Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

How to Upgrade to Junos OS Release 21.2R3

SUMMARY In this topic, you’ll learn how to upgrade Junos OS software to Release 21.2R3 on your Juniper Networks® SRX Series Firewall device. You'll also learn about the upgrade options available for your Juniper Networks® vSRX Virtual Firewall Virtual Firewall.

Best Practices for Upgrading Junos OS

We suggest that you start with the following best practices to optimize your upgrade experience:

  • Read the Release Notes for Junos OS Release 21.2R3.

  • Connect your laptop/computer to the SRX Series firewall through the console port if you are upgrading software using CLI (recommended).

  • Connect your device to the Internet.

  • Back up the current configuration.

  • Ensure that there are no uncommitted changes.

  • Clear files and erase unwanted or unused configurations using the request system storage cleanup command.

  • Ensure that both nodes are online and have the same version of Junos OS if you have a chassis cluster setup.

  • Plan for an extended maintenance window, preferably during non-business hours, to minimize impact.

  • Allocate sufficient time during the maintenance window for the upgrade, troubleshooting, and any post-configuration procedures.
  • Identify business contacts who will help verify application and network functionality after the upgrade.

Perform Preinstallation Steps

Ensure that you complete the following tasks before you perform the upgrade.
  1. Check the current Junos OS software version.
    user@host> show version
  2. Check whether the system has sufficient storage for the upgrade.
    user@host> show system storageFrom the sample output, /dev/vtbd0s1a and /dev/vtbd1s1f indicate that storage is available on the CompactFlash card and the hard disk.
  3. Save the active configuration and license keys. You can create a file containing configuration or license key and save it using one of the following methods.
    • Save it on external server (FTP, HTTP, or SCP) or your laptop (recommended). The following example shows saving active configuration on an external device using SCP.
    • Save it on the local device. The following example shows saving active configuration on the device.
    The system saves the active configuration at the specified file location.
    Similarly save license keys using the user@host> request system license save filename command and copy it to external device or store it locally.
  4. Optionally, create copies of the software running on your device using the system snapshot feature. Having a snapshot of software helps you recover to a known, stable environment in case something goes wrong with the upgrade. See Backing Up an Installation Using Snapshots.
  5. Ensure that there are no uncommitted changes.
  6. Remove the NTP configuration that has more than one source address.
  7. Check if your configuration includes the following Junos default applications and remove them.

    • GPRS tunneling protocol (GTP) applications: Junos-gprs-gtp-c-tcp, junos-gprs-gtp-c-tcp, junos-gprs-gtp-u-tcp

    • SSL-based dynamic-applications: junos:HTTPS, junos:IMAPS, junos:POP3S, junos:SMTPS

Upgrade Directly on Your Standalone Security Device (CLI)

We'll use the following hardware and software combination in this example:

  • Juniper Networks SRX300 Firewall
  • Junos OS Release 20.4R3
  • Available flash memory of 512 MB

To upgrade from Junos OS Release 20.4R3 to Junos OS Release 21.2R3:

  1. Navigate to the Juniper Networks Support page for the SRX300 and select Junos as the OS and 21.2 as the version, as shown in Figure 1.
    Figure 1: Download Junos OS Software Download Junos OS Software
  2. Click tgz (395.91 MB) under Downloads.
  3. Enter your credentials to review and accept the End User License Agreement. You’ll be guided to the software image download page.
  4. You’ll see the following two options on the page. Use one of the options to download the Junos OS image file:
    • To download the image directly on your security device, use the following URL:. You can download the software image directly on your security device. According to the instructions on the screen, copy the URL provided in the box. The URL string is copied to the clipboard. Use file copy command on your security device to download the image.

      Example: To download the image directly on your security device, run the following command on your security device. .

      Your security device downloads the image to the /var/tmp/image-name location. The image name in this example is junos-srxsme-21.2R3.8.tgz.

    • To download the image on your local host (local system such as laptop): You can copy the software image from your local system to the security device using SCP or SFTP options.

      Example : To use SCP to copy software image to your security device, run the following commands on your security device.

    In this procedure, we’ll download the image directly on to the security device.
  5. Verify MD5 checksums on a Junos installation package.
    This step confirms that the Junos installation package downloaded from the Juniper Networks website is not modified in any way.
    1. List the files to display the downloaded image.
      user@host> file list /var/tmp
    2. Display the MD5 checksum value of your image file.
      user@host> file checksum md5 /var/tmp/junos-srxsme-21.2R3.8.tgz
    3. Go back to software download page and click the Checksums option for SRX300. Compare the MD5 checksum value displayed on the screen with MD5 hash output value you obtained from the CLI command output.
      Figure 2: MD5 Checksum Value MD5 Checksum ValueMD5 Checksum Value
    4. Repeat the steps to calculate the SHA1, SHA256, and SHA512 values of the file.
  6. Validate the Junos OS image to ensure that the existing configuration is compatible with the new image before you start the actual upgrade.
    user@host> request system software validate /var/tmp/junos-srxsme-21.2R3.8.tgz
    Note: When you upgrade your SRX Series Firewall to Junos OS Release 21.2 or later from Junos OS versions prior to Release 21.2, the SRX1500 device, SRX4000 line of devices, SRX5000 line of devices with RE3, and vSRX Virtual Firewall instances do not support the request system software validate command for software validation.
  7. Install the image.
    user@host> request system software add /var/tmp/junos-srxsme-21.2R3.8.tgz no-copy
    About Software Validation Options
    Note the following when you upgrade Junos OS from the release 21.2 or earlier to the release 21.2 or later:

    • SRX1500 device, SRX4000 line of devices, SRX5000 line of devices with RE3, and vSRX Virtual Firewall instances do not support software validation due to FreeBSD upgrade.

    • Use the no-validate option in the request system software upgrade or the request system software in-service-upgrade commands.

    • Use the no-compatibility-check option with the request system software in-service-upgrade command instead of no-validate option.

    Check the Knowledge Base article Need to use "no-validate" option for more details.

    Note:

    If you are upgrading an SRX5000-line firewall with RE3, you must use the "request vmhost software add" command.

  8. Reboot your system.
    Reboot the system ? [yes,no] (no)
    Yes
  9. Complete the following checks after you install the new Junos OS version.
  • Check the Junos OS version after the system reboots using the show version command.
  • Ensure your device settings, network settings, and other configuration are in place using the show configuration command.

Upgrade Directly on Your Security Devices in a Chassis Cluster (CLI)

We'll use the following hardware and software combination in this example:

  • Juniper Networks SRX4200 Firewall devices in a chassis cluster setup
  • Junos OS Release 20.4R3
  • Available flash memory of 512 MB

Before you Begin

  • Ensure that you have the same version of Junos OS on each node of the cluster.
  • Ensure that both devices in the cluster are online at the same time.
  • Remove chassis cluster fabric interface enable or disable configuration in case you have configured that option.

Example:

  1. Download and validate the Junos OS Release 21.2R3 image. See Step 1 through Step 6 provided in Upgrade Directly on Your Standalone Security Device (CLI) for details.
  2. Install the Junos OS image on node 0.
    Do not reboot the device after installation completes.
  3. Install the Junos OS image on node 1.
    Do not reboot the device after installation completes.
  4. Reboot both the nodes by using the request system reboot command on both the nodes separately.
    After the reboot, both the nodes will have the same Junos OS image.
  5. Check the Junos OS version after system reboots by using the show version command.

Upgrade Junos OS Using USB Flash Drive or J-Web

USB Flash Drive

You can use a USB flash drive to upgrade Junos OS images or recover an SRX Series Firewall after boot media corruption in cases where you don't have console access to an SRX Series Firewall. For more information, see the KB article at Install Software via CLI (Method 3 - from Junos software copied to USB stick).

J-Web

You can upgrade your SRX Series Firewall in a few steps using J-Web. For more information, see Install Software Packages.

Upgrade Considerations for vSRX Virtual Firewall VM

If you consider upgrading Junos OS on your vSRX Virtual Firewall VM, note the following:

  • We recommend that you deploy a new vSRX Virtual Firewall VM instead of performing a Junos OS upgrade. The new VM enables you to move from vSRX Virtual Firewall to the newer and more enhanced vSRX Virtual Firewall 3.0 version.

  • Moving to the vSRX Virtual Firewall 3.0 software architecture offers many benefits including introduction to new services, delivering customized services, and scaling security services based on dynamic needs. Junos OS Release 18.4R1 and later releases support vSRX Virtual Firewall 3.0.

  • See the KB article Overview of the Available Virtual SRX Models, vSRX and vSRX 3.0 for more details on vSRX Virtual Firewall 3.0 support and Migrate to vSRX3.0 for instructions on migrating to vSRX Virtual Firewall 3.0.

Upgrade Considerations for Your cSRX Container Firewall Container Firewall

Starting in Junos OS Release 20.2R1, the Juniper Networks® cSRX Container Firewall Container Firewall image is available for download from the Juniper Support site, similar to other Junos OS platform images. The cSRX Container Firewall container is packaged in a Docker image and runs in the Docker Engine on the Linux host.

To upgrade cSRX Container Firewall, you must download the cSRX Container Firewall software image from the Juniper Networks website on your Docker environment and launch the new cSRX Container Firewall instance. For more information, see the following linlks:

For docker installation instructions on the different supported Linux host operating systems, see:

For complete information about how to implement Juniper’s cSRX Container Firewall on a server with Ubuntu OS, see Day One: Building Containers with cSRX.

Upgrade Junos OS on SRX Series Firewalls Managed by Junos Space

SUMMARY Use the following simple steps to upgrade your security device managed by Junos Space. Watch the video Junos Space Image Management to understand the procedure.

We'll use the following hardware and software combination in this example:

  • Juniper Networks SRX300 Firewall managed by Security Director
  • Junos OS Release 15.1X49-D170
  1. On the Network Management Platform GUI, select Devices > Device Management. The Device Management page appears.
  2. Check the operating system (OS) version running on the device.
  3. Navigate to the Juniper Networks Support page and download Junos OS Release 21.2R3 and save the file to your computer. See Upgrade Directly on Your Security Device (CLI) for instructions.
  4. Go to Images and Scripts and select Images. Click the Import Image icon to upload the image file to Junos Space Platform.

    After the uploading of the image completes, the Images page displays the uploaded image under File Name.

  5. Validate the image by selecting the Actions > Verify Image on Device option.
  6. Check the validation results by navigating to the Images and Scripts > Images > MD5 Validation Result page.
  7. Select the uploaded Junos OS image and choose the Deploy Image option from Actions menu. Alternatively, you can choose to stage the deployment at a later time by selecting the Stage Image on Device option.
  8. On the Deploy Image on Devices page, select the device that you want to upgrade and specify the Remove the package after successful installation and Delete any existing image before download options.
  9. Click Deploy to start installation. After the upgrade completes, you can check the software version on your device by navigating to the Devices > Device Management page. Here, the OS version now displays Junos OS Release 21.2R3.
  10. Reboot the device after a successful installation.

Upgrade Junos OS on SRX Series Firewalls Managed by Juniper Security Director Cloud

You can use Juniper Security Director Cloud to manage the software images running on SRX Series (both standalone and chassis clusters) and vSRX Virtual Firewall. Juniper Security Director Cloud helps you to manage (add, stage, deploy, and delete) the entire lifecycle of images of all managed network devices.

To perform the Junos OS upgrade on devices managed by security director cloud, go to SRX > Device Management > Software images.

When you need to upgrade or downgrade the image running on a device, you can add software images of devices, stage and deploy the required image on the device by using Juniper Security Director Cloud.

For more information, see About the Images Page of Juniper Security Director Cloud User Guide.

Upgrade Junos OS on SRX Series Firewalls Managed by Juniper Sky™ Enterprise

You can upgrade your Junos OS devices easily with images hosted by Juniper Sky Enterprise. Juniper Sky Enterprise streamlines the Junos OS image upgrade process by using only a browser.

To perform the Junos OS upgrade on devices managed by Juniper Sky Enterprise:

  1. Select a target device from the Juniper Sky Enterprise dashboard and select the Junos OS image version you want to upgrade.

  2. Click the Upgrade option.

  3. Juniper Sky Enterprise checks for available disk space. If there is sufficient space, it enables the New Upgrade option to continue.

Juniper Sky Enterprise delivers the image directly from Juniper Networks, making the process fast and efficient. For more information, see Juniper Sky Enterprise User Guide.

After You Upgrade to Junos OS Release 21.2R3

Perform the following steps after you upgrade to Junos OS Release 19.4R3 or to Junos OS Release 21.2R3.

  • Copy the device configuration files back to the device. We recommend that you retain the configuration unless you are deploying a new vSRX Virtual Firewall VM.

  • Download and install the latest intrusion detection and prevention (IDP) signature package. See Updating the IDP Signature Database Manually.

  • Download and install the latest application signature package. See Downloading and Installing the Junos OS Application Signature Package Manually.

  • Change GPRS tunneling protocol (GTP) settings. GTP distribution without GTP inspection does not work after an upgrade from Junos OS Release 15.1X49 to Junos OS 18.X releases. You can use one of the following workarounds:

    • Disable the GTP distribution feature if possible.

    • Enable GTP inspection on all GTP traffic that passes through the device. You do this by configuring a GTP profile on all security policies that may carry GTP traffic. See Example: Enabling GTP Inspection in Policies.

  • Decide when you’d like to migrate to unified policies. See Start Using Unified Policies Post Upgrade.

Licensing Requirements

Starting in Junos OS Release 21.1R1, we've transitioned to the Flex Software Subscription Licensing Model for SRX Series Firewalls and vSRX Virtual Firewall. Junos OS Releases before Release 21.1 use licenses from a legacy Licensing Management System (LMS).

If you have legacy license keys and if you apply them when you upgrade to Junos OS Release 21.1, Release 21.2R3, or later releases, the license expires after a grace period of 30 days. You must purchase a new license using the Juniper Agile Licensing (JAL) portal. See Flex Software License for SRX Series Devices for details.

If you have any questions, contact your Juniper Networks sales representative at https://www.juniper.net/in/en/contact-us/ and they will assist you in choosing the best licensing model for your application.

What's Next

Now that you've installed the new Junos OS on your device, if you want to migrate to the unified policy configuration, see Start Using Unified Policies Post Upgrade. Otherwise, learn about new features and enhancements that you can start using with your Junos OS. See Explore New Features Post Upgrade to Junos OS Release 19.4R3.