This article lists the minimum requirements for configuring SRX devices in a chassis cluster. 

What are the minimum hardware and software requirements for a SRX Chassis Cluster to function properly?

Two modes are supported -- Active/Passive and Active/Active.

Active/Passive mode is the most commonly used HA mode in which all the traffic is processed by the "Active" or "primary" firewall, while the "Passive" or "Backup" firewall is in a warm standby mode ready to take over as the "Active" firewall in case of failure on the original "Active" firewall.  In this mode, there is only two Redundancy Groups (RG). The first one is RG0 which is for "Control Plane", and RG1 is for the "Data Plane".  RE is always part for RG0, and on whichever node RG0 is primary, that node is the Primary node.

Active/Active mode allows both firewalls to process traffic providing a load sharing HA scenario. In this mode, there can be more than two "Redundancy Groups (RG). The first one is RG0 which is for the "Control Plane", and the other RG's are for the "Data Plane". RE is always part for RG0, and on whichever node RG0 is primary, that node is the Primary node.

Only the data plane can work in Active/Active mode because the RE is part of RG0 and only one RE can be active at any given point.

For additional information on chassis clustering, refer to Chassis Cluster for Security Devices

Note: Step-by-step configuration instructions are provided in KB15650 - SRX Getting Started - Configure Chassis Cluster (High Availability) [juniper.net] .

The minimum requirements for chassis clustering are:

1. Hardware:

   The hardware on both the devices should be identical.  Also, the placement of cards should be identical.

   There are a couple exceptions:

   • For SRX5600 and SRX5800 chassis clusters, the placement and type of Services Processing Cards (SPCs) must match in the two clusters.
   • For SRX3400 and SRX3600 chassis clusters, the placement and type of SPCs, Input/Output Cards (IOCs), and Networking Processing Cards (NPCs) must match in the two devices. 
   • For SRX1400 chassis clusters, the placement and type of Network and Services Processing Card (NSPC)(or 1 SPC and 1 NPC ) and System I/0 Card(SYSIO) must match in the two devices.

2. Software:

   The Junos software version must be the same on both devices.

   Verify using this command on both devices:

   root@LAB-SRX> show version 
   Hostname: LAB-SRX
   Model: vsrx
   Junos: 19.4R2-S1.2

3. License Keys: There is not a separate license for chassis cluster. However, both firewalls must have the identical features and license keys enabled or installed. 

4. Removal of existing configuration on FXP0 and FXP1:

   In the SRX configuration, remove any existing configuration associated with the interfaces that will be transformed into fxp0 (out-of-band management) and fxp1 (control link) when the chassis cluster feature is enabled. The interfaces that are mapped to fxp0 and fxp1 are device specific. For more information on this, refer to KB15356 - How are interfaces assigned on J-Series and SRX platforms when the chassis cluster is enabled? [juniper.net]

   For help on removing the existing configuration on these interfaces, refer to KB27713 - How to remove references to the interfaces that will be used as fxp0 and fxp1 [juniper.net] .

Additional requirements for the control plane, control link, data plane and data link are provided below:

Control Plane & Control Link:

• On SRX5600 and SRX5800 devices, by default, all control ports are disabled. Each SPC in a device has two control ports, and each device can have multiple SPCs plugged into it. To set up the control link in a chassis cluster with SRX5600 or SRX5800 devices, you connect and configure the control ports that you will use on each device (fpcn and fpcn) and then initialize the device in cluster mode.
• For SRX3400 and SRX3600 devices, there are dedicated chassis cluster (HA) control ports on the switch fabric board. No control link configuration is needed for SRX3400 and SRX3600 devices.
• For SRX1400 devices, there are dedicated chassis cluster (HA) control ports (ge-0/0/10 and ge-0/0/11 ) on the SYS I/O Card.
• For SRX650, SRX550 and SRX240 devices, the ge-0/0/1 interface is used for the control link.
• For SRX 220 devices, the ge-0/0/7 interface is used for the control link.
• For SRX100 and SRX210 devices, the fe-0/0/7 interface is used for the control link.

• Understanding the Chassis Cluster Control Plane
• Understanding Chassis Cluster Control Links

Data Plane & Data Link:

2020-09-26: Added SRX345 in the exception stanza and updated latest CLIi o/p.

• Best Practices for SRX Series CHASSIS CLUSTER [Page No:1]