Friday, May 14, 2021

vSRX in eve-ng reth interface issues

Hi All,

I've got a lab built in eve-ng with a vSRX cluster built however im having issues with the reth interfaces and wanted to see if anyone has had these problems before.

The below configuration is from node0/primary SRX and the Cisco IOL switch the reth interface is connected to.

Topology: https://i.imgur.com/GknG8E9.png

Note: Eve-ng topology shows that node0 is connected to eth2/0 through ge-0/0/9 however due to how the numbering works, on the vSRX itself its actually ge-0/0/8.

SRX Reth0 Config

root@SRX-THN-NODE0# show chassis cluster redundancy-group 1 node 0 priority 100; node 1 priority 1; interface-monitor { ge-0/0/4 weight 255; ge-7/0/4 weight 255; ge-0/0/8 weight 255; ge-0/0/9 weight 255; ge-7/0/9 weight 255; ge-7/0/8 weight 255; } root@SRX-THN-NODE0# show interfaces reth0 vlan-tagging; redundant-ether-options { redundancy-group 1; } unit 500 { vlan-id 500; family inet { address 10.50.1.1/24; } } root@SRX-THN-NODE0# show interfaces ge-0/0/8 gigether-options { redundant-parent reth0; } root@SRX-THN-NODE0# show security zones security-zone trust host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { reth0.10; } {primary:node0}[edit] root@SRX-THN-NODE0# run ping 10.50.1.10 PING 10.50.1.10 (10.50.1.10): 56 data bytes ^C --- 10.50.1.10 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss 

Cisco Trunk Port and test interface VLAN

THN-SWITCH#sh run int eth 2/0 interface Ethernet2/0 description SRX-NODE0-RETH0 switchport trunk allowed vlan 10,500-510 switchport trunk encapsulation dot1q switchport mode trunk end THN-SWITCH#sh run int vlan 500 interface Vlan500 ip address 10.50.1.10 255.255.255.0 end 

On the vSRX if i change interface ge-0/0/8 to not be a reth interface, the interface works as expected and i can access the test interface VLAN.

root@SRX-THN-NODE0# show interfaces ge-0/0/8 vlan-tagging; unit 500 { vlan-id 500; family inet { address 10.50.1.1/24; } } root@SRX-THN-NODE0# show security zones security-zone trust host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { reth0.10; ge-0/0/8.500; } {primary:node0}[edit] root@SRX-THN-NODE0# run ping 10.50.1.10 PING 10.50.1.10 (10.50.1.10): 56 data bytes 64 bytes from 10.50.1.10: icmp_seq=0 ttl=255 time=31.026 ms 64 bytes from 10.50.1.10: icmp_seq=1 ttl=255 time=1.635 ms 64 bytes from 10.50.1.10: icmp_seq=2 ttl=255 time=1.526 ms 64 bytes from 10.50.1.10: icmp_seq=3 ttl=255 time=1.400 ms ^C --- 10.50.1.10 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.400/8.897/31.026/12.777 ms 

Has anyone come across these issues before with eve-ng and have any ideas on how to get around this i dont think im missing anything config wise

Thanks,



No comments:

Post a Comment