This section lists known behavior, system maximums, and limitations in hardware and software in Juniper Networks CSO Release 3.3.0.
AWS Spoke
When an AWS spoke site is being provisioned and the vSRX instance is coming up, all traffic is stopped for 16–30 minutes. After the device is activated and if intent-based policies are configured, the traffic flows as configured.
The cloud formation template includes a new route table to forward traffic to the vSRX device. If you have configured manual routing between your subnets and VMs, then the new route table replaces the manual routing with only one route forwarding the traffic to the vSRX device.
In CSO Release 3.3.0, the supported Junos OS release for the AWS spoke is Junos OS Release 15.1X49.D133. You can use the Amazon Machine Image (AMI) number for the respective region from Table 18 or obtain the latest AMI for Release 15.1X49.D133 from the AWS Marketplace.:
Note You must specify the Custom Image ID field because not doing so results in failure during stack creation or provisioning.
Table 18: AMI IDs for Different Regions
Region | AMI ID |
|---|---|
US East (N. Virginia) | ami-4a09d335 |
US East (Ohio) | ami-416a5924 |
US West (N. California) | ami-8f9182ef |
US West (Oregon) | ami-7dc4a705 |
Canada (Central) | ami-90c342f4 |
EU (Frankfurt) | ami-f45c071f |
EU (Ireland) | ami-d37155aa |
EU (London) | ami-5936d63e |
Asia Pacific (Singapore) | ami-dd0928a1 |
Asia Pacific (Sydney) | ami-a2bf77c0 |
Asia Pacific (Seoul) | ami-faaa0494 |
Asia Pacific (Tokyo) | ami-48c0dc34 |
Asia Pacific (Mumbai) | ami-6f735400 |
South America (Sao Paulo) | ami-a6b6e7ca |
AWS GovCloud (US) | ami-74c85c15 |
When you create a cloud spoke site, the default link fields and backup link fields are not applicable.
Policy Deployment
The deployment of fiirewall policies with UTM profiles fails on sites (devices) on which UTM licenses are not present. Ensure that you install the required licenses before deploying firewall policies that are associated with UTM profiles.
In addition, when you add new sites or departments, firewall policies that are automatically deployed to the sites might fail if licenses are not installed. In such cases, install the licenses on the applicable sites and re-deploy the failed policy.
After ZTP of SD-WAN CPE, you must install APBR licenses and app signatures prior to deploying SD-WAN policies through the administrator portal GUI .
An SD-WAN policy deployment is successful even if there is no matching WAN link meeting the SLA. This is expected behavior and is done so that when a WAN link matching the SLA becomes available, traffic is routed through that link.
When you are creating an SLA Profile and want to specify the advanced configuration, then you must specify maximum upstream rate, maximum upstream burst size, maximum downstream rate and maximum downstream burst size.
Security Management
Intrusion prevention system (IPS) is not supported. Therefore, in the IPS report, the attack name from the IPS signatures is displayed as UNKNOWN.
ISSL Proxy is not supported on SRX300 and SRX320 series devices.
Firewall rules are pushed to the device depending on the order in which the firewall policy intents are resolved.
Site and Tenant Workflow
In the Configure Site workflow, use IP addresses instead of hostnames for the NTP server configuration.
CSO uses hostname-based certificates for device activation. The regional microservices VM hostname must be resolvable from CPE.
CSO uses RSA key based authentication when establishing an SSH connection to a managed CPE device. The authentication process requires that the device has a configured root password, and you can use the Administration Portal to specify the root password in the device template.
To specify a root password for the device:
When you try to deploy a LAN segment on an SRX Series spoke device, the CSO GUI allows you to select more than one port for a LAN segment. However, for SRX Series devices, only one port for a LAN segment can be deployed; multiple ports in a LAN segment can be deployed only on NFX Series devices.
Tenant Administrator users cannot delete sites.
On a site with an NFX Series device, if you deploy a LAN segment without the VLAN ID specified, CSO uses an internal VLAN ID meant for internal operations and this VLAN ID is displayed in the UI. There is no impact on the functionality.
CSO does not push the default class-of-service configuration on the hub device. You must configure this configuration manually to ensure that the hub configuration is synchronized with the spoke configuration.
On a cloud hub shared by multiple tenants, by default, CSO does not add a default route and no security policies are configured for the traffic to reach the Internet. You must add the default route and the required security policies for the site traffic to reach the Internet through the cloud hub.
Topology
Changing the DHCP IP address on the OAM interface is not supported.
Hybrid-WAN and SD-WAN deployments using the same MX as a hub is not supported.
When using MX as a SD-WAN hub, NAT configuration must be done on MX Series routers using Stage-2 configuration templates.
DHCP configuration on WAN links on a SD-WAN hub is not supported.
Automatic hub-meshing is not supported. Hub-meshing must be performed manually in order for traffic to flow between the hubs.
The customization of AUX, LAN, and OAM subnets in device profiles (templates) is not supported. Therefore, do not modify the device profiles to change the existing subnets for AUX, LAN, and OAM. Use the default subnets provided in the device profiles.
You cannot manage an MX Series cloud hub by using an Internet link. Use MPLS as the OAM link to manage the MX Series cloud hub.
User Interface
When you use Mozilla Firefox to access the CSO GUIs, a few pages do not work as expected. We recommend that you use Google Chrome version 60 or later to access the CSO GUIs.
General
When you edit a tenant, changing the deployment plan from Hybrid WAN to SD-WAN or vice versa is not supported, although the field is displayed as editable.
For a centralized deployment, use the following procedure to check that the JSM Heat resource is available in Contrail OpenStack on the Contrail Controller node.
Note This procedure must be performed on all the Contrail Controller nodes in your CSO installation.
If the search returns the text OS::JSM::Get Flavor, the file is available in Contrail OpenStack.
jsm_contrail_3.py file to the following directory:For Heat V1 APIs, the /usr/lib/python2.7/dist-packages/contrail_heat/resources directory on the Contrail Controller node.
For Heat V2 APIs, the /usr/lib/python2.7/dist-packages/vnc_api/gen/heat/resources directory on the Contrail Controller node.
Note The jsm_contrail_3.py file is located in the /root/Contrail_Service_Orchestration_3.3/scripts directory on the VM or server on which you installed CSO.
jsm.py in the Heat resource directory to which you copied the file.In vCPE deployments, when a tenant object is created through Administration Portal or the API for a centralized deployment, ContrailOpenStack adds a default security group for the new tenant. This default security group denies inbound traffic and you must manually update the security group in Contrail OpenStack to allow ingress traffic from different networks. Otherwise, Contrail OpenStack might drop traffic.
In vCPE deployments, CSO does not provide a remote procedure call (RPC) to get the device identifier for a specific site. You can use multiple API calls or the license installation tool to obtain the device identifier for a specific site.
From CSO Release 3.3.0 onward, service chaining with the Silver Peak VX VNF is not supported.
After you successfully upgrade from CSO Release 3.2.1 to Contrail Service Orchestration (CSO) Release 3.3.0, ensure that you download the application signatures before installing signatures on the device. This is a one-time operation after the upgrade.
NFX Series devices that are used to form a cluster in a dual CPE scenario must be configured with the same time zone.