manual

Copyright © 2010, Juniper Networks, Inc. 15
APPLICATION NOTE - Branch Office Connectivity Guide
is routed through interface Ethernet 0/1, the interface IP address is used to NAT the traffic. In this way, there is no
need to propagate the addresses between service providers. In addition, DSL connections are supported because it is
not necessary to know the IP address assigned to each of the Internet-connected interfaces in advance. Instead, the
Dynamic Host Configuration Protocol (DHCP) is used in this case.
For deploying HA at branch office Type A, see Implementing High Availability (HA) at the Branch Office.
High Availability for Branch Office Type B
The branch office Type B uses two firewall devices that are connected to two different networks, such as a Peer-
to-Peer (PTP) network and the Internet. IPsec tunnels are configured to each data center using both networks in
a similar fashion like branch office Type A. The difference is that the metrics are lower on the tunnel interfaces
terminating the IPsec tunnels that transverse the PTP network. Thus, whenever possible, the PTP network carries
traffic going to and from the data centers.
Figure 12 shows the HA configuration for branch office Type B.
Figure 12: Type B optimized – HA configuration
Using Secure Services Gateway for Type B
For branch office Type B, each Juniper Networks SSG Series Secure Services Gateway terminates a pair of tunnels
(one to each data center), as each is connected to a different network. Both devices are constantly active, but the
NSRP is used in the trust (and guest) interfaces to direct the traffic to the SSG Series that connects to the PTP
network. NSRP is configured in such a way that whenever a tunnel fails, NSRP fails over to the SSG Series terminating
tunnels routed through the Internet. In this way, the PTP network is preferred over the Internet if the tunnels are
active. Whenever a tunnel fails at any of the data centers, traffic is rerouted to the secondary SSG Series gateway.
Whenever the primary SSG Series is active, Internet traffic is routed using the Ethernet interface connecting both
SSG Series Secure Services Gateways (belonging to the sync zone). Traffic, in turn, is NATed to the egress interface
address on the ISP that connects the SSG Series (1.4.0.253 in this example).
The PTP network is used to back up the Internet connection whenever the link between the SSG Series and the
Internet fails. One of the data centers advertises a default route over the PTP-transported IPsec tunnels. A default
route is also advertised by the SSG Series to its neighbor over the Ethernet that is connecting them (Ethernet 0/1
in our example). In this manner, when the connection between the SSG Series and the Internet fails, the other SSG
Series prefers the default route received through IPsec and sends all of its Internet traffic to the data center.
Because addresses in the PTP network are known in advance, a tunnel terminating at the primary SSG Series uses
main mode and identifies the IPsec peers by their remote IP address. Instead, tunnels routed through the Internet
use aggressive mode and IDs identify peers.
172.18.20.5
e0/0
1.4.0.253
e0/0
172.18.20.4
1.4.0.1
1.2.0.6
172.18.8.162
SSG Series
SSG Series
DATA
CENTER A
10.255.5.0/24
10.255.1.0/24
1.20.2.0/24
INTERNET
PTP NETWORK
b0:1
b0:1
192.168.100.1
e0/1
192.168.100.1
e0/1
10.255.5.20
Tunnel 5
10.255.1.20
Tunnel 1
10.255.5.254
Tunnel 5
10.255.1.254
Tunnel 1