A Virtual-Network-Function (VNF) has been created on the NFX.  The VNF interface is created, mapped to hsxe0, using virtual-functions, so it is using SR-IOV.  The VNF is configured for VRRP, and when the physical interface goes down, it is expected that the VNF interface would go down, so that VRRP can fail over to the peer device.

When the physical interface, mapped to the SR-IOV VNF Interface is disconnected, the VNF Interface does not go down.  In the case where VRRP is configured on the VNF device, since the VNF Interface does not go down, VRRP will not fail over to the peer.

If a VNF interface is configured with SR-IOV, when the physical interface bound to it goes down, the SR-IOV interface will continue to stay up.  This is because the SR-IOV NIC is an internal interface, and it always stay up.  The Virtual-Function will stay up, hence the mapped VNF interface will stay up.  Since the mapped VNF SR-IOV interface stays up, VRRP failover will not occur. 

The only solution is to change the configuration to OVS, and configure the peer-interfaces feature that will map a VNF interface to the front panel physical interface.  Once this is configured, when the front panel physical interface goes down, the VNF Interface mapped to it will also go down.

Example:

set virtual-network-functions vsrx interfaces eth2 mapping peer-interfaces ge-0/0/1

This will map front panel physical interface ge-0/0/1 to the VNF Interface vsrx_eth2 . 

This feature is available on NFX-2 software, running Junos 18.1 through 19.1.  This feature is also available on all NFX platforms running NFX-3 software (Junos version 19.1 and higher).

8/13/2020 - Article created
12/16/2024 - Article updated to include all versions of NFX-3 software support this