Description

The client ordered a 2nd ISP connection for the site and requested that both be used at the same time for a VPN connection as well as outbound internet traffic (hosted phones on one ISP and all other data on the other ISP.

We mostly followed the article: https://supportportal.juniper.net/s/article/J-SRX-Example-Configuring-a-primary-and-backup-VPN-with-route-failover-using-ip-monitoring?language=en_US and added the 2nd security zone (with polices to permit trusted traffic and VPN traffic) routing instance, and RIB We confirmed that both VPN's connected and that the VPN traffic routed properly if one ISP or the other goes down.

The default route 0.0.0.0 does not seem to fail over though, it appears that the 2nd ISP being in the 2nd routing instance prevents the failover route from becoming active. Can you review to see if we are not building the RIB group right or if we are missing something required to fail over the default route between the two?

Solution

Default route failover for dual ISP was not working. The route for the backup ISP was configured on a routing-instance, and it was not leaked into inet.0, causing the route to never become an active route on the inet.0 routing table.

 

We added command: set routing-instances <routing-instance-name> routing-options interface-routes rib-group inet <rib-group-name>, and this injected the local and direct routes from the custom routing instance into inet.0, resolving our issue.

Modification History

2023-10-04 : Article Created
12/7/2023: Formatting corrections made.