PROBLEM OR GOAL:

How do I configure a pair of Juniper firewall's for Active/Passive High Availability (NSRP)?
What are the minimum NSRP commands required?
The basic configuration steps for the following topology are documented in this solution.

Minimum software and hardware requirements for configuring Active/ Passive NSRP:
Firewall's with identical ScreenOS versions and license keys
Firewall's with identical hardware
At least one interface on each firewall to be configured in the HA zone, which will be used for carrying
control channel information
For more information on the software and hardware requirements for NSRP, refer to KB11432.

SOLUTION:
For assistance with configuring a pair of firewalls for NSRP, follow the steps below.
These instructions were performed on a SSG-500. The same concept applies to the other models that support
NSRP; the difference being the interface notation or dedicated HA port.
Perform basic configuration on Firewall-A. Bind the interfaces to the zones desired, and configure an IP
address on the interfaces.

set
set
set
set

interface
interface
interface
interface

ethernet0/3
ethernet0/1
ethernet0/3
ethernet0/1

zone untrust
zone trust
ip 10.1.1.2/24
ip 1.1.1.1/24

You may also configure policies, VPNs, etc, and get the firewall working as designed. Then proceed to the next
step when ready to configure NSRP.
OR
It is also possible to do minimal configuration as above and proceed onto the next step to configure NSRP. Then
once the Active/Passive pair is configured for NSRP, subsequent configuration commands (policies, VPNs, etc)
will be automatically sync'd to the other firewall.

Start configuring NSRP by choosing the interface(s) for HA. In our example, it is eth0/4. For more
information on assigning the HA ports, refer to KB11296.

set interface ethernet0/4 zone HA

Configure the NSRP cluster id:

set nsrp cluster id 1

Both firewalls in the cluster must have the same Cluster ID number.
Important: Other NSRP firewall pairs on the same segment must have a different set of cluster ids.
Once the cluster id is set to a value, all the security interfaces will become part of the VSD-group 0, by default.
[Optional] Configure cluster name for NSRP:
Each NSRP cluster member can have different host names. In situations with SNMP or IPSec configured, a
failover of the NSRP device can mean a disruption in communication for SNMP or IPSec. Defining a single name
for all cluster members allows SNMP communication and digital certificates use to be continued without
interruption after failover.
To define a single name for all cluster members, type the following CLI command:

set nsrp cluster name <name_str>

Use the cluster name when configuring the SNMP host name for the Juniper firewall device (set snmp name
name_str) and when defining the common name in a PKCS10 certificate request file.
Note: Only one digital certificate is required for an NSRP cluster.
[Recommended] Configure NSRP monitoring to trigger failover if an interface goes down.

set nsrp monitor interface eth0/1

set nsrp monitor interface eth0/3
By adding the monitor command we will monitor the physical state of the interface eth0/1 and eth0/3. In the
event that either one of the interfaces goes down, Firewall-A will initiate a fail over to Firewall-B, and Firewall-B
will continue to pass traffic.
NOTE: Only specify the interfaces that have an active link. Otherwise, the firewall will go to the (I) Inoperable
state; for more information, see KB11327.
Configure NTP command, if applicable. Are your firewalls configured with an NTP (Network Time
Protocol) server?
No - Continue with Step 7.
Yes - Enter the command: set ntp no-ha-sync
For more information on disabling NTP for HA configurations, see KB7009. Then continue to Step 7.
Repeat steps 2 - 6 for Firewall-B.
Synchronize the configurations from the Backup firewall. On Firewall-B, enter the following CLI
command:

firewall-B-> exec nsrp sync global-config save

The following will be reported shortly after you enter the above command:

load peer system config to save

firewall-B(B)-> Save global configuration successfully.
firewall-B(B)-> Save local configuration successfully.
firewall-B(B)-> Done.
firewall-B(B)-> Please reset your box to let cluster configuration to take
effect!
For more information on synchronizing the configurations, refer to KB6351.

Reset Firewall-B.

IMPORTANT: If you are prompted to save the configuration after you enter the reset command, answer n (No).
Then, proceed with the reboot by answering y (Yes).

firewall-B(B)-> reset
firewall-B(B)-> Configuration modified. Save? [y]/n n
firewall-B(B)-> System reset. Are you sure? y/[n] y
After the boxes have rebooted, synchronize the RTOs (Run-Time Objects):

firewall-A(M)-> set nsrp rto-mirror sync

After entering the "rto-mirror" sync, the Master and backup firewall's will start to synchronize the real time
sessions informations. On the master device, the console will have the following:

firewall-A(M)-> Begin to sync all run-time-object to peer ...Done

firewall-A(M)->
On the backup device, the console will have the following:

firewall-B(B)-> configuration in sync (local checksum 1545829970 == remote

checksum 145829970)
Received all run-time-object from peer.
NOTE: Steps 11 and 12 can be performed before step 7, however, for simplicity, they are performed at this point.
[Recommended] Configure priority and preempt for selecting which device in the cluster should be
the preferred master:
The firewall with the lowest priority will be the master. By default the ScreenOS sets the priority to 100. This can
be modified by the following command to select the Master device:

firewall-A(M)-> set nsrp vsd-group id 0 priority 50

To set the preempt option, enter the following command always on the device which has the lowest priority value.
You should add this command on only one device, the device that you want to be always Master:

firewall-A(M)-> set nsrp vsd-group id 0 preempt

In the case of a failover scenario, let's say Firewall-B becomes the master. Later if the original Master, Firewall-A
(which has a lower priority and preempt configured) recovers, Firewall-A will take back the Master role. For more
information on the priority and preempt commands, refer to KB11373.
[Recommended] Configure the NSRP clusters for management by adding a mange-ip on the VSI
interface:
When configured in the Active/Passive HA setup, there are situations where we need to manage both the Master
and Backup firewall at the same time. To achieve this, we need to configure a manage-ip on the VSI interface of
the Master and Backup firewall; this address must be a unique IP from the same subnet as the VSI interface
network.

firewall-A(M)-> set interface e0/1 manage-ip 1.1.1.2

On the backup firewall, you can configure IP 10.1.1.3:

firewall-B(B)-> set interface e0/1 manage-ip 1.1.1.3

For more information on configuring a manage IP, see KB4059.

PURPOSE:
Configuration