Juniper SSG5 Failover

Posted on 2008-11-17
Last Modified: 2012-05-05
I have a Juniper SSG5 Screen OS 6.2.0 running in Failover mode, everything works fine.
But I have been hit up with a scenario, that I do not know if it is possible.

Eth 0/0 ISP1
Eth 0/1 ISP2

Can I have a VPN on Eth 0/0 that if ISP1 goes down, will failover to Eth 0/1 ISP2? (Simply Yes, but please read on)
While with the above VPN failover, can I have all other traffic go out Eth 0/1 ISP2, and fail over to Eth 0/0 ISP1 if ISP2 goes down?

Hope that makes sense.
Thanks In Advance for any responses.
Question by:Shayne Sales
    LVL 1

    Expert Comment

    If you have it set up with the correct weighting, then your B Firewall will fail back over to your M Firewall once it's able to re-establish connectivity.    

    Author Comment

    by:Shayne Sales
    So your saying that a SSG5 can do a "Active/Active" Dual ISPs?

    What about the VPN situation, can I weight that in a sense, that it will re-eastablish the VPN on the secondary connection should the primary become un-available?

    And I can weight it that all "HTTP/HTTPS" type traffic goes out the secondary, and weight it so the traffic destined for the VPN goes out the Primary?

    Right now, the default failover is "Active/In-Active" since the Primary port is being used and the Secondary port is always set to Down status until failover.


    Accepted Solution

    I have found the answer to my question on the forums.
    Here is the answer.

    "It's all routing once you have the tunnel's setup across each ISP.  Your routing entries would simply use metrics and/or preferences and have a higher metric/preference for one tunnel interface over the other.  Once that VPN drops, the higher preferred route will become inactive and the secondary route will become active.  It's effectively the same thing with the un-encrypted traffic.  But your question is also the same result, if ISP1 goes down then everything will failover to ISP2, and then will failback to ISP1 once it comes back up.  The tunnel will inherently fail because outbound traffic is horked altogether.


    So, your VPN routing entries could look like this:


    set route int tunnel.1 preference 20 metric 20

    set route int tunnel.2 preference 20 metric 30


    You could also do two default routes for Internet traffic, either with equal (possibly also using ECMP) or un-equal preferences.


    set route int e0/0 gate preference 20 metric 20

    set route int e0/1 gate preference 20 metric 30

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    This article is a how to to configure a UCS Ethernet-uplink portchannel via the console. It is easy to do and can be done quite quickly. In certain versions of the UCS manager the portchannel has issues coming up and this is a workaround. I am…
    Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
    Internet Business Fax to Email Made Easy - With eFax Corporate (, you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now