Routed HA pair WAN configuration

[LontzroV]

We currently have a single MX in our topology, but would like to upgrade to an HA deployment. I have some vague memories around VRRP but get a little confused with the WAN configuration. I've devoured the Meraki documentation on the HA feature, and this is what I am left with.

Facts:

- Currently our ISP modems are set to 'passthrough', meaning the public IPs are physically assigned to the MX

- One ISP is a cable provider who also provides us with a static public IP (set as static on MX)

- The other ISP is a cellphone carrier which we access through a MG21E modem

Questions:

1. For the HA setup to work, does the modem need to own the public IP instead of the MXs? I assume this, given that at least a VIP setup requires non-public IPs on the WAN interfaces. If we ditched VIPs, could the modems remain in 'passthroug' mode?

2. It is recommended to use VIPs to make failovers as seemless as possible. What exactly makes a non-VIP setup less seemless? Would not the secondary MX take on the static IP settings from the primary, and thus start to communicate with the modem imitating the primary?

3. Why do some people suggest we need multiple public IPs for the VIP solution to work? Assuming modem owns the public IP and forwards relevant traffic to the VIP shared between the MXs, why would we need 3 public IPs per ISP (I've seen people suggest that each MX requires a public IP as well as the VIP interface - how can an IP need an IP?)

4. Can HA even work with an MG21E? I know the MG21E has two lan ports, so perhaps it can work withoug a VIP setup. But I seem to be unable to create internal subnets and VLANs on the gateway- so a VIP setup seems impossible for sure...?

Probably not great to ask 4 questions at once, but I assume some answers will have bearing on all three. Any info/suggestion/clarifcation will be of help!

[ww]

1) only if you have enough  public ips.

2)no without vip the secondairy  will be using its own wan IP. (So thats different then lan side)

3) i supose because of clients get double  nat. But we use it many times without issues. 

4) mg is using private range addresses  on the lan ports. So u can use a vip in that range.

[cmr]

2. If you don't use a VIP on the WAN interface then outbound traffic presents itself to the world as the IP address of the MX that is currently primary.  i.e. if MX 1 has a public IP of 1.1.1.11 and MX 2 has a public IP of 1.1.1.12 and MX 1 is primary, then all outbound traffic will be seen by the outside world as coming from IP 1.1.1.11.  If the MX pair experience a failover then the traffic will now appear as coming from 1.1.112.  This can affect services that rely on traffic coming from a specific IP address.

If you have a third IP address, the virtual IP, in this case perhaps on 1.1.1.10, then all traffic will appear to the world as 1.1.1.10, regardless of which MX is active.

[LontzroV · Accepted solution]

Hm. Let's assume a VIP setup...

If the Modem is in passthrough: I'd need 3 public IP addresses (MX1, MX2, VIP)

If the Modem is NATed: I'd need 1 public IP (on modem) and 4 private IPs (Modem, MX1, MX2, VIP) in a dedicated WAN VLAN. Modem configured to forward traffic to VIP.

Is this correct?

[cmr]

@LontzroV yes, either option would work and both are correct.

[LontzroV]

Thanks! @cmr