Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Customer Portal FAQ


This topic presents frequently asked questions and answers about Customer Portal.

How do I log in to Customer Portal?

When a tenant account is created in CSO, you receive an account activation e-mail that contains a link to set your password and a link to the CSO portal. The password setting link expires in 24 hours or after it is used. After setting the password, you can login using the CSO portal link. You can bookmark the CSO portal link for easy access.

I forgot my password and I am unable to log in. What should I do?

You can reset your password from the CSO login page. Access the login page and enter your username in the first field (Username). Click the Forgot Password? link and follow the instructions to reset your password.

Is there a recommended browser for accessing CSO GUIs?

We recommend that you use Google Chrome Version 60 or later to access CSO GUIs.

How do I get started with Customer Portal?

You can see the Quick Start Guide for information about the required steps to be performed by an enterprise (tenant) administrator user or a managed service provider (OpCo) administrator user to quickly get started with CSO for Juniper-hosted cloud. You can also view the Customer Portal Getting Started Guide by clicking the help icon (?) on the top right of a Customer Portal page.

How do I navigate within the Customer Portal?

You can easily navigate within the Customer Portal using the menu bar (left sidebar) on every page. The actions that you can perform depend on your access privileges. For more information, see Customer Portal Overview.

Where can I view the deployment status of my policies?

You can view the policies that are awaiting deployment and the policies for which the deployment is in progress by clicking the deployments icon in the banner. You can also view and manage deployments from the Deployments page (Configuration > Deployments).

What is the character limit for a site name?

The site name can contain alphanumeric characters and hyphens (-) and must not exceed 10 characters.

What type of sites can a Tenant Administrator add?

Tenant Administrator users can add the following sites:

  • Hybrid WAN deployment model—on-premise spoke sites

  • SD-WAN deployment model—on-premise spoke site , provider hub site, and enterprise hub site.

  • Next-generation firewall—on-premise spoke site

  • LAN—on-premise spoke site; can create SD-WAN on-premise spoke sites with LAN capability, next-generation firewall site with LAN capability, and standalone LAN sites

Can Tenant Operator users create, modify, or delete objects, such as departments or sites, in Customer Portal?

Tenant Operator users have read-only access to objects in the Customer Portal UI and APIs and they cannot create, modify, or delete objects.

Can Tenant Administrator users upload device images for the devices from Customer Portal?

No. Tenant Administrator users can view the list of device images that are uploaded by the Service Provider (SP) administrator or the OpCo administrator users.

Can Tenant Administrator users upload any license files from the Customer Portal?

No. Tenant Administrator users can view the list of device or CSO license files that are uploaded by the SP administrator or the OpCo administrator users.

How many WAN links of a site can have LTE, ADSL, or VDSL access type?

You can select only one WAN link with LTE, ADSL, or VDSL access type.

Can the same tenant have sites for different types of services?

Yes. While creating a tenant, an SP administrator can specify whether a tenant can create sites for one or more of the following services:

  • SD-WAN

  • Hybrid WAN

  • LAN

  • Next-generation firewall

Can I configure APN settings on all CPE devices?

Currently, APN configuration is supported only on LTE WAN links. CSO supports LTE WAN links on NFX150 and NFX250 CPE devices.

What is an enterprise hub site?

An enterprise hub site is an SD-WAN site that is used to carry site-to-site traffic between on-premise spoke sites and to break out backhaul (central breakout) traffic from on-premise spoke sites. An enterprise hub site typically has a data center department behind it; however, this is not enforced in Contrail Service Orchestration (CSO). You add an enterprise hub site from the Sites page. In releases earlier than CSO 5.0.0, the enterprise hubsite was called gateway site.

What are the differences between a provider hub and a enterprise hub?

The following table explains the differences between a provider hub and a enterprise hub:


Provider Hub

Enterprise Hub

Tenant Support

Shared between multiple tenants of an OpCo or a service provider

Specific for a single tenant

Can be Added by

SP Administrator or OpCo Administrator

Tenant Administrator

Cloud Spoke Support


Not supported

Dynamic VPN Support

Not supported


Backhaul or Central Breakout Support



Mesh Tags Between a Spoke Site and a Hub

Not supported


Mesh Tags Between Two Hubs (Provider hub-Provider hub or Enterprise hub-Enterprise hub)

Supported only through customized stage-2 configurations


Breakout to Internet


Supported. However, you need to enable Enable Local Breakout and Autocreate Source NAT Rule for WAN link on the Add Site page.




What are security logs? For how long are security logs saved?

Security logs are logs generated for security events in CSO. For example, APPQOE_ACTIVE_SLA_METRIC_REPORT, KMD_VPN_DOWN_ALARM_USER, and so on. The security logs are saved for 30 days.

What are audit logs? For how long are audit logs saved?

An audit log is a record of a sequence of activities that have affected a specific operation or procedure. Audit logs are useful for tracing events and for maintaining historical data. Audit logs are retained indefinitely until an administrator purges the logs.