Junos Firmware Upgrade: EX Series and Single SRX node
Table of Contents
Upgrading the firmware on your router or switches can be a painstaking exercise for many reasons, outside of the fact that doing the actual upgrade is quite straightforward. Having to confirm with clients, checking that there’s no major events going on within the company, reassuring that the outrage wouldn’t take more time than expected blah, blah. All major pains!!! If you don’t need to worry about all that jazz and only have to do the upgrade then you’re a lucky so and so :P
This page will go through the steps needed to process with a Junos Firmware upgrade. This method can be used on EX and Single SRX (Junos upgrades on clustered SRXs is a different animal, which I will write up in due time). I’ll be doing this upgrade on EX4200.
I haven’t upgraded an MX Series Router before, so I can’t say if it works on them. When I do Junos Firmware upgrade on a MX Series Router, I will update this page accordingly :)
UPDATE 23/03/2016⌗
I got my hands on MX Series Router and wrote down some notes on the process here
Standalone upgrade⌗
You will need to upload the new version of Junos onto the switch/firewall. There’s a few ways you can do this. I normally Secure Copy (SCP) the package from my Mac to the device and save the package in the /tmp directory.
$ scp jinstall-ex-4200-12.3R5.7-domestic-signed.tgz kmarquis@192.168.1.10:/tmp
You can check the transfer by using the start shell from Operational Mode and then go to the /tmp folder.
From Operational Mode you will need to use the following command to start the upgrade process: request system software add reboot /tmp/xxx validate
After running this once the package has been added, the device will reboot, as a reboot is needed for the firmware to be upgraded.
It normally takes like 5 minutes or so, for the upgrade to happen and once it has completed you will need to upgrade the backup image as well. request system snapshot all-members slice alternate
To validate that this has been completed: show system snapshot all-members media internal
And as simple as that you have an upgraded Junos firmware :)
In Service Upgrades⌗
If you have Virtual Chassis (VC) configuration, you will be able to perform an In-Service Software Upgrade (ISSU) or Non-Stop Software Upgrade (NSSU). As most VCs are configured with two Routing-Engines (RE) (as recommended by Juniper) by using ISSU, you are essentially upgrading the backup RE then swapping the backup to the master, to allow the other RE to upgrade.
To run ISSU you will need to have the following commands configured on the switches BEFORE you start
set system commit synchronize
set chassis redundancy graceful-switchover
set ethernet-switching-options nonstop-bridging
set routing-options nonstop-routing
set virtual-chassis preprovisioned
set virtual-chassis member 0 role routing-engine
set virtual-chassis member 0 serial-number (serial-number)
set virtual-chassis member 1 role routing-engine
set virtual-chassis member 1 serial-number (serial-number)
set virtual-chassis fast-failover ge
set virtual-chassis fast-failover xe
Once you have checked, to start the upgrade you will need to run the command: request system software nonstop-upgrade /var/tmp/xxxxx
Once it has started you will see
Chassis ISSU Check Done
ISSU: Validating Image
ISSU: Preparing Backup RE
Installing image on other FPC's along with the backup
Checking pending install on fpc0
Pushing bundle to fpc0
NOTICE: Validating configuration against jinstall-ex-4500-12.3R5.7-domestic-signed.tgz.
NOTICE: Use the 'no-validate' option to skip this if desired.
WARNING: A reboot is required to install the software
WARNING: Use the 'request system reboot' command immediately
Completed install on fpc0
Backup upgrade done
Rebooting Backup RE
Once the backup RE has been upgraded, you will be switched from the Master to the Backup so that the Master can be upgraded.
Now that the upgrade as has been completed you will need upgrade its backup image as well, like with all junos upgrades, you will use request system snapshot slice alternate all-members and to verify the change has been completed show system snapshot media internal all-members
Upgrading Backup Image⌗
root@EX4200-Member-0> request system snapshot slice alternate all-members
fpc0:
--------------------------------------------------------------------------
Formatting alternate root (/dev/da0s2a)...
Copying '/dev/da0s1a' to '/dev/da0s2a' .. (this may take a few minutes)
The following filesystems were archived: /
fpc1:
--------------------------------------------------------------------------
Formatting alternate root (/dev/da0s2a)...
Copying '/dev/da0s1a' to '/dev/da0s2a' .. (this may take a few minutes)
The following filesystems were archived: /
Verifying Backup Image⌗
root@EX4200-Member-0> show system snapshot media internal all-members
fpc0:
--------------------------------------------------------------------------
Information for snapshot on internal (/dev/da0s1a) (primary)
Creation date: Dec 20 14:58:28 2013
JUNOS version on snapshot:
jbase : ex-12.3R5.7
jkernel-ex: 12.3R5.7
jcrypto-ex: 12.3R5.7
jdocs-ex: 12.3R5.7
jswitch-ex: 12.3R5.7
jpfe-ex45x: 12.3R5.7
jroute-ex: 12.3R5.7
jweb-ex: 12.3R5.7
fips-mode-powerpc: 12.3R5.7
Information for snapshot on internal (/dev/da0s2a) (backup)
Creation date: Dec 20 15:20:09 2013
JUNOS version on snapshot:
jbase : ex-12.3R5.7
jkernel-ex: 12.3R5.7
jcrypto-ex: 12.3R5.7
jdocs-ex: 12.3R5.7
jswitch-ex: 12.3R5.7
jpfe-ex45x: 12.3R5.7
jroute-ex: 12.3R5.7
jweb-ex: 12.3R5.7
fips-mode-powerpc: 12.3R5.7
fpc1:
--------------------------------------------------------------------------
Information for snapshot on internal (/dev/da0s1a) (primary)
Creation date: Dec 20 15:08:57 2013
JUNOS version on snapshot:
jbase : ex-12.3R5.7
jkernel-ex: 12.3R5.7
jcrypto-ex: 12.3R5.7
jdocs-ex: 12.3R5.7
jswitch-ex: 12.3R5.7
jpfe-ex45x: 12.3R5.7
jroute-ex: 12.3R5.7
jweb-ex: 12.3R5.7
fips-mode-powerpc: 12.3R5.7
Information for snapshot on internal (/dev/da0s2a) (backup)
Creation date: Dec 20 15:21:29 2013
JUNOS version on snapshot:
jbase : ex-12.3R5.7
jkernel-ex: 12.3R5.7
jcrypto-ex: 12.3R5.7
jdocs-ex: 12.3R5.7
jswitch-ex: 12.3R5.7
jpfe-ex45x: 12.3R5.7
jroute-ex: 12.3R5.7
jweb-ex: 12.3R5.7
fips-mode-powerpc: 12.3R5.7
UPDATE 29/4/2015⌗
To upgrade the backup image of High End SRX Series (SRX1400, SRX3400, SRX3600, SRX5600 or SRX5800), you need to use a slightly different command. The High-End SRXs use a Compact Flash (Primary) and Hard-disk (Backup), when you do a firmware upgrade you will write to the Compact Flash however you will need to update the Hard-Disk as well. To check the image on the hard-disk, you can run the command show system snapshot media hard-disk
{primary:node0}
root@lab\_be-rtr0-h3> show system snapshot media hard-disk
node0:
--------------------------------------------------------------------------
Information for snapshot on hard-disk (ad2s1)
Creation date: Apr 29 10:29:53 2015
JUNOS version on snapshot:
junos : 12.1X44-D40.2-domestic
node1:
--------------------------------------------------------------------------
Information for snapshot on hard-disk (ad2s1)
Creation date: Apr 29 10:32:03 2015
JUNOS version on snapshot:
junos : 12.1X44-D40.2-domestic
When we do a show system snapshot media compact-flash we can see the difference.
{primary:node0}
root@lab\_be-rtr0-h3> show system snapshot media compact-flash
node0:
--------------------------------------------------------------------------
Information for snapshot on compact-flash (ad0s1)
Creation date: Apr 29 12:25:16 2015
JUNOS version on snapshot:
junos : 12.1X46-D10.2-domestic
node1:
--------------------------------------------------------------------------
Information for snapshot on compact-flash (ad0s1)
Creation date: Apr 29 12:11:59 2015
JUNOS version on snapshot:
junos : 12.1X46-D10.2-domestic
To correct this, we will need to run request system snapshot media hard-disk {node all}
Node All is only used if you have chassis cluster
root@lab\_be-rtr0-h3> request system snapshot media hard-disk node all
node0:
--------------------------------------------------------------------------
Verifying compatibility of destination media partitions...
Running newfs (905MB) on hard-disk media / partition (ad2s1a)...
Running newfs (101MB) on hard-disk media /config partition (ad2s1e)...
Copying '/dev/ad0s1a' to '/dev/ad2s1a' .. (this may take a few minutes)
Copying '/dev/ad0s1e' to '/dev/ad2s1e' .. (this may take a few minutes)
The following filesystems were archived: / /config
node1:
--------------------------------------------------------------------------
Verifying compatibility of destination media partitions...
Running newfs (905MB) on hard-disk media / partition (ad2s1a)...
Running newfs (101MB) on hard-disk media /config partition (ad2s1e)...
Copying '/dev/ad0s1a' to '/dev/ad2s1a' .. (this may take a few minutes)
Copying '/dev/ad0s1e' to '/dev/ad2s1e' .. (this may take a few minutes)
The following filesystems were archived: / /config
To verify that we have consistency between the Compact-Flash and Hard-disk, again we will run show system snapshot media {compact-flash|hard-disk}
Compact-Flash⌗
{primary:node0}
root@lab\_be-rtr0-h3> show system snapshot media compact-flash
node0:
--------------------------------------------------------------------------
Information for snapshot on compact-flash (ad0s1)
Creation date: Apr 29 12:25:16 2015
JUNOS version on snapshot:
junos : 12.1X46-D10.2-domestic
node1:
--------------------------------------------------------------------------
Information for snapshot on compact-flash (ad0s1)
Creation date: Apr 29 12:11:59 2015
JUNOS version on snapshot:
junos : 12.1X46-D10.2-domestic
Hard-disk⌗
{primary:node0}
root@lab\_be-rtr0-h3> show system snapshot media hard-disk
node0:
--------------------------------------------------------------------------
Information for snapshot on hard-disk (ad2s1)
Creation date: Apr 29 13:06:53 2015
JUNOS version on snapshot:
junos : 12.1X46-D10.2-domestic
node1:
--------------------------------------------------------------------------
Information for snapshot on hard-disk (ad2s1)
Creation date: Apr 29 13:09:13 2015
JUNOS version on snapshot:
junos : 12.1X46-D10.2-domestic