Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

System Backup and Recovery

Learn how to recover your firewall from failed upgrades, software corruption, and configuration issues using vmhost snapshots, Junos OS recovery options, and system reinitialization methods.

Overview

The SRX4120 and SRX4300 Firewalls provide several options to back up, recover, and reinitialize the system. Based on operational requirements, you can create a vmhost snapshot, recover the system by booting from a USB storage device or a PXE boot server, erase system configuration and user data, or perform a complete software reinstallation using a USB storage device or a PXE boot server.

Before you upgrade Junos OS, perform system maintenance, or make significant configuration changes and create a vmhost snapshot. The snapshot saves the current Junos OS software image and configuration on the backup disk. Use the vmhost snapshot to restore the device to a known operational state if a software or configuration issue occurs.

The SRX1600, SRX4120, and SRX4300 Firewalls use solid-state drives (SSDs) as the only nonvolatile storage (NVS) media. Customer data, including configuration files, log files, core files, and snapshots are stored on the SSDs.

As a best practice, perform regular backups and create vmhost snapshots before major maintenance activities and software upgrades.

Note: The SRX1600 firewall doesn't support the following commands:

  • request system snapshot

  • request vmhost snapshot

Benefits

  • Recover from system failures caused by failed upgrades, configuration errors, or software corruption.

  • Minimize downtime and expedite system recovery.

Backup, Recovery, and Reinitialization Methods

Select the method based on whether you need to recover the system, erase user data, remove Junos partitions, or reinstall the Junos OS.

Recovery Snapshots

Use the request vmhost snapshot command to create a recovery snapshot on the backup disk. The snapshot copies the active host OS and Junos OS image to the backup disk and provides a recovery point if the primary disk becomes unavailable. For more information, see request vmhost snapshot.

If the primary disk fails, boot the device from the backup disk and use the request vmhost snapshot recovery command to restore the primary disk. The recovery process replaces the contents of the primary disk with the snapshot stored on the backup disk.

When the primary disk fails, verify the snapshot status by using the show vmhost snapshot command and reboot the device from the secondary disk by using the request vmhost reboot disk2 command. After the device boots from disk2, recover the primary disk. For more information, see request vmhost reboot.

Table 1: Comparison of Recovery and Reinitialization Methods
Method Erase Data Erase/Recreate Partition Erase & Reinstall OS
request vmhost zeroize Yes No No
request vmhost zeroize erase-disk Yes Yes No
USB/PXE Recovery Installation Yes Yes Yes

Erase Data for Safe RMA

Use the request vmhost zeroize command to remove all configuration information, customized log files, and user-created data (including plaintext passwords, secrets, and private keys) from the Routing Engine and return the system to factory-defaults. This command removes user data without modifying the partitions of the disk or reinstalling the existing host OS. For more information, see request vmhost zeroize.

Use the request vmhost zeroize erase-disk command when an extensive cleanup is required. This command removes user data and configuration, erases existing partitions, and repartitions the disk, without reinstalling the OS.

USB and PXE Recovery Installation

Use USB-based or PXE-based installation methods when a complete software installation is required, such as recovering a device, reimaging a device, or preparing a replacement device during an RMA process. These methods erase all existing data, repartition the storage media, and perform a complete installation of the Junos OS.

For more information, see Boot Junos OS Using a Bootable USB Device on SRX Firewalls and Install or Recover Junos OS on SRX Series Firewalls by Using a PXE Boot Server.

Safe RMA

A Safe Return Material Authorization (RMA) process helps protect customer data when a defective firewall or hardware component is returned to Juniper Networks for repair or replacement. Before returning a firewall as part of the Safe RMA process, you must remove or secure customer data stored on nonvolatile media in compliance with organizational security requirements. The SRX1600, SRX4120, and SRX4300 Firewalls store configuration files, log files, core files, snapshots, and other operational data on internal storage media.

For information about chassis replacement and return procedures, see:

Benefits of Safe RMA

Safe RMA provides the following benefits:

  • Helps protect sensitive customer data stored on the device.

  • Reduces the risk of unauthorized access to configuration files, log files, core files, snapshots, and other operational data.

  • Supports compliance with organizational security and data-handling requirements.

  • Enables hardware replacement or repair while maintaining data security controls.

  • Provides a secure approach for returning devices used in high-security or regulated environments.