Description

SRX340-Cluster running HA with local interface as WAN port and connect to remotes VPN Site. the purpose of such design with local interface is to load-share traffic and provide Redundancy.   IP-Monitoring is configured in st0.0. and st0.1 

#st0.0 is in Node0 and st0.1 is in st0.1 defined in two different Routing instance. 
set security ike gateway vr1-ike external-interface ge-0/0/7
set security ike gateway vr2-ike external-interface ge-5/0/7
set security zones security-zone vr1-untrust interfaces ge-0/0/7.0
set security zones security-zone vr2-untrust interfaces ge-5/0/7.0
set security ipsec vpn vr1-vpn bind-interface st0.0
set security ipsec vpn vr2-vpn bind-interface st0.1
set security zones security-zone vr1-tunnel interfaces st0.0
set security zones security-zone vr2-tunnel interfaces st0.1
set interfaces st0 unit 0 family inet address 192.168.10.30/30
set interfaces st0 unit 1 family inet address 192.168.20.30/30
set routing-instances VR-CORE-1 interface st0.0
set routing-instances VR-CORE-2 interface st0.1

#IP-monitoring defined to install route to st0.1 when fail 
set services rpm probe icmp-vr1 test ping-vr1 target address 1.1.1.100
set services rpm probe icmp-vr1 test ping-vr1 test-interval 5
set services rpm probe icmp-vr1 test ping-vr1 thresholds successive-loss 3
set services rpm probe icmp-vr1 test ping-vr1 destination-interface ge-0/0/7.0
set services ip-monitoring policy vr1 match rpm-probe icmp-vr1
set services ip-monitoring policy vr1 then preferred-route routing-instances VR-CORE-2 route 172.18.11.0/27 next-hop st0.1

 

Symptoms

#IP-Monitoring fail and route applied 
labroot@srx340-ha> show services ip-monitoring status 
 
Policy - vr1 (Status: FAIL)
  RPM Probes:
    Probe name             Test Name       Address          Status   
    ---------------------- --------------- ---------------- ---------
    icmp-vr1               ping-vr1        1.1.1.100         FAIL     

  Route-Action (Adding backup routes when FAIL):
      route-instance    route             next-hop         state
    ----------------- ----------------- ---------------- ------------- 
    VR-CORE-2           172.18.11.0/27    st0.1            APPLIED

#Routing table - Static/1 route to st0.1 installed by IP-Monitoring 
primary:node0}
labroot@srx340-ha> show route 172.18.11.0/27 

VR-CORE-1.inet.0: 49 destinations, 64 routes (49 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

172.18.11.0/27     *[Static/5] 09:29:01
                    >  via st0.0

VR-CORE-2.inet.0: 42 destinations, 79 routes (42 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

172.18.11.0/27     *[Static/1] 09:13:45   ####ROUTE INSTALLED BY IP-MONITORING
                    >  via st0.1
                    [Static/4] 09:29:36
                    >  to 10.132.26.97 via ge-5/0/2.0
                    [Static/5] 09:29:02
                    >  via st0.1

#In the event both SRX reboots(in reallife scenario, power outage).  Route installed by IP-Monitoring no longer applies after SRX bootup. 
{primary:node0}
labroot@srx340-ha> show system uptime     
node0:
--------------------------------------------------------------------------
Current time: 2023-12-12 15:22:15 HKT
Time Source:  LOCAL CLOCK 
System booted: 2023-12-12 15:12:38 HKT (00:09:37 ago)
Protocols started: 2023-12-12 15:19:12 HKT (00:03:03 ago)
Last configured: 2023-12-12 15:21:51 HKT (00:00:24 ago) by t7support
3:22PM  up 10 mins, 1 user, load averages: 5.54, 7.40, 4.10

node1:
--------------------------------------------------------------------------
Current time: 2023-12-12 15:22:16 HKT
Time Source:  LOCAL CLOCK 
System booted: 2023-12-12 15:12:42 HKT (00:09:34 ago)
Last configured: 2023-12-12 15:21:47 HKT (00:00:29 ago) by t7support
3:22PM  up 10 mins, 0 users, load averages: 1.35, 2.83, 1.81


labroot@srx340-ha> show services ip-monitoring status 
 .
Policy - vr1 (Status: FAIL)
  RPM Probes:
    Probe name             Test Name       Address          Status   
    ---------------------- --------------- ---------------- ---------
    icmp-vr1               ping-vr1        1.1.1.100         FAIL     

  Route-Action (Adding backup routes when FAIL):
      route-instance    route             next-hop         state
    ----------------- ----------------- ---------------- ------------- 
    VR-CORE-2           172.18.11.0/27    st0.1            APPLIED   
   

{primary:node0}
labroot@srx340-ha> show route 172.18.11.0/27 

VR-CORE-1.inet.0: 49 destinations, 65 routes (49 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

172.18.11.0/27     *[Static/5] 00:01:39
                    >  via st0.0

VR-CORE-2.inet.0: 41 destinations, 60 routes (41 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

172.18.11.0/27     *[Static/4] 00:01:39
                    >  to 10.132.26.97 via ge-5/0/2.0
                    [Static/5] 00:01:39
                    >  via st0.1


 

Solution

This is a bug and track in PR1780326.    As a workaround, deactivate and activate affected IP-monitoring Policy can trigger IP-Monitoring route to be installed.
  
{primary:node0}
labroot@srx340-ha> edit 
warning: Clustering enabled; using private edit
warning: uncommitted changes will be discarded on exit
eEntering configuration mode

{primary:node0}[edit]
labroot@srx340-ha# edit services ip-monitoring    

{primary:node0}[edit services ip-monitoring]
labroot@srx340-ha# deactivate policy vr1 

{primary:node0}[edit services ip-monitoring]
labroot@srx340-ha# top 

{primary:node0}[edit]
labroot@srx340-ha# commit and-quit 
node0: 
configuration check succeeds
node1: 
commit complete
node0: 
commit complete
Exiting configuration mode
   
-activate test-2 policy in IP-Monitoring
{primary:node0}
labroot@srx340-ha> edit 
warning: Clustering enabled; using private edit
warning: uncommitted changes will be discarded on exit
Entering configuration mode

{primary:node0}[edit]
labroot@srx340-ha# rollback 1 
load complete

labroot@srx340-ha# show | compare 
[edit services ip-monitoring]
!     active: policy vr1 { ... }

{primary:node0}[edit]
labroot@srx340-ha# commit and-quit 
node0: 
configuration check succeeds
node1: 
commit complete
node0: 
commit complete
Exiting configuration mode

Alternatively, restart system-health-management also can trigger IP-Monitoring route to be installed. 
{primary:node0}
root@srx340-ha> restart system-health-management 
System Health Management Daemon started, pid 87220

 

Modification History

2024-03-07 : Article Created
2024-09-27: Published to Partner