Juniper JUNOS 10.1 - S 5-13-2010 Release Note Download Page 183

Page: 183 / 204

■

installMedia

—Refers to the installation media downloaded into the

/var/tmp

directory. For example,

install-media-srx5000-10.1R1-domestic.tgz

The following code example can be used to write the image that you copied to
the master Routing Engine (RE0) in step 1 onto the USB storage device:

dd if=install-media-srx5000-10.1R1-domestic.tgz of=/dev/da0 bs=64k

Log out as root or superuser:

exit

After the software image is written to the USB storage device, remove the device
and insert it into the USB port on the second Routing Engine (RE1).

Move the console connection from the master Routing Engine (RE0) to the second
Routing Engine (RE1), if you do not already have a connection.

Reboot the second Routing Engine (RE1). Issue the following command:

# reboot

■

When the following system output appears, press

WARNING: The installation will erase the contents of your disks.
Do you wish to continue (y/n)?

■

When the following system output appears, remove the USB storage device
and press

Enter

Eject the installation media and hit [Enter] to reboot?

Upgrade and Downgrade Instructions for JUNOS Release 10.1 for SRX Series Services
Gateways and J Series Services Routers

In order to upgrade to JUNOS Release 10.1 or later, your device must be running
one of the following JUNOS Software releases:

■

9.1S1

■

9.2R4

■

9.3R3

■

9.4R3

■

9.5R1 or later

If your device is running an earlier release, upgrade to one of these releases and then
to the 10.1 release. For example, to upgrade from Release 9.2R1, first upgrade to
Release 9.2R4 and then to Release 10.1R2.

Upgrade and Downgrade Instructions for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services

Routers

■

183

Upgrade and Downgrade Instructions for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers

Summary of Contents for JUNOS 10.1 - S 5-13-2010

Page 1: ...e notes on the Juniper Networks JUNOS Software Documentation Web page which is located at http www juniper net techpubs software junos Contents JUNOS Software Release Notes for Juniper Networks M Series Multiservice Edge Routers MX Series Ethernet Service Routers and T Series Core Routers 6 New Features in JUNOS Release 10 1 for M Series MX Series and T Series Routers 6 Class of Service 6 High Ava...

Page 2: ...Basic Procedure for Upgrading to Release 10 1 90 Upgrading a Router with Redundant Routing Engines 92 Upgrading Juniper Routers Running Draft Rosen Multicast VPN to JUNOS Release 10 1 92 Upgrading the Software for a Routing Matrix 94 Upgrading Using ISSU 95 Upgrading from JUNOS Release 9 2 or Earlier on a Router Enabled for Both PIM and NSR 95 Downgrade from Release 10 1 96 JUNOS Software Release ...

Page 3: ...Series Services Routers 158 Errata and Changes in Documentation for JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers 163 Application Layer Gateways ALGs 163 Attack Detection and Prevention 163 CLI Reference 164 Command Line Interface CLI 164 CompactFlash Card Support 164 Flow and Processing 164 Hardware Documentation 165 Installing Software Packages 166 Integrated ...

Page 4: ... EX Series Switches 187 Layer 2 and Layer 3 Protocols 188 Infrastructure 188 User Interface and Configuration 188 Limitations in JUNOS Release 10 1 for EX Series Switches 188 Access Control and Security 189 Class of Service 189 Firewall Filters 189 Infrastructure 189 Interfaces 190 Outstanding Issues in JUNOS Release 10 1 for EX Series Switches 191 Access Control and Port Security 191 Bridging VLA...

Page 5: ...8 Upgrading from JUNOS Release 9 3R1 to Release 10 1 for EX Series Switches 199 Upgrading from JUNOS Release 9 2 to Release 10 1 for EX Series Switches 199 Downgrading from JUNOS Release 10 1 to Release 9 2 for EX4200 Switches 200 JUNOS Documentation and Release Notes 202 Documentation Feedback 202 Requesting Technical Support 202 Revision History 204 5 ...

Page 6: ...ontrol packets Protocols such as telnet FTP and SSH that are mapped to queue 0 are classified as best effort No configuration is necessary but the queue assignments can be altered with a multifield classifier Class of Service CoS aspects of the MPC MIC MX Series routers with Trio MPC MIC interfaces Cover all aspects of CoS configuration for this hardware combination Support includes shaping rates ...

Page 7: ...onfigure scheduler node scaling include the maximum hierarchy levels statement at the edit interfaces xe fpc pic port hierarchical scheduler hierarchy level The only supported value is 2 Class of Service Network Interfaces Forwarding class aliases M320 and T Series routers Enable you to configure up to 16 forwarding classes and 8 queues with multiple forwarding classes assigned to single queues To...

Page 8: ...ss SA MAC learning MAC accounting and MAC policing Stacked virtual LAN VLAN tag and VLAN rewrite functionalities Network Interfaces Class of Service PIC Guide Intelligent oversubscription services MX Series with 16 port 10 Gigabit Ethernet MPC with SFP The 16 port 10 Gigabit Ethernet Modular Port Concentrator MPC is an oversubscribed configuration Consequently it is necessary to protect control tr...

Page 9: ...s are supported on the 16 port 10 Gigabit Ethernet MPC with SFP Accepts traffic destined for GRE tunnels or DVMRP IP in IP tunnels JUNOS Release 10 0R2 Bidirectional Forwarding Detection BFD protocol JUNOS Release 10 0R2 Border Gateway Protocol BGP JUNOS Release 10 0R2 BGP Multiprotocol Label Switching MPLS virtual private networks VPNs JUNOS Release 10 0R2 Distance Vector Multicast Routing Protoc...

Page 10: ...0R2 Layer 2 frame filtering JUNOS Release 10 0R2 IEEE 802 3ad link aggregation JUNOS Release 10 0R2 Link Aggregation Control Protocol LACP JUNOS Release 10 0R2 Local loopback JUNOS Release 10 0R2 MAC learning policing JUNOS Release 10 0R2 Multiple tag protocol identifiers TPIDs accounting and filtering JUNOS Release 10 0R2 Multiprotocol Label Switching MPLS JUNOS Release 10 0R2 Nonstop active rout...

Page 11: ... service VPLS JUNOS Release 10 0R2 Virtual private network VPN JUNOS Release 10 0R2 Virtual Router Redundancy Protocol VRRP for IPv4 JUNOS Release 10 0R2 To support these features some modifications have been made to the following configuration statements The ability to configure the DSCP as the action of a filter rule is already present in the JUNOS Software However with this line card the value ...

Page 12: ...ture which transparently applies scaling to oversubscribed queues Class of Service High Availability Enhancements to unified ISSU support on PICs T Series JUNOS Release 10 1 extends unified ISSU support for the following PICs to T Series routers PB 1CHOC12 STM4 IQE SFP 1 port channelized OC12 STM4 enhanced IQ PIC PB 1OC12 STM4 IQE SFP 1 port nonchannelized OC12 STM4 enhanced IQ PIC PB 4CHDS3 E3 IQ...

Page 13: ...s Layer 2 feature parity includes Layer 2 bridging VPLS forwarding MAC address learning aging and MAC address limit Mesh group support Implicit VLAN mapping Integrated routing and bridging IRB Multicast over IRB MAC statistics Layer 2 features that are not supported in this release include Spanning Tree Protocols xSTP VLAN Spanning Tree Protocol VSTP Multiple Spanning Tree Protocol MSTP Rapid Span...

Page 14: ...tunnel only statement at the chassis fpc number pic number hierarchy level You can use the show interfaces queue gr fpc pic port command to display statistics for the specified tunnel Network Interfaces Class of Service PIC Guide Root System Domain RSD configuration of logical interface filters on shared interfaces JCS1200 platform Enables Root System Domain RSD configuration support for logical i...

Page 15: ...The previous CLI constraint check that requires you to configure either the clear dont fragment bit statement or a tunnel key with the allow fragmentation statement is no longer enforced There are no associated changes to the CLI statements or operational mode commands NOTE For other routers the earlier configuration constraint check still holds Services Interfaces MPLS Applications MX Series Laye...

Page 16: ...C is supported by this PIC Network Interfaces Enhanced Intelligent Queuing IQE PICs add support for T3 and T1 channelization under SDH framing M40e M120 and M320 with Sahara FPC and T Series routers The following IQE PICs are supported 1 port COC48 IQE 4 port COC12 IQE 1 port COC12 IQE 2 port COC3 IQE The JUNOS Software supports T1 and CT1 interface types under CAU4 To configure T1 and CT1 interfa...

Page 17: ...Awareness for JUNOS Software service chains New application level gateways ALGs are available for FTP junos ftp TFTP junos tftp and RTSP junos rtsp you can include them as values for the applications statement at the edit services stateful firewall rule rule name term term name from hierarchy level In addition you can include new statement options at the edit interfaces ms fpc pic port services op...

Page 18: ...JUNOS XML API and Scripting 18 New Features in JUNOS Release 10 1 for M Series MX Series and T Series Routers JUNOS 10 1 Software Release Notes ...

Page 19: ...message clear vrrp clear vrrp information clear_vrrp_information vrrp message clear vrrp interface clear vrrp interface statistics clear_vrrp_interface_statistics NONE request system scripts refresh from request script refresh from request_script_refresh_from dhcpv6 server binding information show dhcpv6 server binding get dhcpv6 server binding information get_dhcpv6_server_binding_information dhc...

Page 20: ... information get_idp_policy_template_information idp detail status information show security idp status detail get idp detail status information get_idp_detail_status_information service nat mapping information show services nat mappings get service nat mapping information get_service_nat_mapping_information task memory information show task memory get task memory information get_task_memory_infor...

Page 21: ... statement at the edit protocols mpls static label switched path static lsp name hierarchy level You must also configure either the pop or the swap statement at the edit protocols mpls static label switched path static lsp name transit hierarchy level If you configure the swap statement you must specify a non reserved label in the range of 0 through 1 048 575 The transit static LSP is added to the...

Page 22: ...cs command and the monitor static lsp lsp name command The show mpls static lsp statistics command includes the following options ingress transit bypass and name static lsp name This command displays the packet count and byte count for the static LSP You can clear the statistics for static LSPs by issuing the clear mpls static lsp statistics command You can also log the static LSP statistics to a ...

Page 23: ... enter the media release statement at the edit services border signaling gateway gateway name sip new call usage policy policy name term term name then media policy hierarchy level Multiplay Solutions Services Interfaces Routing Policy and Firewall Filters New MPLS firewall filter match conditions T Series routers The JUNOS Software now supports filtering MPLS tagged IPv4 packets based on IP param...

Page 24: ...s are sent on the same multiaccess network This improves scalability and efficiency by reducing the number of identical messages sent to the same router This feature is useful when there are a large number of routers on a multiaccess network that will be receiving traffic for a particular multicast group Suppressing joins at each router saves bandwidth and reduces heavy processing at upstream rout...

Page 25: ... wait before processing the messages The next hop hold time statement can be configured at the edit routing instances routing instance name hierarchy level The hold time can be configured from 1 to 1000 milliseconds The routing instance must be of type VPLS or virtual switch If the next hop hold time statement is deleted from the router configuration IGMP bulk updates are disabled The configuratio...

Page 26: ...el on all PE routers participating in the MVPN Include the family inet mvpn statement and family inet6 mvpn statement at the edit routing instances routing instance name vrf advertise selective hierarchy level to selectively advertise routes on PE routers that use one VRF for unicast routing and a separate VRF for MVPN routing VPNs Routing Protocols Routing Protocols and Policies Command Reference...

Page 27: ... shared between IPv4 and IPv6 For example you can install 3000 IPv4 filters or 3000 IPv6 filters or a combination of both that totals 3000 You cannot install 3000 IPv4 filters and 3000 IPv6 filters No new statements are required to configure these enhancements However whether you use IPv6 flow tapping or not you must include the family inet6 statement at the edit interfaces vt fpc pic port unit lo...

Page 28: ... 999 15 999 Dynamic PPPoE interfaces per chassis 4000 Dynamic PPPoE interfaces per IQ2 IQ2E PIC 32 000 32 000 Dynamic PPPoE interfaces per Trio MPC MIC 15 999 15 999 15 999 Static interfaces per chassis PPPoE subscriber VLANs 2000 Per IQ2 IQ2E PIC 8000 Per chassis with IQ2 IQ2E PIC 32 000 32 000 Per Trio MPC MIC 32 000 32 000 Per chassis with Trio MPC MIC PPP connections logical interfaces are sup...

Page 29: ...ables you to configure CoS for dynamic PPPoE subscriber interfaces on Trio MPC MIC interfaces available on MX Series routers and the Intelligent Queuing 2 IQ2 PIC on M120 and M320 Series routers In earlier releases only static CoS was supported for static PPPoE subscriber interfaces configured on IQ2 PICs on M120 and M320 Series routers To configure CoS for a dynamic PPPoE interface configure the ...

Page 30: ...ing new predefined variables have been added to implement IPv6 addressing for subscriber services Definition Dynamic Profile Variable Route prefix of an IPv6 access route junos framed route ipv6 address prefix Next hop address of an IPv6 access route junos framed route ipv6 nexthop Attaches a filter based on RADIUS VSA 26 106 IPv6 Ingress Policy Name to the interface junos input ipv6 filter IPv6 p...

Page 31: ...he router uses the information configured in the dynamic profile to determine the properties of the dynamic PPPoE logical interface The use of dynamically created PPPoE interfaces gives you the flexibility of having the router create the dynamic PPPoE logical interface only when the subscriber logs in on the associated underlying interface By contrast statically created interfaces always allocate ...

Page 32: ...interface unit predefined dynamic variable instead of the actual logical unit number for the unit statement and the junos underlying interface predefined dynamic variable instead of the actual name of the underlying interface for the underlying interface statement 2 Assign the dynamic profile to the underlying interface on which the router creates the dynamic PPPoE interface To do so include the p...

Page 33: ...cess Support for PPPoE Layer 3 wholesale configuration in a subscriber access network Enables you to configure PPPoE Layer 3 wholesaling within a subscriber access network Wholesale access is the process by which an access network provider partitions the access network into separately manageable and accountable subscriber segments for resale to other network providers An access network provider ma...

Page 34: ...rofiles profile name interfaces pp0 unit junos interface unit family inet hierarchy level To view the logical system and routing instance for each subscriber use the show subscriber operational command Subscriber Access Broadband Subscriber Management PPP PAP and CHAP enhancements for subscriber management M120 and M320 routers Subscriber management supports both bidirectional and unidirectional P...

Page 35: ... over the Trio MPC MIC interfaces on MX Series routers To apply input and output filters for logical interfaces include the input input filter name and output output filter name statements To apply these filters statically include the statements at the edit interfaces interface name unit logical unit number filter hierarchy level To apply these filters dynamically include the statements at the edi...

Page 36: ... profiles profile name interfaces demux0 unit unit number demux options hierarchy level When configuring dynamic VLAN demux interfaces specify the VLAN ID variable junos vlan id for the vlan id statement at the edit dynamic profiles profile name interfaces demux0 unit unit number hierarchy level You must also specify the underlying device name variable junos interface ifd name for the underlying i...

Page 37: ...types of attack WEBFILTER Describes messages with the WEBFILTER prefix They are generated by the Web filtering process webfilter which allows you to manage Internet usage by preventing access to inappropriate Web content The following system log messages are new in this release COSD_NULL_INPUT_ARGUMENT DCD_GRE_CONFIG_INVALID DCD_PARSE_ERROR_MAX_HIER_LEVELS DCD_PARSE_ERR_INCOMPATIBLE_CFG EVENTD_ALA...

Page 38: ...s more flexibility to load balance the traffic over as many as 64 LSPs To configure the maximum limit for ECMP next hops include the maximum ecmp next hops statement at the edit chassis hierarchy level edit chassis maximum ecmp next hops You can configure a maximum ECMP next hop limit of 16 32 or 64 using this statement The default limit is 16 The following types of routes support the ECMP maximum...

Page 39: ... limit of 32 or 64 ECMP next hops is applicable To view the details of the ECMP next hops issue the show route command The show route summary command also shows the current configuration for the maximum ECMP limit To view details of the ECMP LDP paths issue the traceroute mpls ldp command System Basics Policy Framework Routing Protocols Command Reference Support for configuring time based user acc...

Page 40: ... rewrite rules with a subscriber interface in a dynamic profile You must statically configure the classifiers and rewrite rules at the static edit class of service hierarchy level To associate a classifier configuration with a subscriber interface in a dynamic profile include the classifiers statement at the edit dynamic profiles profile name class of service interfaces interface name unit logical...

Page 41: ...ifetime managed configuration max advertisement interval min advertisement interval no managed configuration no other stateful configuration other stateful configuration prefix reachable time and retransmit timer All of these statements appear at the edit dynamic profiles profile name protocols router advertisement hierarchy level NOTE Statements used for router advertisement protocol configuratio...

Page 42: ... learn configuration statement at the edit interfaces interface name unit interface unit number family inet and edit interfaces interface name unit interface unit number family inet6 hierarchy levels To disable ARP address learning for IPv4 traffic for a logical interface include the no neighbor learn statement at the edit interfaces interface name unit interface unit number family inet hierarchy ...

Page 43: ...in the Packet Forwarding Engine configuration category host user show interfaces extensive ge 7 1 3 Packet Forwarding Engine configuration Destination slot 7 CoS information Direction Output CoS transmit queue Bandwidth Buffer Priority Limit bps usec 0 best effort 95 950000000 95 0 low none 3 network control 5 50000000 5 0 low none Direction Input CoS transmit queue Bandwidth Buffer Priority Limit...

Page 44: ...ced number of configuration statements To configure an interface range group include the interface range statement and substatements at the edit interfaces hierarchy level To view an interface range group in expanded configuration use the show display inheritance command Network Interfaces Interfaces Command Reference Enhancement to the show chassis fabric fpcs command In JUNOS Release 10 1 and la...

Page 45: ...utes 45 seconds 4 Empty use show chassis fabric fpcs to determine which PFEs have destination errors However for JUNOS Release 9 3 and 9 5 the command only displays the message destination errors or no destination errors for a SIB that is in the Check state but does not display the number of destination errors user host show chassis sibs Slot State Uptime 0 Empty 1 Empty 2 Check destination errors...

Page 46: ...e MPLS statistics file you can view the statistics using SNMP instead This change helps to reduce disk space usage on the routing engine especially on routers on which numerous LSPs have been configured MPLS NSR tracing flags for MPLS You can now configure MPLS tracing flags for nonstop active routing NSR synchronization events This enables you to track the progress of NSR synchronization between ...

Page 47: ...s vpls and bridge now support the interface set match condition for firewall filters To configure include the interface set interface set name statement at the edit firewall family bridge filter filter name term term name from or the edit firewall family vpls filter filter name term term name from hierarchy level The protocol family bridge is supported only on MX Series routers An interface set is...

Page 48: ... application identification counter to view the APPID counters for the specified interface System Basics and Services Command Reference Session offloading on Multiservices PICs To enable session offloading on a per PIC basis for Multiservices PICs include the session offload statement at the edit chassis fpc hierarchy level System Basics Option to clear the do not fragment bit To clear the do not ...

Page 49: ...erfaces Permanent limitation for session timeout on APPID If session timeout is configured for an APPID application a session for that application will be cleared once the session timeout expires Once the same session is re created as a new session it will not be identified by APPID Services Interfaces Integrated Multi Services Gateway IMSG The clear services border signaling gateway gateway name ...

Page 50: ...500 New call usage policies per BSG 500 New transaction policies per BSG 10 Policies per service point 100 Service points per BSG 20 Terms per policy 10 000 Terms per BSG 4 Total of AND and OR operators in a policy term Session Border Control Solutions Subscriber Access Management Enabling and disabling DHCP snooping support You can now explicitly enable or disable DHCP snooping support on the rou...

Page 51: ...uration options or statements within the last level in the hierarchy is not supported For example in the following sample configuration hierarchy annotation is supported up to the level 1 parent hierarchy but is not supported for the metric child statement edit protocols isis interface ge 0 0 0 0 level 1 metric 10 CLI User Guide Support for accounting is restricted to events and operations on a ma...

Page 52: ...nterface to pop the service VLAN ID on input and push the service VLAN ID on output and in this way limit the impact of doubly tagged frames on scaling MX Series Layer 2 Configuration Layer 2 5 VPNs support ISO family and MPLS family over TCC MX Series routers JUNOS Release 8 3 introduced support for M320 and T Series routers JUNOS Release 10 1 extends support to MX Series routers Interfaces suppo...

Page 53: ...e following hierarchy levels edit logical systems logical system name routing instances routing instance name protocols vpls mesh group mesh group name edit routing instances routing instance name protocols vpls mesh group mesh group name NOTE The mac tlv receive and mac tlv send statements were removed from Release 10 0 of the JUNOS Software and are no longer visible in the edit logical systems l...

Page 54: ...ries Routers on page 89 Issues in JUNOS Release 10 1 for M Series MX Series and T Series Routers The current software release is Release 10 1R2 For information about obtaining the software packages see Upgrade and Downgrade Instructions for JUNOS Release 10 1 for M Series MX Series and T Series Routers on page 89 Current Software Release on page 54 Previous Releases on page 73 Current Software Rel...

Page 55: ...e next item in the object tree is fetched before the current object is parsed PR 433418 Under rare circumstances if the filter is changed while a counter query is in progress and the system is under heavy load the system may crash PR 447033 The numerical values configured for the ip options match criteria on a firewall filter matches any ip options no matter what is specified PR 516778 High Availa...

Page 56: ... might restart during a graceful Routing Engine switchover GRES PR 295464 When two routers are connected via SONET SDH interfaces that are configured as container interfaces and the Routing Engine on one router reboots the container interfaces on the other router might go down and come up again PR 302757 When forwarding options is configured without route accounting commit goes through with the me...

Page 57: ...erational impact PR 504363 On MX Series routers with JUNOS Release 10 0R2 or higher the backup Routing Engine might report the following warning message upon commit once network service is configured under the chassis stanza WARNING network services flag has been changed please reboot system PR 505690 When trigger hold timer UP DOWN values for a defect condition is configured or changed from the C...

Page 58: ...of these addresses A second loopback address is added with the primary keyword This results in the targeted LDP neighbor being up with both IP addresses The neighbor with the old address may continue to remain up even after the old loopback address is deleted on the remote neighbor This neighborship with the old address eventually times out when the router id is changed to reflect the new loopback...

Page 59: ...ncluding the arp ip address statement at the edit interfaces interface name hierarchy level PR 237107 When you perform an in service software upgrade ISSU on a routing platform with an FPC3 or an Enhanced FPC3 with 256 MB of memory and the number of routes in the routing table exceeds 750 000 route loss might occur If route loss occurs as a workaround perform either of the following tasks Replace ...

Page 60: ...gine switchover PR 511366 Setting the TCP maximum segment size MSS may not change the actual MSS value PR 514196 On M120 and MX Series routers when an AE interface with LACP enabled is used as a core facing interface for L3VPN non MPLS traffic received on the AE interface can sometimes get black holed To recover from this state deactivate and activate the AE interface in the configuration PR 51427...

Page 61: ...routing table with default damping parameters even though the import policy has a non default setting As a result damping settings do not change appropriately when the route attributes change PR 51975 When you issue the show ldp traffic statistics command the following system log message might be generated for all forwarding equivalence classes FECs with an ingress counter set to zero send rnhstat...

Page 62: ...nooping interface command does not display snooping erroneously stating that IGMP itself is not running instead of IGMP snooping not running PR 516355 The configured robust count value is not applied on the non querier router when it receives a robust count value of 0 It uses the default value 2 instead of the configured value PR 520252 The new NSR master may not send the OSPF hello messages immed...

Page 63: ...suite PR 499395 When a backup gateway is configured in any term under an IPsec stanza for any subsequent terms where this backup gateway is now configured as the primary IPsec tunnel establishment will fail PR 510608 The IPv6 gateway may have a NULL value when the destination address points to an aggregated next hop PR 516058 Subscriber Access Management The revert interval value configured in the...

Page 64: ...sometimes have their access restricted to view permission only when they log in through TACACS PR 388053 On M Series MX Series and T Series routers the user cannot differentiate between active and inactive configurations for system identity management access user management and date and time pages PR 433353 Selecting the monitor port for any port in the Chassis Viewer page displays the common Port...

Page 65: ...instances changes in certain ways the BGP sessions between PE and CE routers might not be established after the switchover PR 399275 On MX Series M120 and new EIII FPCs on M320 routers the ISO Connectionless Network Service CLNS packets over the translational cross connect TCC are dropped in the case of Frame Relay even though the family TCC has been configured to switch family iso on the Frame Re...

Page 66: ...icer configuration is deactivated and reactivated PR 501726 When a filter group is configured on an interface residing on an ES FPC the rpf check configured on that interface will not function correctly As a workaround deactivate the configured filter group PR 503609 This issue has been resolved On configuring a three color policer a dfwc core file is generated PR 509742 This issue has been resolv...

Page 67: ...resolved When t1 options are configured at the edit interfaces ct1 x y z hierarchy level some ct1 interfaces of a 10xCHT1 IQ PIC might flap when the configuration changes are committed As a workaround remove the t1 options PR 500820 This issue has been resolved Polling ifInOctets on Gigabit Ethernet IQ PIC VLANs might momentarily return a higher value PR 500852 This issue has been resolved On 40x1...

Page 68: ... This issue has been resolved On M7i and M10i routers the syncer process writes to the file var rundb chassisd dynamic db every 30 seconds PR 511901 This issue has been resolved Under certain circumstances the chassisd process might crash on a backup Routing Engine while a configuration is commited PR 512044 This issue has been resolved Due to a flaw in implementation the execution of the show int...

Page 69: ...n resolved In cases where the secondary Routing Engines contain no label switched paths in the up state due to the lack of NSR support such label switched paths might not come up even after a switchover PR 501969 This issue has been resolved LDP might not handle certain error conditions gracefully when NSR is enabled This might cause the LDP replication state to be stuck in the In Progress state f...

Page 70: ...ses PR 490172 This issue has been resolved If you configure an IP address with a larger subnet for example 19 on a different interface first the router begins to negotiate for the ARP of a specific host on that interface and gets stuck in a hold state If you later configure a more specific subnet of 29 on another interface from where the host can be reached the forwarding table will still prefer t...

Page 71: ...een resolved On tcpdump or when the monitor traffic interface command is used for an lo0 interface with the IP address having its last octet is greater than or equal to 224 x x x 224 or higher following message is received inet class for 0xe1e11955 unknown PR 511911 This issue has been resolved Routing Protocols If a static route points to a discard configuration a failure might occur when the rou...

Page 72: ...scenarios the routing protocol process might crash as changes occur to a prefix in the primary table at the same time as BGP tries to send out updates via the secondary table PR 515626 This issue has been resolved Services Applications If the Juniper Firewall Attribute attribute in a RADIUS server configuration file names a policer that sets a bandwidth limit for Layer 2 Tunneling Protocol L2TP se...

Page 73: ... activating and deactivating two consecutive nested objects can cause a syntax error during commit PR 506677 This issue has been resolved On M10i M120 M320 and MX Series routers with dual Routing Engines running JUNOS Release 9 4 or later the dfwd process running on the backup Routing Engine might access the var pdb rdm taf file every 30 seconds causing excessive writes to the hard disk drive This...

Page 74: ...finition does not have any forwarding class statement PR 499755 This issue has been resolved Forwarding and Sampling The output firewall filter counter does not work when the firewall is configured for discard next hop PR 404645 This issue has been resolved Policers cannot be modified after a system upgrade due to a flaw in the parser routine This error occurs when the current item is deleted and ...

Page 75: ...riority comparison does not consider the signal fail condition PR 465906 This issue has been resolved Both the working and protect circuit are stuck in the disabled state when the TX cable is unplugged and the RX cable is plugged for protect circuit after an Automatic Protection Switching APS switchover PR 466649 This issue has been resolved On an M320 router the 4x STM 1 1x STM 4 SFP PIC PB 4OC3 ...

Page 76: ... the AE bundle is disabled then enabled As a workaround deactivate and activate the child link that is not in the Collecting Distributing LACP state PR 487786 This issue has been resolved With GRES configured a container interface CI configuration can trigger a kernel core on the backup Routing Engine PR 488679 This issue has been resolved Container interfaces with ATM children with OAM may not in...

Page 77: ...t have this issue PR 495555 This issue has been resolved When ilmid uses a large amount of memory the following error message displays kernel Process 1702 ilmid has exceeded 85 of RLIMIT_DATA used 129084 KB Max 131072 KB PR 495645 This issue has been resolved The one port OC12 3 PIC cannot support eight queues when the no concatenate option is configured PR 499452 This issue has been resolved When...

Page 78: ...routers the chassisd crashes when the SCB is taken offline and removed PR 510950 This issue has been resolved On M7i and M10i routers the syncer process writes to the file var rundb chassisd dynamic db every 30 seconds PR 511901 This issue has been resolved Under certain circumstances the chassisd process might crash on a backup Routing Engine while a configuration is commited PR 512044 This issue...

Page 79: ...te the show mpls lsp p2mp command PR 266343 This issue has been resolved Constrained Shortest Path First CSPF fails to calculate a P2MP LSP reroute path merging upon a user configuration change PR 454692 This issue has been resolved When an RSVP LSP is configured with the no install to address option and is not associated with CCC connection flaps the routing protocol process will crash when the L...

Page 80: ...ed cells via high speed links they might unnecessarily reboot and report the following system log error message Unrecoverable Error Flist gtop bit toggled No reset is needed to recover from this condition PR 441844 This issue has been resolved When the strict high priority queue is overloaded the high priority queue may starve resulting in the loss of high priority traffic PR 455152 This issue has...

Page 81: ...ins over an AE interface represented by two or more AE legs on separate Packet Forwarding Engines In a Packet Forwarding Engine ASIC forwarding the next hop shared by these multicast routes contains a list representing the two or more Packet Forwarding Engines When this next hop list is no longer referenced by any active multicast route it is not correctly freed and remains stranded in the Packet ...

Page 82: ...e the first PIM hello packet from a PIM neighbor after the restart This may delay the establishment of PIM neighbors and therefore multicast traffic convergence for up to twice the PIM hello interval PR 452751 This issue has been resolved When the last CE interface in a VPLS instance goes down pseudowires in the VPLS instance are also removed However multicast snooping process does not remove the ...

Page 83: ...in a no forwarding routing instance PR 492017 This issue has been resolved If there are enough routing instances with PIM configured and there is enough IGMP MLD join state present and a configuration change is made a routing protocol process scheduler slip might occur PR 493062 This issue has been resolved On an unnumbered Ethernet interface in P2P mode OSPF does not skip validation of the networ...

Page 84: ...ed The show services nat pool name CLI filter does not have any effect PR 493820 This issue has been resolved Under certain conditions the replication socket between two Routing Engines for the local policy decision function process LPDFD does not close properly This results in high CPU consumption by the LPDFD As a workaround restart the local policy decision function process LPDFD on the master ...

Page 85: ...ard disk drive This problem does not occur when GRES is enabled PR 506691 This issue has been resolved VPNs Configuring a forwarding cache threshold under a routing instance for NG MVPN might not produce the expected behavior and might not limit the number of forwarding cache entries PR 438164 This issue has been resolved In an MLAN scenario where two PEs are connected to the multicast receiver wh...

Page 86: ...un JUNOS Software The new index page provides direct access to core JUNOS information and links to information for JUNOS features that run on particular platforms Errata This section lists outstanding issues with the documentation High Availability TX Matrix Plus routers and T1600 routers that are configured as part of a routing matrix do not currently support nonstop active routing High Availabil...

Page 87: ...terface name variable edit dynamic profiles access profile user host set protocols igmp interface junos interface name Table 25 in the Dynamic Variables Overview topic neglects to define the junos igmp version predefined dynamic variable This variable is defined as follows junos igmp version IGMP version configured in a client access profile The JUNOS Software obtains this information from the RAD...

Page 88: ...Access topic in the Subscriber Access Configuration Guide erroneously states that dynamic CoS is supported for dynamic VLANs on the Trio MPC MIC family of products In the current release dynamic CoS is supported only on static VLANs on Trio MPC MIC interfaces Subscriber Access The Subscriber Access Configuration Guide incorrectly describes the authentication order statement as it is used for subsc...

Page 89: ... Series Routers on page 6 Changes in Default Behavior and Syntax in JUNOS Release 10 1 for M Series MX Series and T Series Routers on page 42 Issues in JUNOS Release 10 1 for M Series MX Series and T Series Routers on page 54 Upgrade and Downgrade Instructions for JUNOS Release 10 1 for M Series MX Series and T Series Routers on page 89 Upgrade and Downgrade Instructions for JUNOS Release 10 1 for...

Page 90: ...for JUNOS Software is 1 GB For M7i and M10i routers with only 256 MB memory see the Customer Support Center JTAC Technical Bulletin PSN 2007 10 001 at https www juniper net alerts viewalert jsp txtAlertNumber PSN 2007 10 001 actionBtn Search NOTE Before upgrading back up the file system and the currently active JUNOS configuration so that you can recover to a known stable environment in case the u...

Page 91: ...nections are lost during the upgrade process Customers in the United States and Canada use the following command user host request system software add validate reboot source jinstall 10 1R2 8 domestic signed tgz All other customers use the following command user host request system software add validate reboot source jinstall 10 1R2 8 export signed tgz Replace source with one of the following valu...

Page 92: ...isrupting network operation as follows 1 Disable graceful Routing Engine switchover GRES on the master Routing Engine and save the configuration change to both Routing Engines 2 Install the new JUNOS Software release on the backup Routing Engine while keeping the currently running software version on the master Routing Engine 3 After making sure that the new software version is running correctly o...

Page 93: ... PE routers in the network have been upgraded to JUNOS Release 10 1 2 After you have upgraded all routers configure each router s main instance loopback address as the source address for multicast interfaces Include the default vpn source interface name loopback interface name statement at the edit protocols pim hierarchy level 3 After you have configured the router s main loopback address on each...

Page 94: ...r SCC or SFC and T640 routers or T1600 routers LCC are all re1 or are all re0 All master Routing Engines in all routers run the same version of software This is necessary for the routing matrix to operate All master and backup Routing Engines run the same version of software before beginning the upgrade procedure Different versions of the JUNOS Software can have incompatible message formats especi...

Page 95: ...about using unified in service software upgrade see the Junos High Availability Configuration Guide Upgrading from JUNOS Release 9 2 or Earlier on a Router Enabled for Both PIM and NSR JUNOS Release 9 3 introduced NSR support for PIM for IPv4 traffic However the following PIM features are not currently supported with NSR The commit operation fails if the configuration includes both NSR and one or ...

Page 96: ...3 or later software using the instructions appropriate for the router type You can either use the standard procedure with reboot or use ISSU 3 After the router reboots and is running the upgraded JUNOS Software enter configuration mode disable PIM NSR with the nonstop routing disable statement and then reenable PIM edit user host set protocols pim nonstop routing disable user host activate protoco...

Page 97: ... 42 Issues in JUNOS Release 10 1 for M Series MX Series and T Series Routers on page 54 Errata and Changes in Documentation for JUNOS Software Release 10 1 for M Series MX Series and T Series Routers on page 86 Upgrade and Downgrade Instructions for JUNOS Release 10 1 for M Series MX Series and T Series Routers 97 Upgrade and Downgrade Instructions for JUNOS Release 10 1 for M Series MX Series and...

Page 98: ...Release 10 1 for SRX Series Services Gateways and J Series Services Routers on page 117 Known Limitations in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers on page 126 Issues in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers on page 137 Errata and Changes in Documentation for JUNOS Release 10 1 for SRX Series Services Gateways a...

Page 99: ...loops and drop the traffic if one exists Note that the DNS ALG can translate the first 32 A records in a single DNS reply A records after the first 32 will not be handled Also note that the DNS ALG supports only IPv4 addresses and does not support VPN tunnels JUNOS Software Security Configuration Guide MS RPC ALG This feature is now supported on SRX3400 SRX3600 SRX5600 and SRX5800 devices in addit...

Page 100: ...ices to handle the dynamic transport address negotiation mechanism of the Sun RPC and to ensure program number based security policy enforcement You can define a security policy to permit or deny all RPC requests or to permit or deny by specific program number The ALG also supports route and NAT mode for incoming and outgoing requests JUNOS Software Security Configuration Guide Chassis Cluster Int...

Page 101: ...Configuration Guide Redundancy group IP address monitoring through a secondary interface This feature is supported on SRX3400 SRX3600 SRX5600 and SRX5800 devices In JUNOS Release 10 1 redundancy group IP address monitoring through a redundant Ethernet reth interface has been extended to include monitoring of addresses on secondary links as well as on primary links Redundancy group failover can thu...

Page 102: ...r proxy server to which these calls are routed use the media policy statement in the edit services converged services hierarchy level set services convergence service service class name dscp bitmap set services convergence service service class media policy name term term name from peer address addresses set services convergence service service class media policy name term then service class name ...

Page 103: ...nternet access telephone services like voice over IP VoIP high definition TV HDTV and interactive gaming services over a single connection VDSL2 is an enhancement to VDSL and permits the transmission of asymmetric and symmetric full duplex aggregate data rates up to 100 Mbps on short copper loops using a bandwidth up to 30 MHz The VDSL2 technology is based on the ITU T G 993 2 standard The followi...

Page 104: ...rovided in the PPPoE messages to dynamically adjust the interface speed of the PPP links Use the radio router statement from the set interfaces unit hierarchy to indicate that metrics announcements received on the interface will be processed by the device Class of service CoS for devices operating in transparent mode This feature is supported on SRX3400 SRX3600 SRX5600 and SRX5800 devices SRX3400 ...

Page 105: ... at the edit vlans hierarchy to map without specifying customer VLANs All packets from a specific access interface are mapped to the S VLAN Many to one bundling Use the customer vlans statement at the edit vlans hierarchy to specify which C VLANs are mapped to the S VLAN Mapping C VLAN on a specific interface Use the mapping statement at the edit vlans hierarchy to map a specific C VLAN on a speci...

Page 106: ... the device can compare the power needed by an IP telephone running on a PoE interface with available resources If the device cannot meet the resources required by the IP telephone the device could negotiate with the telephone until a compromise on power is reached LLDP and LLDP MED must be explicitly configured on uPIMs in enhanced switching mode on J Series devices base ports on SRX100 SRX210 an...

Page 107: ...r to do this the current application identification layer is split into two layers application and protocol New extended application signatures have been added to identify these extended applications JUNOS Software Security Configuration Guide CLI enhancements supported for J Web This feature is supported on SRX Series and J Series devices Additional functionality has been added to existing IDP J ...

Page 108: ...OS Software CLI Reference JUNOS Software Security Configuration Guide 108 New Features in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers JUNOS 10 1 Software Release Notes ...

Page 109: ...de using JUNOS CLI New Features in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers 109 New Features in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers ...

Page 110: ...CLI Commands for Manual BIOS Upgrade Backup BIOS Active BIOS request system firmware upgrade re bios backup request system firmware upgrade re bios Procedure for BIOS upgrade 1 Installing a jloader srxsme package 1 Copy the jloader srxme signed package to the device NOTE Note that this package should be of the same version as that of the corresponding JUNOS example on a device with a 10 2 JUNOS pa...

Page 111: ...40h JUNOS Software Release 10 2B3 JUNOS BIOS Software Suite 10 2B3 NOTE Installing the jloader srxsme package puts the necessary images under directory boot New Features in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers 111 New Features in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers ...

Page 112: ... needs to verify that the correct version of BIOS images available for upgrade root show system firmware Part Type Tag Current Available Status version version Routing Engine 0 RE BIOS 0 1 5 1 7 OK Routing Engine 0 RE BIOS Backup 1 1 5 1 7 OK Routing Engine 0 RE FPGA 11 12 3 0 OK 112 New Features in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers JUNOS 10 1 Softwa...

Page 113: ...how system firmware Part Type Tag Current Available Status version version Routing Engine 0 RE BIOS 0 1 5 1 7 UPGRADED SUCCESSFULLY Routing Engine 0 RE BIOS Backup 1 1 5 1 7 OK Routing Engine 0 RE FPGA 11 12 3 0 OK NOTE The device must be rebooted for the upgraded active BIOS to take effect Backup BIOS 1 Initiate the upgrade using the request system firmware upgade re bios backup command root requ...

Page 114: ...ules in a source NAT rule set was 8 JUNOS Release 10 1 the maximum number of source NAT rules that you can configure on a device are 512 for J Series SRX100 and SRX210 devices 1024 for SRX240 and SRX650 devices 8192 for SRX3400 SRX3600 SRX5600 and SRX5800 devices These are systemwide maximums for total numbers of source NAT rules There is no limitation on the number of rules that you can configure...

Page 115: ...Q message The credit interval parameter controls how frequently the router generates credit announcement messages For PPPoE this corresponds to the interval between PADG credit announcements for each session For example edit interfaces ge 0 0 1 unit 0 encapsulation ppp over ether radio router credit interval 10 bandwidth 80 threshold 5 NOTE The resource component variables attribute has been depre...

Page 116: ...ts a maximum of 10000 site to site VPN tunnels WLAN AX411 Access Point clustering The AX411 Access Point is a Layer 2 device that connects wireless communication devices together to create a wireless network The access point is connected to the wired network and relays data between the wired and the wireless network Multiple access points form a part of a bigger wireless network and can be cluster...

Page 117: ...rint Currently available from Juniper Networks Sierra Wireless AirCard Global System for Mobile Communications GSM High Speed Downlink Packet Access HSDPA ExpressCard Sierra Wireless AirCard 880E Currently available from Juniper Networks For more information on installing 3G ExpressCards see the SRX210 Services Gateway Hardware Guide For more information on configuring the 3G interface see the JUN...

Page 118: ...e The automatic pause timer functionality related to IP address monitoring for redundancy groups has been removed Instead a configurable hold down interval timer for all redundancy groups has been instituted See the Configuring a Dampening Time Between Back to Back Redundancy Group Failovers section of the JUNOS Software Security Configuration Guide IP address monitoring on redundancy group 0 is n...

Page 119: ...Default Behavior and Syntax in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers 119 Changes In Default Behavior and Syntax in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers ...

Page 120: ...116 120 Channel 120 124 Channel 124 128 Channel 128 132 Channel 132 136 Channel 136 140 Channel 140 149 Channel 149 153 Channel 153 157 Channel 157 161 Channel 161 165 Channel 165 auto Automatically selected Example 2 user host set wlan access point ap6 radio 2 radio options channel number 1 Channel 1 2 Channel 2 3 Channel 3 4 Channel 4 5 Channel 5 6 Channel 6 7 Channel 7 8 Channel 8 9 Channel 9 1...

Page 121: ...do not work when PCS is configured and removed thorough the CLI The dial tone dissappears when the analog station calls the SIP station As a workaround either run the rtmd restart command or restart the device On SRX5600 and SRX5800 devices the set security end to end debug CLI hierarchy command has been changed to set security datapath debug On AX411 Access Points the possible completions availab...

Page 122: ...ia internal da0 Partitions Information Partition Size Mountpoint s1a 898M s1e 24M config s1f 61M var show system storage partitions USB Example 3 show system storage partitions usb user host show system storage partitions Boot Media usb da1 Active Partition da1s1a Backup Partition da1s2a Currently booted from active da1s1a Partitions Information Partition Size Mountpoint s1a 293M s2a 293M altroot ...

Page 123: ...chy level has been changed from 28 800 seconds to 3600 seconds Flow and Processing On SRX Series devices the factory default for the maximum number of backup configurations allowed is five Therefore you can have one active configuration and a maximum of five rollback configurations Increasing this backup configuration number will result in increased memory usage on disk and increased commit time T...

Page 124: ... Prevention IDP On SRX5600 and SRX5800 devices while running commands in IDP ensure that you provide the service field values for custom attack definitions in lowercase In the following example the protocol service field value udp is specified in lowercase set security idp custom attack temp severity info attack type signature context packet direction any pattern protocol udp destination port matc...

Page 125: ...stem time zone utc and set security log utc timestamp CLI statements Configuring the External CompactFlash card on SRX650 Services Gateways The SRX650 Services Gateway includes 2 GB CompactFlash storage devices The Services and Routing Engine SRE contains a hot pluggable CompactFlash external CompactFlash storage device used to upload and download files The chassis contains an internal compact fla...

Page 126: ...ting options hierarchy level are not supported AX411 Access Point On SRX100 devices there are command line interface CLI commands and J Web tabs for wireless LAN configurations related to the AX411 Access Point However at this time the SRX100 devices do not support the AX411 Access Point Chassis Cluster On SRX Series and J Series devices the following features are not supported when chassis cluste...

Page 127: ... devices have the following limitations Only two of the 10 ports on each PIC of 40 port 1 Gigabit Ethernet I O cards IOCs for SRX5600 and SRX5800 devices can simultaneously enable IP address monitoring Because there are four PICs per IOC this permits a total of eight ports per IOC to be monitored If more than two ports per PIC on 40 port 1 Gigabit Ethernet IOCs are configured for IP address monito...

Page 128: ... devices six CLI users and five J Web users Dynamic VPN SRX100 SRX210 and SRX240 devices have the following limitations The IKE configuration for the dynamic VPN client does not support the hexadecimal preshared key The dynamic VPN client IPsec does not support the Authentication Header AH protocol and the Encapsulating Security Payload ESP protocol with NULL authentication When you log in through...

Page 129: ...nd J Series devices broadcast TFTP is not supported when flow is enabled on the device On SRX5800 devices network processing bundling is not supported in Layer 2 transparent mode On SRX3400 SRX3600 SRX5600 and SRX5800 devices downgrading is not supported in low impact in service software upgrade ISSU chassis cluster upgrades LICU Hardware This section covers filter and policing limitations On SRX3...

Page 130: ...licers is 2000 The maximum burst size of a policer or three color policer is 16 MB On SRX650 devices the T1 E1 GPIMs 2 or 4 port version do not work in 9 6R1 This issue is resolved in JUNOS Release 9 6R2 and JUNOS Release 10 1 but if you roll back to the 9 6R1 image this issue is still seen Interfaces and Routing On SRX650 devices MAC pause frame and FCS error frame counters are not supported for ...

Page 131: ...im interfaces inet6 show pim neighbors inet6 show pim source inet6 show pim rps inet6 show pim join inet6 show pim mvpn show multicast next hops inet6 show multicast rpf inet6 show multicast route inet6 show multicast scope inet6 show multicast pim to mld proxy show multicast statistics inet6 show multicast usage inet6 show msdp sa group group set protocols pim interface interface family inet6 set...

Page 132: ...e dr election on p2p family inet 6 set protocols pim dr election on p2p family inet 6 set protocols pim export export join policy family inet 6 set protocols pim import export join policy family inet 6 set protocols pim disable import export join policy family inet 6 On SRX210 devices the USB modem interface can handle bidirectional traffic of up to 19 kbps On oversubscription of this amount that ...

Page 133: ...devices the application level denial of service application level DDoS rulebase rulebase ddos does not support port mapping If you configure an application other than default and if the application is from either predefined JUNOS Software applications or a custom application that maps an application service to a nonstandard port application level DDoS detection will not work When you configure the...

Page 134: ...attacks from a source with more than one destination have active sessions distributed across nodes the attack might not be detected because time binding counting has a local node only view Detecting this sort of attack requires an RTO synchronization of the time binding state that is not currently supported J Web On J Series devices some J Web pages for new features for example the Quick Configura...

Page 135: ... set can be configured on a device For destination NAT up to 32 rule sets and up to 8 rules per rule set can be configured on a device For source NAT the following are the maximum numbers of source NAT rules that can be configured on a device 512 for J Series SRX100 and SRX210 devices 1024 for SRX240 and SRX650 devices 8192 for SRX3400 SRX3600 SRX5600 and SRX5800 devices These are systemwide maxim...

Page 136: ...must upgrade the memory to 1 GB to run UTM VPNs On SRX3400 SRX3600 SRX5600 and SRX5800 devices the IPsec NAT T tunnels scaling and sustaining issues are as follows For a given private IP address the NAT device should translate both 500 and 4500 private ports to same public IP address The total number of tunnels from a given public translated IP cannot exceed 1000 tunnels WLAN The following are the...

Page 137: ...ommand while doing a bulk call generation it might bring down the SPU with a flowd core file error PR 292956 On SRX210 devices the SCCP call cannot be set up after disabling and enabling the SCCP ALG The call does not go through PR 409586 On SRX3400 and SRX3600 devices RTSP TFTP and FTP ALG at scale in Layer 2 mode with A P is not supported in JUNOS Release 10 1 PR 474140 On SRX3400 SRX3600 SRX560...

Page 138: ...tart the wireless LAN service PR 497752 On AX411 Access Points an access point might not synchronize with the newly associated configuration by changing or swapping the MAC address and also might not join the changed cluster when it is associated to a new config block in the WLAN access point configuration As a workaround deactivate and activate the access point the following CLI commands deactiva...

Page 139: ...96728 On an SRX210 device in a chassis cluster when you upgrade to the latest software image the interface links do not come up and are not seen in the Packet Forwarding Engine As a workaround you can reboot the device to bring up the interface PR 399564 On an SRX210 device in a chassis cluster sometimes the reth interface MAC address might not make it to the switch filter table This results in th...

Page 140: ...ateway and a site to site gateway is not allowed PR 440833 On SRX650 devices the following message appears on the new primary node after a reboot or a RG0 failover WARNING cli has been replaced by an updated version CLI release 9 6B1 5 built by builder on 2009 04 29 08 24 20 UTC Restart cli using the new version yes no yes yes PR 444470 On SRX240 and SRX650 devices in chassis cluster active active...

Page 141: ...ICU when the LICU upgrade is performed for JUNOS Release 10 0R2 to 10 1R2 PR 491834 On SRX5600 and SRX5800 devices the shaping rate is not honored during LICU upgrades During LICU upgrades when the secondary node is upgraded to the primary node the shaping rate is doubled and continues to be the same doubled value after the LICU upgrade is finished PR 499481 Class of Service CoS J4350 and J6350 de...

Page 142: ...se fields shown by the show security flow session summary command will reflect this PR 284299 PR 397300 On J Series devices outbound filters will be applied twice for host generated IPv4 traffic PR 301199 On SRX Series devices configuring the flow filter with the all flag might result in traces that are not related to the configured filter As a workaround use the flow trace flag basic with the com...

Page 143: ...X5600 and SRX5800 devices there is missing information in the jnxJsFwAuthMultipleFailure trap message The trap message is required to contain the username IP address application and trap name but the username is missing PR 439314 On SRX5800 devices for any network processing bundle configuration change to take effect a reboot is needed Currently there is no message displayed after a bundle configu...

Page 144: ...ustomized application on other ports is not supported PR 464357 On J Series devices interfaces with different bandwidths even if they are of same interface type for example serial interfaces with different clock rates or channelized T1 E1 interfaces with different timeslots should not be bundled under one ML bundle PR 464410 SRX3400 and SRX3600 devices with one Services Processing Card and two Net...

Page 145: ...237721 On J Series devices the Clear NVRAM option in the BIOS configuration mode does not work as expected This issue can be seen on the J4350 and J6350 routers with BIOS Version 080011 and on the J2320 and J2350 routers with BIOS Version 080012 To help mitigate this issue note any changes you make to the BIOS configuration so that you can revert to the default BIOS configuration as needed PR 2377...

Page 146: ...d J6350 devices the link status of the onboard Gigabit Ethernet interfaces ge 0 0 0 through ge 0 0 3 or the 1 port Gigabit Ethernet ePIM interface fails when you configure these interfaces in loopback mode PR 72381 On J Series Routers asymmetric routing such as tracing a route to a destination behind J Series devices with Virtual Router Redundancy Protocol VRRP does not work PR 237589 On J2320 dev...

Page 147: ...rate 62400 ADD IFL SHAPER PR 430756 On SRX650 devices configuring dual and quad T1 E1 framing at the chassis level has no effect PR 432071 On SRX240 devices the serial interface maximum speed in extensive output is displayed as 16384 Kbps instead of 8 0 Mbps PR 437530 On SRX Series devices incorrect Layer 2 circuit replication on the backup Routing Engine might occur when you Configure nonstop rou...

Page 148: ...transitions three to four are seen during long duration traffic testing with ALU 7302 DSLAM There is no impact on traffic except for the packet loss after long duration traffic testing which is also seen in the vendor CPE PR 467912 On SRX210 devices with VDLS2 remote end ping fails to go above the packet size of 1480 as the packets are get dropped for the default MTU which is 1496 on an interface ...

Page 149: ...devices PR 505347 On SRX5600 and SRX5800 devices load balance does not happen within the aggregated Ethernet ae interface when you prefix length with 24 while incrementing the dst ip PR 505840 Intrusion Detection and Prevention IDP On SRX3400 SRX3600 SRX5600 and SRX5800 devices when the firewall and IDP policy both enable diffServ marking with a different DSCP value for the same traffic the firewa...

Page 150: ...y and they will time out eventually PR 458900 When an SRX Series device running JUNOS Release 10 1 Layer 2 access integrated mode is rolled back to the JUNOS Release 9 6 image the DUT comes up in JUNOS Release 9 6 with Layer 2 access integrated mode which was not supported in JUNOS Release 9 6 PR 469069 On SRX3400 SRX3600 SRX5600 and SRX5800 devices the application level distributed denial of serv...

Page 151: ... SRX3600 SRX5600 and SRX5800 devices selecting Configure Security Policy IDP Policies Security Package Update Help in the J Web user interface brings up the IDP policy Help page instead of the Signature update Help page To access the corresponding Help page select Configure IDP Signature Update and then click Help PR 409127 On SRX Series devices the CLI Terminal feature does not work in J Web over...

Page 152: ...d use the CLI to view the available flags PR 475313 On SRX100 SRX210 SRX240 SRX650 and J Series devices when you have a large number of static routes configured and if you have navigated to pages other than to page 1 in the Route Information table in the J Web interface Monitor Routing Route Information changing the Route Table to query other routes refreshes the page but does not return you to pa...

Page 153: ...is required for the change to take effect PR 441546 On SRX Series and J Series devices with session init and session close enabled you should not clear sessions manually when too many sessions are in status used PR 445730 On SRX5600 and SRX5800 devices data path debug trace messages are getting dropped at above 1000 packets per second pps PR 446098 On J2350 J4350 and J6350 devices extended Bit Err...

Page 154: ...ower 12 4 PR 465307 On SRX100 SRX210 SRX240 and SRX650 devices with factory default configurations the device is not able to manage the AX411 Acess Point This might be due to the DHCP default gateway not being set PR 468090 On SRX210 PoE devices managing AX411 Access Points traffic of 64 bytes at speed more than 45 megabits per second Mbps might result in loss of keepalives and reboot of the AX411...

Page 155: ... transactions if the current antivirus status is engine not ready and the fallback setting for this state is block An empty file is generated on the HTTP server without any block message contained within it PR 412632 On SRX240 SRX650 J2320 J2350 J4350 and J6350 devices Outlook Express is sending infected mail with an EICAR test file to the mail server directly not through DUT Eudora 7 uses the IMA...

Page 156: ...84507 On SRX210 High Memory devices the modem interface can handle bidirectional traffic of up to 19 Kbps During oversubscription of 20 Kbps or more traffic the keepalive packets are not exchanged and the interface goes down PR 487258 On SRX210 High Memory devices IPv6 is not supported on dialer interfaces with a USB modem PR 489960 On SRX210 High Memory devices http traffic is very slow through t...

Page 157: ...e able to establish IKE IPsec tunnels PR 288551 On SRX210 and SRX240 devices concurrent login to the device from a different management systems for example laptop or computers are not supported The first user session will get disconnected when a second user session is started from a different management system Also the status in the first user system is displayed incorrectly as Connected PR 434447...

Page 158: ... SRX3400 and SRX3600 devices in a chassis cluster ESP authentication errors occurred while traffic was sent through 4000 site to site IPsec tunnels PR 426073 This issue has been resolved On SRX650 and J Series devices doing a redundancy group 0 failover with 1000 logical interfaces on the reth interface caused replication errors As a result the ksyncd process generated a core file PR 428636 This i...

Page 159: ...call server page in J Web PR 445750 This issue has been resolved The J Web Call Feature Add button did not work PR 446422 This issue has been resolved Was not able to edit the extension number on the J Web call features page PR 447523 This issue has been resolved When you edited the remote access number in J Web the change was not displayed until you refreshed the page PR 447530 This issue has bee...

Page 160: ... had the match criteria for the same attacks Error warning messages did not appear during policy compilation PR 414416 This issue has been resolved On SRX3400 SRX3600 SRX5600 and SRX5800 devices with application level DDoS protection the IDP session capacity dropped by 9 percent in integrated mode PR 479552 This issue has been resolved SRX5600 devices operating at high HTTPS session rate with the ...

Page 161: ...This issue has been resolved On SRX210 SRX240 and SRX650 devices wired equivalent privacy WEP key validation was not properly executed in J Web sometimes an error returned even if the proper validation key was submitted PR 486910 This issue has been resolved On SRX3400 devices in chassis cluster mode the predefined attacks list was also loaded PR 488607 This issue has been resolved On SRX devices ...

Page 162: ...as SRX 3400 instead of SRX3400 Note that there was no blank space between SRX and model number 3400 3600 PR 490296 This issue has been resolved USB Modem On SRX210 Services Gateways with Integrated Convergence Services when you had USB modem configurations and you removed the USB modem from USB port 1 the device rebooted PR 491777 This issue has been resolved Virtual LANs VLANs On SRX650 devices c...

Page 163: ...ation Guide has been renamed to Verifying the Microsoft RPC ALG Tables to reflect RPC ALG data structure cleanup ALG configuration examples in the JUNOS Software Security Configuration Guide incorrectly show policy based NAT configurations NAT configurations are now rule based The JUNOS Software Security Configuration Guide incorrectly states that ALGs are not supported in transparent mode on SRX3...

Page 164: ...s are supported on all SRX Series devices when in fact they are not supported on SRX3400 SRX3600 SRX5600 and SRX5800 devices edit security flow aging early ageout edit security flow aging high watermark edit security flow aging low watermark The Understanding Selective Stateless Packet Based Services section in the JUNOS Software Administration Guide states The following security features are not ...

Page 165: ...p screenshot shown in the SRX210 Services Gateway Getting Started Guide and the SRX240 Services Gateway Getting Started Guide contains the following inaccuracies The J Web screenshot incorrectly shows the Enable DHCP on ge 0 0 0 0 check box as disabled in factory default settings The J Web screenshot should indicate the Enable DHCP on ge 0 0 0 0 check box as enabled in factory default settings The...

Page 166: ... SRX240 devices only the ge 0 0 0 port supports TFTP in uboot and on the SRX650 device all front end ports support TFTP in uboot Step 2 of the Installing JUNOS Software Using TFTPBOOT instructions should mention that the URL path is relative to the TFTP server s TFTP root directory The instructions should also mention that you should store the JUNOS Software image file in the TFTP server s TFTP ro...

Page 167: ...ted Convergence Services the Transport Layer Security TLS option for the SIP protocol transport is not supported in JUNOS Release 10 1 However it is documented in the Integrated Convergence Services entries of the JUNOS Software CLI Reference Guide The JUNOS Software CLI Reference contains Integrated Convergence Services statement entries for the music on hold feature which is not supported for JU...

Page 168: ...ion in the JUNOS Software Security Configuration Guide on page 810 Table 101 is missing The definition for exclude context values should be as follows Configure a list of common context value patterns that should be excluded from application level DDoS detection For example if you have a Web server that receives a high number of HTTP requests on home landing page you can exclude it from applicatio...

Page 169: ...ond 0 Peak 0 2010 02 05 06 49 51 UTC Latency microseconds min 0 max 0 avg 0 Packet Statistics ICMP 0 TCP 0 UDP 0 Other 0 Flow Statistics ICMP Current 0 Max 0 2010 02 05 06 49 51 UTC TCP Current 0 Max 0 2010 02 05 06 49 51 UTC UDP Current 0 Max 0 2010 02 05 06 49 51 UTC Other Current 0 Max 0 2010 02 05 06 49 51 UTC Session Statistics ICMP 0 TCP 0 UDP 0 Other 0 Policy Name sample Running Detector Ve...

Page 170: ...scribe how to configure screen options using the set security screen screen name CLI statements Instead you should use the set security screen ids option screen name CLI statements All screen configuration options are located at the set security screen ids option screen name level of the configuration hierarchy Related Topics New Features in JUNOS Release 10 1 for SRX Series Services Gateways and ...

Page 171: ...r and heat dissipation capacity of each PIM and troubleshooting procedures see the J series Services Routers Hardware Guide Supported Third Party Hardware for J Series Services Routers The following third party hardware is supported for use with J Series Services Routers running JUNOS software USB Modem We recommend using a U S Robotics USB 56K V 92 Modem model number USR 5637 Storage Devices The ...

Page 172: ... and DRAM Requirements Maximum DRAM Supported Minimum DRAM Required Minimum CompactFlash Card Required Model 1 GB 512 MB 512 MB J2320 1 GB 512 MB 512 MB J2350 2 GB 512 MB 512 MB J4350 2 GB 1 GB 512 MB J6350 Related Topics New Features in JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers on page 98 Known Limitations in JUNOS Release 10 1 for SRX Series Services Gatew...

Page 173: ...ed the system will be able to boot from the backup JUNOS Software image located in the other root partition and remain fully functional SRX Series devices that ship with JUNOS Release 10 1 are formatted with dual root partitions from the factory SRX Series devices that are running JUNOS Release 9 6 or earlier can be formatted with dual root partitions when upgrading to JUNOS Release 10 1 NOTE The ...

Page 174: ... other root partition are erased The contents of the other root partition will not be valid unless the installation is completed successfully With the dual root partitioning scheme after a new JUNOS Software image is installed add on packages like jais or jfirmware should be reinstalled as required With the dual root partitioning scheme the request system software rollback CLI command does not del...

Page 175: ... desired use the conventional CLI and J Web installation methods as described in the JUNOS Software Administration Guide for Security Devices Upgrading to JUNOS Release 10 1 with Dual Root Partitioning To format the media with dual root partitioning while upgrading to JUNOS Release 10 1 use one of the following installation methods Installation from the boot loader using a TFTP server This method ...

Page 176: ... and set the following variables ipaddr loader set ipaddr IP address of the device netmask loader set netmask netmask gatewayip loader set gatewayip gateway IP address serverip loader set severip TFTP server IP address 3 Install the image using the following command at the loader prompt loader install tftp server ip image path on server For example loader install tftp 10 77 25 12 junos srxsme 10 1...

Page 177: ...heme 2 After the device reboots with JUNOS Release 10 1 upgrade the boot loader to version 1 5 See Upgrading the Boot Loader on page 177 3 Reinstall the 10 1 image from JUNOS CLI using the request system software add command with the partition option This will copy the image to the device then reboot the device for installation The device will boot up with the 10 1 image installed with the dual ro...

Page 178: ...o not need to reinstall the earlier version of the boot loader Reinstalling the Single Root Partition Release Over TFTP To reinstall JUNOS Software from the boot loader using a TFTP server 1 Upload the JUNOS Software image to a TFTP server 2 Stop the device at the loader prompt and set the following variables ipaddr loader set ipaddr IP address of the device netmask loader set netmask netmask gate...

Page 179: ...rimary JUNOS Software Image with Dual Root Partitioning Scheme If the SRX Series Services Gateway is unable to boot from the primary JUNOS Software image and boots up from the backup JUNOS Software image in the backup root partition a message is displayed on the console at the time of login indicating that the device has booted from the backup JUNOS Software image login user Password WARNING THIS ...

Page 180: ...g a snapshot to a USB storage device that is less than 1 GB is not supported With the dual root partitioning scheme you must use the partition option when performing a snapshot If the partition option is not specified the snapshot operation fails with a message that the media needs to be partitioned for snapshot The output for the show system snapshot CLI command is changed in devices with dual ro...

Page 181: ...srxsme 10 1R1 domestic tgz no copy no validate partition reboot Copying package junos srxsme 10 01R1 domestic tgz to var tmp install Rebooting The system will reboot and complete the installation WARNING Using the partition option with the request system software add CLI command erases the existing contents of the media Only the current configuration is preserved Any important data should be backe...

Page 182: ...e JUNOS Software image with the usual upgrade commands Instead use the master Routing Engine RE0 to create a bootable USB storage device which you can then use to install a software image on the second Routing Engine RE1 To upgrade the software image on the second Routing Engine RE1 1 Use FTP to copy the installation media into the var tmp directory of the master Routing Engine RE0 2 Insert a USB ...

Page 183: ...pears press y WARNING The installation will erase the contents of your disks Do you wish to continue y n When the following system output appears remove the USB storage device and press Enter Eject the installation media and hit Enter to reboot Upgrade and Downgrade Instructions for JUNOS Release 10 1 for SRX Series Services Gateways and J Series Services Routers In order to upgrade to JUNOS Relea...

Page 184: ...bed in this section Not all EX Series software features are supported on all EX Series platforms in the current release For a list of all EX Series software features and their platform support see EX Series Switch Software Features Overview New features are described on the following pages Hardware on page 184 Access Control and Port Security on page 185 Bridging VLANs and Spanning Trees on page 1...

Page 185: ...llows you to authenticate users on EX Series switches by redirecting Web browser requests to a login page that requires users to input a username and password before they are allowed access to the network In addition to using the feature to control network access by requiring users to provide information that is authenticated against a RADIUS server database you can also use it to display an accep...

Page 186: ...st reverse path forwarding RPF is available on EX8200 switches The unicast RPF feature can be enabled on specific interfaces on EX8200 switches and supports ECMP traffic Layer 2 and Layer 3 Protocols IPv6 Layer 3 multicast routing and forwarding EX3200 and EX4200 switches now support IPv6 Layer 3 multicast routing and forwarding which includes Multicast Listener Discovery version 1 MLDv1 and MLDv2...

Page 187: ...s using the interface match condition You can configure an ingress or egress firewall filter with an aggregated Ethernet interface as a match condition and apply the firewall filter to ports VLANs and Layer 3 interfaces Related Topics Changes in Default Behavior and Syntax in JUNOS Release 10 1 for EX Series Switches on page 187 Limitations in JUNOS Release 10 1 for EX Series Switches on page 188 ...

Page 188: ...for the 100Base ZX interface If you enable PIM on all interfaces using the interface all command it is not enabled on the me0 and vme interfaces by default Therefore you do not need to explicitly disable PIM on the management interfaces Previously enabling PIM on all interfaces caused it to be enabled on these management interfaces Related Topics New Features in JUNOS Release 10 1 for EX Series Sw...

Page 189: ...arameters on an EX3200 or EX4200 switch running JUNOS Release 9 2 or Release 9 3 for EX Series switches and then attempt to upgrade to a later release or a later version of Release 9 3 than the one that is currently installed the switch might display the following error message init interface control is thrashing not restarted As a workaround on the interfaces you had previously configured configu...

Page 190: ...gger the alarm that displays the message Loss of communication with Backup RE There is no functionality affected Interfaces EX Series switches do not support queued packet counters Therefore the queued packet counter in the output of the show interfaces interface name extensive command always displays a count of 0 and is never updated The following message might appear in the system log Resolve re...

Page 191: ...age 194 Errata in Documentation for JUNOS Release 10 1 for EX Series Switches on page 198 Upgrade and Downgrade Issues for JUNOS Release 10 1 for EX Series Switches on page 198 Outstanding Issues in JUNOS Release 10 1 for EX Series Switches The following are outstanding issues in JUNOS Release 10 1R1 for EX Series switches The identifier following the description is the tracking number in our bug ...

Page 192: ... PR 504273 Infrastructure On EX Series switches MAC addresses not present in the forwarding database FDB because of hash collision are not removed from the Ethernet switching process eswd These MAC addresses do not age out of the Ethernet switching table even if traffic is stopped completely and are never relearned when traffic is sent to these MAC addresses even when there is no hash collision As...

Page 193: ...e Port Security Configuration page you are required to configure action when you configure MAC limit even though configuring an action value is not mandatory in the CLI PR 434836 In the J Web interface in the OSPF Global Settings table in the OSPF Configuration page the Global Information table in the BGP Configuration page or the Add Interface window in the LACP Configuration page if you try to c...

Page 194: ...n an EX2200 switch the DHCP snooping database might not be built on the switch PR 480682 This issue has been resolved Bridging VLANs and Spanning Trees When Multiple VLAN Registration Protocol MVRP and MSTP are enabled together on EX Series switches convergence does not occur between MVRP and MSTP PR 449248 This issue has been resolved On EX4200 switches with the access interface through which tra...

Page 195: ...the queue can stop dequeueing packets As a workaround stop traffic going out on the port and deactivate and reactivate class of service CoS You can also reboot the switch PR 481401 This issue has been resolved Firewall Filters The accept action and the log and syslog action modifiers in the firewall filter configuration might not work as expected for packets destined for the switch PR 406714 This ...

Page 196: ... an interface is assigned to a VLAN before the interface s stg state is set loops might form in the network if a VLAN ID is assigned to the VLAN while the interface is active in a redundant topology PR 472617 This issue has been resolved On EX8200 switches after a graceful Routing Engine switchover GRES you can navigate through the Maintenance menu in the LCD even after the Maintenance menu in the...

Page 197: ...as been resolved When you access the J Web interface using the Mozilla Firefox Web browser and move a J Web window for example the Add Interface window over the browser toolbars the window appears behind the browser toolbars After this problem occurs the window cannot be moved because the title bar of the window is not visible If you cancel and reopen the window the window continues to appear behi...

Page 198: ...199 Downgrading from JUNOS Release 10 1 to Release 9 2 for EX4200 Switches on page 200 Upgrading or Downgrading from JUNOS Release 9 4R1 for EX Series Switches The ARP aging time configuration in the system configuration stanza in JUNOS Release 9 4R1 is incompatible with the ARP aging time configuration in JUNOS Release 9 3R1 or earlier and JUNOS Release 9 4R2 or later If you have configured syste...

Page 199: ...d that all interfaces are configured on the switch and assigned to the ethernet switching family If the VLAN or the interface is not configured and you try to commit the configuration the commit will fail Remove static MAC addresses on single supplicant mode interfaces If they exist and you try to commit the configuration the commit will fail In an 802 1X configuration stanza if authentication pro...

Page 200: ...nd STP and priority tagged packets are processed on logical interface 0 and not on logical interface 32767 In addition if you have not configured any untagged interfaces the switch creates a default logical interface 0 On EX4200 switches if you have installed advanced licenses for features such as BGP rename the config license directory to config license_priv before upgrading from Release 9 2 to R...

Page 201: ...witches on page 194 Errata in Documentation for JUNOS Release 10 1 for EX Series Switches on page 198 Upgrade and Downgrade Issues for JUNOS Release 10 1 for EX Series Switches 201 Upgrade and Downgrade Issues for JUNOS Release 10 1 for EX Series Switches ...

Page 202: ...cal bookstores and book outlets around the world The current list can be viewed at http www juniper net books Documentation Feedback We encourage you to provide feedback comments and suggestions so that we can improve the documentation You can send your comments to techpubs comments juniper net or fill out the documentation feedback form at https www juniper net cgi bin docbugreport If you are usi...

Page 203: ... entitlement by product serial number use our Serial Number Entitlement SNE Tool located at https tools juniper net SerialNumberEntitlementSearch Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone Use the Case Management tool in the CSC at http www juniper net cm Call 1 888 314 JTAC 1 888 314 5822 toll free in the USA Canada and Mexico For international or direct dia...

Page 204: ...istered trademarks or registered service marks are the property of their respective owners Juniper Networks assumes no responsibility for any inaccuracies in this document Juniper Networks reserves the right to change modify transfer or otherwise revise this publication without notice Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following p...

Search results

Summary of Contents for JUNOS 10.1 - S 5-13-2010

Reviews:

Related manuals for JUNOS 10.1 - S 5-13-2010

Brands by name

Popular brands

Juniper JUNOS 10.1 - S 5-13-2010, Release Note

Search results

Summary of Contents for JUNOS 10.1 - S 5-13-2010

Reviews:

Related manuals for JUNOS 10.1 - S 5-13-2010

Brands by name

Popular brands