe-count 3

set groups srx-gwr-site-routing-config-ISP1 services rpm probe lbo-probe-WAN_1-upstream-ISP1 test icmp-10.30.97.108 probe-interval 1

set groups srx-gwr-site-routing-config-ISP1 services rpm probe lbo-probe-WAN_1-upstream-ISP1 test icmp-10.30.97.108 test-interval 1

set groups srx-gwr-site-routing-config-ISP1 services rpm probe lbo-probe-WAN_1-upstream-ISP1 test icmp-10.30.97.108 thresholds successive-loss 3

set groups srx-gwr-site-routing-config-ISP1 services rpm probe lbo-probe-WAN_1-upstream-ISP1 test icmp-10.30.97.108 thresholds total-loss 3

set groups srx-gwr-site-routing-config-ISP1 services ip-monitoring policy breakout-policy-WAN_1-local-INTERNET-ISP1 match rpm-probe lbo-probe-WAN_1-upstream-ISP1

set groups srx-gwr-site-routing-config-ISP1 services ip-monitoring policy breakout-policy-WAN_1-local-INTERNET-ISP1 then preferred-route routing-instances internet-local-breakout route 0.0.0.0/0 next-hop 10.14.240.109 preferred-metric 1
 
 
Before Link Failure :
 
user1@SITEA-SRX> show route table internet-local-breakout

internet-local-breakout.inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both


0.0.0.0/0 *[Static/11] 07:57:18, metric2 0

> to 10.14.240.109 via reth0.0

to 10.35.7.201 via reth1.0



user1@SITEA-SRX> show services ip-monitoring status breakout-policy-WAN_1-local-INTERNET-ISP1


Policy - breakout-policy-WAN_1-local-INTERNET-ISP1 (Status: PASS)

RPM Probes:

Probe name Test Name Address Status

---------------------- --------------- ---------------- ---------

lbo-probe-WAN_1-upstream-ISP1 icmp-10.30.97.108 10.30.97.108 PASS


Route-Action (Adding backup routes when FAIL):

route-instance route next-hop state

----------------- ----------------- ---------------- -------------

internet-local-breakout 0.0.0.0/0 10.14.240.109 NOT-APPLIED
 
 
 
AFTER Link Failure :

user1@SITEA-SRX> show services ip-monitoring status breakout-policy-WAN_1-local-INTERNET-ISP1


Policy - breakout-policy-WAN_1-local-INTERNET-ISP1 (Status: FAIL)

RPM Probes:

Probe name Test Name Address Status

---------------------- --------------- ---------------- ---------

lbo-probe-WAN_1-upstream-ISP1 icmp-10.30.97.108 10.30.97.108 FAIL


Route-Action (Adding backup routes when FAIL):

route-instance route next-hop state

----------------- ----------------- ---------------- -------------

internet-local-breakout 0.0.0.0/0 10.14.240.109 APPLIED


{primary:node0}

user1@SITEA-SRX> show route table internet-local-breakout


internet-local-breakout.inet.0: 5 destinations, 6 routes (5 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both


0.0.0.0/0 *[Static/1] 00:01:26, metric2 0

> to 10.14.240.109 via reth0.0

 

 

Modification History

2026-03-27 : Article Created