Juniper JUNOSE 11.2.X MULTICAST ROUTING, Configuration Manual

Page: 236 / 256

When the router creates a dynamic tunnel-service interface, it assigns that interface to
a particular module. If that module becomes unavailable, the router removes the interface.
If the initiator of the dynamic interface requests its reestablishment, the router recreates
the dynamic tunnel service interface and assigns it to an available module.
Going forward, if you reinstall a module that was formerly unavailable or removed, the
router deletes unwanted dynamic tunnel-service interfaces and creates new ones for
applications on other modules. Gradually, the distribution of dynamic tunnel-service
interfaces on the modules becomes even.
Interface Allocation for Shared Tunnel-Server Modules
When determining how to distribute interfaces across tunnel-server ports, the E Series
router does not perform interface policing to prevent the access services of a shared
tunnel-server module from depriving the tunnel services of the requisite interface resources
(and vice-versa). We recommend that when provisioning shared tunnel-server ports,
you restrict the number of interfaces configured for both access and tunnel services to
prevent competition between them.
For example, when paired with the ES2-S1 OC3-8/STM1 IOA or the ES2-S1 GE-4 IOA, the
ES2 4G LM on the E320 router can support a maximum of 16,000 access interfaces and
8,000 shared tunnel-server interfaces, both of which must compete for the overall
supported maximum of 16,000 interface columns.
For tunneling, PPP, and IP maximums, see JunosE Release Notes, Appendix A, System
Maximums .
ISMs
You can install multiple ISMs to provide redundancy. If you install multiple ISMs at the
same time, the router automatically distributes ISM interfaces over the modules in
proportion to the available ISM interfaces.
Even distribution of ISM interfaces is not critical to router performance. However, the
number of ISMs that you install must be able to support the extra tunnels if one of the
modules becomes unavailable.
When you configure a static IPSec interface, the router automatically assigns that interface
to a particular ISM. If that ISM becomes unavailable, the interface becomes not present
(operational state down).
The router then manages the interface as follows:
•
If the interface’s local IP address (tunnel source) is less than the remote IP address
(tunnel destination), the router attempts to reassign the interface to an available ISM.
If the reassignment is successful, the router immediately initiates an IPSec negotiation,
also known as
rekeying the interface.
•
If the interface’s local IP address is greater than the remote IP address, the router
attempts to reassign the interface to an available ISM. If the reassignment is successful,
the router waits 3 minutes before initiating an IPSec negotiation.
Copyright © 2010, Juniper Networks, Inc. 214
JunosE 11.2.x Physical Layer Configuration Guide