Description

When adding an extra Services Processing Card (SPC) on devices in a cluster, existing sessions are synced to the same Services Processing Unit (SPU) in the secondary node but are not load balanced. However, new connections are load balanced. This article explains this behavior.

Symptoms

The goal of this article is to explain the session syncing behavior in high end SRX devices

Solution


For every active session in a chassis cluster anchored on the SPU on the primary node, a backup session is created on the secondary node. Each such session is anchored on the same SPU of the secondary node. This helps when we do a failover of the redundancy groups for the data plane traffic; the backup session becomes active in a seamless manner.

Example :

If a session is anchored on SPU 1 of the SPC in slot 4 on the primary node, then the backup session is installed in SPU 1 of the SPC in slot 4 of the secondary node only and is not installed on any other SPCs or SPUs. This behavior makes it easy for the secondary node to keep track of the sessions once it becomes active, and no processing power is required for creating new sessions.

In transient stage, node0 has three SPCs and node1 has two SPCs.

There are two possible scenarios.

Scenario 1 :  If node 0 is primary and node 1 is secondary for data plane:
  • Sessions are evenly distributed on all SPUs on node0
  • Backup sessions on node1 are distributed within available SPUs
root# run show chassis cluster status
Cluster ID: 1
Node Priority Status Preempt Manual failover

Redundancy group: 0 , Failover count: 2
node0 1 primary no no
node1 1 secondary no no

Redundancy group: 1 , Failover count: 6
node0 255 primary no yes
node1 1 secondary no yes

root# run show security flow session summary | match "in-use|FPC"
Flow Sessions on FPC0 PIC1: <<< Node 0 >>>
Sessions-in-use: 150
Flow Sessions on FPC1 PIC0:
Sessions-in-use: 234
Flow Sessions on FPC1 PIC1:
Sessions-in-use: 159
Flow Sessions on FPC3 PIC0:
Sessions-in-use: 174
Flow Sessions on FPC3 PIC1:
Sessions-in-use: 187
Flow Sessions on FPC0 PIC1: <<< Node 1 >>>
Sessions-in-use: 182
Flow Sessions on FPC1 PIC0:
Sessions-in-use: 203
Flow Sessions on FPC1 PIC1:
Sessions-in-use: 134

Scenario 2 : If node 0 is secondary and node 1 is primary for dataplane:

  • Sessions are evenly distributed on all SPUs on node 1
  • Backup sessions are distributed among same slot numbered SPUs present on node 1
root# run show chassis cluster status
Cluster ID: 1
Node Priority Status Preempt Manual failover

Redundancy group: 0 , Failover count: 1
node0 1 primary no no
node1 1 secondary no no

Redundancy group: 1 , Failover count: 2
node0 100 secondary no yes
node1 255 primary no yes

root# run show security flow session summary | match "in-use|FPC"
Flow Sessions on FPC0 PIC1: <<< Node 0 >>>
Sessions-in-use: 453
Flow Sessions on FPC1 PIC0:
Sessions-in-use: 458
Flow Sessions on FPC1 PIC1:
Sessions-in-use: 459
Flow Sessions on FPC3 PIC0:
Sessions-in-use: 0 <<< No sessions >>>
Flow Sessions on FPC3 PIC1:
Sessions-in-use: 0 <<< No sessions >>>
Flow Sessions on FPC0 PIC1: <<< Node 1 >>>
Sessions-in-use: 142
Flow Sessions on FPC1 PIC0:
Sessions-in-use: 145
Flow Sessions on FPC1 PIC1:
Sessions-in-use: 162

Once both the nodes have the same SPCs installed, the session synchronization for all the SPCs will start between the corresponding SPCs on the backup node. Existing sessions will not be load balanced.

There are two methods of load balancing the existing sessions:

  1. Reboot both the nodes in the cluster simultaneously. This will cause a network outage while both devices boot up and come online.

  • Clear all the sessions from the active box and allow users to re-initiate the sessions. This is done by using the command clear security flow sessions all .

    • All the existing sessions will be deleted. New sessions will start to load-balance automatically between the SPCs in the cluster.

Related Information