MX100 HA NAT mode warm spare questions

SOLVED
BrandonS
Kind of a big deal

MX100 HA NAT mode warm spare questions

Can someone help me clear up some doubts about how to configure this?  I have read https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair

and also https://www.willette.works/mx-warm-spare/

 

1. Is it not good to connect the MX's directly to each other anymore?  Do I need to care why?

2. Do I need 2 switches also?  I prefer to have one switch only and only have HA for if one internet goes down or one MX fails.  For this instance I am not concerned about 'core' switch failure.

3. How do I handle client VPN if one internet fails?  Users need to know two different IP's to connect to potentially?

4. This customer uses public IP whitelisting to access some cloud services.  I am not clear on the VIP configuration.  I will have one VIP from each ISP that would need to be whitelisted by the service providers I guess?

 

Thanks for any help.  I have been working with Meraki for some time, but not yet configured HA.

 

 

- Ex community all-star (⌐⊙_⊙)
1 ACCEPTED SOLUTION
NolanHerring
Kind of a big deal

1. Correct, the old style method of connecting them directly together is no longer a recommended design, and can actually cause issues.

2. Technically no. I don't see any issues with this, it's simply a matter of redundancy however. If that one switches goes down, the HA warm spare status won't function but at this point who cares because your entire network is down internally lol

3. You have to use the vIP solution if your using client-VPN. This is the only supported method

4. vIP will only work by having a /29 from your provider. The whitelisting should be done for the entire /29 in my opinion, not 'just' the vIP. Makes it easier.
Nolan Herring | nolanwifi.com
TwitterLinkedIn

View solution in original post

7 REPLIES 7
NolanHerring
Kind of a big deal

1. Correct, the old style method of connecting them directly together is no longer a recommended design, and can actually cause issues.

2. Technically no. I don't see any issues with this, it's simply a matter of redundancy however. If that one switches goes down, the HA warm spare status won't function but at this point who cares because your entire network is down internally lol

3. You have to use the vIP solution if your using client-VPN. This is the only supported method

4. vIP will only work by having a /29 from your provider. The whitelisting should be done for the entire /29 in my opinion, not 'just' the vIP. Makes it easier.
Nolan Herring | nolanwifi.com
TwitterLinkedIn
jdsilva
Kind of a big deal

Hey @BrandonS

 

  1. Nope, it is not good. Don't do it. Bad things can happen. Traffic may be blackholed, or other general instabilities (I had interesting STP TC's being generated leading to an unconverged network)
  2. Nope. You can use one switch. But then you have redundant MXes and a single MS... You have to decide how far you want to take redundancy. 
  3. Use the Virtual IP feature on the WAN for this. Then clients always connect to the VIP which is on the active MX. Or, if you cannot use a VIP then use the DDNS built into the MXes. The current active primary DDNS name will always point to the active MX.
  4. That's correct. User's are NAT'ed to the VIP(s), so that's what need to be whitelisted by a *aaS provider.

 

 

 


@BrandonS wrote:

Can someone help me clear up some doubts about how to configure this?  I have read https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair

and also https://www.willette.works/mx-warm-spare/

 

1. Is it not good to connect the MX's directly to each other anymore?  Do I need to care why?

2. Do I need 2 switches also?  I prefer to have one switch only and only have HA for if one internet goes down or one MX fails.  For this instance I am not concerned about 'core' switch failure.

3. How do I handle client VPN if one internet fails?  Users need to know two different IP's to connect to potentially?

4. This customer uses public IP whitelisting to access some cloud services.  I am not clear on the VIP configuration.  I will have one VIP from each ISP that would need to be whitelisted by the service providers I guess?

 

Thanks for any help.  I have been working with Meraki for some time, but not yet configured HA.

 

 


 

@jdsilva

I wasn't aware of the DDNS to get around not being able to use vIP. Good to know 😃
Nolan Herring | nolanwifi.com
TwitterLinkedIn

Thanks for the great replies!  I think the last thing I am wondering is if I need to consider anything for my single switch.  I can just plug LAN 1 on each MX into my single switch instead of the two like diagramed here? Or do I want a VLAN for the connectivity between MX also?  That seems the same as a direct cable though..

 

Screen Shot 2018-11-06 at 2.07.52 PM.png

 

And maybe I want an MS120-8 on the WAN side with two VLANs (one for each ISP between their handoff and the MX's).  It looks like a need a total of 3 IP addresses from each ISP, right?

 

Going with number 1-4 on the diagram

Comcast: 1: 1.1.1.1, 3: 1.1.1.2

at&t: 2: 2.2.2.1 4: 2.2.2.2

 

Then also two VIPs like 1.1.1.3 and 2.2.2.3?

 

Thanks again.

- Ex community all-star (⌐⊙_⊙)

@BrandonS

 

For some reason I didn't realize that you had two ISP providers. Thought we were talking just one here.


If your only using 1 switch, then each MX should only have one connection (since they don't support LACP).

 

The diagram your showing is if you had two switches.

 

You don't need a specific VLAN for warm spare. By default the VRRP packets are sent out on all vlans.

 

Each ISP would need to give you 3 IP addresses (this is only done by giving you a /29)

 

As for the edge switch between your ISP and your MX, I believe this will be needed unless they are able to hand you 2 uplinks from their side for each ISP.

 

You can use your core switch for this too if you want. Via that diagram from https://www.willette.works/mx-warm-spare/

 

1111.jpg

 

 

 

Keep in mind doing this now makes that switch a single point of failure.

 

As for the vIP, if you get a /29, you actually get 5 usable IP addresses. So you use two of them for each MX and then one for the vIP, entirely up to you.

 

As for your client-VPN, if ISP 1 goes down, even using the vIP, then I would imagine you lose your client-VPN even though ISP 2 is alive. Maybe @jdsilva knows if that DDNS he mentioned earlier solves this?

Nolan Herring | nolanwifi.com
TwitterLinkedIn

 


@NolanHerring wrote:

 

 

As for your client-VPN, if ISP 1 goes down, even using the vIP, then I would imagine you lose your client-VPN even though ISP 2 is alive. Maybe @jdsilva knows if that DDNS he mentioned earlier solves this?


Yup, it will follow. 

 

Meraki went and changed how you configure DDNS in the last week or so... It used to tell you which name was which, but now it's just lists the 3 DDNS names you get without explaining what does what.

 

image.png

 

If you use the DDNS name I circled you will always point to the IP of the "current primary uplink", doesn't matter which uplink port, or which MX that is. It'll even change to the cellular IP if you have a USB cellular modem connected. 

I am currently deploying this network topology, although with a single ISP only.

Using multiple switches in the WAN breakout network (VLAN) you need to keep an eye on your STP. Because I am basically implementing multiple tiered network loop, I having a problem net STP actually doing its job, and thus blocking all WAN links to my Warm Spare MX. In order to keep my secondary MX online, I have to disable RSTP on one port, so as it doesn't go into a blocking state.
LinkedIn ::: https://blog.rhbirkelund.dk/

Like what you see? - Give a Kudo ## Did it answer your question? - Mark it as a Solution 🙂

All code examples are provided as is. Responsibility for Code execution lies solely your own.
Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels