Data Center LAN Migration Guide - Juniper Networks
Data Center LAN Migration Guide - Juniper Networks
Data Center LAN Migration Guide - Juniper Networks
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Data</strong> <strong>Center</strong> <strong>LAN</strong> <strong>Migration</strong> <strong>Guide</strong><br />
In the preinstallation phase, security policies must be developed. This typically takes time and can be complex to<br />
coordinate. <strong>Juniper</strong> Professional Services can be used as a resource to help analyze and optimize security policies at all<br />
enforcement points. The full suite of <strong>Juniper</strong> <strong>Networks</strong> Professional Services offerings can be found at:<br />
www.juniper.net/us/en/products-services/consulting-services.<br />
• Establish a migration plan, identifying a time line and key migration points, if all appliances cannot be migrated in a<br />
flash cut.<br />
• As with the other insertion points, PoC testing can be done and could include:<br />
- Establishing the size of the target rule base to be used post conversion<br />
- Checking the efficacy of the zone definitions<br />
- Determining the effectiveness of the IPS controls<br />
- Determining the suitability and implementation of the access controls to be used<br />
Installation Tasks<br />
As with the aggregation/core insertion point, it is important to have a fallback position to existing appliances in the<br />
event of any operational issues. The current firewall appliances should be kept on hot standby. The key to a successful<br />
migration is to have applications identified for validation and to have a clear test plan for success criteria. There are<br />
three typical options for migration, with option 1 being the one most commonly used.<br />
<strong>Migration</strong> Test Plan (Option 1)<br />
• Test failover by failing the master firewall (legacy vendor) to the backup (this confirms that HA works and the other<br />
devices involved in the path are working as expected).<br />
• Replace the primary master, which was just manually failed, with the <strong>Juniper</strong> firewall. The traffic should still be<br />
flowing through the secondary, which is the legacy vendor firewall.<br />
• Turn off the virtual IP (VIP) address or bring the interface down on the backup (legacy vendor firewall) and force<br />
everything through the new <strong>Juniper</strong> firewall.<br />
• A longer troubleshooting window helps to ensure that the switchover has happened successfully. Also, turn off<br />
synchronization checks (syn-checks) initially, to process already established sessions, since the TCP handshake has<br />
already occurred on the legacy firewall. This will ensure that the newly established <strong>Juniper</strong> firewall will not drop all<br />
active sessions as it starts up.<br />
<strong>Migration</strong> Test Plan (Option 2)<br />
• This is essentially a flash cut option where an alternate IP address for the new firewall is configured along with the<br />
routers and the hosts then point to the new firewall. If there is an issue, gateways and hosts can then be provisioned<br />
to fall back to the legacy firewalls. With this option, organizations will sometimes choose to leave IPsec VPNs or<br />
other termination on their old legacy firewalls and gradually migrate them over a period of time.<br />
<strong>Migration</strong> Test Plan (Option 3)<br />
• This option is typically used by financial organizations due to the sensitive nature of their applications.<br />
• A Switched Port Analyzer (SPAN) session will be set up on the relevant switches with traffic sent to the <strong>Juniper</strong><br />
firewalls, where traffic is analyzed and session tables are built. This provides a clear understanding of traffic<br />
patterns and provides more insight into the applications being run. This option also determines whether there is any<br />
interference due to filter policies or IPS, and it creates a more robust test and cutover planning scenario. This option<br />
typically takes more time than the other options, so organizations typically prefer to go with option 1. Again, this is a<br />
more common option for companies in the financial sector.<br />
Copyright © 2012, <strong>Juniper</strong> <strong>Networks</strong>, Inc. 45