JUNIPER SRX 1400 Firmware Upgrade

Buon salve all,

how are you? How does proceed your digital life?

Today we speak about....Juuuuniiiiipeeeer!!!
Yes, you understand correctly, I speak again of Juniper firewalls and in particular SRX 1400 models.
It's the second time I have to update the firmware of a SRX 1400, and it's te second time I encounter some issues.

The first procedure I try to follow, it has been the upgrade directly from Web Interface.

The web pages doesn't proceed on the following steps. (Instead I used this procedure for, for example, SRX240 or lower). I have tried both with Internet Explorer, both with Firefox and also with Chrome. The results it has been always the same: failure.

So I have decided to try with the second procedure: ftp and tftp upload of the file and request of the firmware upgrade via console. I report, the procedure I have followed (Juniper Link), below.

Follow these steps to copy the software to the SRX device and then perform the software installation via the CLI:

Copy software to SRX via SCP or FTP to /var/tmp:

For example:
user@srx>  scp  junos-srxsme-11.4R4.4-domestic.tgz  user@srx:/var/tmp/junos-srxsme-11.4R4.4-domestic.tgz

OR

user@srx>  ftp <ip address of local ftp server>  (and login)
user@srx>  lcd /var/tmp
user@srx>  bin
user@srx>  get junos-srxsme-11.4R4.4-domestic.tgz
user@srx>  bye

Install software with the commands below.  For detailed instructions, refer to Installing the Software.

For example:
From the local file in /var/tmp
user@srx>  request system software add no-copy /var/tmp/junos-srxsme-11.4R4.4-domestic.tgz
user@srx>  request system reboot

The results it has been the same as before: failure. It was not possible to open the ftp server installed in the client. The communication between SRX1400 and client was ok (they can ping each other). No windows firewall onboard the PC.

So I have decided to try with the third and solving procedure: upload the file from a USB stick and request of the firmware upgrade via console. I report, the procedure I have followed (Juniper Link), below.

Follow these steps to install the software via the CLI from a USB stick:

Download the Junos upgrade file to the USB stick.

Locate the USB device ID that Junos is associating to the USB stick:

user@srx> start shell
user@srx% ls /dev/

Insert the USB device into the USB slot.  For example, slot 0 would return the following:

root# umass0: USB USBFlashDrive, rev 2.00/1.00, addr 2
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <USB USBFlashDrive 0100> Removable Direct Access SCSI-0 device
da0: 1.000MB/s transfers
da0: 980MB (2007040 512 byte sectors: 64H 32S/T 980C)

Run the following command

user@srx% ls /dev/

Locate difference in outputs to locate drive label. (It will usually be da#s1, i.e. da0s1)

Create a mount directory:

user@srx% mkdir /tmp/usb

Mount the USB to the directory:

user@srx% mount -t msdosfs /dev/<drivelabel, e.g. #da0s1> /tmp/usb

Example:
user@srx% mount -t msdosfs /dev/da0s1 /tmp/usb (there is a space between the label name and /tmp)

Verify that the USB is mounted to the device:
root@% pwd
/cf/root
root@% cd /tmp/usb/
root@% pwd
/cf/tmp/usb
root@% ls
junos-jsr-11.4R5.7-export.tgz

Exit shell and install the software:

user@srx% exit
user@srx> request system software add /tmp/usb/<upgrade filename> no-validate no-copy

For additional details regarding a software installation, refer to the instructions at Installing the Software.
Upon completion, reboot the SRX, BUT BEFORE REMOVE THE USB DEVICE FROM SRX (if not the SRX try to boot from USB Device - My personal note due to personal experience ;) )

user@srx> request system reboot


This procedure it has been to one that solved my issue...two times.

And for today it's all.

I hope this post can help you and your troubleshooting! 

Have a nice digitalday!

DiGiTsHaMaN

JUNIPER SRX1400 CLUSTER DHCP RELAY CONFIGURATION MORE INTERFACES

Buon salve all,

how are you? How does proceed your digital life?

Some days ago I spoke you, in this post, about the solved issue I encounter to configure the dhcp relay into a Juniper SRX1400 cluster environment. Today I would like to update that issue describing you how you can configure a different DHCP-RELAY for a different reth you have configuerd on your firewall.

Technology involved: Juniper SRX 1400
Software release: JUNOS Software Release [12.1X46-D15.3]
Description: configuration, into a cluster environment, of the DHCP relay for reth X.Y. Configuration of a different DHCP relay for a different reth K.H. 

Into the image above you can see a simple network schema. This post will descrive the configuration you have to insert on the firewall Juniper SRX1400 to permit that some reth X.Y interface will forward the DHCP request to one DHCP server 01 and others (minimum one interface) will forward the DHCP request to a different DHCP server 02.

All the check you have to perform on the Juniper SRX 1400 are the same described into the previous post: firmware, jdhcpd, etc.

What does it have to change?

The following configuration:

forwarding-options {
    dhcp-relay {
        server-group {
            DHCP-SERVER-01 {
                XXX.YYY.ZZZ.KKK; (this is the ip address of the DHCP-SERVER-01)
            }
            DHCP-SERVER-02 {
                HHH.JJJ.WWW.QQQ; (this is the ip address of the DHCP-SERVER-02)
            }
        }
        group DHCP-SERVER-01-GROUP {
            active-server-group DHCP-SERVER-01;
            interface reth1.41;
            interface reth2.42;
            interface reth1.307;
            interface reth1.305;
        }
        group DHCP-SERVER-02-GROUP {
            active-server-group DHCP-SERVER-02;
            interface reth2.306;

            interface reth2.304
        }
    }
}

I hope this post can help you and your troubleshooting!

Have a nice day!
DiGiTsHaMaN

JUNIPER SRX1400 CLUSTER DHCP RELAY CONFIGURATION

Buon salve all,

how are you? How does proceed your digital life?

Today I speak you about a case I encountered some weeks ago. After an internet search, trying to solve the issue (you find it into the title) by myself, I don't find enough technical documentation; so I hope this post will help anyone of you will encounter the same problem.

So let's start. 

Technology involved: Juniper SRX 1400

Software release: JUNOS Software Release [12.1X46-D15.3]

Description: configuration, into a cluster environment, of the DHCP relay for reth X.Y. The examples and configurations, will follow, will be shown for reth 2.42 (my real and persona case).

First point - it's fundamental to have installed onboard at least the software release described above: the DHCP relay into a cluster environment is supported starting from this release and not before.

Second point - on your cluster juniper, from console type the following comand:

root# run show system processes extensive | grep dhcp

Check that the output of the command typed is:

1281 root        1  96    0 50280K 12060K select  19:38  0.00% jdhcpd

The important think is that you find jdhcpd and not dhcpd.

The dhcpd is the normal dhcp unders system services, and it's the usual way you can configure dhcp into a single environment. Obviously the jdhcpd is the only manner to configure dhcp and dhcp relay into a cluster environment. To enable the jdhcpd you can type the following command:

[edit]
set forwarding-options dhcp-relay server-group <sever-group-name> <ip-address>
set forwarding-options dhcp-relay active-server-group <server-group-name>
set forwarding-optoins dhcp-relay relay-option-60 vendor-option ……
set forwarding-options dhcp-relay group <group-name> interface <interface-name>

That, translated into my real case will produce the following configuration:

forwarding-options {
    dhcp-relay {
        server-group {
            DHCP-SERVER-XYZ {
                XXX.YYY.KKK.HHH;
            }
        }
        active-server-group DHCP-SERVER-XYZ;
        group DHCP-RELAY {
            interface reth2.42;
        }
    }
}

After done this, check again the output of the command:

root# run show system processes extensive | grep dhcp

Another command that can help you to understand if DHCP packets are exanched you cna type:

root# run show dhcp relay statistics

I hope this post can help you and you troubleshooting.

Have a nice day!

DiGiTsHaMaN