Discover how to update a Juniper SRX router. Update from 12.1X46-D50.4 to 12.3X48-D45.6 in just a few minutes.
Real-world use case
Your Juniper SRX 100 router is accumulating overdue security patches: here's how to update it cleanly.
Updating an SRX 100 router running Junos
Sometimes it becomes necessary to update your router in order to close security holes or gain access to new, more or less significant features. My SRX100 router is currently running firmware 12.1X46-D50.4, dated April 2016. I want to update it to 12.3X48-D45.6, dated February 2017. The changes between the two firmware versions are significant and available at the following link.
Prerequisites:
- Back up the router's current configuration:
save /tmp/conf17052017
Wrote 751 lines of configuration to '/tmp/conf17052017'
- Have the latest firmware available on Juniper's website, accessible from a valid account.
- Have physical access to the router, or an FTP server to upload the firmware.
- Half an hour of free time to carry out the SRX100 update.
Individual update
There are different types of updates, let's discover together the individual update for the SRX100.
We start in operational mode and check the router's version:
show version
Hostname: junsrx
Model: srx100h2
JUNOS Software Release [12.1X46-D50.4]
In our case, we get the firmware from Juniper's website. In my case, I uploaded it via SFTP to the /tmp directory, then retrieved the previously created router configuration: conf17052017. Here's the contents of /tmp:
root@junsrx> start shell
root@junsrx% cd /tmp/
root@junsrx% ls
.clnpkg.LCK conf17052017
.download-manager.LCK idpd.pid
.pkg.REBOOT junos-srxsme-12.3X48-D45.6-domestic.tgz
BSD.var.dist libappid_debug.log
appidd_trace_debug lockmgr
exit
For users who prefer using the FTP method, here's the basic command:
user@host> file copy ftp://username:[email protected]/filename /tmp/
We're now ready to update the router:
root@junsrx> request system sofware add /tmp/junos-srxsme-12.3X48-D45.6-domestic.tgz validate
Formatting alternate root (/dev/da0s1a)...
/dev/da0s1a: 619.6MB (1268876 sectors) block size 16384, fragment size 2048
using 4 cylinder groups of 154.91MB, 9914 blks, 19840 inodes.
super-block backups (for fsck -b #) at:
32, 317280, 634528, 951776
Extracting /tmp/junos-srxsme-12.3X48-D45.6-domestic.tgz ...
saving package file in /var/sw/pkg ...
Checking compatibility with configuration
Initializing...
rm: /var/validate/chroot/mfs/var/etc/pam.conf: Operation not permitted
rm: /var/validate/chroot/mfs/var/etc: Directory not empty
rm: /var/validate/chroot/mfs/var: Directory not empty
rm: /var/validate/chroot/mfs: Directory not empty
rm: /var/validate/chroot: Directory not empty
Verified manifest signed by PackageProductionEc_2016 method ECDSA
Verified junos-12.1X46-D50.4-domestic signed by PackageProductionEc_2016 method ECDSA
Using junos-12.3X48-D45.6-domestic from /altroot/cf/packages/install-tmp/junos-12.3X48-D45.6-domestic
Copying package ...
veriexec: cannot update veriexec for /cf/var/validate/chroot/junos/usr/lib/libslax.so.3: No such file or directory
veriexec: cannot update veriexec for /cf/var/validate/chroot/junos/usr/lib/libext_bit.so.3: No such file or directory
veriexec: cannot update veriexec for /cf/var/validate/chroot/junos/usr/lib/libext_curl.so.3: No such file or directory
veriexec: cannot update veriexec for /cf/var/validate/chroot/junos/usr/lib/libext_xutil.so.3: No such file or directory
Verified manifest signed by PackageProductionEc_2017 method ECDSA
Hardware Database regeneration succeeded
Validating against /config/juniper.conf.gz
Usage: license-check -f "<features>" -m -p -q -M -u -U -V
-V verify if release based licenses are present
Connectivity fault management process: rtslib: ERROR kernel does not support all messages: expected 103 got 102,a reboot or software upgrade may be required
Connectivity fault management process:
Connectivity fault management process: rtslib: WARNING version mismatch for msg bulkstats: expected 0 got 98,a reboot or software upgrade may be required
Connectivity fault management process:
Connectivity fault management process: rtslib: WARNING version mismatch for msg ddos: expected 99 got 98,a reboot or software upgrade may be required
Connectivity fault management process:
Connectivity fault management process: rtslib: WARNING version mismatch for msg notify msg: expected 98 got 0,a reboot or software upgrade may be required
Connectivity fault management process:
Connectivity fault management process: rtslib: WARNING version mismatch for msg kuack messages: expected 99 got 0,a reboot or software upgrade may be required
Connectivity fault management process:
Connectivity fault management process: rtslib: WARNING version mismatch for msg marker ifstate: expected 104 got 0,a reboot or software upgrade may be required
Connectivity fault management process:
mgd: commit complete
Validation succeeded
rm: /cf/var/validate/chroot/mfs/var/etc/pam.conf: Operation not permitted
rm: /cf/var/validate/chroot/mfs/var/etc: Directory not empty
rm: /cf/var/validate/chroot/mfs/var: Directory not empty
rm: /cf/var/validate/chroot/mfs: Directory not empty
rm: /cf/var/validate/chroot: Directory not empty
Installing package '/altroot/cf/packages/install-tmp/junos-12.3X48-D45.6-domestic' ...
Verified junos-boot-srxsme-12.3X48-D45.6.tgz signed by PackageProductionEc_2017 method ECDSA
Verified junos-srxsme-12.3X48-D45.6-domestic signed by PackageProductionEc_2017 method ECDSA
Verified junos-boot-srxsme-12.3X48-D45.6.tgz signed by PackageProductionEc_2017 method ECDSA
Verified junos-srxsme-12.3X48-D45.6-domestic signed by PackageProductionEc_2017 method ECDSA
JUNOS 12.3X48-D45.6 will become active at next reboot
WARNING: A reboot is required to load this software correctly
WARNING: Use the 'request system reboot' command
WARNING: when software installation is complete
Saving state for rollback ...
You're asked to reboot the device in order to load the new firmware version:
root@junsrx> request system reboot
Reboot the system ? [yes,no] (no) yes
Shutdown NOW!
root@junsrx> *** FINAL System shutdown message from root@junsrx *** System going down IMMEDIATELY
Once the device reboots, a message appears before we log in:
WARNING: JUNOS versions running on dual partitions are not same
** /dev/da0s2a
FILE SYSTEM CLEAN; SKIPPING CHECKS
clean, 240844 free (44 frags, 30100 blocks, 0.0% fragmentation)
Junos uses two partitions: da0s1a and da0s2a, which still contain our old firmware.
To fix the problem, we'll copy our firmware from partition da0s1a to da0s2a like this:
root@junsrx> request system snapshot slice alternate
Formatting alternate root (/dev/da0s2a)...
Copying '/dev/da0s1a' to '/dev/da0s2a' .. (this may take a few minutes)
The following filesystems were archived: /
To check the update fully completed:
root@junsrx> show system snapshot media internal slice alternate
Information for snapshot on internal (/dev/da0s1a) (primary)
Creation date: May 17 19:12:57 2017
JUNOS version on snapshot:
junos : 12.3X48-D45.6-domestic
Information for snapshot on internal (/dev/da0s2a) (backup)
Creation date: May 17 19:24:28 2017
JUNOS version on snapshot:
junos : 12.3X48-D45.6-domestic
Finally, a reboot is needed for the message to disappear and for our router to become operational.