On SRX Series chassis clusters, a redundancy group (RG) failover can complete quickly at the control-plane level while traffic forwarding through the redundant Ethernet (reth) interface takes additional time to recover.

Starting with Junos OS 18.4R1, SRX Series Firewalls use a default 11-second hold-time for both reth up and down transitions. The hold timer provides interface damping by delaying advertisement of the parent reth interface state until the timer expires. The up and down timers are configurable in seconds. 

Because of this behavior, packet captures may show an apparent forwarding delay of approximately 11 seconds even though the redundancy group has already transitioned to the new primary node.

During an abrupt chassis-cluster failover, the following behavior may be observed:

• RG failover completes rapidly.
• JSRPD shows the surviving node becoming primary for the redundancy group.
• Reth ownership moves to the surviving node.
• The connected switch removes the reth virtual MAC address from the previous active port.
• There is an additional delay of approximately 11 seconds before packets sourced from the reth virtual MAC are observed from the new primary node.
• The switch learns the reth virtual MAC on the new node-facing port shortly after the SRX begins transmitting.
• Traffic may recover before the first gratuitous ARP is observed, indicating that GARP or switch MAC learning is not necessarily responsible for the initial delay.

For example, an investigation may show:

RG1 secondary -> ineligible
RG1 ineligible -> primary
        |
        | approximately 11 seconds
        |
First packet transmitted from new active reth path

The important distinction is that the overall traffic interruption should not be interpreted as the RG failover time. The redundancy-group state transition and subsequent reth/interface forwarding convergence are separate stages.

Check the reth interface hold-time configuration:

show configuration interfaces reth0 | display inheritance
show configuration interfaces reth1 | display inheritance

Juniper documents the configurable reth hold-time as:

set interfaces reth0 hold-time up <seconds>
set interfaces reth0 hold-time down <seconds>

set interfaces reth1 hold-time up <seconds>
set interfaces reth1 hold-time down <seconds>

The up value specifies the hold time when the primary child transitions from down to up, while the down value specifies the hold time when the primary child transitions from up to down. The value is specified in seconds.

From Junos OS 18.4R1 onward, the default value on SRX Series Firewalls is:

hold-time up   11 seconds
hold-time down 11 seconds

If faster convergence is required, the hold-time values can be explicitly reduced. For example:

set interfaces reth0 hold-time up 1
set interfaces reth0 hold-time down 1

set interfaces reth1 hold-time up 1
set interfaces reth1 hold-time down 1

The appropriate values should be validated in a maintenance window. Reducing the timer decreases interface damping and therefore changes how the cluster reacts to short interface transitions.

To validate whether reth hold-time is contributing to the forwarding delay, perform a controlled failover while collecting:

show chassis cluster information detail
show chassis cluster status
show chassis cluster interfaces

along with simultaneous packet captures and switch MAC-table monitoring.

Compare:

RG becomes PRIMARY
        ↓
First packet sourced from new active reth
        ↓
Switch learns reth virtual MAC on new port
        ↓
Traffic recovery

If reducing the reth hold-time produces a corresponding reduction in the post-RG forwarding interval, this confirms that the hold-time behavior is contributing to the observed convergence delay.

Juniper documents the reth hold timer as configurable and specifies an 11-second default for both up and down hold-time beginning with Junos OS 18.4R1.

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/hold-time_edit_interfaces%28reth%29.html