Juniper Hidden Command : set chassis cluster control-link-vlan enable

set chassis cluster control-link-vlan enable

Explanation:

[SRX] How to enable or disable VLAN tagging on the chassis cluster control port

[KB24843] Show KB Properties

---

SUMMARY:

This article provides information on how to enable and disable VLAN tagging on the chassis cluster control port.

PROBLEM OR GOAL:

• One Node is upgraded from a version that is prior to or from Junos OS 10.2R2 to 10.4 or later.


• By default, the VLAN tag on the control port will be in the enabled state.


• The node on which RE has been replaced was downgraded/upgraded from a version after Junos OS 10.2R2 to the same version as the other node and does not join the cluster and goes into split brain; that is, the nodes do not see each other.

Sample Output on NODE-0:

{primary:node0}
root@> show chassis cluster information detail 
node0:
--------------------------------------------------------------------------
Redundancy mode:
    Configured mode: active-active
    Operational mode: active-active

Redundancy group: 0, Threshold: 255, Monitoring failures: none
    Events:
        Aug  5 16:51:18.773 : hold->secondary, reason: Hold timer expired
        Aug  5 16:51:34.789 : secondary->primary, reason: Only node present
Control link statistics:
    Control link 0:
        Heartbeat packets sent: 63115
        Heartbeat packets received: 0
        Heartbeat packet errors: 0
        Duplicate heartbeat packets received: 0
    Control recovery packet count: 0
    Sequence number of last heartbeat packet sent: 63114
    Sequence number of last heartbeat packet received: 0
Fabric link statistics:
    Probes sent: 63114
    Probes received: 0
    Probe errors: 0
    Probes not processed: 0             
    Probes dropped due to control link down: 0
    Probes dropped due to fabric link down: 0
    Sequence number of last probe sent: 63114
    Sequence number of last probe received: 0
Chassis cluster LED information:
    Current LED color: Red
    Last LED change reason: Peer node: node1 is not present
Control port tagging:
    Enabled 


{primary:node0}
root> show chassis cluster status
Cluster ID: 1
Node    Priority   Status  Preempt  Manual  failover
Redundancy group: 0,Failover count: 1
node0       1        primary  no  no
node1       0        lost     n/a n/a

Sample Output on NODE-1:

{primary:node1}
root> show chassis cluster information detail 
node1:
--------------------------------------------------------------------------
Redundancy mode:
    Configured mode: active-active
    Operational mode: active-active

Redundancy group: 0, Threshold: 255, Monitoring failures: none
    Events:
        Aug  5 16:50:52.904 : hold->secondary, reason: Hold timer expired
        Aug  5 16:56:38.711 : secondary->primary, reason: Remote yield (1/0)
Control link statistics:
    Control link 0:
        Heartbeat packets sent: 64212
        Heartbeat packets received: 337
        Heartbeat packet errors: 0
        Duplicate heartbeat packets received: 0
    Control recovery packet count: 0
    Sequence number of last heartbeat packet sent: 64210
    Sequence number of last heartbeat packet received: 361
Fabric link statistics:
    Probes sent: 64210
    Probes received: 0
    Probe errors: 0
    Probes not processed: 0             
    Probes dropped due to control link down: 0
    Probes dropped due to fabric link down: 0
    Sequence number of last probe sent: 64210
    Sequence number of last probe received: 0
Chassis cluster LED information:
    Current LED color: Red
    Last LED change reason: Peer node: node0 is not present
Control port tagging:
    Disabled

{primary:node1}
root> show chassis cluster status    
Cluster ID: 1 
Node    Priority   Status  Preempt  Manual failover 

Redundancy group: 0 , Failover count: 1    
node0       0         lost    n/a  n/a     
node1       1         primary no   no  
  

CAUSE:

One device is sending a tagged heartbeat and the other is sending a untagged heartbeat, as VLAN tagging is enabled on one node and disabled on the other node.

SOLUTION:

Prior to Junos OS 10.2R3, in the chassis cluster, VLAN tagging was enabled by default on the control port. From Junos OS 10.2R3 onwards, by default VLAN tagging is not enabled on the control port.

To check the control port tagging status, execute the show chassis cluster information detail command and look for Control port tagging:

admin@host> show chassis cluster information detail
.
Control port tagging:
Disabled

On one node, it is enabled and on the other node, it is disabled.

It is also possible to check by taking the packet capture of the control port from both of the nodes. In one node,  the packet will be tagged with vlan-id 4096 and the other packet will not have any tagging. VLAN tagging on the control port can be enabled or disabled by using the following command:

admin@host> set chassis cluster control-link-vlan enable/disable

Note: control-link-vlan is a hidden command on the SRX platform. Users must manually configure this command.

As VLAN tagging is disabled on the control port in versions that are later than Junos OS 10.2R2, it is recommended to disable tagging on both of the nodes.

PURPOSE:

Configuration
Implementation
Installation
Troubleshooting

RELATED LINKS: 

Procedures to Replace failed Checkpoint Cluster Member Appliance

The UTM 272 is running R75.40. We found when it failed over to active, the load will push temperature higher than 60, which caused it shutdown itself.

Called Checkpoint Support and get RMA order.

Here is the procedures to replace it:

1. Console in.

Check Point SecurePlatform R71.30
For Web User Interface access connect to https://192.168.1.1:4434

login: admin
Password: 
Last login: Thu Jan 23 00:24:59 on ttyS0

? for list of commands
sysconfig for system and products configuration

[cpmodule]# cpconfig
Welcome to Check Point Appliance

You can not use the 'sysconfig' and 'cpconfig' utilities until you successfully complete
the First Time Wizard in the Administration web GUI.

Press Enter to continue...

2. Disabling/bypassing the First Time Configuration Wizard based on sk71000

[cpmodule]# expert
Enter expert password: 

You are in expert mode now.

[Expert@cpmodule]# 
[Expert@cpmodule]# touch /opt/spwm/conf/wizard_accepted 
[Expert@cpmodule]# reboot

Are you sure? (y/n) y

INIT: Sending processes the TERM signal

3. [cpmodule]# cpconfig

Welcome to Check Point Configuration Program
=================================================
Please read the following license agreement. 
Hit 'ENTER' to continue... 

       Software License Agreement & Limited Hardware Warranty
              Check Point Software Technologies Ltd.
...

Do you accept all the terms of this license agreement (y/n) ? y


Select installation type:
-------------------------

(1) Stand Alone - install Check Point Security Gateway and Security Management.
(2) Distributed - install Check Point Security Gateway, Security Management and/or Log Server.

Enter your selection  (1-2/a-abort) [1]: 2

Select installation type:
-------------------------

(1) Check Point Security Gateway.
(2) Security Management.
(3) Security Management and Check Point Security Gateway.
(4) Enterprise Log Server.
(5) Check Point Security Gateway and Enterprise Log Server.

Enter your selection  (1-5/a-abort) [1]: 1

Select installation type:
-------------------------

(1) Check Point Security Gateway.
(2) Security Management.
(3) Security Management and Check Point Security Gateway.
(4) Enterprise Log Server.
(5) Check Point Security Gateway and Enterprise Log Server.

Enter your selection  (1-5/a-abort) [1]: 1
Is this a Dynamically Assigned IP Address gateway installation ? (y/n) [n] ? 
Would you like to install a Check Point clustering product (CPHA, CPLS or State Synchronization)? (y/n) [n] ? y
IP forwarding disabled
Hardening OS Security: IP forwarding will be disabled during boot.
Generating default filter
Default Filter installed
Hardening OS Security: Default Filter will be applied during boot.
This program will guide you through several steps where you
will define your Check Point products configuration.
At any later time, you can reconfigure these parameters by
running cpconfig

Configuring Licenses and contracts...
=====================================
Host             Expiration  Signature                             Features            

Contract Coverage:

There is no contract coverage for the above licenses.
Note: The recommended way of managing licenses is using SmartUpdate.
cpconfig can be used to manage local licenses only on this machine.

Do you want to add licenses (y/n) [y] ? n


Configuring Random Pool...
==========================
Automatically collecting random data to be used in
various cryptographic operations.

    [....................]  

Automatic collection of random data is done.



Configuring Secure Internal Communication...
============================================
The Secure Internal Communication is used for authentication between
Check Point components

Trust State: Uninitialized
Enter Activation Key: 
Retype Activation Key: 

The Secure Internal Communication was successfully initialized

initial_module:
Compiled OK.

Hardening OS Security: Initial policy will be applied
until the first policy is installed

In order to complete the installation
you must reboot the machine.
Do you want to reboot? (y/n) [y] ? 



Choose a configuration item ('e' to exit):
------------------------------------------------------------------
1) Host name                    7) DHCP Server Configuration
2) Domain name                  8) DHCP Relay Configuration
3) Domain name servers          9) Export Setup
4) Time and Date               10) Products Installation
5) Network Connections         11) Products Configuration
6) Routing
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice: 5

4. [cpmodule]# sysconfig
Choose a configuration item ('e' to exit):
------------------------------------------------------------------
1) Host name                    7) DHCP Server Configuration
2) Domain name                  8) DHCP Relay Configuration
3) Domain name servers          9) Export Setup
4) Time and Date               10) Products Installation
5) Network Connections         11) Products Configuration
6) Routing
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice:


5. [cpmodule]# webui enable 4434
Shutting down cp_http_server_wd: [  OK  ]
Running cp_http_server_wd: [  OK  ]

6. Select Upgrade Path

7. Restore Image to R75 through Image Management Webui

8. Go to checkpoint website to download upgrade package from R75 to R75.40 Gaia.
http://dl3.checkpoint.com/paid/3c/Check_Point_Upgrade_for_R75.40.Splat_to_Gaia.tgz?HashKey=1390855121_58594d4de69e0eb524bb08b1bed646bc&xtn=.tgz

Note: Use Internet Explorer rather than Chrome since chrome will change file extention from .tgz to .gz, which is not accepted by Upgrade tab.

Note: Before update package, run Cpconfig and Sysconfig first.

9. Change host name, DNS, NTP configuration, SNMP, add interfaces info and static routes

10. Reset SIC and Rebuid Secure Internal Communication

11. Install Policy.

12. Failover test.

Upgrade Checkpoint from Command Line after failed from Webui

There is 2012 Appliance 4205 in the environment. Some basic configuration done, including internal interface and gateway. But after a couple of times failed attempt to upgrade OS from R75 Splat to R75.40 Gaia, I have to stop to see where is wrong.

The failed screenshot is showing in the following:

The package name is Check_Point_Upgrade_for_R75.40.Splat_to_Gaia.tgz download from https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=14899&from=wizard.

Followed command line installation guide:

1. Upload the upgrade package through the GUI, it will be placed in: /var/log/cpupgrade/web/

2. Move upgrade.tgz into /var/upgrade

3. #tar -zxvf upgrade.tgz

4. #./UnixInstallScript -NOCRS
In R75.20 the install script is installme.sh

5. Reboot when complete and login to verify upgrade

Notes: 

Do not forget put idle 999 in, else you will get following auto log out messages:

[Expert@CP-Management]# ls

CPsecplPtchMod                                              base          lib                stam.tgz          upgrade_config.xml

Check_Point_R77.10_T151_upg_WEBUI_and_SmartUpdate.Gaia.tgz  content.txt   package_info.html  take_number.conf  vi.recover

RPMS                                                        cprid         resetips           upgrade           wrapper

SU                                                          installme.sh  scripts            upgradeClient

[Expert@CP-Management]# ./installme.sh 

Start Upgrading ..

Wait while creating upgrade image ... complete

Creating upgrade image is ok
[CP-Management]#
Idle timeout expired, performing auto-logout...



Actually, in my this case, the real reason for failure is because we did not run first time installation wizard and Checkpoint Package did not install first. After tried cpconfig finished first time installation wizard, upgrade was successful.

DSL Line - PPPoE on Cisco Router Configuration Template

interface GigabitEthernet0/0
 no ip address
 ip virtual-reassembly
 duplex auto
 speed auto
 pppoe enable group global
 pppoe-client dial-pool-number 1

interface GigabitEthernet0/1

 ip address 100.199.14.7 255.255.255.0

 ip nat inside

 ip virtual-reassembly

 duplex auto

 speed auto

interface Dialer1

 ip address negotiated

 ip mtu 1492

 ip nat outside

 ip virtual-reassembly

 encapsulation ppp

 ip tcp adjust-mss 1452

 dialer pool 1

 dialer-group 1

 ppp authentication pap callin

 ppp pap sent-username dsl@net.ca password 0 123456

!

ip nat inside source list 1 interface Dialer1 overload

ip nat inside source static 100.199.38.3 9.1.1.8

ip route 0.0.0.0 0.0.0.0 Dialer1

access-list 1 permit 100.199.38.0 0.0.0.255

Upgrade Juniper JUNOS on SRX using USB Storage

1. Insert USB Pen Driver into USB port on SRX Firewall

2. log into SRX Firewall with root account. 

Create /var/tmp/usb folder

root@fw-1-1% cd /var/tmp

root@fw-1-1% ls

cleanup-pkgs.log        gksdchk.log             idp_license_info        krt_gencfg_filter.txt   policy_status           sec-download            vi.recover

eedebug_bin_file        gres-tp                 install                 pics                    rtsdb                   spu_kmd_init

root@fw-mex1-1% mkdir usb

3. Get usb device name

root@fw-1-1% cd /var/log

root@fw-1-1% cat messages 

then find out following messages:

Oct  3 17:55:23  fw-mex1-1 /kernel: %KERN-2: umass1: HP v220w, rev 2.00/11.00, addr 4

Oct  3 17:55:24  fw-mex1-1 /kernel: %KERN-2: da1 at umass-sim1 bus 1 target 0 lun 0

Oct  3 17:55:24  fw-mex1-1 /kernel: %KERN-2: da1: <hp v220w 1100> Removable Direct Access SCSI-4 device 

Oct  3 17:55:24  fw-mex1-1 /kernel: %KERN-2: da1: 40.000MB/s transfers

Oct  3 17:55:24  fw-mex1-1 /kernel: %KERN-2: da1: 7788MB (15950592 512 byte sectors: 255H 63S/T 992C)

Oct  3 17:55:30  fw-mex1-1 sshd[27752]: %AUTH-6: Did not receive identification string from 10.4.20.5

Device name will be da1s1

4. Mount device to folder /var/tmp/usb

root@fw-1-1% cd /dev/

root@fw-1-1% ls

altroot         bo0s3e          bpf10           bpf3            cfi0            da0             da0s3           da0s4e          fileassoc       md0             nfslock         ptyp1           stdout          usb

ata             bo0s3f          bpf11           bpf4            console         da0s1           da0s3c          da1             gblmem          md1             null            random          ttyp0           usb0

bo0s1a          bo0s4a          bpf12           bpf5            cpld            da0s1a          da0s3e          da1s1           geom.ctl        md2             octpkt          root            ttyp1           usb1

bo0s1c          bo0s4c          bpf13           bpf6            ctty            da0s1c          da0s3f          devctl          gpio            md3             pass0           rtfifo          ttyu0           veriexec

bo0s2a          bo0s4e          bpf14           bpf7            cuau0           da0s2           da0s4           devstat         klog            mdctl           pass1           smb             ttyu0.init      xpt0

bo0s2c          bpf0            bpf15           bpf8            cuau0.init      da0s2a          da0s4a          fd              kmem            mem             pci             stderr          ttyu0.lock      zero

bo0s3c          bpf1            bpf2            bpf9            cuau0.lock      da0s2c          da0s4c          fido            log             nfs4            ptyp0           stdin           urandom

root@fw-mex1-1% mount -t msdos /dev/da1s1 /var/tmp/usb

5. copy the file to folder /var/tmp/usb

6. add package into system software

root@fw-1-1> request system software add /var/tmp/usb/junos-srxsme-11.4R7.5-domestic.tgz no-copy no-validate

Follow the screen notification to do upgrade firewall.