Quantcast
Channel: All SRX Services Gateway posts
Viewing all 17645 articles
Browse latest View live

Re: Significant SRX reliability problems

$
0
0

Hi!

 

No - you're not the only one. We didn't have any jack- or pushbutton-issues, but loads of problems with bad blocks in NAND which often lead to problems during upgrade (i.e. change of boot partition). ISSU going haywire, Systems responding extremly slow after config change (had to re-image the divice). Or SRXes stuck in bootlaoder for no reason - issuing a 'boot' then brings them up (had it with severeal SRX300 so far) - but of course that has to be done from console, i.e. driving to customers site and do it locally since customers usually don't have serial adapter nor want to / are able to revive their equipment. Not to mention the extended downtime at customers site...

 

And it's not the SRXes alone - in the last few months, we had increasing problems with EX-switches too.

Corrupted filesystems (no power outage - NAND simply 'slowly dies' during regular operation within 2 years. JTAC tells me that's normal and we have to live with this). Update of a 9 chassis- VC left 4 of the chassis in boot-prompt

Sponatnoues reboot after a simple commit, false emergency fire-shutdowns due to possible bug in CPU temp sensor.

JUNOS Quality suffered massively - we ran into many bugs in the past - most of them 'confidential', i.e. we didn't even had a chance to circumvent them. To make things worse many (not all!) JTAC engineers have a strange way of tackeling problems ('please try to install a different JUNOS-Version in your production environment- we don't know if it will work (potluck), but hey - it's just half an hour of downtime (if you're lucky) and a drive to the customers site (since you might loose network access to the devices and need console access) - it might cost you a few thousand bucks, but be honest-money is not an issue...) or (well NAND problems ar inadvertable - please check nand on all your (200+) devices once a week to quickly identify problems...).

And I have the feeling that often, they didn't even try once to actually install their recommended versions of Junos on the corresponding devices - we had it more than once that the recommendation didn't work at all on the device (too little memory). Funny things then happen (e.g. systems boots, and forward packets but doesn't NAT anymore - no error messages...).

I already complained multiple times toward Juniper to beef up their QA again - so far in vein.

 

Kai


Re: Firewall filter configuration for loopback IP access

$
0
0

sorry for the confusion.  The basic idea is that your filter is setup like this:

 

Protocol Term 1:  Allow the specific protocol and ip address you want

Protocol Term 2: block that same protocol as a whole so that nothing else can connect

 

Continue for all the protocols you want to limit

 

The last term is then allow all so that anything else will pass.

 

Logging our counts can be added to any desired term.

 

Re: Upgrading from 12.1X44-D40 to 12.1X46-D60 fails

$
0
0

Tom,

 

Strange problem.  You can try to create a bootable USB on the working device.

 

request system snapshot media usb

 

With this plugged in before boot up it should be selected as the boot device by the SRX.  Once up on this clean working junos you might be able to zeroize the device.

 

request system zeroize

 

Re: NAT VLAN trunk directly to untrust statics?

$
0
0

Just change ge-0/0/0 to what ever interface is facing the switch.

 

family ethernet switching is for when you want the tagged port layer 2

 

The above configuration puts a layer 3 address on the tagged interface port facing the switch.

 

Re: Source NAT through VPN not working from switched interface

$
0
0

Hi Steve,

 

I have fe-0/0/3.0 in VLAN 170, both that and the SVI are up/up and I can ping between my client on 192.168.170.2 on fe-0/0/3.0 and the svi interface ip of 192.168.170.1.

 

Thanks

 

Claire

Re: Significant SRX reliability problems

$
0
0

Juniper has been my go-to vendor for over a decade-- but their  reliability problems are killing us-- and rapidly changing my mind.

 

I hate to say it, but I'm t taking another look at pfSense, because that will give me control over hardware quality.  Last I saw, they didn't do routed IPSec which was a show-stopper, and I really DON'T want to mess with Cisco PIX.  Dealing with TAC for our Cisco phone system is a big enough nightmare.  But none of our Cisco gear (switches, VPN gateway, phone system) have failed in any way.

 

Juniper is killing themselves with quality control problems.  Maybe not on million-dollar carrier gear, but definitely on branch tier equipment.

Re: Upgrading from 12.1X44-D40 to 12.1X46-D60 fails

$
0
0

Steve,

Thanks for the response. I need to find a way to do this from loader prompt. I also need a copy of the default config for srx100H2. As I understand it, there should be a way to auto-install with USB, but I need to place the default config on the box as well.  There is a thread stating its possible to use autoinstall.conf empty file and reinstall with usb stick, and recover default config using junos-config file on the usb, but I do not have a default junos config file to use. My predecessor made these dummy-proof and tamper proof for remote use and I think he deleted everything and locked the console in a jail somehow. Any ideas? I do not have a default config I can use? Thanks for any assistance.

Re: Upgrading from 12.1X44-D40 to 12.1X46-D60 fails

$
0
0

So SRX100H2 and I interrupted the boot process by hitting spacebar and got this prompt: =>.

performed nand-format command (took a while)

then I reboot SRX via power buttom, waited for loader prompt(boot failed error cannot find kernel) got loader promt: loader>

disbaled watchdog: loader>watchdog disable

then was able to install from usb:

loader>install file:///junos-srxsme-12.1X46-D67-domestic.tgz

software is currently reinstalling, will update if that fixes anything.....


Re: Upgrading from 12.1X44-D40 to 12.1X46-D60 fails

$
0
0

and we're back.....

same old config, cannot change anything. WTF?

Re: NAT VLAN trunk directly to untrust statics?

$
0
0

Thanks, I was having a hard time figuring out how L2 and L3 ports worked on this box, that really helps, will try it.

SRX100H2 Factory Reset Help Required

$
0
0

I have 2 SRX100H2 devices that were somehow locked and cannot be factory defaulted or changed in any way. I need assistance trying to set them back to factory default and enable jWEB.

What I have done:

I performed nand-format

I downloaded latest software from juniper: junos-srxsme-12.1X46-D67-domestic.tgz to USB stick and performed watchdog disable and install file junos-srxsme-12.1X46-D67-domestic.tgz.

device booted up and I configured via CLI.

saved and reboot, here is what I see on console: DOES THIS LOOK NORMALL? OR IS THIS IN ANY WAY UNUSUAL?

init regular console

Primary ICache: Sets 64 Size 128 Asso 4

Primary DCache: Sets 1 Size 128 Asso 64

Secondary DCache: Sets 128 Size 128 Asso 8

GDB: debug ports: uart

GDB: current port: uart

KDB: debugger backends: ddb gdb

KDB: current backend: ddb

kld_map_v: 0x8ff80000, kld_map_p: 0x0

Copyright (c) 1996-2017, Juniper Networks, Inc.

All rights reserved.

Copyright (c) 1992-2006 The FreeBSD Project.

Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994

        The Regents of the University of California. All rights reserved.

JUNOS 12.1X46-D67 #0: 2017-07-12 01:39:21 UTC

    builder@quoarth.juniper.net:/volume/build/junos/12.1/service/12.1X46-D67/obj-octeon/junos/bsd/kernels/JSRXNLE/kernel

JUNOS 12.1X46-D67 #0: 2017-07-12 01:39:21 UTC

    builder@quoarth.juniper.net:/volume/build/junos/12.1/service/12.1X46-D67/obj-octeon/junos/bsd/kernels/JSRXNLE/kernel

real memory  = 2147483648 (2048MB)

avail memory = 1057017856 (1008MB)

FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs

Security policy loaded: JUNOS MAC/pcap (mac_pcap)

Security policy loaded: JUNOS MAC/runasnonroot (mac_runasnonroot)

netisr_init: !debug_mpsafenet, forcing maxthreads from 2 to 1

cpu0 on motherboard

: CAVIUM's OCTEON 5020 CPU Rev. 0.1 with no FPU implemented

        L1 Cache: I size 32kb(128 line), D size 8kb(128 line), sixty four way.

        L2 Cache: Size 128kb, 8 way

obio0 on motherboard

uart0: <Octeon-16550 channel 0> on obio0

uart0: console (9600,n,8,1)

twsi0 on obio0

dwc0: <Synopsis DWC OTG Controller Driver> on obio0

usb0: <USB Bus for DWC OTG Controller> on dwc0

usb0: USB revision 2.0

uhub0: vendor 0x0000 DWC OTG root hub, class 9/0, rev 2.00/1.00, addr 1

uhub0: 1 port with 1 removable, self powered

uhub1: vendor 0x0409 product 0x005a, class 9/0, rev 2.00/1.00, addr 2

uhub1: single transaction translator

uhub1: 2 ports with 1 removable, self powered

umass0: STMicroelectronics ST72682  High Speed Mode, rev 2.00/2.10, addr 3

umass1: General USB Flash Disk, rev 2.00/1.00, addr 4

cpld0 on obio0

pcib0: <Cavium on-chip PCI bridge> on obio0

Disabling Octeon big bar support

PCI Status: PCI 32-bit: 0xc041b

pcib0: Initialized controller

pci0: <PCI bus> on pcib0

pci0: <serial bus, USB> at device 2.0 (no driver attached)

pci0: <serial bus, USB> at device 2.1 (no driver attached)

pci0: <serial bus, USB> at device 2.2 (no driver attached)

gblmem0 on obio0

octpkt0: <Octeon RGMII> on obio0

cfi0: <AMD/Fujitsu - 4MB> on obio0

Timecounter "mips" frequency 500000000 Hz quality 0

###PCB Group initialized for udppcbgroup

###PCB Group initialized for tcppcbgroup

da0 at umass-sim0 bus 0 target 0 lun 0

da0: <ST ST72682 2.10> Removable Direct Access SCSI-2 device

da0: 40.000MB/s transfers

da0: 2000MB (4096000 512 byte sectors: 255H 63S/T 254C)

da1 at umass-sim1 bus 1 target 0 lun 0

da1: <General USB Flash Disk 1.00> Removable Direct Access SCSI-2 device

da1: 40.000MB/s transfers

da1: 7651MB (15669248 512 byte sectors: 255H 63S/T 975C)

Trying to mount root from ufs:/dev/da0s1a

MFSINIT: Initialising MFSROOT

Process-1 beginning MFSROOT initialization...

Creating MFSROOT...

/dev/md0: 20.0MB (40956 sectors) block size 16384, fragment size 2048

        using 4 cylinder groups of 5.00MB, 320 blks, 640 inodes.

super-block backups (for fsck -b #) at:

32, 10272, 20512, 30752

Populating MFSROOT...

Creating symlinks...

Setting up mounts...

Continuing boot from MFSROOT...

Attaching /cf/packages/junos via /dev/mdctl...

Mounted junos package on /dev/md1...

D

automatic reboot in progress...

** /dev/da0s1a (NO WRITE)

** Last Mounted on /

** Root file system

** Phase 1 - Check Blocks and Sizes

** Phase 2 - Check Pathnames

** Phase 3 - Check Connectivity

** Phase 4 - Check Reference Counts

** Phase 5 - Check Cyl groups

161 files, 75850 used, 236336 free (56 frags, 29535 blocks, 0.0% fragmentation)

mount reload of '/' failed: Operation not supported

 

-a: not found

-a: not found

-a: not found

-a: not found

-a: not found

-a: not found

-a: not found

-a: not found

-a: not found

-a: not found

Checking integrity of BSD labels:

  s1: Passed

  s2: Passed

  s3: Passed

  s4: Passed

** /dev/bo0s3e

FILE SYSTEM CLEAN; SKIPPING CHECKS

clean, 23569 free (25 frags, 2943 blocks, 0.1% fragmentation)

** /dev/bo0s3f

FILE SYSTEM CLEAN; SKIPPING CHECKS

clean, 313159 free (87 frags, 39134 blocks, 0.0% fragmentation)

Checking integrity of licenses:

Checking integrity of configuration:

  rescue.conf.gz: No recovery data

Loading configuration ...

mgd: commit complete

Setting initial options: .

Starting optional daemons:  usbd.

Doing initial network setup:.

Initial interface configuration:

Time and ticks drifted too much,                        resetting synchronization...

additional daemons: eventd.

Additional routing options:kern.module_path: /boot//kernel;/boot/modules -> /boot/modules;/modules/ifpfe_drv;/modules;

kld netpfe drv: ifpfed_dialer ipsec kld.

Doing additional network setup:.

Starting final network daemons:.

setting ldconfig path: /usr/lib /opt/lib

starting standard daemons: cron.

Initial rc.mips initialization:.

Local package initialization:.

starting local daemons:set cores for group access

.

Creating JAIL MFS partition...

JAIL MFS partition created

boot.upgrade.uboot="0xBFC00000"

boot.upgrade.loader="0xBFE00000"

Boot media /dev/da0 has dual root support

** /dev/da0s2a

FILE SYSTEM CLEAN; SKIPPING CHECKS

clean, 240288 free (48 frags, 30030 blocks, 0.0% fragmentation)

Fri Dec  8 05:16:29 UTC 2017

 

 

 

Re: SRX100H2 Factory Reset Help Required

$
0
0

so, no matter what I try, both of these SRX100 devices always revert to old config(gre tunnels, IP addresses, ect.) and I cannot access JWEB, or get factory default settings, or even get an IP from DHCP if i manually add a pool/server via console. I need help.

Re: SRX100H2 Factory Reset Help Required

$
0
0

Have you tried zeroizing it?

 

request system zeroize

Re: vSRX scsi & IDE ova image difference

$
0
0

Hello Suresh,

 

There is no difference between the two in terms of performance or stability from the vSRX perspective.

 

Here are the guidelines:

IDE OVA - media-vsrx-vmdisk-15.1X49-D120.3.ide.ova - Used in most VMware deployments
SCSI OVA - media-vsrx-vmdisk-15.1X49-D120.3.scsi.ova - Use in VMware deployments that require SCSI vDisk support, for example, deployments that include network-attached storage (NAS).

 

I suggest that if you are not sure check with the VMware admin.

 

Regards,

 

Vikas

Re: Significant SRX reliability problems

$
0
0

Hello 

 

Thanks a lot for the feedabck. 

 

To understand better, what is the model of the newly procured SRXes and what is the JUNOS verison this fleet is running?

 

Regards,

 

Vikas


Re: Upgrading from 12.1X44-D40 to 12.1X46-D60 fails

$
0
0

Hello Tom,

Just to ensure I understand, you are able to make config changes but it does not survive a reboot?

 

> Are you a super-user?
> Have you tried the typical "request system software add..." to do a clean install
> Alternately, you could try rolling back to the old OS running on the device in which you may not have the same trouble:
   show system software backup
   request system software rollback

 

Regards,

Vikas

 

Re: Upgrading from 12.1X44-D40 to 12.1X46-D60 fails

$
0
0

Tom,

 

Sorry for the lack of clarity, I am referring to your comment here:

 

 I do have another SRX100H2 that is working, so if there is a way to pull the software off that and install it on the messed up one I can try that.

 

---On this other working/good SRX:

insert an empty usb (it will be overwritten

request system snapshort media usb

 

This will create a bootable usb with the Junos and configuration of the working device.

 

Power off the bad device

insert the usb

power on and it should boot from the usb with that version of junos clean

 

From here you should then be able to either:

1-snapshot to the internal media - which should put the good Junos and config on the flash

request system snapshort media internal

 

or

 

2- erase the device

request system zeroize

 

 

Re: Source NAT through VPN not working from switched interface

Re: Significant SRX reliability problems

$
0
0

"Newly procured?"  Per my original post, these were bought 4-5 years ago-- which is still fairly young in networking gear terms.  (except the one with the reset button problem is just under 3 years old, problem started at age 2)


210HE, 220H, 240H

 

Some are on 12.1X46-D67, others are still at 12.1X44-D30.4.  

 

That's another MAJOR complaint.  ALL of our devices are still under PAID support, but there is NO JUNOS version we can run that mitigates vulnerabilities CVE-2016-10012, CVE-2016-10010, CVE-2015-6564 and CVE-2015-8325.  The fix is 12.3X48-D55 but none of our devices can run that build, per JTAC, because they are not the newer H2 model.  It is also impossible to disable SSL 3.0 and TLS 1.0 (per JTAC) because the builds that do that are also NOT able to run on our still-paid-supported gear.  I put in an enhancement request for that, but haven't heard a thing.  So I've had to disable nearly all external access on devices that are a long distance away.

What the main reason when have "error bad UDP checksum" ?

$
0
0

Hi all,

 

currently we facing and issue when the snmp server cannot poling the certain interface info on other MX router. The traffic is flow through SRX5800 before it reach the MX router. When do tcp dump on snmp server it see "bad UDP checksum". When we do traceoption on SRX we see "bad udp length".

 

So may i know whether its related to MTU issue?

 

Thanks

Viewing all 17645 articles
Browse latest View live