1. Is there a cabling best practice document to possible move to 10 gig even port channels if possible?
2. Based on item 1 how does the config map the ports.
3. how do I initially get the MX250's online. I have a /29 on each of my duel ISPs can I standalone set these devices up and not connect them to the internal network at first?
4. Is there a step by step document to stand up the MX250 and is the config easily replicated from the MX84?
5. Lastly I have 2 GCP VPNs that will need to move the PSK's to the new Appliance
Most of your questions if not all, are answered in this KB.
Swapping one MX for another is very easy to do and downtime should be minimal.
I am looking for the upgrade process not an RMA operation.
Do MX250 auto port channel?
My current implementation is poor so I want to move to the best practices model
MX250 Active / standby
Each MX240 connected to port channels on a stack of MS410.
I believe I basically need each MX DOT1Q do the MS for the TRUST/INTERNAL SVI
Each ISP on an access port on the MS with its own VLAN ISP1 and ISP2 then plugged into each MX so that the VRRP for the Virtual is heard across those vlans. for the UNTRUST/EXTERNAL. Right now we are using a small netgear for this which is not desired.
I will need to prune those VLANS off the MX to MS Trunk I believe.
@JED2021, what you are intending to do is mostly achievable, but there are a few point to note:
If. no VRRP on the wan weeks / VIP configuration then what is the specified requirement to have a separate broadcast domain for ISP1 plugged into both MX and ISP 2 needs a broadcast domain and plugged into both MX?
@JED2021 you don't have to have a shared broadcast domain across both the WAN1 interfaces (or both the WAN2 interfaces) in a HA configuration for routed/NAT mode, you only need that if you run a VIP, and you don't have to have a VIP. (A VIP is only a necessity in a HA VPN concentrator configuration).
You can run HA with ISP1 to WAN1 on the active MX, and ISP2 to WAN1 on the standby MX, and it all works fine. ISP2 is only used for telemetry from the standby MX, there is no traffic using it unless a failover occurs. You can only configure the WAN1 bandwidth once for both the active and standby MX, so either the ISP services should be similarly sized (or use WAN2 on the standby, so WAN2 is empty on the primary MX and WAN1 is empty on the secondary MX). And, if you don't have a VIP, when a failover occurs all current sessions have to be reinitiated, and all VPN tunnels rebuilt (because of the IP address change), but that doesn't take long.
The current pair of MX84 are
Spare Passive ready
Both WAN ports are active and do have traffic
We have client VPN and Generic 2 VPNs to a cloud provide. We would like to add a second pair of VPNs off the ISP2.
This is what it is (. do not get confused that our of coincidence the 4th octet is the same for different ISPs, Maybe just luck)
CARRIER A assigned A.A.A.64/29
CARRIER A assigned B.B.B.64/29
MX84 SMMARY Screen
PUBLIC IP. A.A.A.66
CONFIGURED AS VIRTUAL
IP ADDRESS A.A.A.66
VIRTUAL IP. A.A.A.67
CONFIGURED AS. VIRTUAL
IP ADDRESS. B.B.B.66
VIRTUAL IP B.B.B.67
I am moving toward a core pair of MS devices in stack with aggregation switches connected via port channels for floors in the building
I am using a VIRTUAL IP currently and thise VIRTUAL IPs connect to VPNS at a cloud provider.
Additionally, the following other considerations should be kept in mind:
QUESTION. What protocol do the the MX use on the WAN side?
On the WAN side the MX just uses Ethernet (for Link Layer) and TCP/IP (for Network Layer) - that's basically it, there is no VRRP or anything else at these Layers.