This KB provides a reference design and configuration overview for integrating a Juniper SRX4600 HA cluster with Cisco Nexus switches using LACP-based redundant Ethernet (reth) interfaces, vPC, and VLAN tagging. It also covers optional HSRP configuration when Layer 3 gateway functionality is required on the Cisco side.
Supported LACP configuration on CISCO NEXUS and SRX
SRX4600 operates in an HA cluster using reth interfaces.
reth
Multiple physical interfaces from both SRX nodes are bundled into a single reth interface using LACP.
Cisco Nexus switches are configured with vPC, allowing both SRX nodes to connect redundantly without STP blocking.
VLAN-tagged Layer 3 interfaces are used on the SRX.
Optional HSRP is configured on Cisco switches when a routed SVI is required.
Let's consider the following as an example:
SRX-4600 HA Interface Configuration
set interfaces et-1/0/2 gigether-options redundant-parent reth0 set interfaces et-1/0/3 gigether-options redundant-parent reth0 set interfaces et-8/0/2 gigether-options redundant-parent reth0 set interfaces et-8/0/3 gigether-options redundant-parent reth0set interfaces reth0 vlan-tagging set interfaces reth0 redundant-ether-options redundancy-group 1 set interfaces reth0 redundant-ether-options minimum-links 1 set interfaces reth0 redundant-ether-options lacp passive set interfaces reth0 redundant-ether-options lacp periodic slowset interfaces reth0 unit 20 vlan-id 20set interfaces reth0 unit 20 family inet address 10.10.10.1/24Note: The minimum-links parameter defines the minimum number of active member interfaces required for the LACP bundle to be considered operational. Although the cluster has multiple physical interfaces participating in the bundle, traffic forwarding must still be maintained under worst-case failure scenarios. Configuring minimum-links 1 ensures that the EtherChannel remains up as long as at least one member link is available, even if multiple physical interfaces are down.
minimum-links
minimum-links 1
By enabling vlan-tagging and configuring a logical sub-interface (for example, unit 20 with vlan-id 20), the SRX is configured to operate as a tagged Layer 3 interface. This means the SRX expects all traffic destined for that logical unit (for example, reth0.20) to be 802.1Q-tagged with the corresponding VLAN ID by the upstream device.
vlan-tagging
vlan-id 20
reth0.20
On the SRX, all required Layer 2 and Layer 3 interface configurations are complete. Please ensure that the appropriate security zones and security policies are also configured to permit the intended traffic flows.
CISCO Configuration
On the cisco side we need to configure the child interface, the port channel and additional vPC keep alive and peer-link
feature vpc feature lacp
interface Ethernet1/51
description Trunk Member Interface
switchport mode trunk
switchport trunk allowed vlan 20
mtu 9216
channel-group 11 mode active
interface Ethernet1/53
interface port-channel11
description Trunk Port-Channel
spanning-tree port type edge trunk
interface Ethernet1/54
switchport trunk allowed vlan 3-4093
spanning-tree port type network
channel-group 3 mode active
interface Ethernet1/50
description VPC-KEEPALIVE
no switchport
channel-group 2 mode active
no shutdown
interface port-channel2
description vPC Keepalive
vrf member vpc_keepalive
ip address 169.254.101.1/30
interface port-channel3
description vPC peer-link
vpc peer-link
vrf context vpc_keepalive
vpc domain 500
peer-switch
role priority 999
system-priority 4000
peer-keepalive destination 169.254.101.2 source 169.254.101.1 vrf vpc_keepalive
delay restore 150
peer-gateway
layer3 peer-router
auto-recovery
ip arp synchronize
The above configuration will be the same on the second CISCO Switch side and they need to be configured the same except the slight diff on VPC part of the config as below
vpc domain 500 peer-switch role priority 1000 system-priority 4000 peer-keepalive destination 169.254.101.1 source 169.254.101.2 vrf vpc_keepalive delay restore 150 peer-gateway layer3 peer-router auto-recovery ip arp synchronize
If from the Switch side pure L2 is needed then the above configuration is enough however some design require an IP addressing to be configured on the L3 Switch and SVIs is needed for the transit network thus HSRP needs to be configured on Cisco side in time of failover to avoid an outage.
Please configure the following HSRP configuration on both L3 Switches
CISCO-SWITCH-1
interface Vlan20 ip address 10.10.10.2 255.255.255.0 standby 255 ip 10.10.10.3 standby 255 timers 1 3 standby 255 priority 110 standby 255 preempt
CISCO-SWITCH-2
interface Vlan20 ip address 10.10.10.4 255.255.255.0 standby 255 ip 10.10.10.3 standby 255 timers 1 3 standby 255 preempt
Topology : reth0 as an example
SRX-Node0<------->CISCO-SWITCH-1
jtac-SRX4600 et-1/0/2 -- 51 jtac-Cisco-N9K
jtac-SRX4600 et-1/0/3 -- 53 jtac-Cisco-N9K
SRX-Node1<-------->CISCO-SWITCH-2
Between Cisco Switch: for vPC keepalive and peer-link
jtac-Cisco-N9K-1 54 -- 54 jtac-Cisco-N9K-2
jtac-Cisco-N9K-1 50 -- 50 jtac-Cisco-N9K-2
LACP part of configuration is completed and validation commands from the SRX side(out put more detail)
root@SRX4600-A> show lacp interfacesAggregated interface: reth0 LACP state: Role Exp Def Dist Col Syn Aggr Timeout Activity et-1/0/2 Actor No No Yes Yes Yes Yes Slow Active et-1/0/2 Partner No No Yes Yes Yes Yes Slow Active et-1/0/3 Actor No No Yes Yes Yes Yes Slow Active et-1/0/3 Partner No No Yes Yes Yes Yes Slow Active et-8/0/2 Actor No No Yes Yes Yes Yes Slow Active et-8/0/2 Partner No No Yes Yes Yes Yes Slow Active et-8/0/3 Actor No No Yes Yes Yes Yes Slow Active et-8/0/3 Partner No No Yes Yes Yes Yes Slow Active LACP protocol: Receive State Transmit State Mux State et-1/0/2 Current Slow periodic Collecting distributing et-1/0/2 Current Slow periodic Collecting distributing et-8/0/3 Current Slow periodic Collecting distributing et-8/0/3 Current Slow periodic Collecting distributing
From CISCO side, you can run the following commands to validate the LACP states
JTAC-Cisco-N9K-C93180YC-FX-r001#show port-channel summary
2025-02-16 : Article Created
= Second Switch vPC config is added for reference
= Optional HSRP config is added