Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Installation and Upgrade


You can install CSO by using a GUI-based installer as well as through the CLI installer.

  • When you install or upgrade CSO by using the CLI, ensure that you save the passwords for each infrastructure component when they are displayed on the console because these passwords are encrypted and are not displayed again.

    In addition, during the installation, ensure that you save the Administration Portal password that is displayed on the console. For the upgrade, you must log in using the password configured for the previously installed version of CSO.

  • If you are using the GUI installer, after the installation is successful, click the View all IP addresses and passwords link to view all the IP addresses used by CSO and the passwords for various CSO components.

    Ensure that you save the passwords for each CSO component (the cspadmin password, used for the Administration Portal login, is the most important) because these passwords are not displayed again.

Software Downloads

Table 3 displays the supported versions and download links for CSO Release 4.1.0 and associated software components.​ We recommend that you use the CSO Downloader to download and install CSO.

Table 3: CSO and Associated Software Components


Supported Version

Download Link

CSO Downloader (available for Windows, MacOS, and Linux Desktop versions)


Contrail Service Orchestration


Juniper Identity Management Service (JIMS)


Pre-bundled with CSO and also available here: record/75619.html

Contrail Analytics

Pre-bundled with CSO

Contrail Cloud Platform

3.2.5 record/69888.html

NFX150 CPE device

Junos OS Release 18.2X85D11

NFX250 CPE device

Junos OS Release 15.1X53-D496

SRX Series CPE device

Junos OS Release 15.1X49-D170


Junos OS Release 15.1X49-D170

MX Series (hub device)

Junos OS Release 16.1R5

Installation Instructions

A full-version installer is available for CSO Release 4.1.0, which can be used for small, medium, and large deployments. For more information, follow the instructions in the Installation and Upgrade Guide or the README file that is included with the software installation package.


The physical servers on which you install CSO must have Internet access to download the libvirt packages. After the packages are downloaded, you do not need Internet access for the rest of the CSO installation.

Software Installation Requirements for NFX Series Network Services Platform

When you set up a distributed deployment with an NFX150 or an NFX250 device, you must use Administration Portal or the CSO API to:

  1. Upload the software image to CSO.
  2. Specify this image as the boot image when you configure activation data.

For more information, see pathway-pages/nfx-series/product/.

Upgrade Instructions


You can upgrade to CSO Release 4.1.0 only from CSO Release 4.0.2.

If your installed version of CSO is not Release 4.0.2, then you must perform a fresh installation of CSO Release 4.1.0.

If your installed version is CSO Release 4.0.2, you can use a script ( to directly upgrade to CSO Release 4.1.0. If the upgrade is unsuccessful, you can roll back to CSO Release 4.0.2.

For more information, see Upgrading Contrail Service Orchestration Overview in the Installation and Upgrade Guide.

Installation and Upgrade Limitations

  • For SD-WAN deployments, CPE devices behind NAT are supported only for Internet links.

  • The VM on which the virtual route reflector (VRR) is installed supports only one management interface.

Post-Installation Instructions and Notes

  • Before you onboard devices, ensure that the device is running the software version that is recommended in this release notes.

  • To use full capabilities of CSO Release 4.1.0, we recommend that you upgrade the sites by using the site upgrade workflow, to Release 4.1.0.

  • After you upgrade a site, delete and recreate the SD-WAN policies other the ones that use local breakout. For local breakout policies, create a local breakout profile.

  • After you upgrade CSO to Release 4.1.0, existing SD-WAN policies are shown as undeployed in the CSO UI even though the policies are still active and deployed.