Upgrade JunOS from RAM Disk

Here is the steps to upgrade JunOS from RAM disk if you do not have enough available space on your disk, but you have enough memory free to use.

First, make sure you have enough free memory on your system:
Method1:
john@FW-GDBURTI-SRX-0> show system processes extensive 
node0:
--------------------------------------------------------------------------
last pid: 15489;  load averages:  0.14,  0.08,  0.08  up 10+23:35:46    18:27:00
124 processes: 18 running, 92 sleeping, 2 zombie, 12 waiting

Mem: 160M Active, 32M Inact, 560M Wired, 17M Cache, 112M Buf, 201M Free
Swap:


  PID USERNAME  THR PRI NICE   SIZE    RES STATE  C   TIME   WCPU COMMAND
 1114 root        7  76    0   490M 46780K RUN    0 820.3H 281.10% flowd_octeon_hm
   22 root        1 171   52     0K    16K RUN    0 226.7H 86.43% idle: cpu0
   23 root        1 -20 -139     0K    16K WAIT   0 170:59  0.00% swi7: clock
    5 root        1 -84    0     0K    16K rtfifo 0  56:51  0.00% rtfifo_kern_recv
 1120 root        1  76    0  4272K  1644K select 0  38:08  0.00% license-check
 1117 root        1  76    0  9864K  3088K select 0  12:40  0.00% jsrpd
 1119 root        1  76    0  9924K  3544K select 0  11:29  0.00% rtlogd
   25 root        1 -40 -159     0K    16K WAIT   0  11:02  0.00% swi2: net
 1111 root        2  76    0 20116K  5336K select 0   9:53  0.00% pfed
 1104 root        1  76    0 31052K  4920K select 0   9:03  0.00% chassisd
 1105 root        1  76    0  7140K  2500K select 0   8:04  0.00% alarmd
   48 root        1 -16    0     0K    16K psleep 0   6:57  0.00% vmkmemdaemon
 1101 root        1  76    0  2624K   744K select 0   6:31  0.00% bslockd
   26 root        1 -16    0     0K    16K -      0   5:41  0.00% yarrow
 1167 root        1  76    0 14640K  5500K select 0   2:53  0.00% mib2d
 1168 root        1  76    0 12680K  5480K select 0   2:50  0.00% snmpd
   41 root        1  20    0     0K    16K vnlrum 0   2:34  0.00% vnlru_

Method2:
root@FW-TRN1-MAO-UAC> show chassis routing-engine
node0:
--------------------------------------------------------------------------
Routing Engine status:
    Temperature                 36 degrees C / 96 degrees F
    CPU temperature             34 degrees C / 93 degrees F
    Total memory              1024 MB Max   748 MB used ( 73 percent)
      Control plane memory     560 MB Max   386 MB used ( 69 percent)
      Data plane memory        464 MB Max   362 MB used ( 78 percent)
    CPU utilization:
      User                      10 percent
      Background                 0 percent
      Kernel                     5 percent
      Interrupt                  0 percent
      Idle                      85 percent
    Model                          RE-SRX240H
    Serial ID                      AABG0967
    Start time                     2013-10-02 20:50:57 EDT
    Uptime                         19 minutes, 26 seconds
    Last reboot reason             0x200:normal shutdown
    Load averages:                 1 minute   5 minute  15 minute
                                       0.27       0.21       0.30

The unused part of control plane memory can be used to create a RAM disk. In the above example you can calculate it (560 - 386 = 174 MB free).

Note: Do not try to create a RAM disk if you do not have enough free memory for this operation. The system may halt and stop responding, if you run out of memory while creating or using the RAM disk.

Other steps to create a RAM Disk
0. Login as root to shell.
1. Create tmp directory: "mkdir /var/tmp/disk1"
2. Mount it to RAM: "mount_mfs -s 200m md /var/tmp/disk1/"
3. Copy Junos image to /var/tmp/disk1
4. From CLI run update "request system software add
/var/tmp/disk1/junos-srxsme-11.4R5.5-domestic.tgz no-copy no-validate"
5. If you have managed to upgrade software on node-0 move to node-1 and upgrade Junos on it.
6. Reboot both nodes at same time.

Note: after reboot, the files in RAM disk will disappear automatically.

How to Clean-up Space on Juniper SRX Devices

I have a pair of Juniper SRX 240 H running in company network environment. Recently it has to be upgraded to JunOS 11.4R5.5 which is latest recommended version. First thing I checked is the available space on those two devices. It seems node0 used 130m more space to storage files based on following command:

show system storage 
node0:
--------------------------------------------------------------------------
Filesystem              Size       Used      Avail  Capacity   Mounted on
/dev/da0s2a             293M       214M        56M       79%  /
devfs                   1.0K       1.0K         0B      100%  /dev
/dev/md0                599M       599M         0B      100%  /junos
/cf                     293M       214M        56M       79%  /junos/cf
devfs                   1.0K       1.0K         0B      100%  /junos/dev/
procfs                  4.0K       4.0K         0B      100%  /proc
/dev/bo0s3e              24M        88K        22M        0%  /config
/dev/bo0s3f             342M       215M       100M       68%  /cf/var
/dev/md1                168M        16M       139M       10%  /mfs
/cf/var/jail            342M       215M       100M       68%  /jail/var
/cf/var/log             342M       215M       100M       68%  /jail/var/log
devfs                   1.0K       1.0K         0B      100%  /jail/dev
/dev/md2                 39M       4.0K        36M        0%  /mfs/var/run/utm
/dev/md3                1.8M       196K       1.5M       11%  /jail/mfs

node1:
--------------------------------------------------------------------------
Filesystem              Size       Used      Avail  Capacity   Mounted on
/dev/da0s2a             293M       214M        56M       79%  /
devfs                   1.0K       1.0K         0B      100%  /dev
/dev/md0                599M       599M         0B      100%  /junos
/cf                     293M       214M        56M       79%  /junos/cf
devfs                   1.0K       1.0K         0B      100%  /junos/dev/
procfs                  4.0K       4.0K         0B      100%  /proc
/dev/bo0s3e              24M        86K        22M        0%  /config
/dev/bo0s3f             342M        84M       231M       27%  /cf/var
/dev/md1                168M        16M       139M       10%  /mfs
/cf/var/jail            342M        84M       231M       27%  /jail/var
/cf/var/log             342M        84M       231M       27%  /jail/var/log
devfs                   1.0K       1.0K         0B      100%  /jail/dev
/dev/md2                 39M       4.0K        36M        0%  /mfs/var/run/utm
/dev/md3                1.8M       4.0K       1.7M        0%  /jail/mfs




test@test> request system storage cleanup  

List of files to delete:

         Size Date         Name
  13.5K Jan 24 19:28 /cf/var/log/default-log-messages.0.gz
  33.7K Jan 24 19:27 /cf/var/log/default-log-messages.1.gz
   147B Jan 24 19:28 /cf/var/log/interactive-commands.0.gz
   358B Jan 24 19:28 /cf/var/log/messages.0.gz
  36.7K Jan 24 19:27 /cf/var/log/rtlogd.0.gz
  34.9K Jan 24 19:26 /cf/var/log/rtlogd.1.gz
  19.5K Jan 24 19:28 /cf/var/log/traffic-create.0.gz
  12.2K Jan 24 19:28 /cf/var/log/traffic-deny.0.gz
  20.8K Jan 24 19:24 /cf/var/log/traffic-deny.1.gz
   152B Jan 24 19:16 /cf/var/log/wtmp.0.gz
    27B Jan 24 18:38 /cf/var/log/wtmp.1.gz
Delete these files ? [yes,no] (no)

But still not too much space freed up.
Followed these steps from

"
After the cleanup, if there is still not enough space for the upgrade, perform the following procedure:

1. Start  the shell by using start shell command on the CLI.


2. Issue the following command on the shell:

   find -x /cf/var -type f -exec du -k {} \; | sort –n
   



3. Delete the files at the end of the above generated output.  Here is an example:

       18256   /cf/var/lost+found/#11136/flowd_octeon.core.1.gz
       19600   /cf/var/lost+found/#11136/flowd_octeon.core.0.gz
   

   The first column displays the file size in kilobytes and the second column displays the file location.


4. You can also find files, which are greater in than the specific value. For example, the following command will show files whose size will be more than 10MB:

         sh -c 'find / -size +10485760c 2> /dev/null' | xargs du -h | sort -nr

"

% sh -c 'find / -size +10485760c 2> /dev/null' | xargs du -h | sort -nr
210M    /cf/packages/junos-10.4R8.5-domestic
 32M    /cf/var/db/idpd/db/secdb.d02
 27M    /usr/sbin/flowd_octeon_hm
 24M    /usr/sbin/flowd_octeon
 20M    /cf/var/db/idpd/nsm-download/SignatureUpdate.xml
 16M    /usr/sbin/rpd
 12M    /cf/var/db/ai_cache/dfa_group_cache.d02
 11M    /mfs/var/run/db/schema.db
 10M    /usr/sbin/authd

Another interesting thing is software backup can not be deleted for somehow even we requested to do system software delete-backup.
# run show system software backup  
Backup JUNOS package information:
File name: /altroot/cf/packages/junos-11.2R2.4-domestic
File size: 145507179



> request system software delete-backup 
Delete backup system software package [yes,no] (no) yes

List all the CheckPoint hotfixes

Checkpoint SK41258 provides a way to list all installed hotfix on your system:

[Expert@CP]# fw ver
This is Check Point VPN-1(TM) & FireWall-1(R) R75.40 - Build 275
[Expert@CP]# grep -i HOTFIX $CPDIR/registry/HKLM_registry.* | more
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                 : (HOTFIX_R71_30
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                 : (HotFixes
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                         :HOTFIX_FOXX_HF_HA40_041 (1)
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                 : (HOTFIX_FOXX_HF_HA40_041
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                         :SilentUninstall ("/opt/CPsuite-R75.40/uninstall_fw1_wrapper_HOTFIX_FOXX_HF_HA40_041 -SU")
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                 : (HOTFIX_R71_30
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                         :SilentUninstall ("/opt/SecurePlatform/uninstall_SecurePlatform_HOTFIX_R71_30 -SU")
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                 : (HOTFIX_R71_30
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                 : (HOTFIX_R71_30
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                 : (HotFixes
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                         :HOTFIX_FOXX_HF_HA40_041 (1)
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                 : (HOTFIX_FOXX_HF_HA40_041
/opt/CPshrd-R75.40/registry/HKLM_registry.data:                                         :SilentUninstall ("/opt/CPppak-R75.40/uninstall_sim_HOTFIX_FOXX_HF_HA40_041 -SU")
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                     : (HOTFIX_R71_30
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                     : (HotFixes
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                             :HOTFIX_FOXX_HF_HA40_041 (1)
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                     : (HOTFIX_FOXX_HF_HA40_041
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                             :SilentUninstall ("/opt/CPsuite-R75.40/uninstall_fw1_wrapper_HOTFIX_FOXX_HF_HA40_041 -SU")
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                     : (HOTFIX_R71_30
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                             :SilentUninstall ("/opt/SecurePlatform/uninstall_SecurePlatform_HOTFIX_R71_30 -SU")
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                     : (HOTFIX_R71_30
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                     : (HOTFIX_R71_30
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                     : (HotFixes
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                             :HOTFIX_FOXX_HF_HA40_041 (1)
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                     : (HOTFIX_FOXX_HF_HA40_041
/opt/CPshrd-R75.40/registry/HKLM_registry.data.old:                                             :SilentUninstall ("/opt/CPppak-R75.40/uninstall_sim_HOTFIX_FOXX_HF_HA40_041 -SU")

With latest R75.45  cpinfo new option -y, it is able to list all installed Hotfixes with intuitive results.


[Expert@CP-1]# fw ver

This is Check Point VPN-1(TM) & FireWall-1(R) R75.45 - Build 193

[Expert@CP-1]# cpinfo -y all
------------------------
Hotfix versions
------------------------
[FW1] 
  HOTFIX_R75_45 
[SecurePlatform] 
  No hotfixes..
[PPACK] 
  HOTFIX_R75_45 
[CPinfo] 
  No hotfixes..
[SmartPortal] 
  No hotfixes..
[Reporting Module] 
  HOTFIX_R75_45 
[CVPN] 
  HOTFIX_R75_45 
[SmartLog] 
  HOTFIX_R75_45 
[PICPmgmtrfesR75] 
  No hotfixes..
[R7520CMP] 
  default 
[R75CMP] 
  HOTFIX_R75_45 
[NGXCMP] 
  No hotfixes..
[V40CMP] 
  No hotfixes..
[EdgeCmp] 
  HOTFIX_R75_45 
[SFWCMP] 
  No hotfixes..
[FLICMP] 
  HOTFIX_R75_45 
[CON66CMP] 
  No hotfixes..
[rtm] 
  No hotfixes..

Enable SFTP to Checkpoint Gaia OS System

1. Enable SFTP on Checkpoint either SPLAT or Gaia

By default, there is no SFTP access to Checkpoint OS either SPLAT or Gaia. But there is always a way to enable it manually.  Here is a listed steps to do it from Gaia command line

1.1. Enter into Expert Mode

1.2. Enable an account to have bash access

chsh -s /bin/bash admin

1.3. Edit the SSHD configuration file in Vi editor:

[Expert@CP]# vi /etc/ssh/sshd_config

1.4. At the almost end of sshd_config file, uncomment the 'Subsystem  sftp  /usr/libexec/openssh/sftp-server' line by deleting the pound '#' character:

# override default of no subsystems
Subsystem       sftp    /usr/libexec/openssh/sftp-server

DenyUsers root shutdown halt nobody ntp pcap rpm
# ckp - CR00596011
#AllowGroups root
"/etc/ssh/sshd_config" 124L, 3422C written

1.5. Save the changes and exit Vi editor

1.6. Restart SSHD service:

[Expert@CP]# /etc/init.d/sshd restart
Stopping sshd: [  OK  ]
Starting sshd: [  OK  ]

1.7. Set Admin back to default clish shell, simply run 'chsh -s /etc/cli.sh admin' command.

Note: Please remember you will get an error message if you did not put admin into bash mode while doing sftp:
(Received too large(1129072974 B) SFTP packet. Max Supported packet size is 1024000 B.)

---------------------------------------------------------------------------------------------------------

2. Another way to enable SFTP on Gaia

It is possible to enable an SFTP server on any Gaia device via the SSH deamon. To do so, edit the file /etc/ssh/sshd_config:


2.1 Look for the line '#Subsystem     sftp     /usr/libexec/openssh/sftp-server' and change it to 'Subsystem sftp internal-sftp'

2.2 Restart the SSHd via command:[expert@host]# /sbin/service sshd restart

You can now connect to the device through any SFTP client using port 22.

Backup Checkpoint Configuration in Gaia and Gaia+

There are different Gaia version released already by Checkpoint. From Clish , using "show version all" to check version build number:


CP> show version all 
Product version Check Point Gaia R75.40
OS build 338
OS kernel version 2.6.18-92cp
OS edition 32-bit

So far, there are following version we know:

latest EA: 264
GA: 338
2nd GA: 339
GAIA+: 65
GAIA+: 123

Gaia+ version provides more feature and functions than Gaia. One of difference is the way to do configuration backup.

1.
In Gaia version, browser does not provide the ability to execute backup from GUI interface. Command line is "add backup ftp/local/scp/tftp"


CP> add backup 
ftp   - Store the files on ftp server
local - Store the files locally
scp   - Store the files on scp server
tftp  - Store the files on tftp server

CP> add backup local 
Creating backup package. Use the command 'show backups' to monitor creation progress.

CP> show backups
Backup package is under creation now.

CP> > show backups
backup_CP.checkpoint.com_7_1_2013_11_51.tgz Mon, Jan 07, 2013 31.11 MB

The file locates at /var/log/CPbacku/backups/R75.40_ foler.


[Expert@Montereal-DMZ]# find / -name backup_CP*
/var/log/CPbackup/backups/R75.40_/backup_CP.checkpoint.com_7_1_2013_11_51.tgz

2. Gaia+, you can do it both from GUI and Command Line. 

In the browser, it is under Maintenance tab.