Known Behavior

This section lists known behavior, system maximums, and limitations in hardware and software in Juniper Networks Cloud CPE Solution Release 3.2.1.

• Application Visibility data is displayed only when there is at least one SD-WAN policy configured on the SD-WAN CPE.

• Deployments where CSO is behind NAT require spokes and hubs to be able to reach the VRR without NAT.
• For SD-WAN deployments, CPE behind NAT is not supported.
• If the Kubernetes minion node in the central or regional microservices VM goes down, the pods on the minion node are moved to the Kubernetes master node. When you bring the minion node back up, the pods do not automatically rebalance across the nodes.
• In Cloud CPE Solution Release 3.2.1, the virtual machine (VM) on which the virtual route reflector (VRR) is installed supports only one management interface.
• Before upgrading vSRX by using CSO, execute the request system storage cleanup command on the vSRX by using Junos OS CLI.

• The deployment of fiirewall policies with UTM profiles fails on sites (devices) on which UTM licenses are not present. Ensure that you install the required licenses before deploying firewall policies that are associated with UTM profiles.

  In addition, when you add new sites or departments, firewall policies that are automatically deployed to the sites might fail if licenses are not installed. In such cases, install the licenses on the applicable sites and re-deploy the failed policy.

• After ZTP of SD-WAN CPE, you must install APBR licenses and app signatures prior to deploying SD-WAN policies through the administrator portal GUI .
• An SD-WAN policy deployment is successful even if there is no matching WAN link meeting the SLA. This is expected behavior and is done so that when a WAN link matching the SLA becomes available, traffic is routed through that link.
• When you are creating an SLA Profile and want to specify the advanced configuration, then you must specify maximum upstream rate, maximum upstream burst size, maximum downstream rate and maximum downstream burst size.
• Dynamic SLA is not supported for full mesh topology; only static policies are supported.

• In Cloud CPE Solution Release 3.2.1, intrusion prevention system (IPS) is not supported. Therefore, in the IPS report, the attack name from the IPS signatures is displayed as UNKNOWN.
• In Cloud CPE Solution Release 3.2.1, SSL Proxy is not supported on SRX300 and SRX320 series devices.
• When you create an antivirus profile, the engine type Kaspersky and Juniper Express are not supported.
• Firewall rules are pushed to the device depending on the order in which the firewall policy intents are resolved.

• In the Configure Site workflow, use IP addresses instead of hostnames for the NTP server configuration.
• CSO uses hostname-based certificates for device activation. The regional microservices VM hostname must be resolvable from CPE.
• You can use the Administration Portal to upload licenses to Contrail Service Orchestration; however, you cannot use the Administration Portal to install licenses on physical or virtual devices that Contrail Service Orchestration manages. You must use the APIs or the license installation tool to install licenses on devices.
• Contrail Service Orchestration uses RSA key based authentication when establishing an SSH connection to a managed CPE device. The authentication process requires that the device has a configured root password, and you can use the Administration Portal to specify the root password in the device template.

  To specify a root password for the device:

  1. Log in to the Administration Portal.
  2. Select Resources>Device Templates.
  3. Select the device template and click Edit.
  4. Specify the encrypted value for the root password in the ENC_ROOT_PASSWORD field.
  5. Click Save.
• In Cloud CPE Solution Release 3.2.1, when you try to deploy a LAN segment on an SRX Series spoke device, the CSO GUI allows you to select more than one port for a LAN segment. However, for SRX Series devices, only one port for a LAN segment can be deployed; multiple ports in a LAN segment can be deployed only on NFX Seriesdevices.
• Tenant Administrator users cannot delete sites.
• On a site with an NFX Series device, if you deploy a LAN segment without the VLAN ID specified, CSO uses an internal VLAN ID meant for internal operations and this VLAN ID is displayed in the UI. There is no impact on the functionality.
• Site names across tenants must be unique, that is, you cannot use the same site name across tenants.
• In rare cases, site routes are not advertised to the hub, which results in the sites not being reachable.

  Workaround: Delete the LAN segments for the sites that are not reachable and add the LAN segments again.

• Changing the DHCP IP address on the OAM interface is not supported.
• Hybrid-WAN and SD-WAN deployments using the same MX as a hub is not supported.
• When using MX as a SD-WAN hub, NAT configuration must be done on MX Series routers using Stage-2 configuration templates.
• DHCP configuration on WAN links on a SD-WAN hub is not supported.
• Cloud CPE Solution Release 3.2.1 does not support automatic hub-meshing. Hub-meshing must be performed manually in order for traffic to flow between the hubs.
• IP addresses of the first two WAN interfaces of a site that is part of a full mesh topology deployment cannot be changed once it is provisioned.

• When you use Mozilla Firefox to access the Contrail Service Orchestration (CSO) GUIs, a few pages do not work as expected. We recommend that you use Google Chrome version 60 or later to access the CSO GUIs.
• The preferred link for the underlay is not displayed in the GUI.

• In Cloud CPE Solution Release 3.2.1, when you edit a tenant, changing the deployment plan from Hybrid WAN to SD-WAN or vice versa is not supported, although the field is displayed as editable.
• For a centralized deployment, use the following procedure to check that the JSM Heat resource is available in Contrail OpenStack on the Contrail Controller node.

  Note: This procedure must be performed on all the Contrail Controller nodes in your CSO installation.

  1. Log in to the Contrail Controller node as root.
  2. To check whether the JSM Heat resource is available, execute the heat resource-type-list | grep JSM command.

     If the search returns the text OS::JSM::Get Flavor, the file is available in Contrail OpenStack.

  3. If the file is missing, do the following:
     1. Use Secure Copy Protocol (SCP) to copy the jsm_contrail_3.py file to the following directory:
        • For Heat V1 APIs, the /usr/lib/python2.7/dist-packages/contrail_heat/resources directory on the Contrail Controller node.
        • For Heat V2 APIs, the /usr/lib/python2.7/dist-packages/vnc_api/gen/heat/resources directory on the Contrail Controller node.

        Note: The jsm_contrail_3.py file is located in the /root/Contrail_Service_Orchestration_3.2.1/scripts directory on the VM or server on which you installed CSO.

     2. Rename the file to jsm.py in the Heat resource directory to which you copied the file.
     3. Restart the Heat services by executing the service heat-api restart && service heat-api-cfn restart && service heat-engine restart command.
     4. After the services restart successfully, verify that the JSM Heat resource is available as explained in Step 2. If it is not available, repeat Step 3.
• In vCPE deployments, when a tenant object is created through Administration Portal or the API for a centralized deployment, ContrailOpenStackadds a default security group for the new tenant. This default security group denies inbound traffic and you must manually update the security group in Contrail OpenStack to allow ingress traffic from different networks. Otherwise, Contrail OpenStack might drop traffic.
• In vCPE deployments, CSO does not provide a remote procedure call (RPC) to get the device identifier for a specific site. You can use multiple API calls or the license installation tool to obtain the device identifier for a specific site.