skills.rest
fastrevmd-lab
fastrevmd-labCOMMUNITY
Explore all skills by this author →
GitHub

srx-mnha

Design, configure, and troubleshoot Juniper SRX Multi-Node High Availability deployments.

9|Updated Mar 7, 2026
Search Tags:#failover#high-availability#junos#juniper#srx#mnha#chassis-cluster
One-click install
npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-mnha-fastrevmd-lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: srx-mnha
Source: https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/srx-mnha
Command: npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-mnha-fastrevmd-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Juniper SRX Multi-Node High Availability (MNHA) is easy to misconfigure: chassis-cluster habits don't translate, Junos 26.x rejects the flat config model, and silent failures like blocked ICL BFD or black-holed transit routes only appear during failover. This Skill pins the agent to field-verified MNHA syntax, deployment modes, and failure-mode knowledge so designs, migrations, and troubleshooting are grounded in real device behavior. ## Core Features & Use Cases - Deployment mode design: Covers routed, default-gateway (VIP/vMAC), and hybrid MNHA modes with SRG0/SRG1+ semantics, ICL/ICD link design, and activeness-probe requirements. - Chassis-cluster migration: Translates reth interfaces, redundancy groups, and per-node config into independent MNHA nodes, including the Junos 26.x grid-model syntax with reboot requirements. - Advanced workflows: References cover synchronized IPsec across routing instances, deterministic NAT, signal-route BGP/OSPF steering, DHCP relay vs split local pools, and a 23-item field-confirmed pitfalls list. - Use Case: An engineer migrating a chassis cluster to MNHA on vSRX 26.2R1.7 gets the correct grid-model config, learns that activeness-probe is mandatory for routing deployment type, and avoids the ICL-zone BFD permit bug that silently breaks cold sync. ## Quick Start Use the srx-mnha skill to design a routed MNHA pair with eBGP signal-route steering for my two SRX firewalls and produce a failover test plan.

Frequently Asked Questions about srx-mnha

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I migrate from SRX chassis cluster to MNHA?▼

Migration translates intent rather than renaming commands: convert each reth into node-local physical interfaces or a node-local ae bundle, dissolve node0/node1 groups into direct per-node config, and map redundancy groups to SRGs with routing-based preference. Verify upstream LAG support per node before recreating LACP.

What is the difference between SRX chassis cluster and MNHA?▼

Chassis cluster merges two nodes into one logical chassis with shared config and reth interfaces, while MNHA keeps each SRX as an independent device with its own control plane, routing, and configuration. MNHA synchronizes runtime state like sessions and IPsec SAs over a routed ICL instead of HA/fabric ports.

Does SRX MNHA configuration work on Junos 26.x?▼

The flat local-id/peer-id syntax commits on Junos 26.x but never activates, showing mode not configured. Junos 26.x requires the grid model with grid-id, local-domain-id, and peer-domain-id statements plus a reboot, and deployment-type routing SRGs require a mandatory activeness-probe.

Why does MNHA cold sync fail with both nodes showing ACTIVE?▼

A common cause is the ICL security zone permitting system-services high-availability but not protocols bfd, since BFD is a protocol not a system service. ICMP passes while liveness BFD is silently dropped, leaving Conn State DOWN and both nodes self-electing ACTIVE; add host-inbound-traffic protocols bfd on both nodes.

How do I handle DHCP on an SRX MNHA pair?▼

Prefer DHCP relay to an external redundant DHCP service, since local lease databases are not assumed to synchronize between MNHA nodes. If local DHCP is required, run separate per-node servers with non-overlapping pools, node-local server identifiers, and the VIP as the router option.

When should I use ICD instead of symmetric routing in MNHA?▼

Use the Inter-Chassis Datalink only when asymmetric routing is part of the design, such as ECMP delivering flow directions to different nodes or L7 inspection needing bidirectional visibility. Prefer symmetric routing first, and validate ICD platform support, MTU overhead, and real application traffic before relying on it.

Related Skills

Explore More Software Engineering Skills→
ForgePlanForgePlan
3

zone-extractor

Extract zones, nodes, and mega-nodes from ForgePlan map data.

Official
Advanced
rennerenne

high-availability

Manage Proxmox VE HA clusters for automatic VM and container failover.

Community
Advanced
rloisellrloisell
7

network-security

Define ACLs, NAT/PAT, IPsec VPNs, and zone-based firewall policies for Cisco IOS/IOS-XE and Linux iptables.

Community
Advanced
starwreckntxstarwreckntx

failsafe-chassis-activation

Activate emergency failsafe chassis protocols with deterministic sequencing and safety checks.

Community
Advanced