This article provides a comprehensive guide on configuring ISP failover using IP Monitoring (RPM) on SRX devices. It also explains how to leverage the virtual-router routing-instance to leak routes into the default routing-instance, ensuring seamless failover between ISPs.

Solution

This example demonstrates how to configure ISP failover on an SRX device using RPM (Real-time Performance Monitoring) and IP Monitoring. The design uses multiple routing instances to maintain backup Internet routes and leverages route leaking to make those routes available to the default routing table during failover events.

Network Topology

The default routing instance uses ISP1 as the primary Internet connection. ISP2 and ISP3 are configured in separate virtual-router routing instances and serve as backup Internet paths.

Configuration Workflow

The solution consists of the following steps:

1. Configure WAN and LAN interfaces.

2. Configure backup ISP routing instances.

3. Configure route leaking into the default routing instance.

4. Configure RPM probes to monitor ISP reachability.

5. Configure IP Monitoring policies to trigger failover.

6. Configure source NAT for each ISP.

7. Configure security zones and policies.

8. Configure IPsec VPN gateways and tunnels.

Step 1 – Configure Interfaces

set interfaces ge-0/0/0 unit 0 family inet address 172.16.10.1/24
set interfaces ge-0/0/1 unit 0 family inet address 172.16.20.1/24
set interfaces ge-0/0/2 unit 0 family inet address 172.16.30.1/24
set interfaces ge-0/0/3 unit 0 family inet address 192.168.10.1/24

set interfaces st0 unit 0 family inet
set interfaces st0 unit 1 family inet
set interfaces st0 unit 2 family inet

Step 2 – Configure Routing Instances for Backup ISPs

Create separate virtual-router routing instances for ISP2 and ISP3. These routing instances maintain backup default routes independently from the main routing table.

ISP2

set routing-instances ISP2 instance-type virtual-router
set routing-instances ISP2 interface ge-0/0/1.0
set routing-instances ISP2 routing-options static route 0.0.0.0/0 next-hop 172.16.20.2

ISP3

set routing-instances ISP3 instance-type virtual-router
set routing-instances ISP3 interface ge-0/0/2.0
set routing-instances ISP3 routing-options static route 0.0.0.0/0 next-hop 172.16.30.2

Step 3 – Configure Route Leaking

Import routes from ISP2 and ISP3 routing instances into the default routing instance.

set policy-options policy-statement Import-to-Default term 1 from instance ISP2
set policy-options policy-statement Import-to-Default term 1 then accept

set policy-options policy-statement Import-to-Default term 2 from instance ISP3
set policy-options policy-statement Import-to-Default term 2 then accept

set routing-options instance-import Import-to-Default

Configure the primary default route through ISP1:

set routing-options static route 0.0.0.0/0 next-hop 172.16.10.2

Step 4 – Configure RPM Monitoring

RPM continuously checks upstream reachability of each ISP gateway.

Monitor ISP1

set services rpm probe Failover1 test probe-ge1 probe-type icmp-ping
set services rpm probe Failover1 test probe-ge1 target address 172.16.10.2
set services rpm probe Failover1 test probe-ge1 probe-count 5
set services rpm probe Failover1 test probe-ge1 probe-interval 1
set services rpm probe Failover1 test probe-ge1 test-interval 5
set services rpm probe Failover1 test probe-ge1 thresholds total-loss 3
set services rpm probe Failover1 test probe-ge1 next-hop 172.16.10.2

Monitor ISP2

set services rpm probe Failover2 test probe2-ge2 probe-type icmp-ping
set services rpm probe Failover2 test probe2-ge2 target address 172.16.20.2
set services rpm probe Failover2 test probe2-ge2 probe-count 5
set services rpm probe Failover2 test probe2-ge2 probe-interval 1
set services rpm probe Failover2 test probe2-ge2 test-interval 5
set services rpm probe Failover2 test probe2-ge2 routing-instance ISP2
set services rpm probe Failover2 test probe2-ge2 thresholds total-loss 3
set services rpm probe Failover2 test probe2-ge2 next-hop 172.16.20.2

When three consecutive probe failures occur, the monitored ISP is considered unavailable.

Step 5 – Configure IP Monitoring Failover Policies

IP Monitoring uses RPM probe results to inject backup default routes.

Failover from ISP1 to ISP2

set services ip-monitoring policy GE1 match rpm-probe Failover1

set services ip-monitoring policy GE1 then preferred-route \
routing-instances ISP2 route 0.0.0.0/0 next-hop 172.16.20.2

set services ip-monitoring policy GE1 then preferred-route \
routing-instances ISP2 route 0.0.0.0/0 preferred-metric 4

Failover from ISP2 to ISP3

set services ip-monitoring policy GE1_2 match rpm-probe Failover2

set services ip-monitoring policy GE1_2 then preferred-route \
routing-instances ISP3 route 0.0.0.0/0 next-hop 172.16.30.2

set services ip-monitoring policy GE1_2 then preferred-route \
routing-instances ISP3 route 0.0.0.0/0 preferred-metric 3

Failover sequence:

• ISP1 available → traffic uses ISP1.

• ISP1 fails → traffic moves to ISP2.

• ISP1 and ISP2 fail → traffic moves to ISP3.

• ISP1 recovers → traffic automatically returns to ISP1.

Step 6 – Configure Source NAT

Create a NAT rule for each ISP path.

ISP1

set security nat source rule-set NAT from zone Trust
set security nat source rule-set NAT to zone ISP1
set security nat source rule-set NAT rule NAT match source-address 0.0.0.0/0
set security nat source rule-set NAT rule NAT then source-nat interface

ISP2

set security nat source rule-set NAT1 from zone Trust
set security nat source rule-set NAT1 to routing-instance ISP2
set security nat source rule-set NAT1 rule NAT1 match source-address 0.0.0.0/0
set security nat source rule-set NAT1 rule NAT1 then source-nat interface

ISP3

set security nat source rule-set NAT2 from zone Trust
set security nat source rule-set NAT2 to routing-instance ISP3
set security nat source rule-set NAT2 rule NAT2 match source-address 0.0.0.0/0
set security nat source rule-set NAT2 rule NAT2 then source-nat interface

Step 7 – Configure Security Zones

set security zones security-zone ISP1 interfaces ge-0/0/0.0 host-inbound-traffic system-services all
set security zones security-zone ISP2 interfaces ge-0/0/1.0 host-inbound-traffic system-services all
set security zones security-zone ISP3 interfaces ge-0/0/2.0 host-inbound-traffic system-services all
set security zones security-zone LAN interfaces ge-0/0/3.0 host-inbound-traffic system-services all

Configure a simple permit-all policy for testing:

set security policies global policy allow match source-address any
set security policies global policy allow match destination-address any
set security policies global policy allow match application any
set security policies global policy allow then permit

Verification

Verify RPM status:

show services rpm probe-results

Verify IP Monitoring:

show services ip-monitoring status

Verify active default route:

show route 0.0.0.0/0

Verify leaked routes:

show route table ISP2.inet.0
show route table ISP3.inet.0

Successful operation is confirmed when the default route automatically transitions from ISP1 to ISP2 and then ISP3 during simulated failures, and returns to ISP1 when connectivity is restored.