VSD Group Configuration

A VSD group is a set of physical devices that make up a single virtual security device (VSD). One physical device acts as the primary of the VSD group. The virtual security interface (VSI) of the VSD is bound to the physical interface of the primary device. The other physical device acts as the backup.

To configure a VSD group

  1. Enter the necessary information:

Group ID: Enter a value from 0 to 63 to identify the VSD group.

Note: By default, when you enable NSRP, the device creates VSD group 0 and makes all existing interfaces VSIs of this VSD group.

Note: The number of VSD groups allowed is limited by the environment variable you set using the set envar nsrp-max-cluster and set envar nsrp-max-vsd CLI commands. Setting a cluster ID range of 1–63 limits the number of allowed VSD groups to 8. For more information about VSD groups, refer to the ScreenOS Reference Guide, available on the Juniper Networks ScreenOS documentation site.

Priority: Enter a number from 1 to 255. An NSRP configuration requires a single primary device and one or more backup devices. The device with the priority number closest to 1 becomes the primary. You can specify one device as the primary by changing its priority number, or you can leave the priority numbers for all devices at 100 (the default), allowing the VSD group members to automatically elect a primary.

Enable Preempt: Enable the preempt option for the device that you want to have act as the primary device in the VSD group. Normally, the primary device also has the priority number closest to 1; however, you can use the preempt option to override this. In the event of a failover, even if the new primary device has a lower priority than the previous primary device, if you set the preempt option for the previous primary; it will automatically take over as the primary device when it becomes operable again.

Preempt Hold-Down Time (sec): Enter an amount of time from 0 to 600 seconds. Using the hold-down time to delay a failover ensures that surrounding network devices have sufficient time to negotiate new links before the new primary device takes over.

Status: (Read-only)The member of a VSD group can be in one of six states:

Primary  – The state of a VSD group member that processes traffic sent to the VSI.

Primary Backup – The state of a VSD group member that becomes the primary device should the current primary device step down. The election process uses device priorities to determine which member to promote. Note that when electing a new primary device, an RTO peer has precedence over any other VSD group member, even if that member has a higher priority rating.

Backup – The state of a VSD group member that monitors the status of the primary backup and elects one of the backup devices to primary backup if the current one steps down.

Initial – The transient state of a VSD group member while it joins a VSD group, either when the device boots up or when it is added via the set nsrpvsd-group id <id_num> command.

Ineligible – The state that an administrator purposefully assigns to a VSD group member so that it cannot participate in the election process.

Inoperable – The state of a VSD group member after a system check determines that the device has an internal problem (such as no processing boards) or a network connection problem (such as when an interface link fails).

Not defined The device is not a member of a VSD group.

  1. Click OK to save your configuration.