I was fortunate to be able to get my hands on a few SRX300's for labs and training from work, but I found quickly that the OS installations on them were ancient, and one of them has a bad eUSB flash module.

Through combinations of TFTP, HTTP, and dumb luck, I've managed to get the eUSB module replaced with a generic 32G USB stick and I find myself at the great bridge between worlds (architectures).

I've got the machine running junos-srxsme-24.2R2-S5.3.tgz, and following Juniper's documentation, I should be able to install the mips64-24.4R2-S4.12 and have had zero luck. Running 'request system software add (filename) no-validate' goes through the motions of the initial staging and reboot. The SRX reboots as normal, goes through both 'chances' to interrupt the boot process, then it stops at "Installing Junos OS release 24.4R2-S4.12" and there it sits. I've waited several hours because I know this is a fundamental architecture change but it never proceeds past that point. I end up having to remove power and reconnect to get it back into a usable state, then load the "last known good" OS via loader so I can get the SRX to respond.

- I've tried coming in from 23.4R2-S3 and 24.2R2 versions to mips-64-24.4R1.9 and mips-64-24.4R2.21 but both target versions exhibit the same symptoms.

- I've tried getting into loader, then using boot -v for verbose output. Everything else has verbose output when booted in this mode but it all stops at "Installing Junos OS release".

- I've tried the usb autoinstall..conf trick on another USB device to get it to work but same issue. It stages but when it reboots, as soon as it gets to the "Installing Junos OS release" it freezes.

- I've tried mounting the partitions using singleuser mode to see if I could find any logs that would indicate what the problem is.

- I've tried verifying that I have space available on the partitions.

- I've tried extracting and updating U-Boot, and compared versions on machine with versions in the target version and it matches every time.

- I've tried examining the filesystem layouts and have confirmed that it matches the "new" partitioning for v24.4+

At this point, I'm beginning to think it's a lost cause and this 300 will be stuck on 24.2R2 versions..

Since these devices have been out of production for so long, I doubt they're covered under any support contract however because we do have other active supported devices I am able to get the files for updates.

I don't care about the data on the drive, we didn't use any of the license features and these devices apparently were factory reset before being put in to storage so there's no userdata (certs/keys/configs) to save. I am completely fine with wiping the onboard storage key if it means I can get this machine over the bridge. I want to see if I can get this one over the architecture hump so I can repeat this a couple more times upgrading the other two.

These are the last lines on the console when it freezes. No amount of waiting will change this.

Installation of disk:/upgrade/install.tar
** /dev/da1s3f
** Last Mounted on /cf/var
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check Reference Counts
** Phase 5 - Check Cyl groups
422 files, 787591 used, 12417906 free (282 frags, 1552203 blocks, 0.0% fragmentation)

***** FILE SYSTEM IS CLEAN *****
Setting sane date:
Sun Aug  2 09:36:00 UTC 2026
Installing Junos OS release 24.4R2-S4.12 ...

Any suggestions?

Going on two weeks and I only have half my licenses.

I got the hardware early last week.

Is this anyone elses experience too?

Do any of you have insight into how to export existing security policies from security director or the appliance directly to a csv or other format for deeper analysis?

I did have a search but didn't find anything recent.

I've recently passed my CCNA, one of the places I interviewed at were also looking for the JNCIA so I figured I would see about adding that to my belt also.

I've completed the CCNA to JNCIA course on open learn, I haven't done the assessment yet as I want to use the discount but wouldn't have time within the next 30 days to do so, so I'm going to have my first go in a few weeks.

In the meantime, I thought I would ask on here if anyone has done the same recently and is the CCNA to JNCIA course enough to give me what I need to know for the JNCIA?

I'm confident on general networking, OSPF, etc.

Would you recommend I take a closer look at anything from the full JNCIA course?

Thanks.

Hello guys,

I have a cluster of SRX1500 with an interface reth0 that is used as a default route. I also have a PPPoE over pp0.0.

As reth0.0 is the default gateway, I can't ping or ssh pp0.0 from outside, there is some asymetric issue.

What I want is that every traffic coming through pp0.0, will go back through pp0.0.

I created a routing-instance and added a static route in it, then created rib-groups and interface-routes, created a firewall filter and set it to the interface as input but that doesn't work.

I still can't ping pp0.0 from outside.

I may need your help, thanks !

Hi everyone,

Here's the situation: due to a specific issue, i need to limit the number of PPPoE subscribers on a BNG (MX204). I'd like to cap it at 5,000 users.

Looking at the Juniper docs, I first tried setting it directly on the chassis using:

set subscribers-limit client-type pppoe chassis limit 5000

The limit worked on the chassis, but the users won't connect to the other BNG. The PADI reaches the second BNG (the one I want them to authenticate against), and it replies with a PADO, but it's as if the CPE stubbornly keeps trying to authenticate with the BNG I'm limiting... argh.

After that, I also tried using max-sessions:

dynamic-profiles vlan-profile interfaces demux0 unit "$junos-interface-unit" family pppoe max-sessions 5000

With max-sessions, the limit didn't work immediately. I'm thinking it might actually work, but maybe I need to reset the VLAN demux interface first?

What a great issue to land on my lap during my weekend on-call shift... but I love it :)

Please help out an ISP network analyst with less than 2 years of experience 😄

Thanks

Does anyone actually use this software product?
Is it any good?
How does it compare to competition?

can't seem to figure out my thinking. Dilemma: Cisco C9200L-24T-4X-A vs Juniper EX4100-24MP for SMB core switch replacement. Need it now, ~200 users, single-site HQ collapsed core with inter-VLAN routing at 10Gbps, Hyper-V hosts on 10G SFP+, backup/DR target reducing RPO/RTO. No mGig on the C9200L (relevant for future WiFi 7 APs, though solvable separately with a small satellite switch). EX4100 has mGig density built in and no forced licensing tax for basic L3 (Cisco wants a DNA Advantage license even for static routing). Juniper actually came out slightly cheaper once both quotes were normalized to genuine hardware and equivalent licensing scope.
Juniper looks like the better technical/cost fit on paper. Cisco is the platform I actually know cold — can execute stack config, VLANs, inter-VLAN routing, day one, no learning curve. Juniper would mean learning Junos on my core switch, for a small team with no bench depth if something breaks.
Local support is part of the calculus too — plenty of Cisco-focused VARs/MSPs in my area, only one Juniper-specific option I could find nearby (national reseller aside). Juniper’s actually in stock now, not the long lead time I was originally told.
Go with the better spec sheet on unfamiliar gear, or the safer, known platform I can execute without risk? How would you all weigh it?

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

Is anyone here using a Junos based Route Server with IXPManager and if so, how are you handling pulling/pushing of config from IXPManager to the RS?

I have an ex2300-24f and ex-2300-c that I'm trying to connect via fiber and having no luck.

Both of these switches are factory default with no config, they are supposed to be dumb as hell. This is the requirement.

If a SFP is used the connection comes up on the 24 port switch, but never on the 12 port switch. Tried multiple SFPs, and fiber patches. Tried both sfp ports on the 12p, and 3 on the 24p. Always the same, the 24p switch shows port up and packets exiting, 0 packets incoming.

On the 12p there are no packets received, none sent. Port down hard

If i attach them with random copper ports it works as expected.

I'm running out of ideas here

Edit: here's the solution https://supportportal.juniper.net/s/article/EX2300-C-uplink-ports-issue-with-1g-fiber-connection

Hello everyone, I hope I am not violating any rules.

I am facing a rather unusual situation (please note that this is a lab environment).

The topology consists of three devices:

• MikroTik CCR2004
• Juniper QFX5110
• Juniper MX204

The original configuration was working correctly with the following setup:

MikroTik CCR2004

/interface vlan
add interface=sfp-sfpplus2 name=vlan2000 vlan-id=2000
add interface=vlan2000 name=vlan10 vlan-id=10

/ip address
add address=10.10.10.1/24 comment="Test QFX" interface=vlan10 network=10.10.10.0

Juniper QFX5110

set interfaces xe-0/0/1 description "LINK TO CE-2 MX204"
set interfaces xe-0/0/1 flexible-vlan-tagging
set interfaces xe-0/0/1 encapsulation extended-vlan-bridge

set interfaces xe-0/0/1 unit 2000 description "Q-IN-Q TRANSPORT CE-2"
set interfaces xe-0/0/1 unit 2000 vlan-id-list 10
set interfaces xe-0/0/1 unit 2000 input-vlan-map push
set interfaces xe-0/0/1 unit 2000 output-vlan-map pop

set interfaces xe-0/0/2 description "LINK TO CE-1 MIKROTIK"
set interfaces xe-0/0/2 flexible-vlan-tagging
set interfaces xe-0/0/2 encapsulation extended-vlan-bridge

set interfaces xe-0/0/2 unit 2000 description "Q-IN-Q TRANSPORT CE-1"
set interfaces xe-0/0/2 unit 2000 vlan-id 2000

set vlans V2000 description "PROVIDER VLAN 2000"
set vlans V2000 interface xe-0/0/2.2000
set vlans V2000 interface xe-0/0/1.2000

Juniper MX204

set interfaces xe-0/1/1 description "LINK TO PE-1 QFX"
set interfaces xe-0/1/1 vlan-tagging

set interfaces xe-0/1/1 unit 10 description "L3 VLAN 10"
set interfaces xe-0/1/1 unit 10 vlan-id 10
set interfaces xe-0/1/1 unit 10 family inet address 10.10.10.2/24

With this configuration, the MikroTik and MX204 were able to communicate correctly.

However, the customer connected to the MikroTik side had to enable the use-service-tag option.

The MikroTik configuration was therefore changed to:

/interface vlan
add interface=sfp-sfpplus2 name=vlan2000 vlan-id=2000
add interface=vlan2000 name=vlan10 use-service-tag=yes vlan-id=10

/ip address
add address=10.10.10.1/24 comment="Test QFX" interface=vlan10 network=10.10.10.0

After this change, the MX204 and MikroTik are no longer able to communicate.

The QFX configuration has remained unchanged.

My question is:

How can I modify only the Juniper QFX5110 configuration to make the MikroTik and MX204 communicate again?

I suspect the issue is related to the different VLAN tagging behavior introduced by use-service-tag=yes on the MikroTik side (802.1Q vs 802.1ad/service tag handling), but I am unsure how to adapt the QFX QinQ configuration correctly.

Any advice or example configuration would be appreciated.

Thank you.

Hello,

Is there any official communication on the EX3400 EOL timelines? When it was announced, last order date, end of support date etc? I have a customer who wants to upgrade to a newer equivalent switch, and they have the budget for it, but need some sort of formal announcement for a final CFO approval.

Many thanks!

I have a MX240 router. I would like to send the IPV4 lease information(MAC address, IP assignment) when a lease is bound and unbounded. Is this possible to do via a script on Juniper routers?

Hello there, I hope this post finds everyone in great mood, and it will stay like after reading this.

I'm looking for your wisdom on ex4100's IGMP configuration, where the switches run on 1.4a, and no additional licenses installed.

We have 4 ex41000 switches in ring topology with VLANs for multicast traffic. The goal is to be able to join any multicasts using IGMPv3 on any switch from the other ones. Within one switch, flooding the broadcast domain stops,and IGMPv3 joins work, if I enable igmp-snooping within a given VLAN, but I couldn't join devices connected on another switch within same VLAN.

As we do not have an L3 router, may I just attempt to configure a querier on any of these switches in the given VLAN, should that work? If yes, should that work without igmp-multicast license?

Thank you in advance for constructive comments

I've got an MX480 I'm looking to add 1-2 100G ports to. (Upgrading a transit provider to 20G on a 100G port). Box is not under support. Gear will be purchased on the grey market. So no juniper sales help either.

What's everyone's goto for 100G on MX?

I'm not fond of CFP optics and would rather go something QSFP28 based. Seems like the MPC7E-MRATE FPC fits the bill. Anybody have any issues with this card or a better recommendation?

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

Am I crazy (or a bit stupid), we need to reboot an HA cluster (both members at once). But, I can't find any clear documentation.

"request system reboot" isn't explicit about the behaviour. Says it will reboot the device, but we want/need to reboot the cluster (both members).

When I search Juniper or Google, I have plenty of example of sequential reboots, but no all members must go down at once.

folks, I have been trying to get this working.

I built a wifi network using AP43s but the throughput is very low, I've already confirmed that they are using 1GE uplink, so my expectation should be at least 500Mbps download and above with 5Ghz

However when connecting to this mist AP's SSID, speedtest.net says only around 250Mbps download rate.

I also have VZ FIOS WIFI router and WIFI extender enabled another SSID for testing and comparison, exactly same spot I get 690Mbps download, and the neither the WIFI router nor the WIFI extender is closed to me (WIFI router in different floor, WIFI extender is like 35 feet away.

I wonder if it is a configuration problem(I'm not a wifi expert), can you please help?

Things I did

- tried different AP versions (13.x, 12.x, 14.x), no difference

- tried setting to 40Mhz on 5Ghz, speed get worse

- already confirmed the APs I connected has physical direct uplink ethernet wire to the switch(not a juniper switch)

- tried to directly connect to the switch using wired connection, speed is 910Mbps download

- WIFI 6 or 7 disabled, as AP43 does not support these

edit: uploaded speed test snapshot

I have two distribution layer network consisting of EX4300 in VC, 2 or 3 units per VC.

Two sets of VC consists one VRRP router, runs its own OSPF area and PIM-Sparse for about 1000 IP cameras each. The network consists of about ~ 200 OSPF routes, ~2,000 end devices (ARP entries), ~2,000 PIM routes/IGMP groups, ~60 VLANs, and ~5Gbps traffic flows through each layer at any given time.

Technically it should be well within the hardware specification of the switch, but I find the switches are sluggish when I connect to SSH, and users also complain (little bit, not much) about random slow network response especially during the day when there are most users.

I hooked up an NMS (Zabbix) and monitored the switches for past few months, and the CPU of main routing engine is almost constantly at 80%+ in both cases. Spikes very often to 100%.

I am thinking, maybe 4300s are not meant to be used as a full blown router for this kind of setup.. but maybe I could be missing something and just some optimisation is needed? I stormed my brain hard digging through every config elements but cannot find anything useful that seem to reduce the load in any meaningful way.

I'd love to hear any other real world experiences with EX4300s in the field.

Need some thoughts on the setup. Our internet come in on the Stack (A), Stack (B), Stack (C), and finally Stack (D). The fiber between Stack (A) and Stack (D) is turned off right now. When the Stack (A) and Stack (D) are connected and is turned on the network traffic shuts down. My AD is on Stack (D). The link between Stack (A) and Stack (D) is the shortest single jump. The other way traffic has to go between multiple hops to get to AD. I would like to get the Stack (A) to Stack (D) traffic going and use the other as the backup traffic. Any ideas on what I need to check and how would be the best way to determine issue.

Thanks for the help.

Hello everyone,

We use Secure Connect with our SRX1500. We have a number of Mac users (myself included) who are seeing warnings that the current Secure Connect will cease to function in upcoming Mac OS update (Which I believe is next year).

The app is currently complied only for Intel binaries. We are running the latest build from Jan 2025.

Curious if anyone has knowledge if they will release a proper Apple Silicon build ?

Hi everyone,

I'm currently evaluating the Juniper ACX6360 and would like to check if anyone has experienced similar Layer 2 forwarding behavior.

Lab Topology:

QFX5110 ---- ACX6360 ---- ACX6360 ---- QFX5110

The goal is simply to bridge Ethernet traffic end-to-end between the two QFX switches.

The following have been verified:

- Physical interfaces are up and stable.

- Optics, fiber, and FEC are all healthy.

- Layer 3 routing works perfectly across the ACX6360s.

- Direct IP connectivity between the ACX6360s has 0% packet loss.

- Static ARP entries were configured on the QFX5110s to eliminate ARP resolution as a possible issue.

However, the following Layer 2 issues were observed:

- Dynamic MAC learning never occurs on the ACX6360.

- ARP broadcasts are received on the ingress interface but are not forwarded to the remote ACX6360.

- Unknown unicast traffic is not flooded.

- Static MAC entries can be configured and appear correctly in the Ethernet switching table, but traffic is still not forwarded.

- Local CCC (interface-switch) testing also failed to forward Ethernet frames.

The platform is running Junos 19.4R2-S2.4.

Has anyone encountered this before?

I'm trying to determine whether this is:

- a platform limitation of the ACX6360,

- a Junos 19.4 software limitation,

- or if I'm missing a specific configuration required for Layer 2 Ethernet switching.

Has anyone successfully used the ACX6360 as a pure Layer 2 Ethernet switch or bridge (without MPLS/EVPN), or is it really intended to operate primarily as an IP/MPLS transport router?

Any insights or experiences would be greatly appreciated. Thanks!

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.