Sat, 12 Mar 2016 3:07 PM
Sat, 23 Aug 2014 1:27 PM
Running JunOS 12.1X47 on first gen SRX240H
Michael Dale
So 12.1X47 just came out and no longer supports SRX devices with less than 2GB of ram.
I have a couple of spare Juniper SRX240Hs (so first gen devices with 1GB of ram) and would like to test 12.1X47 in my lab, unfortunately I don't have any 2GB ram devices in my lab.
When trying to install 12.1X47 on the SRX240H you get the following error:
Copying package ...
ERROR: Unsupported platform srx240h for 12.1X47 and higher
ERROR: validate-config: junos/+REQUIRE fails
So I decided to see if I could work around this and trick JunOS into installing on my 240H, I was successful :D
I wouldn't recommend ever using this in production, but I am sure it will work fine for the lab. The only difference between the 240H and the 240H2 is that the H2 has 2GB flash and 2GB ram, CPU is the same.
Now you can actually upgrade the ram in the SRX240H to 2GB, it just uses standard DDR2 PC ram (you just need to find a 2GB stick, I used 800MHz but 667MHz ram should work too).
First Upgrading SRX ram
Take off the SRX case and swap out the ram, easy!
Old Ram:
New Ram:
As you can see the SRX now boots with 2GB of ram:
Second modifying the installer checks
Unfortunately this isn't enough for 12.1X47 to install, the installer checks the model number not the amount of ram.
Copying package ...
ERROR: Unsupported platform srx240h for 12.1X47 and higher
ERROR: validate-config: junos/+REQUIRE fails
WARNING: Current configuration not compatible with /altroot/cf/packages/install-tmp/junos-12.1X47-D10.4-domestic
So it is time to modify junos-srxsme-12.1X47-D10.4-domestic.tgz to work on 240H devices.
I did this on Mac OS but any *nix system will work, it isn't that hard.
- Go and download junos-srxsme-12.1X47-D10.4-domestic.tgz from Juniper.
- Extract junos-srxsme-12.1X47-D10.4-domestic.tgz
- Now all we need to do is edit 2 files.
- In the +INSTALL file: Comment out line: 889 -> Error "Unsupported platform $product_model for 12.1X47 and higher"
- In the +REQUIRE file: Comment out line: 889 -> Error "Unsupported platform $product_model for 12.1X47 and higher"
To comment out just add a # at the start of the line.
- Now we need to tar this back into a tgz file.
- So from the command line cd into the unzipped folder
- Now tar gz everything: tar czf ../junos-srxsme-12.1X47-D10.4-domestic-fixed.tgz *
- Once done I changed junos-srxsme-12.1X47-D10.4-domestic-fixed.tgz back to junos-srxsme-12.1X47-D10.4-domestic.tgz, not sure if that matters.
- Now you can install like any normal firmware upgrade: root> request system software add http://xxx/junos/junos-srxsme-12.1X47-D10.4-domestic.tgz reboot
Done!
Now this process still leaves the SRX 240H with only 1GB of flash, but even with a dual root partition there is still 100M+ free space on the primary mount point.
That should be fine for now, you might need to use external logging or a usb flash drive in future though.
I am interested to know if this process works on 1GB ram devices, as these changes might allow JunOS X47 it install on them. Although I would recommend 2GB ram.
Sat, 23 Aug 2014 12:37 AM
JunOS 12.1X47, first gen SRX devices are no longer supported
Michael Dale
ERROR: Unsupported platform srx210h for 12.1X47 and higher
This is the error that you will get if you try and install 12.1X47 on a Juniper SRX 210H (or 100B, 100H or any "first gen" srx).
From reading:
http://www.juniper.net/techpubs/en_US/junos12.1x47/information-products/topic-collections/release-notes/12.1x47/index.html?topic-87511.html
"Note: Upgrading to Junos OS Release 12.1X47-D10 or later is not supported on the J Series devices or on the low-memory versions of the SRX100 and SRX200 lines."
I thought maybe it would just be the base memory devices e.g SRX100B or SRX210B but it looks like any SRX device with 512MB or 1GB ram are not supported.
This is a shame as for example the SRX110H devices weren't that old and supported removable/upgradable CF cards. Even the SRX240B2 is not supported! You need 2GB of ram.
The ASA5505 is good example of a device designed to last. Pity I like JunOS so much!
I have a couple of SRX240Hs, these allow you to upgrade the ram (standard DDR2), so I wonder if an upgraded 240H will work.
Mon, 07 Apr 2014 9:45 PM
Networking Lab
Michael Dale
My current networking lab setup for testing a new network design including OSPF, BGP & IPsec route based VPNs.
From top to bottom:
- The imposter, a Ubiquiti EdgeRouter Lite!
- Juniper SSG 5 (extended license
) - Juniper SRX 100 (base memory
) - Juniper SSG 20 (not currently being used)
- Juniper SRX 110H (older 1GB ram model)
- Juniper SRX 210H-POE (pretty old slow beast with 1GB ram and a lowly 400MHz CPU). I still run a standard 210H at home, one day I'll get the 210H2....
Fri, 19 Nov 2010 12:54 PM
Sun, 08 Aug 2010 10:53 AM
Cisco Fail
Michael Dale
I don't normally sell Cisco products, but one of my clients already has a full Cisco network, so for them we purchased an ASA5505 for a remote office.
Cisco have made a number of upgrades to the software of the ASA range and have really stuffed up a few sections.
- It took me about a month to get a new ASA5505 (the new 512mb version as the OS now needs more memory)! For some reason Cisco cannot manage their stock, they suck. Also the ASA5505 should have had 512mb to start with.
- Finally when the ASA5505 comes, it doesn't work! It doesn't even switch on. I don't think I've ever had a DOA Juniper product. I understand these things happen but it doesn't leave a good impression.
- The power connector is really bad, it is some stupidly small plastic thing that will no doubt break in the future.
Overall the ASA5505 is a good product, but they've done some stupid things with the range. I wouldn't recommend one over a Juniper SSG.
I don't know why companies always create shitty products, the Juniper SRX range is another fine example. The code base on the Juniper SRX is still buggy. Junos 10.2 should finally fix most of my issues with the OS, but really.
Fri, 29 Jan 2010 6:18 PM
Juniper SRX210 Review
Michael Dale
Well I've finally had some time to finish off my review of the SRX210! It's only taken like 4 months. There is still some things missing from this review that I will post about at some stage.
- SSG20 has two mini-pim slots (for ADSL modules etc)
- SSG20 loses two of the ethernet ports the SSG5 has
- SSG20 is physically larger
- SRX210 has 100mbit more routing throughput (750mbit)
- 2 gigabit ethernet ports
- Express card slot for 3G modems
- 1 mini-pim slot
- plus some other software things (increased session limit, max policies etc)
- The SRX100 models all have 1GB of ram installed, yet the base version has a software licensing limitation of 512mb.
- You cannot upgrade a base SRX210 to 1GB as the base version only has 512mb of fixed memory.
- 3G WWLAN (SRX210 only)
- Significant routing performance increase
- JunOS
- Gigabit ethernet on smaller devices (from SRX210 upwards)
- PoE options (SRX210)
- Jflow/Netflow support
- Usable web interface (more on this later)
- Integrated ADSL and wireless options
- Auto Connect VPN (probably will be fixed in a software update)
- Other minor feature differences
- It's slow, much much slower to load that ScreenOS
- It seems to expire my session and log me out while in the process of doing stuff
- It doesn't feel like it was designed for people to actually use. It is basically a graphical representation of the configuration file. I've noticed that I expect different things from a web interface verses a command line interface.
Sun, 17 Jan 2010 11:10 AM
Native IPv6 over PPPoE with Internode and a Juniper SSG5
Michael Dale
Internode released a trial of native IPv6 over ADSL a few months back, so anyone with an ADSL account with them can try it.
So one of my clients has an SSG5 and an internode connection so I thought I'd set it up.
So the setup:
- ADSL modem in bridge mode
- SSG5 running ScreenOS 6.3.0r2 (I had some issues with 6.2, so it is best to use the latest OS)
The very first step is to enable IPv6 on the SSG5, this requires you to run the following command and then restart/reboot the device:
Once done you should now have access to all the IPv6 functions in the WebUI.
The next step is to modify your PPPoE connection settings.
set pppoe name "Internode" username "username@ipv6.internode.on.net" password "encryptedpassword"
set pppoe name "Internode" ppp ipv6cp ipcp
Now you need to enable IPv6 on the interface that the PPPoE connection is setup on.
set interface "ethernet0/0" ipv6 mode "host"
set interface "ethernet0/0" ipv6 enable
set interface ethernet0/0 ipv6 ra accept
unset interface ethernet0/0 ipv6 nd nud
So the above should be enough for you to get the /64 on the PPPoE interface.
Internode is currently handing out a /60 for use in your network (via DHCPv6), so lets now set that up.
set interface ethernet0/0 dhcp6 client
set interface ethernet0/0 dhcp6 client options rapid-commit
set interface ethernet0/0 dhcp6 client options request pd
set interface ethernet0/0 dhcp6 client pd ra-interface bgroup0
set interface ethernet0/0 dhcp6 client enable
In the above "bgroup0" is my LAN interface.
Now let's get IPv6 running on "bgroup0"
set interface "bgroup0" ipv6 mode "router"
set interface "bgroup0" ipv6 ip 2001:44b8:7763:baa0::1/64
set interface "bgroup0" ipv6 enable
set interface bgroup0 ipv6 ra link-address
set interface bgroup0 ipv6 ra transmit
unset interface bgroup0 ipv6 nd nud
In the above the IPv6 address there is my first /64 out of the /60, I've manually set it to a :1 address but you can use whatever it's default auto assigned address is.
Now you might want to hand out internodes IPv6 DNS server addresses to your LAN
set interface bgroup0 dhcp6 server
set interface bgroup0 dhcp6 server options dns dns1 2001:44b8:1::6
set interface bgroup0 dhcp6 server options dns dns2 2001:44b8:2::6
set interface bgroup0 dhcp6 server enable
Now we need to setup the default IPv6 route, as the one that is added by default is incorrect.
set route ::/0 interface ethernet0/0 gateway ::
And finally the IPv6 policy to allow traffic out (yay no NAT).
set policy id 12 from "Trust" to "Untrust" "Any-IPv6" "Any-IPv6" "ANY" permit log
That should be all you need to do to get IPv6 working on your network.
There is more information over at the internode site if needed.
And here is a traceroute from a computer on the LAN
C:\Users\Administrator>tracert -6 ipv6.google.com
Tracing route to ipv6.l.google.com [2001:4860:c004::68]
over a maximum of 30 hops:
1 1 ms <1 ms <1 ms 2001:44b8:7763:baa0::1
2 37 ms 37 ms 37 ms loop0.lns6.syd7.internode.on.net [2001:44b8:b070::4]
3 37 ms 37 ms 37 ms gi1-1.cor2.syd7.internode.on.net [2001:44b8:b070:5::1]
4 37 ms * 37 ms gi6-0-0-146.bdr1.syd6.internode.on.net [2001:44b8:b060:146::1]
5 37 ms 37 ms 37 ms 2001:4860:1:1:0:1283:0:2
6 38 ms 38 ms 39 ms 2001:4860::1:0:9f8
7 184 ms 295 ms 174 ms 2001:4860::1:0:165
8 175 ms 175 ms 175 ms 2001:4860::1:0:890
9 181 ms 176 ms 182 ms 2001:4860::29
10 185 ms 176 ms 244 ms tx-in-x68.1e100.net [2001:4860:c004::68]
Trace complete.
Thu, 13 Aug 2009 6:52 PM
Jflow on SRX210
Michael Dale
We'll I've got my Juniper SRX210 up and running and it supports some stuff the old SSG didn't (it is also missing a few features too).
One of the new features is the support for JFlow (which is the Juniper version of Cisco's NetFlow).
Basically it means that the firewall can log traffic to a server in a format that allows for graphs such as this:
Pretty cool. Anyway the documentation for the SRX isn't that great, so here is my configuration for this (running SRX JunOS 9.6):
fe-0/0/7 {
unit 0 {
family inet {
filter {
input cflow;
output all;
}
address 203.206.210.249/29;
}
}
}
firewall {
filter all {
term all {
then {
sample;
accept;
}
}
}
filter cflow {
term 1 {
then {
sample;
accept;
}
}
}
}
forwarding-options {
sampling {
input {
rate 1;
run-length 0;
max-packets-per-second 50000;
}
family inet {
output {
flow-server 203.206.210.250 {
port 2055;
version 5;
}
}
}
}
}
Wed, 22 Jul 2009 9:40 PM
New Router/Firewall Time! Juniper SRX 210
Michael Dale
We'll I've had my SSG 5 for about 2.5 years now and it has worked great, and will probably keep working for many years to come. But Juniper have released a new/replacement model (kind of, they're still selling the SSGs) that runs JunOS.
So I thought it was about time to learn the operating system as ScreenOS (OS on the SSG) will eventually be discontinued.
The SRX 210 is really more of a replacement to the SSG 20, but it looks there isn't a SSG 5 replacement (yet at least, I did see some mentions of an SRX 100).
Anyway hopefully I should get it next week and then I'll do a review of it.
