If you did not plan appropriately in either case, you may find yourself in a very sticky situation.
Your phone chimes with your favorite themed text message alert.
5 minutes later your phone rings in the same themed ring tone.
Customers inside one of your data centers are experiencing an extra 250 – 500 milliseconds of unplanned latency. On top of that, some connections are timing out altogether. All of your monitoring tools show green. Everything is up. What thuh?
user@firewall> show security flow session summary | match "node|FPC|use"
Session count looks good. These bad boys seem to be load balancing sessions across all SPCs appropriately and are well below the max session count.
So you take a look at your redundant ethernet interfaces.
NOW…. At first glance, you may look at these numbers and dismiss any potential issue. They are after all 10Gb interfaces that operate in full duplex. But look closely. Your design used a single SRX-IOC-4XGE-XFP on each firewall. This means that reth0 and reth1 are sharing 10Gb TOTAL capacity.
Uh Oh. You may not typically have 10Gb cards laying around. But if you do, are you going to come up with the right solution at 3am? You may want to look elsewhere for a solution. How about police the traffic as it enters the firewall like you would on any of your MXs or other routers. Check out this SRX policing link.
Don't want to police on the firewalls? Try policing lower in the stack. You have MX routers. You have EX switches. You can make this work.
You finally rate limit your main offenders and the firewalls are back to a somewhat healthy state.
It's now 4am and you head back to bed except you're so wound up, you can't get back to sleep so you start working on your plan to add bandwidth to your high end SRXs. Let's talk link aggregation. How should you do it? There are some options.
I'll follow up this post next week with a link aggregation howto.