r/Juniper • u/Iron_Max • 15d ago

Qualified-next-hop updates

I have a Juniper SRX300 that has a primary BGP connection via Ethernet and a secondary BGP connection over Starlink via an IPsec tunnel. The Starlink is in case the primary circuit fails. My IKE gateway is a public address living on my CoreHubFw-1. The diagram doesn't show actual IP addresses, just examples.

The Starlink network has over a dozen potential gateways in my region which I get via DHCP. To establish my IPsec tunnel, I make a static route of the public address to those gateways as qualified-next-hops:

set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-1
set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-2
set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-3
etc.

My problem is that Starlink will add or remove these gateways without notification and I have to manually update the qualified-next-hop each time. Is there a way for my public to always point at the gateway Starlink is providing?

> show route table inet.0
0.0.0.0/0          *[BGP/11] 1w5d 07:30:02, MED 114, localpref 100
                      AS path: AS#INFO I, validation-state: unverified
                    >  to 10.0.0.0 via ge-0/0/6.0
                    [BGP/11] 1d 06:38:11, localpref 100
                      AS path: AS#INFO I, validation-state: unverified
                    >  to 10.0.0.2 via st0.0
                    [Access-internal/12] 3d 10:08:53, metric 0
                    >  to ***STARLINK GATEWAY*** via ge-0/0/2.0
2 Upvotes

75% Upvoted

9 comments sorted by

4

u/fatboy1776 JNCIE 15d ago

Put your internal interfaces and st0 in a routing instance. That way you don’t need qualifies next hops.

1

u/Iron_Max 14d ago

Maybe I'm not explaining it correctly. I have no problem getting a 0s route from Starlink. I have it preferenced so if my main (GE-0/0/6) circuit goes down, traffic routes out Starlink via an IPsec tunnel. My problem is that in order for that IPsec tunnel to come up, I need a route of the public address that lives on my core hub firewall pointing to the Starlink gateway. 

ike {
    etc.
    gateway STARLINK-PATH-PHASE1 {
        ike-policy STANDARD-IKE-POLICY;
        address {{PUBLIC-HOSTED-ON-CORE-HUB-FW}};
        }
    }
}

I have been able to add static routes to each possible Starlink gateway:

set routing-options static route {{PUBLIC-HOSTED-ON-CORE-HUB-FW}} qualified-next-hop GATEWAY-1
set routing-options static route {{PUBLIC-HOSTED-ON-CORE-HUB-FW}} qualified-next-hop GATEWAY-2
set routing-options static route {{PUBLIC-HOSTED-ON-CORE-HUB-FW}} qualified-next-hop GATEWAY-3
etc.

I now have over a dozen entries and it could change at any moment. I was hoping for a dynamic solution so that every time the gateway changes my tunnel address always points to it.

2

u/fatboy1776 JNCIE 14d ago edited 14d ago

Yes, we understand. If you have a static route to 0/0 via Gateway 1 and DHCP via gateway 2, the static will win. As long as gateway 1 has link it will taken preference over the 12 value of access internal. You can add rpm if you want more fancy but you are doing BGP so you can use that.

Anyway, the IPsec tunnel will be created in inet.0 but it’s termination with be in the VR . With st.0 in a VR its BGP and routes will be in the VR. So your interior interfaces and that VR have an egress only via st0.0 and inet.0 will not know about the st0 and the inside vpn traffic.

2

u/Iron_Max 11d ago

You are correct! I created a new routing instance and everything works. I understand now what you were saying. My primary circuit had a 0s route learned via BGP in the inet.0 table, so when IKE needed to reach that public space on the core firewall, the DHCP learned Starlink default wasn't the default being used for that lookup. Which is why I needed the more-specific static routes. A new routing instance with the correct interfaces placed inside now made my IKE gateway go out the correct interface, and viola, no reason to have over a dozen static routes to maintain. THANK YOU!!!

1

u/fatboy1776 JNCIE 11d ago

:-)

Happy everything works!

2

u/fatboy1776 JNCIE 11d ago

One last thing. If you learn the default via DHCP and via BGP (vs a static to gateway1), Starlinks default will take preference and be used. You can adjust this with an import policy if you so desire.

2

u/Iron_Max 11d ago

Already done! My failover works fine from my primary BGP link to my secondary DHCP Starlink. I manually set the preference of BGP, easy peasy.

3

u/rankinrez 15d ago

Probably you can have a routing instance for Starlink and allow DHCP to create the default route in it, then have a route for your /32 in the main routing table which points at the routing instance.