2 MX250 HA Pair Long Distance

[Atags]

Hi,

Can you setup a HA pair with (2) MX250 Firewalls long distance? We have 2 WAN circuits coming in from different sides of the building.

Do they have to be near each other to that? Or doesn't matter?

How would I go about this if distance is not an issue for HA?

Just have the HA be setup through a network switch?

Thank you

[jdsilva · Accepted solution]

Two MX in HA need to be layer 2 adjacent, and with as low as latency between them as possible. If you can meet those two conditions then you can place them wherever you like. 

But honestly, you're better off to just use a dedicated VLAN on your switching infrastructure to bring one of the WAN circuits across the building to where the MX pair is. 

[cmr]

@Atags as the MX250 WAN ports are SFP+, I'd think you'd be best to run a fibre from the NTE to the MXs

[Atags]

Thanks all for responding. 

[Aaron_Wilson]

Seems odd to have the two MXs at each ingress point, and not where things converge in an MDF, etc, where all the other distribution/switching gear is.

[JimBurks]

If you have a large campus, it's nice to have the network core split in different server rooms. That gives you redundancy on power, air, etc.

[Brogan]

Hi Jim - Im interested in whether you implemented the stretched HA pair? We busy planning on the doing the same with our MX250's in addition to stretched L3 stack using 4x MS425. Any insights or lessons learnt would be appreciated.