ON THIS PAGE
Known Issues
This section lists known issues in Juniper Networks CSO Release 5.4.0.
SD-WAN
If a provider hub is used by two tenants, one with public key infrastructure (PKI) authentication enabled and other with preshared key (PSK) authentication enabled, the commit configuration operation fails. This is because only one IKE gateway can point to one policy and if you define a policy with a certificate, then the preshared key does not work.
Workaround: Ensure that the tenants sharing a provider hub use the same type of authentication (either PKI or PSK) as the provider hub device.
Bug Tracking Number: CXU-23107
When configuring a DVPN tunnel between two devices, if one device is not functional while the other is functional, the DVPN tunnel should not be configured on the device that is functional.
Workaround: There is no known workaround. If a DVPN tunnel is configured on the functional device, delete the tunnel manually.
Bug Tracking Number: CXU-46188
VNFs are not coming up in NFX150 running on Junos OS Release 19.3R2-S3 due to non availability of the required number of CPUs.
Workaround: There is no known workaround.
Bug Tracking Number: CXU-49268
Upgrade of Junos OS Release 15.1X49-D172 to Junos OS Release 19.3R2-S3 fails on SRX 4100, SRX4200, and SRX300 dual CPE clusters, when functioning as enterprise hubs, due to incorrect IPsec configuration and CLI validations.
Workaround: To upgrade the Junos OS image from Release 15.1X49-D172 to Release 19.3R2-S5:
- Log in to Customer Portal.
- Navigate to Resources > Templates > Configuration Template.
- Select the srx-rouser template and click Deploy to Devices.
- Select the device that you want to upgrade and click Next.
- Select Is Admin for the device and click Next.
The Configure Device Parameters tab is displayed.
- Select the device that you want to upgrade and click the Set Parameters button above the Device table.
The Device Configuration for the Device page appears.
- Click the Is Admin toggle button to enable
the Is Admin option.
The router gets administrator privileges.
- Click Save to save the configuration.
- Click Next.
The Deploy tab is displayed.
- Select Run now for Choose Deployment Time.
- Click Finish.
- Access the terminal of the primary device.
To access the device terminal:
- Navigate to Resources > Devices.
- Select the device and click More > Remote Console.
- On the device console, access the shell and enter the
following command:
cli -c 'show configuration | display set | grep encryption-algorithm | grep cbc | grep "ike proposal"' | awk -Fencryption-algorithm '{b=$1" authentication-algorithm sha-256"; print b}' - Copy the output displayed to a text file.
- Again, enter the following command:
cli -c 'show configuration | display set | grep encryption-algorithm | grep cbc | grep "ipsec proposal"' | awk -Fencryption-algorithm '{b=$1" authentication-algorithm hmac-sha-256-128"; print b}' - Append the text file with the output of the command executed in Step 15.
- Switch to edit mode on the device by typing
Editat the command prompt. - Copy the commands from the text file and paste them into the device CLI.
- Copy the Junos OS Release 19.3R2-S3 image to the device
either by using CSO or manually.
To copy the image to the device by using CSO:
- Switch to Administration Portal.
- Navigate to Resources > Images.
- Click the Add icon (+) to upload the image.
- Wait until the upload is successful.
- Switch to Customer Portal.
- Navigate to Resources > Images and select the uploaded image.
- Click Stage.
- On the Stage Image page, select the device, ensure Run Now is selected for Choose Deployment time, and click OK.
The device image is copied only to the primary device.
- Copy the image to the backup device.
To copy the image to the backup device, access the remote terminal of the backup device by referring to Step12 and enter the following command:
file copy <image location> nodex <new image location>
Where, <image with location> nodex is the location of the image on node x, and<new image location> is the location to where the image should be copied to the backup device. - After the image is copied to both the primary and the backup devices, access the Remote Console option of the primary device from CSO.
- Log in to the backup device from the primary device:
primary:node0} user@node0> request routing-engine login node 1
- On the backup device, issue the upgrade command
request system software add /var/tmp/image-name no-validate.{backup:node1} user@node1> request system software add /var/tmp/<junos-srxmr-x86-64-19.3R2-S1.2-signed.tgz no-validateHost OS upgrade staged. Reboot the system to complete installation! WARNING: A REBOOT IS REQUIRED TO LOAD THIS SOFTWARE CORRECTLY. Use the WARNING: 'request system reboot' command when software installation is WARNING: complete. To abort the installation, do not reboot your system, WARNING: instead use the 'request system software delete junos' WARNING: command as soon as this operation completes. WARNING: The DHCP configuration command used will be deprecated in future Junos releases. WARNING: Please see documentation for updated commands. Saving package file in /var/sw/pkg/junos-srxmr-x86-64-19.3R2-S1.2-signed.tgz ...
- After the image on the backup device is upgraded successfully,
open another remote console on the primary device and upgrade the
image on the primary device.
{primary:node0} user@node0> request system software add /var/tmp/junos-srxmr-x86-64-19.3R2-S1.2-signed.tgz no-validateHost OS upgrade staged. Reboot the system to complete installation! WARNING: A REBOOT IS REQUIRED TO LOAD THIS SOFTWARE CORRECTLY. Use the WARNING: 'request system reboot' command when software installation is WARNING: complete. To abort the installation, do not reboot your system, WARNING: instead use the 'request system software delete junos' WARNING: command as soon as this operation completes. WARNING: The DHCP configuration command used will be deprecated in future Junos releases. WARNING: Please see documentation for updated commands. Saving package file in /var/sw/pkg/junos-srxmr-x86-64-19.3R2-S1.2-signed.tgz ...
- Reboot the backup device.
{backup:node1} root@node1> request system reboot Reboot the system ? [yes,no] (no)yes - Immediately open another remote console and reboot the
primary device.
{primary:node0} root@node0> request system reboot Reboot the system ? [yes,no] (no)yes - After both the devices are up, redeploy the srx-rouser template on the primary device by disabling the Admin option.
Bug Tracking Number: CXU-50068
If you are an Opco administrator and edit the OAM and CONTROL traffic profiles after your tenants have deployed SD-WAN policy intents, then the changes are not immediately applied on your tenant devices.
Workaround: The changes are applied to the device only when your tenants redeploy the SD-WAN policy.
Bug Tracking Number: CXU-52482
For a site-to-site tunnel, if the WAN link on one site is marked as active and the WAN link for the other site is marked as backup, then the tunnel is not considered as a backup tunnel for the site with the WAN link marked as active.
Workaround: You must avoid configuring WAN links with the same mesh tag as active on one site and backup on the other site.
Bug Tracking Number: CXU-51919
You must specify the same value for the Loss Priority field on the SLA Profile page and the Traffic Type Profile page; otherwise, the Loss Priority parameter might not be applied during the traffic congestions.
Workaround: Ensure that you specify the same value for the Loss Priority field on the SLA Profile and Traffic Type Profile pages.
Bug Tracking Number: CXU-52516
Security Management
If UTM Web-filtering categories are installed manually (by using the request system security UTM web-filtering category install command from the CLI) on an NFX150 device, the intent-based firewall policy deployment from CSO fails.
Workaround: Uninstall the UTM Web-filtering category that you installed manually by executing the request security utm web-filtering category uninstall command on the NFX150 device and then deploy the firewall policy.
Bug Tracking Number: CXU-23927
General
If you click a specific application on the Resources > Sites Management > WAN tab > Top applications widget, the Link Performance widget does not display any data.
Workaround: You can view the data from the Monitoring >Application Visibility page or Monitoring >Traffic Logs page.
Bug Tracking Number: CXU-39167
After Network Address Translation (NAT), only one DVPN tunnel is created between two spoke sites if the WAN interfaces (with link type as Internet) of one of the spoke site have the same public IP address.
Workaround: There is no known workaround.
Bug Tracking Number: CXU-41210
On an SRX Series device, the deployment fails if you use the same IP address in both the Global FW policy and the Zone policy.
Workaround: There is no known workaround.
Bug Tracking Number: CXU-41259
Tenant owned Public IP Pool can be edited until the first SD-WAN site is onboarded in that tenant. After you onboard an SD-WAN site, Tenant owned Public IP Pool cannot be edited.
Bug Tracking Number: CXU-41139
After ZTP of an NFX Series device, the status of some tunnels are displayed as down. This issue occurs if you are using the subnet IP address192.168.2.0 on WAN links, which causes an internal IP address conflict.
Workaround: Avoid using the 192.168.2.0 subnet on WAN links.
Bug Tracking Number: CXU-41511
Installation of licenses on SRX1500 and SRX4200 dual CPE clusters by using CSO is failing.
Workaround: Install the licenses manually. To install the licenses manually:
- Copy the license files for both the devices to the primary node of the cluster.
- Install the license on the primary device.
root@node0>request system license add /var/tmp/<node0-license-file.txt>
- Copy the license file of the backup node to the backup
node.
root@node0>file copy /var/tmp/<node1-license-file.txt>
- Log in to the backup node and install the license.
root@node1>request system license add /var/tmp/<node1-license-file.txt>
Bug Tracking Number: CXU-40522
Image upgrade on an SRX4X00 Series cluster fails as the ISSU upgrade command throws an error due to real-time performance monitoring (RPM) configuration. This issue is only applicable when you upgrade from Junos Release 15.149-D172.
Workaround: To upgrade an SRX4X00 Series cluster:
- Log in to CSO Customer Portal and apply the srx-rouser configuration template on the primary device in the cluster.
- Deploy the configuration template on the primary device by enabling the Admin option for the device.
- Copy the image to be upgraded on to both the primary and the backup devices by using CSO or manually.
- After the image is copied on both the primary and the backup devices, access the Remote Console option for the device from CSO.
- Log in to the backup device from the primary device:
primary:node0} user@node0> request routing-engine login node 1
- On the backup device, issue the upgrade command
request system software add /var/tmp/<image-name> no-validate.{backup:node1} user@node1> request system software add /var/tmp/<junos-srxmr-x86-64-19.3R2-S1.2-signed.tgz no-validateHost OS upgrade staged. Reboot the system to complete installation! WARNING: A REBOOT IS REQUIRED TO LOAD THIS SOFTWARE CORRECTLY. Use the WARNING: 'request system reboot' command when software installation is WARNING: complete. To abort the installation, do not reboot your system, WARNING: instead use the 'request system software delete junos' WARNING: command as soon as this operation completes. WARNING: The DHCP configuration command used will be deprecated in future Junos releases. WARNING: Please see documentation for updated commands. Saving package file in /var/sw/pkg/junos-srxmr-x86-64-19.3R2-S1.2-signed.tgz ...
- After the image on the backup device is upgraded successfully,
open another remote console on the primary device and upgrade the
image on the primary device.
{primary:node0} user@node0> request system software add /var/tmp/junos-srxmr-x86-64-19.3R2-S1.2-signed.tgz no-validateHost OS upgrade staged. Reboot the system to complete installation! WARNING: A REBOOT IS REQUIRED TO LOAD THIS SOFTWARE CORRECTLY. Use the WARNING: 'request system reboot' command when software installation is WARNING: complete. To abort the installation, do not reboot your system, WARNING: instead use the 'request system software delete junos' WARNING: command as soon as this operation completes. WARNING: The DHCP configuration command used will be deprecated in future Junos releases. WARNING: Please see documentation for updated commands. Saving package file in /var/sw/pkg/junos-srxmr-x86-64-19.3R2-S1.2-signed.tgz ...
- Reboot the backup device.
{backup:node1} root@node1> request system reboot Reboot the system ? [yes,no] (no)yes - Immediately open another remote console and reboot the
primary device.
{primary:node0} root@node0> request system reboot Reboot the system ? [yes,no] (no)yes - After both the devices are up, redeploy the srx-rouser template on the primary device by disabling the Admin option.
The image is now upgraded on both the devices of the cluster.
Bug Tracking Number: CXU-39491
Link metric widgets do not show data as expected when an analytics node is down.
Workaround: Bring up the analytics node to view link metric widgets correctly.
Bug Tracking Number: CXU-30813
When you install the license on the backup node of an SRX dual CPE cluster, the installation fails.
Workaround: To install license on the backup node of an SRX dual CPE cluster by using CSO:
- Install license on the primary node by using CSO
- Reboot the primary node to switch the backup node to function as the primary node.
- After the backup node becomes the primary node, install license for the backup node (currently working as the primary node) by using CSO.
Bug Tracking Number: CXU-43085
CSO does not support cluster-level Return Material Authorization (RMA) for SRX Series dual CPE devices. Only cluster node-level RMA is supported.
Workaround: There is no known workaround.
Bug Tracking Number: CXU-32157
When you upgrade the image for SRX4200 dual CPE device, the job status is displayed as Success even though the reboot is in progress for the secondary node.
Workaround: Check the status of the cluster and the FPC status on the primary node before proceeding with any other activity on the CPE device.
Bug Tracking Number: CXU-52974
The Initiate RMA option is disabled if the bootstrapping of the device fails and if the device status is Bootstrap_Failed.
Workaround: Delete the site and add a new site.
Bug Tracking Number: CXU-52896
Fortinet and Ubuntu service chaining instance fails on NFX250.
Workaround: There is no known workaround.
Bug Tracking Number: CXU-52817
Ubuntu service chaining instance fails on NFX150.
Workaround: There is no known workaround.
Bug Tracking Number: CXU-52512
The site upgrade fails if a site is associated with the SRX340 device.
Workaround: There is no known workaround.
Bug Tracking Number: CXU-52898