Data Center LAN Migration Guide - Juniper Networks

Data Center LAN Migration Guide
In the preinstallation phase, security policies must be developed. This typically takes time and can be complex to
coordinate. Juniper Professional Services can be used as a resource to help analyze and optimize security policies at all
enforcement points. The full suite of Juniper Networks Professional Services offerings can be found at:
www.juniper.net/us/en/products-services/consulting-services.
• Establish a migration plan, identifying a time line and key migration points, if all appliances cannot be migrated in a
flash cut.
• As with the other insertion points, PoC testing can be done and could include:
- Establishing the size of the target rule base to be used post conversion
- Checking the efficacy of the zone definitions
- Determining the effectiveness of the IPS controls
- Determining the suitability and implementation of the access controls to be used
Installation Tasks
As with the aggregation/core insertion point, it is important to have a fallback position to existing appliances in the
event of any operational issues. The current firewall appliances should be kept on hot standby. The key to a successful
migration is to have applications identified for validation and to have a clear test plan for success criteria. There are
three typical options for migration, with option 1 being the one most commonly used.
Migration Test Plan (Option 1)
• Test failover by failing the master firewall (legacy vendor) to the backup (this confirms that HA works and the other
devices involved in the path are working as expected).
• Replace the primary master, which was just manually failed, with the Juniper firewall. The traffic should still be
flowing through the secondary, which is the legacy vendor firewall.
• Turn off the virtual IP (VIP) address or bring the interface down on the backup (legacy vendor firewall) and force
everything through the new Juniper firewall.
• A longer troubleshooting window helps to ensure that the switchover has happened successfully. Also, turn off
synchronization checks (syn-checks) initially, to process already established sessions, since the TCP handshake has
already occurred on the legacy firewall. This will ensure that the newly established Juniper firewall will not drop all
active sessions as it starts up.
Migration Test Plan (Option 2)
• This is essentially a flash cut option where an alternate IP address for the new firewall is configured along with the
routers and the hosts then point to the new firewall. If there is an issue, gateways and hosts can then be provisioned
to fall back to the legacy firewalls. With this option, organizations will sometimes choose to leave IPsec VPNs or
other termination on their old legacy firewalls and gradually migrate them over a period of time.
Migration Test Plan (Option 3)
• This option is typically used by financial organizations due to the sensitive nature of their applications.
• A Switched Port Analyzer (SPAN) session will be set up on the relevant switches with traffic sent to the Juniper
firewalls, where traffic is analyzed and session tables are built. This provides a clear understanding of traffic
patterns and provides more insight into the applications being run. This option also determines whether there is any
interference due to filter policies or IPS, and it creates a more robust test and cutover planning scenario. This option
typically takes more time than the other options, so organizations typically prefer to go with option 1. Again, this is a
more common option for companies in the financial sector.
Copyright © 2012, Juniper Networks, Inc. 45