What's Changed

MNHA Upgrade Requirement for IPv6-Based ICL Encryption (SRX4200, SRX4300, SRX4600, and SRX4700)—In Multinode High Availability (MNHA) deployments that use IPv6 addresses for Interchassis Link (ICL) (HA link) encryption, upgrading from an earlier Junos OS release to a release that supports IPv6-based ICL encryption requires following the isolated node upgrade procedure to ensure a successful transition. This is a one-time requirement when moving to the first supported release; subsequent upgrades do not require the isolated node upgrade procedure.

[See [SRX] Isolated Node Upgrade Procedure for Multinode High Availability and Software Upgrade in Multinode High Availability.

Sophos antivirus configuration for ISSU (SRX Series)—To use the Sophos antivirus while performing an in-service software upgrade (ISSU), remove the following configuration options.

• edit security utm default-configuration anti-virus forwarding-mode holdset

• edit security utm default-configuration anti-virus forwarding-mode inline-tap

This caution applies only to ISSU upgrades and not to standalone upgrades. Once you complete the ISSU, you can re-enable the above configurations. The Sophos antivirus feature perform as usual when both devices come up.

[See Sophos Antivirus Configuration Overview.]

Support for iPadOS for prelogon compliance checks in Juniper Secure Connect (SRX Series, and vSRX3.0)—You can configure prelogon compliance checks on your firewall to allow or reject endpoints running iPadOS. Use the ipados option at the [edit security remote-access compliance pre-logon <varname>name</varname> term <varname>name</varname> match platform] hierarchy level to enforce these checks. This ensures that only compliant iPadOS devices are permitted access, enhancing the security of your network.

[See prelogon compliance (Juniper Secure Connect).]

Support for NAT debugging (SRX Series Firewalls and vSRX)—To debug NAT-related issues, use the nat option with the request support information security-components command.

[See request support information.]

Alarm added to indicate failure in writing the security logs to traffic logs (SRX4700)—We've introduced alarms indicating a failure in writing the security logs to traffic logs due to disk corruption or a read/write error. The alarms are displayed in the output of the show command show system alarms .

[See show system alarms.]

The CLI command output fields access start time and last updated timestamp has time value in device local time zone.

[See show services user-identification authentication-table.]

The CLI command output fields username and roles are case insensitive in local authentication table.

[See show security user-identification local-authentication-table.]

Certificate enrollment system logs (Junos)—We've added system logs to notify if there is an SCEP and CMPv2 certificate failure. On SCEP certificate enrollment failure, you can see the PKID_SCEP_EE_CERT_ENROLL_FAIL message. On CMPv2 certificate enrollment failure, you can see the PKID_CMPV2_EE_CERT_ENROLL_FAIL message.

[See System Log Explorer.]

The xmlns:junos attribute includes the complete software version string (ACX Series, EX Series, MX Series, PTX Series, QFX Series, SRX Series, vMX and vSRX)—The xmlns:junos namespace string in XML RPC replies includes the complete software version release number, which is identical to the version emitted by the show version command. In earlier releases, the xmlns:junos string includes only partial software version information.

Access privileges for request support information command (ACX Series, EX Series, MX Series, PTX Series, QFX Series, SRX Series Firewalls, and vSRX Virtual Firewall)—The request support information command is designed to generate system information for troubleshooting and debugging purposes. Users with the specific access privileges maintenance , view, and view-configuration can execute request support information command.

Changes to the show system storage command output (ACX Series, EX Series, MX Series, PTX Series, QFX Series, and SRX Series)—We've updated the show system storage command output to include only true (physical) storage and exclude any host/hypervisor level storage. In earlier releases, the output also includes a container/jail storage, which does not have a separate storage of its own.

[See show system storage.]

Default installation of junos-ike package on additional platforms (SRX1500, SRX4100, SRX4200, SRX4600, and vSRx3.0)—The junos-ike package is installed by default on SRX1500, SRX4100, SRX4200, SRX4600, and vSRX3.0 firewalls, ensuring the default support for <codeph>iked</codeph> process for IPsec VPN service. This aligns with the existing default installation of the package on SRX5000 line with Routing Engine 3 (SRX5K-SPC3 with RE3). You can delete the junos-ike package using the command request system software delete junos-ike. This runs the kmd process on these firewalls, allowing flexible management of your security infrastructure.

[See IPsec VPN Feature Support with New Package.]