NextGen Firewall Multi Node High Availability (MNHA) - Virtual IP

Current setup offered by Juniper vSRX is a chassis-based clustering mechanism (running in classic BareMetal servers) requires a pair of firewalls to be placed in the same transit vlan both physically and logically, connecting the two vSRX firewalls using CTRL and FAB links, placed next to each other.

In the IBM VPC deployment, Juniper vSRX introduces the chassis and user traffic high availability feature called MNHA - Multi Node High Availability which allows the two vSRX which can be installed on bare metal or as a VM in KVM, to reside in separate geographies as well as act as Active/Active instead of Active/Backup as was the case in Chassis Cluster model.

The Juniper vSRX MNHA feature allows four different modes of deployment: Switching, Routing, Hybrid, and Cloud

The current workaround in VPC is to use a VPC Load balancer which not only limits the deployment of vSRX in the same zone but requires a DNS bind when used for end customer deployment.

The most viable option is the "CLOUD" deployment mode allowing vSRX to use a script and intergrate/interact with VPC (management or underlay or other) to confirm when/which vSRX to use for certain traffic flows/data. The VPC can provide a feature such as Virtual IP shared between the two vSRX and update the immediate gateway of the VPC subnet using GARP.

This deployment breaks away from the routine Active/Backup models of firewall deployment by using Active/Active firewalls as well as zone/region redundancy allowing firewalls to exist in other regions. And to top it all, there is almost NO service/traffic impact during failover. The firewall images are available in every region to deploy, without restriction and customized to use as VPC VSI.