Increasing Check Point Management Server Log Volume Size

Check Point Gaia LVM

Our Check Point Management Server has been migrated into Virtual Edition platform which is running on Citrix Xen server. Originally it is only 100GB hard drive set for testing.

After running stabilised for a couple of days, I decided to enlarge the log space since 50G logging is definitely not enough.

My old 2014 post "Resize Checkpoint Firewall's Disk/Partition Space (Gaia and Splat Platform)" has some details to enlarge Logical Volume size with existing free space which supposed to be used as snapshots. This post will focus how to add a new disk into your system and enlarge your log logical volume.

Related posts:

• Resize Checkpoint Firewall's Disk/Partition Space (Gaia and Splat Platform)
• Checkpoint Management Center Snapshot, Backup and Log file location

Here are all steps related to this task. Those steps also fit into Vmware environment.



300GB virtual disk has been added into our Management server virtual machine.

[Expert@CP-Management:0]# fdisk -l

Disk /dev/hda: 107.3 GB, 107374182400 bytes
255 heads, 63 sectors/track, 13054 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1          38      305203+  83  Linux
/dev/hda2              39         299     2096482+  82  Linux swap / Solaris
/dev/hda3             300       13054   102454537+  8e  Linux LVM

Disk /dev/hdb: 322.1 GB, 322122547200 bytes
255 heads, 63 sectors/track, 39162 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/hdb doesn't contain a valid partition table

[Expert@CP-Management:0]# fdisk /dev/hdb
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel
Building a new DOS disklabel. Changes will remain in memory only,
until you decide to write them. After that, of course, the previous
content won't be recoverable.


The number of cylinders for this disk is set to 39162.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
   (e.g., DOS FDISK, OS/2 FDISK)
Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-39162, default 1): 
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-39162, default 39162): 
Using default value 39162

Command (m for help): t
Selected partition 1
Hex code (type L to list codes): 83

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.
Syncing disks.
[Expert@CP-Management:0]# fdisk -l

Disk /dev/hda: 107.3 GB, 107374182400 bytes
255 heads, 63 sectors/track, 13054 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1          38      305203+  83  Linux
/dev/hda2              39         299     2096482+  82  Linux swap / Solaris
/dev/hda3             300       13054   102454537+  8e  Linux LVM

Disk /dev/hdb: 322.1 GB, 322122547200 bytes
255 heads, 63 sectors/track, 39162 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hdb1               1       39162   314568733+  83  Linux
[Expert@CP-Management:0]# pvcreate /dev/hdb1
  Physical volume "/dev/hdb1" successfully created
[Expert@CP-Management:0]# pvdisplay
  --- Physical volume ---
  PV Name               /dev/hda3
  VG Name               vg_splat
  PV Size               97.71 GB / not usable 21.26 MB
  Allocatable           yes 
  PE Size (KByte)       32768
  Total PE              3126
  Free PE               724
  Allocated PE          2402
  PV UUID               Stnt1u-kxSY-qv41-HawK-gvLi-Abyx-vgfcUP
   
  --- NEW Physical volume ---
  PV Name               /dev/hdb1
  VG Name               
  PV Size               300.00 GB
  Allocatable           NO
  PE Size (KByte)       0
  Total PE              0
  Free PE               0
  Allocated PE          0
  PV UUID               Af23rd-Nq98-mNm7-uAes-I0I9-yxZV-ALq4Vg
   
[Expert@CP-Management:0]# vgcreate group_john1 /dev/hdb1
  Volume group "group_john1" successfully created

[Expert@CP-Management:0]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
                       20G  8.1G   11G  44% /
/dev/hda1             289M   37M  238M  14% /boot
tmpfs                 4.0G     0  4.0G   0% /dev/shm
/dev/mapper/vg_splat-lv_log
                       49G  5.9G   41G  13% /var/log
[Expert@CP-Management:0]# pvs
  PV         VG          Fmt  Attr PSize   PFree  
  /dev/hda3  vg_splat    lvm2 a-    97.69G  22.62G
  /dev/hdb1  group_john1 lvm2 a-   299.99G 299.99G
[Expert@CP-Management:0]# lvs
  LV         VG       Attr   LSize  Origin Snap%  Move Log Copy% 
  lv_Inia    vg_splat -wi-a-  5.06G                              
  lv_current vg_splat -wi-ao 20.00G                              
  lv_log     vg_splat -wi-ao 50.00G                              
[Expert@CP-Management:0]# lvcreate -L 299990 -n vol2 group_john1
  /dev/cdrom: open failed: Read-only file system
  Rounding up size to full physical extent 292.96 GB
  Logical volume "vol2" created
[Expert@CP-Management:0]# lvs
  LV         VG          Attr   LSize   Origin Snap%  Move Log Copy% 
  vol2       group_john1 -wi-a- 292.96G                              
  lv_Inia    vg_splat    -wi-a-   5.06G                              
  lv_current vg_splat    -wi-ao  20.00G                              
  lv_log     vg_splat    -wi-ao  50.00G                              
[Expert@CP-Management:0]# pvs
  PV         VG          Fmt  Attr PSize   PFree 
  /dev/hda3  vg_splat    lvm2 a-    97.69G 22.62G
  /dev/hdb1  group_john1 lvm2 a-   299.99G  7.03G
[Expert@CP-Management:0]# 

During above steps, I created a new virtual group group_john1 and a new logical volume vol2. Unfortunately, those steps are not needed.

On next section, I will show how to remove logical volume vol2 and virtual group one by one.

After deleted that new virtual group, I will extend existing logical volume to this new disk.

[Expert@CP-Management:0]# fdisk -l        

Disk /dev/hda: 107.3 GB, 107374182400 bytes
255 heads, 63 sectors/track, 13054 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1          38      305203+  83  Linux
/dev/hda2              39         299     2096482+  82  Linux swap / Solaris
/dev/hda3             300       13054   102454537+  8e  Linux LVM

Disk /dev/hdb: 322.1 GB, 322122547200 bytes
255 heads, 63 sectors/track, 39162 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hdb1               1       39162   314568733+  83  Linux
[Expert@CP-Management:0]# vgdisplay       
  --- Volume group ---
  VG Name               group_john1
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  2
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                1
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               299.99 GB
  PE Size               4.00 MB
  Total PE              76798
  Alloc PE / Size       74998 / 292.96 GB
  Free  PE / Size       1800 / 7.03 GB
  VG UUID               FS1Lp5-1x3e-TGHU-0j94-buty-YY2Z-7iRjmN
   
  --- Volume group ---
  VG Name               vg_splat
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  9
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               2
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               97.69 GB
  PE Size               32.00 MB
  Total PE              3126
  Alloc PE / Size       2240 / 70.00 GB
  Free  PE / Size       886 / 27.69 GB
  VG UUID               E3Rsl2-UJHA-dgCG-cZBS-YoGo-CzE0-EIvRXE
   

[Expert@CP-Management:0]# vgchange -a n group_john1
  0 logical volume(s) in volume group "group_john1" now active
[Expert@CP-Management:0]# vgremove group_john1     
  /dev/cdrom: open failed: Read-only file system
  Volume group "group_john1" still contains 1 logical volume(s)
[Expert@CP-Management:0]# lvs
  LV         VG          Attr   LSize   Origin Snap%  Move Log Copy% 
  vol2       group_john1 -wi--- 292.96G                              
  lv_current vg_splat    -wi-ao  20.00G                              
  lv_log     vg_splat    -wi-ao  50.00G                              
[Expert@CP-Management:0]# lvremove /dev/group_john1/vol2
  /dev/cdrom: open failed: Read-only file system
  Logical volume "vol2" successfully removed
[Expert@CP-Management:0]# vgremove group_john1
  /dev/cdrom: open failed: Read-only file system
  Volume group "group_john1" successfully removed
[Expert@CP-Management:0]# pvs       
  PV         VG       Fmt  Attr PSize   PFree  
  /dev/hda3  vg_splat lvm2 a-    97.69G  27.69G
  /dev/hdb1           lvm2 --   300.00G 300.00G
[Expert@CP-Management:0]# pvdisplay /dev/hdb1
  --- NEW Physical volume ---
  PV Name               /dev/hdb1
  VG Name               
  PV Size               300.00 GB
  Allocatable           NO
  PE Size (KByte)       0
  Total PE              0
  Free PE               0
  Allocated PE          0
  PV UUID               Af23rd-Nq98-mNm7-uAes-I0I9-yxZV-ALq4Vg
   
[Expert@CP-Management:0]# vgscan --mknodes
  Reading all physical volumes.  This may take a while...
  Found volume group "vg_splat" using metadata type lvm2
[Expert@CP-Management:0]# pvs
  PV         VG       Fmt  Attr PSize   PFree  
  /dev/hda3  vg_splat lvm2 a-    97.69G  27.69G
  /dev/hdb1           lvm2 --   300.00G 300.00G

[Expert@CP-Management:0]# vgextend vg_splat /dev/hdb1 
  /dev/cdrom: open failed: Read-only file system
  Attempt to close device '/dev/cdrom' which is not open.
  Volume group "vg_splat" successfully extended
[Expert@CP-Management:0]# pvs
  PV         VG       Fmt  Attr PSize   PFree  
  /dev/hda3  vg_splat lvm2 a-    97.69G  27.69G
  /dev/hdb1  vg_splat lvm2 a-   299.97G 299.97G
[Expert@CP-Management:0]# lvs
  LV         VG       Attr   LSize  Origin Snap%  Move Log Copy% 
  lv_current vg_splat -wi-ao 20.00G                              
  lv_log     vg_splat -wi-ao 50.00G                              
[Expert@CP-Management:0]# vgdisplay
  --- Volume group ---
  VG Name               vg_splat
  System ID             
  Format                lvm2
  Metadata Areas        2
  Metadata Sequence No  10
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               2
  Max PV                0
  Cur PV                2
  Act PV                2
  VG Size               397.66 GB
  PE Size               32.00 MB
  Total PE              12725
  Alloc PE / Size       2240 / 70.00 GB
  Free  PE / Size       10485 / 327.66 GB
  VG UUID               E3Rsl2-UJHA-dgCG-cZBS-YoGo-CzE0-EIvRXE
   

Following output is showing how to use lvm_manager to resize lv_current/lv_log. Download LVM manager from here. 

[Expert@CP-Management:0]# ls 

last_dump.log  lvm_manager.sh

[Expert@CP-Management:0]# lvm_manager

elect action:

1) View LVM storage overview
2) Resize lv_current/lv_log Logical Volume
3) Quit
Select action: 1



VM overview
============
                  Size(GB)   Used(GB)   Configurable    Description         
    lv_current    20         9          yes             Check Point OS and products
    lv_log        50         12         yes             Logs volume         
    upgrade       22         N/A        no              Reserved for version upgrade
    swap          2          N/A        no              Swap volume size    
    free          305        N/A        no              Unused space        
    -------       ----                                                      
    total         399        N/A        no              Total size          

press ENTER to continue.

==============================================================================================


elect action:

1) View LVM storage overview
2) Resize lv_current/lv_log Logical Volume
3) Quit
Select action: 2


elect Logical Volume for size modification:
1) lv_current
2) lv_log
3) Cancel
Select Logical Volume: 2


VM overview
============
                  Size(GB)   Used(GB)   Configurable    Description         
    lv_current    20         9          yes             Check Point OS and products
    lv_log        50         12         yes             Logs volume         
    upgrade       22         N/A        no              Reserved for version upgrade
    swap          2          N/A        no              Swap volume size    
    free          305        N/A        no              Unused space        
    -------       ----                                                      
    total         399        N/A        no              Total size          

Resizing lv_log Logical Volume
==============================
lv_log size can be between 13G to 355G.
Enter the new size(GB) or leave blank to cancel: 300

Note that all Check Point products will be shutdown during the resizing operation and the machine will be rebooted automatically at the end of the process.
This may take several minutes.
Are you sure you want to continue?(Y/N)[N]y

Stopping Check Point products. This may take several minutes ...

Killing processes that access to the filesystem...

Unmounting logical volume ...

Checking the filesystem...
/dev/vg_splat/lv_log: 1315/13107200 files (11.4% non-contiguous), 3320980/13107200 blocks

Start resizing...
  Extending logical volume lv_log to 300.00 GB
  Logical volume lv_log successfully resized
Resizing the filesystem on /dev/mapper/vg_splat-lv_log to 78643200 (4k) blocks.
Begin pass 1 (max = 2000)
Extending the inode table     XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
The filesystem on /dev/mapper/vg_splat-lv_log is now 78643200 blocks long.


Mounting the filesystem...


******************************************************************

Operation ended successfully.

Logical Volume size changed from 50G to 300G.

Press ENTER for reboot.
Reboot ... 

Broadcast message from admin (pts/2) (Mon Sep 19 15:01:51 2016):

The system is going down for reboot NOW!
[Expert@CP-Management:0]# 

 lv_current/lv_log has been resized from 50G to 300G. There are 55G free space left which could be used to resize other logical volume or used to store system snapshots as show below.

Verify:

[Expert@CP-Management:0]# lvs
  LV         VG       Attr   LSize   Origin Snap%  Move Log Copy% 
  lv_current vg_splat -wi-ao  20.00G                              
  lv_log     vg_splat -wi-ao 300.00G    

                          
[Expert@CP-Management:0]# pvs
  PV         VG       Fmt  Attr PSize   PFree 
  /dev/hda3  vg_splat lvm2 a-    97.69G     0 
  /dev/hdb1  vg_splat lvm2 a-   299.97G 77.66G

[Expert@CP-Management:0]# pvdisplay
  --- Physical volume ---
  PV Name               /dev/hda3
  VG Name               vg_splat
  PV Size               97.71 GB / not usable 21.26 MB
  Allocatable           yes (but full)
  PE Size (KByte)       32768
  Total PE              3126
  Free PE               0
  Allocated PE          3126
  PV UUID               Stnt1u-kxSY-qv41-HawK-gvLi-Abyx-vgfcUP
   
  --- Physical volume ---
  PV Name               /dev/hdb1
  VG Name               vg_splat
  PV Size               300.00 GB / not usable 28.03 MB
  Allocatable           yes 
  PE Size (KByte)       32768
  Total PE              9599
  Free PE               2485
  Allocated PE          7114
  PV UUID               Af23rd-Nq98-mNm7-uAes-I0I9-yxZV-ALq4Vg
   
[Expert@CP-Management:0]# vgdisplay
  --- Volume group ---
  VG Name               vg_splat
  System ID             
  Format                lvm2
  Metadata Areas        2
  Metadata Sequence No  11
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               2
  Max PV                0
  Cur PV                2
  Act PV                2
  VG Size               397.66 GB
  PE Size               32.00 MB
  Total PE              12725
  Alloc PE / Size       10240 / 320.00 GB
  Free  PE / Size       2485 / 77.66 GB
  VG UUID               E3Rsl2-UJHA-dgCG-cZBS-YoGo-CzE0-EIvRXE
   
[Expert@CP-Management:0]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
                       20G  7.9G   11G  43% /
/dev/hda1             289M   24M  251M   9% /boot
tmpfs                 4.0G     0  4.0G   0% /dev/shm
/dev/mapper/vg_splat-lv_log
                      291G   12G  265G   5% /var/log
[Expert@CP-Management:0]# 

Reference:

1. How to change the default storage path for FireWall Log files on Security Management Server
2. How to add log storage to a VMware Virtual Machine running Gaia OS
3. Increasing the Security Gateway Virtual Edition Disk Size
4. How to Manage and Use LVM (Logical Volume Management) in Ubuntu
5. Managing partition sizes via LVM manager on Gaia OS

Fortigate Firewall Configuration Migrate to Different Device

Fortigate firewall upgrade to different model can become a pain when you are not sure how to migration configuration. Fortinet provides a tool which name is FortiConverter. Here are some features from it website page；

• Multi-vendor Support - Conversion from Check Point, Cisco, Juniper, Alcatel-Lucent, Palo Alto Networks, and SonicWall. A single tool converts configurations from all supported vendors.
• FortiGate to FortiGate - Can migrate configurations between FortiGate devices to minimize the risk associated with network upgrades. Facilitates migration to new hardware models from legacy FortiGate devices. This feature, including conversion output, is enabled with the trial license.
• Standardized Conversion - Configuration conversion is performed according to conversion rules and policy review and tuning is done after the conversion, prior to generating the output. Human error in the conversion process is minimized.
• Full Support - A valid FortiConverter license entitles users to direct engineering support and private builds to support their complex conversion projects.

Actually in most case, you will just need to change the configuration as instructed by docs listing at the reference section. In this post, I will use Fortigate 30D upgraded to 60D as an example to demonstrate steps.

Step 1 : Make sure the target device's firmware version as close as to the source's version

It does not need to be same version and build number. Fortigate 30D is using 5.0.0 and target Fortigate 60D is 5.0.2.

Step 2: Save Target Fortigate 60D configuration to a file
You may want to reset target machine to factory default configuration. But it is not mandatory requirement since you will only need first small section configuration to be copied over.

By clicking Backup from Dashboard Status page, you will be prompted to save configuration to assigned place.

Step 3: Modify Source Fortigate 30D's configuration

3.1 Copy over #config-version part from 60D file to 30D's as show following screenshot

3.2 Replace Interface name 
In this case, Fortigate 30D is using 'wan' and 'lan' as interface name, but 60D is using 'wan1' and 'internal'. Use replace function to replace 'wan' with 'wan1' and 'lan' with ‘internal’.

Verify all replacement has been completed correctly by searching those interface names.

 4. Restore new configuration file into 60DFrom Dashboard's status page , you will have option to restore configuration from a saved file. 

5. Verify

Reboot the device and check all functions as much as you can, such as Interface , routes, policies, virtual ip  etc.


Reference:

1. Technical Note - How to upgrade from one FortiGate unit to another and keep the same configuration
2. SysAdmin’s Notebook - Transferring a configuration file from one model to another

JunOS SRX Cluster Upgrade Failed

For SRX1400, SRX3400, SRX3600, SRX5600, and SRX5800 devices, command introduced in Junos OS Release 9.6 and support for reboot as a required parameter added in Junos OS Release 11.2R2. For SRX100, SRX210, SRX220, SRX240, and SRX650 devices, command introduced in Junos OS Release 11.2R2. For SRX5400 devices, the command is introduced in Junos OS Release 12.1X46-D20.

Symptoms: 

Symptom 1: "tar: Archive contains obsolescent base-64 headers"

root@fw-1> request system software add no-copy /var/tmp/junos-srxsme-12.1X44-D40.2-domestic.tgz no-validate 
Formatting alternate root (/dev/da0s2a)...
/dev/da0s2a: 627.4MB (1284940 sectors) block size 16384, fragment size 2048
        using 4 cylinder groups of 156.86MB, 10039 blks, 20096 inodes.
super-block backups (for fsck -b #) at:
 32, 321280, 642528, 963776
Extracting /var/tmp/junos-srxsme-12.1X44-D40.2-domestic.tgz ...
tar: Skipping to next header
tar: Archive contains obsolescent base-64 headers

gzip: stdin: invalid compressed data--format violated
tar: Child returned status 1
tar: Error exit delayed from previous errors
ERROR: Failed to extract /var/tmp/junos-srxsme-12.1X44-D40.2-domestic.tgz to /altroot/cf/packages/install-tmp/junos-12.1X44-D40.2-domestic

Cause:

This error usually occurs when a file is transferred over to the server in ASCII mode or ftp server software itself issue. To resolve the issue, transfer the file over to the server again; this time in the binary mode. The best practice is to verify file integrity after uploaded the package to the device.

Solution:

using WinSCP 

Using ftp bin mode:

root@fw-1% ftp 10.9.1.109
Connected to 10.9.1.109.
220 Welcome to Quick 'n Easy FTP Server
Name (10.9.1.109:root): test
331 Password required for test
Password:
230 User successfully logged in.
Remote system type is UNIX.

ftp> bin
200 Type set to BINARY
ftp> get junos-srxsme-12.1X44-D40.2-domestic.tgz
local: junos-srxsme-12.1X44-D40.2-domestic.tgz remote: junos-srxsme-12.1X44-D40.2-domestic.tgz
200 Port command successful.
150 Opening BINARY mode data connection for file transfer.
 29% |**************                                    | 42615 KB    07:26 ETA^                            |  1964 KB    19:34 ETAC

Symptom 2: ISSU in progress error

I am having a hiccup when upgrading JunOS on SRX1400. ISSU upgrade failed because of not enough space on CF folder. Here is the output of failed upgrade process:

root@fw-1-2> request system software in-service-upgrade /var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz reboot no-copy    
Chassis ISSU Started
node0:
--------------------------------------------------------------------------
Chassis ISSU Started
ISSU: Validating Image
Initiating in-service-upgrade

node0:
--------------------------------------------------------------------------
Initiating in-service-upgrade
Checking compatibility with configuration
Initializing...
Verified manifest signed by PackageProduction_12_1_0
Verified junos-12.1X44-D40.2-domestic signed by PackageProduction_12_1_0
Using /var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz
Checking junos requirements on /
Available space: 289258 require: 24128
Saving boot file package in /var/sw/pkg/junos-boot-srx1k3k-12.1X46-D25.7.tgz
Verified manifest signed by PackageProduction_12_1_0
Hardware Database regeneration succeeded
Validating against /config/juniper.conf.gz
Usage: license-check -f "<features>" -m -p -q -M -u -U -V
  -V verify if release based licenses are present
FIPS daemon: warning: request security internal-security-association refresh to take effect
FIPS daemon:
mgd: commit complete
Validation succeeded
Validating against /config/rescue.conf.gz
FIPS daemon: warning: request security internal-security-association refresh to take effect
FIPS daemon:
mgd: commit complete
Validation succeeded
failover all RG 1+ groups to node 1 
Initiated manual failover for all redundancy-groups to node1
Redundancy-groups-0 will not failover and the primaryship remains unchanged.
ISSU: Preparing Backup RE
Pushing bundle to node0
Installing package '/var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz' ...
Verified junos-boot-srx1k3k-12.1X46-D25.7.tgz signed by PackageProduction_12_1_0
Verified junos-srx1k3k-12.1X46-D25.7-domestic signed by PackageProduction_12_1_0
Available space: 289258 require: 297584

WARNING: The /cf filesystem is low on free disk space.
WARNING: This package requires 297584k free, but there
WARNING: is only 289258k available.

WARNING: This installation attempt will be aborted.
ERROR: junos-12.1X46-D25.7-domestic fails requirements check
Installation failed for package '/var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz'
error: Failed to install image on secondary node (error-code: 3.1)
error: ISSU Aborted! Backup node maybe in inconsistent state, Please restore backup node

ISSU aborted. But, both nodes are in ISSU window.
 Please do the following:
 1. Rollback the node with the newer image using rollback command
    Note: use the 'node' option in the rollback command
          otherwise, images on both nodes will be rolled back
 2. Make sure that both nodes (will) have the same image
 3. Ensure the node with older image is primary for all RGs
 4. Abort ISSU on both nodes
 5. Reboot the rolled back node

Solutions: 

1. Clear system to get enough space for upgrading process

{secondary:node0}
root@fw-1-1> request system software delete-backup 
Delete backup system software package [yes,no] (no) yes


{secondary:node0}
root@fw-1-1> show system storage node 0 
node0:
--------------------------------------------------------------------------
Filesystem              Size       Used      Avail  Capacity   Mounted on
/dev/ad0s1a             891M       537M       282M       66%  /
devfs                   1.0K       1.0K         0B      100%  /dev
/dev/md0                523M       523M         0B      100%  /junos
/cf                     891M       537M       282M       66%  /junos/cf
devfs                   1.0K       1.0K         0B      100%  /junos/dev/
procfs                  4.0K       4.0K         0B      100%  /proc
/dev/ad0s1e              99M       102K        91M        0%  /config
/dev/ad2s1f              12G       461M        10G        4%  /var
/dev/md1               1006M       1.0M       924M        0%  /mfs
/var/jail                12G       461M        10G        4%  /jail/var
/var/log                 12G       461M        10G        4%  /jail/var/log
devfs                   1.0K       1.0K         0B      100%  /jail/dev

{secondary:node0}
root@fw-1-1> file delete /cf/packages/?
Possible completions:
  <[Enter]>            Execute this command
  <path>               Path to delete
  /cf/packages/junos   Size: 280224023, Last changed: Aug 28 15:07:56
  /cf/packages/junos-12.1X44-D40.2-domestic  Size: 280224023, Last changed: Aug 28 15:07:56
  /cf/packages/junos-12.1X44-D40.2-domestic.certs  Size: 7153, Last changed: Aug 28 10:15:58
  /cf/packages/junos-12.1X44-D40.2-domestic.sha1  Size: 41, Last changed: Aug 28 15:08:54
  /cf/packages/junos-12.1X44-D40.2-domestic.sig  Size: 525, Last changed: Aug 28 15:09:27
  /cf/packages/junos-srx1k3k-12.1X44-D25.5-domestic  Size: 279916118, Last changed: May 13 2014
  /cf/packages/junos.old  Size: 279916118, Last changed: May 13 2014
{secondary:node0}
root@fw-1-1> file delete /cf/packages/junos-srx1k3k-12.1X44-D25.5-domestic 

{secondary:node0}
root@fw-1-1> show system storage detail 
node0:
--------------------------------------------------------------------------
Filesystem       1024-blocks       Used      Avail   Capacity   Mounted on
/dev/ad0s1a           912232     276540     562714        33%  /
devfs                      1          1          0       100%  /dev
/dev/md0              535230     535230          0       100%  /junos
/cf                   912232     276540     562714        33%  /junos/cf
devfs                      1          1          0       100%  /junos/dev/
procfs                     4          4          0       100%  /proc
/dev/ad0s1e           101202        102      93004         0%  /config
/dev/ad2s1f         12432412     472166   10965654         4%  /var
/dev/md1             1029676       1046     946256         0%  /mfs
/var/jail           12432412     472166   10965654         4%  /jail/var
/var/log            12432412     472166   10965654         4%  /jail/var/log
devfs                      1          1          0       100%  /jail/dev

node1:
--------------------------------------------------------------------------
Filesystem       1024-blocks       Used      Avail   Capacity   Mounted on
/dev/ad0s1a           912232     276540     562714        33%  /
devfs                      1          1          0       100%  /dev
/dev/md0              535230     535230          0       100%  /junos
/cf                   912232     276540     562714        33%  /junos/cf
devfs                      1          1          0       100%  /junos/dev/
procfs                     4          4          0       100%  /proc
/dev/ad0s1e           101202        102      93004         0%  /config
/dev/ad2s1f         12432412     830654   10607166         7%  /var
/dev/md1             1029676      11190     936112         1%  /mfs
/var/jail           12432412     830654   10607166         7%  /jail/var
/var/log            12432412     830654   10607166         7%  /jail/var/log
devfs                      1          1          0       100%  /jail/dev
SW1#

2. Clear ISSU in progress error

After got enough space on both cluster members, I tried another ISSU upgrade but there is another warning message:

root@fw-1-2> request system software in-service-upgrade /var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz reboot no-copy 
warning: ISSU in progress

///Then another one for abort command

root@fw-1-2> request system software abort in-service-upgrade 
error: command is not valid on the srx1400

///Finally got the right command for SRX1400

root@fw-1-2> request chassis cluster in-service-upgrade abort 
Exiting in-service-upgrade window
Chassis ISSU Aborted

3. Successfully upgraded SRX1400 to 12.1X46-D25.7

root@fw-1-2> request system software in-service-upgrade /var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz reboot no-copy    
Chassis ISSU Started
Chassis ISSU Started
ISSU: Validating Image
Initiating in-service-upgrade
Initiating in-service-upgrade
Checking compatibility with configuration
Initializing...
Verified manifest signed by PackageProduction_12_1_0
Verified junos-12.1X44-D40.2-domestic signed by PackageProduction_12_1_0
Using /var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz
Checking junos requirements on /
Available space: 562714 require: 297584
Saving boot file package in /var/sw/pkg/junos-boot-srx1k3k-12.1X46-D25.7.tgz
Verified manifest signed by PackageProduction_12_1_0
Hardware Database regeneration succeeded
Validating against /config/juniper.conf.gz
Usage: license-check -f "<features>" -m -p -q -M -u -U -V
  -V verify if release based licenses are present
FIPS daemon: warning: request security internal-security-association refresh to take effect
FIPS daemon:
mgd: commit complete
Validation succeeded
Validating against /config/rescue.conf.gz
FIPS daemon: warning: request security internal-security-association refresh to take effect
FIPS daemon:
mgd: commit complete
Validation succeeded
failover all RG 1+ groups to node 1 
Initiated manual failover for all redundancy-groups to node1
Redundancy-groups-0 will not failover and the primaryship remains unchanged.
ISSU: Preparing Backup RE
Pushing bundle to node0
Installing package '/var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz' ...
Verified junos-boot-srx1k3k-12.1X46-D25.7.tgz signed by PackageProduction_12_1_0
Verified junos-srx1k3k-12.1X46-D25.7-domestic signed by PackageProduction_12_1_0
Available space: 562714 require: 297584
Saving boot file package in /var/sw/pkg/junos-boot-srx1k3k-12.1X46-D25.7.tgz
JUNOS 12.1X46-D25.7 will become active at next reboot
WARNING: A reboot is required to load this software correctly
WARNING:     Use the 'request system reboot' command
WARNING:         when software installation is complete
Saving state for rollback ...
Finished upgrading secondary node node0
Rebooting Secondary Node
Shutdown NOW!
[pid 90847]
ISSU: Backup RE Prepare Done
Waiting for node0 to reboot.
node0 booted up.
Waiting for node0 to become secondary
node0 became secondary.
Waiting for node0 to be ready for failover
ISSU: Preparing Daemons
Secondary node0 ready for failover.
Installing package '/var/tmp/junos-srx1k3k-12.1X46-D25.7-domestic.tgz' ...
Verified junos-boot-srx1k3k-12.1X46-D25.7.tgz signed by PackageProduction_12_1_0
Verified junos-srx1k3k-12.1X46-D25.7-domestic signed by PackageProduction_12_1_0
Available space: 562714 require: 297584
Saving boot file package in /var/sw/pkg/junos-boot-srx1k3k-12.1X46-D25.7.tgz
JUNOS 12.1X46-D25.7 will become active at next reboot
WARNING: A reboot is required to load this software correctly
WARNING:     Use the 'request system reboot' command
WARNING:         when software installation is complete
Saving state for rollback ...
Failing over all redundancy-groups to node0
ISSU: Preparing for Switchover
Initiated failover for all the redundancy groups to node0
Waiting for node0 take over all redundancy groups


{secondary:node1}
john@fw-1-2> show chassis fpc pic-status    
node0:
--------------------------------------------------------------------------
Slot 0   Online       SRX1k 10GE SYSIO
  PIC 0  Online       6x 1GE RJ45 3x 1GE SFP 3x 10GE SFP+
Slot 1   Online       SRX1k Dual Wide NPC+SPC Support Card
  PIC 0  Online       SPU Cp-Flow
Slot 3   Online       BUILTIN NPC
  PIC 0  Online       NPC PIC

node1:
--------------------------------------------------------------------------
Slot 0   Online       SRX1k 10GE SYSIO
  PIC 0  Online       6x 1GE RJ45 3x 1GE SFP 3x 10GE SFP+
Slot 1   Present      SRX1k Dual Wide NPC+SPC Support Card
Slot 3   Online       BUILTIN NPC
  PIC 0  Online       NPC PIC

{secondary:node1}
john@fw-1-2> show chassis fpc pic-status    
node0:
--------------------------------------------------------------------------
Slot 0   Online       SRX1k 10GE SYSIO
  PIC 0  Online       6x 1GE RJ45 3x 1GE SFP 3x 10GE SFP+
Slot 1   Online       SRX1k Dual Wide NPC+SPC Support Card
  PIC 0  Online       SPU Cp-Flow
Slot 3   Online       BUILTIN NPC
  PIC 0  Online       NPC PIC

node1:
--------------------------------------------------------------------------
Slot 0   Online       SRX1k 10GE SYSIO
  PIC 0  Online       6x 1GE RJ45 3x 1GE SFP 3x 10GE SFP+
Slot 1   Online       SRX1k Dual Wide NPC+SPC Support Card
  PIC 0  Offline     
Slot 3   Online       BUILTIN NPC
  PIC 0  Online       NPC PIC

john@fw-1-2> show chassis fpc pic-status    
node0:
--------------------------------------------------------------------------
Slot 0   Online       SRX1k 10GE SYSIO
  PIC 0  Online       6x 1GE RJ45 3x 1GE SFP 3x 10GE SFP+
Slot 1   Online       SRX1k Dual Wide NPC+SPC Support Card
  PIC 0  Online       SPU Cp-Flow
Slot 3   Online       BUILTIN NPC
  PIC 0  Online       NPC PIC

node1:
--------------------------------------------------------------------------
Slot 0   Online       SRX1k 10GE SYSIO
  PIC 0  Online       6x 1GE RJ45 3x 1GE SFP 3x 10GE SFP+
Slot 1   Online       SRX1k Dual Wide NPC+SPC Support Card
  PIC 0  Online       SPU Cp-Flow
Slot 3   Online       BUILTIN NPC
  PIC 0  Online       NPC PIC

Symptom 3: ISSU not allowed

ohn@fw-com1-1> request system software in-service-upgrade /var/tmp/junos-srxsme-15.1X49-D50.3-domestic.tgz no-sync 
WARNING: Not enabled dual root partition on secondary node
         ISSU not allowed

Solution:

Using regular upgrade method.

Reference:

• [EX] How to recover the system from the 'warning: ISSU in progress' error message

Native VLAN mismatch Error on Access Port

Cisco switches always have VLAN 1 as the default VLAN, which is needed for many protocol communication between switches like spanning-tree protocol for instance. Unfortunately you can't change or even delete the default VLAN, it is mandatory.

The native VLAN is the only VLAN which is not tagged in a trunk, in other words, native VLAN frames are transmitted unchanged.

Per default the native VLAN is VLAN 1 but you can change that.

#show interface Fa0/8 trunk

Port        Mode             Encapsulation  Status        Native vlan

Fa0/8       on               802.1q         other         1

To change it use the following command: switchport trunk native vlan <vlan number>

(config-if)#switchport trunk native vlan 2

(config-if)#do show interface f0/8 trunk

Port        Mode             Encapsulation  Status        Native vlan

Fa0/8       on               802.1q         other         2

The default VLAN is still VLAN 1.

#show vlan id 1

VLAN Name Status    Ports

---- -------------------------------- --------- -------------------------------

1    default active    Fa0/8, Gi0/1

I am having two switches connected by access port but with two different vlan at both end. On both ends I got following Native VLAN mismatch discovered errors.

SW1# sh log
Aug  5 15:16:35.286: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug  5 15:17:33.992: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug  5 15:18:32.149: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug  5 15:19:28.217: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug  5 15:20:24.622: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug  5 15:21:17.736: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug  5 15:22:10.554: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug  5 15:23:01.778: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug  5 15:24:00.581: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). SW1# 

SW1#show cdp nei det | b SW2

Device ID: SW2
Entry address(es): 
  IP address: 172.18.14.11
Platform: cisco ISR4331/K9,  Capabilities: Router Switch IGMP 
Interface: GigabitEthernet1/39,  Port ID (outgoing port): GigabitEthernet0/1/0
Holdtime : 151 sec

Version :
Cisco IOS Software, ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.6(1)S1, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Wed 09-Mar-16 18:32 by mcpre

advertisement version: 2
VTP Management Domain: ''
Native VLAN: 2 (Mismatch)
Duplex: full
Power Available TLV:

    Power request id: 0, Power management id: 1, Power available: 0, Power management level: -1
Management address(es): 
  IP address: 172.18.14.11
SW1#

The Configuration on the ports at both ends:

SW1(config-if)#do sh run int g1/39
Building configuration...

Current configuration : 133 bytes
!
interface GigabitEthernet1/39
 description SW2 G0/1/0
 switchport access vlan 14
 switchport mode access
end
SW1#

SW2#sh run int g0/1/0

interface GigabitEthernet0/1/0
 description MS-Network-MGMT
 switchport access vlan 2
 spanning-tree portfast 

SW2#show cdp nei det
... Device ID: SW1 Entry address(es):   IP address: 172.18.14.3 Platform: cisco WS-C4510R+E,  Capabilities: Router Switch IGMP Interface: GigabitEthernet0/1/0,  Port ID (outgoing port): GigabitEthernet1/39 Holdtime : 121 sec 

SW2#

In circumstances like this, where you are sure the mismatch is not a real problem, you may consider to disable cdp for those interfaces to shut up those noise information.

SW2#show run int g1/39
Building configuration...

Current configuration : 148 bytes
!
interface GigabitEthernet1/39
 description SW2 G0/1/0
 switchport access vlan 14
 switchport mode access
 no cdp enable
end

SW2#

Cisco Configuration Professional (CCP) Configure IOS SSL VPN (AnyConnect SSL VPN)

Basic Cisco Configuration Professional (CCP) configuration has been posted before at following link:

• Cisco CCP Installation and Basic Configuration

This Post will demonstrate how to use CCP to configure SSL VPN on an IOS Router.

1. Confirm SSL-VPN License Installed

You can review another post regarding how to add Cisco license into a router.

From Command Line:

VPN-1#show license detail
Index: 1        Feature: NtwkEssSuitek9                    Version: 1.0
        License Type: EvalRightToUse
        License State: Active, Not in Use, EULA not accepted
            Evaluation total period: 8  weeks 4  days
            Evaluation period left: 8  weeks 4  days
            Period used: 0  minute  0  second
        License Count: Non-Counted
        License Priority: None
        Store Index: 2
        Store Name: Built-In License Storage
Index: 2        Feature: SSL_VPN                           Version: 1.0
        License Type: Permanent
        License State: Active, Not in Use
        License Count: 10/0/0  (Active/In-use/Violation)
        License Priority: Medium
        Store Index: 1
        Store Name: Primary License Storage
Index: 3        Feature: datak9                            Version: 1.0
        License Type: EvalRightToUse
        License State: Active, Not in Use, EULA not accepted
            Evaluation total period: 8  weeks 4  days
            Evaluation period left: 8  weeks 4  days
            Period used: 0  minute  0  second
        License Count: Non-Counted
        License Priority: None
        Store Index: 1
        Store Name: Built-In License Storage
Index: 4        Feature: ios-ips-update                    Version: 1.0
        License Type: EvalRightToUse
        License State: Active, Not in Use, EULA not accepted
            Evaluation total period: 8  weeks 4  days
            Evaluation period left: 8  weeks 4  days
            Period used: 0  minute  0  second
        License Count: Non-Counted
        License Priority: None
        Store Index: 3
        Store Name: Built-In License Storage
Index: 5        Feature: ipbasek9                          Version: 1.0
        License Type: Permanent
        License State: Active, In Use
        License Count: Non-Counted
        License Priority: Medium
        Store Index: 0
        Store Name: Primary License Storage
Index: 6        Feature: securityk9                        Version: 1.0
        License Type: Permanent
        License State: Active, In Use
        License Count: Non-Counted
        License Priority: Medium
        Store Index: 2
        Store Name: Primary License Storage
Index: 7        Feature: securityk9                        Version: 1.0
        License Type: EvalRightToUse
        License State: Inactive
            Evaluation total period: 8  weeks 4  days
            Evaluation period left: 8  weeks 4  days
            Period used: 0  minute  0  second
        License Count: Non-Counted
        License Priority: None
        Store Index: 0
        Store Name: Built-In License Storage

2. Launch SSL-VPN Configuration Wizard

3. Configuration Wizard：
3.1 Configure IP Address and Name

3.2 Configure User Authentication Methods

3. Configure IP Address Pool

3.4 SSL VPN Tunnel Interface

3.5 SSL VPN Portal Page

3.6 Summary of the Configuraiton

SSL VPN Service Name : Rogers-SSL-1
SSL VPN Policy Name : policy_1
SSL VPN Gateway Name : gateway_1

Virtual Template IP Address: Un-numbered to GigabitEthernet0/0

User Authentication Method List :  Local

Intranet websites:  Disabled

Full Tunnel Configuration
 SVC Status : Yes
 IP Address Pool : 192.168.5.0-x
 Split Tunneling : Disabled
 Split DNS : Disabled
 Install Full Tunnel Client : Disabled

Configuration which sent to the router:

aaa authentication login ciscocp_vpn_xauth_ml_1 local
ip local pool 192.168.5.0-x 192.168.5.50 192.168.5.200
interface Virtual-Template1
 exit
default interface Virtual-Template1
interface Virtual-Template1
 no shutdown
 ip unnumbered GigabitEthernet0/0
 exit
webvpn gateway gateway_1
 ip address 158.106.98.166 port 443
 http-redirect port 80
 inservice
 ssl trustpoint TP-self-signed-3017776587
 exit
webvpn context Rogers-SSL-1
 aaa authentication list ciscocp_vpn_xauth_ml_1
 gateway gateway_1
 virtual-template 1
 max-users 75
 inservice
 secondary-color white
 title-color #669999
 text-color black
 policy group policy_1
  svc keep-client-installed
  functions svc-enabled
  svc address-pool 192.168.5.0-x netmask 255.255.255.255
  exit
 default-group-policy policy_1
 exit

4. Upload AnyConnect 4.x Package
Latest version is 4.3.01095. It can be downloaded from Cisco Website.

The downloaded package can be imported into Router from CCP Configuration - Security - VPN - SSL-VPN - Package:

Check the package from command line:

VPN-1#dir flash:
Directory of usbflash0:/

    1  -rw-    75608148   Jun 3 2016 14:13:10 -04:00  c1900-universalk9-mz.SPA.154-3.M3.bin
    2  -rw-        3066   Jun 3 2016 14:24:04 -04:00  cpconfig-19xx.cfg
    3  -rw-        1160  Jul 24 2016 10:58:00 -04:00  1.lic.txt
    4  drw-           0   Jun 3 2016 14:24:34 -04:00  ccpexp
  374  -rw-       22737   Jun 3 2016 14:27:22 -04:00  home.html
  382  -rw-        1154   Aug 1 2016 10:34:22 -04:00  2.lic
  388  drw-           0   Aug 1 2016 14:56:12 -04:00  webvpn
  395  -rw-    25162392   Aug 1 2016 15:07:34 -04:00  anyconnect-win-4.3.01095-k9.pkg

251371520 bytes total (113504256 bytes free)

Note: There is a issue when choosing my computer's locale file as location of client software. It always says "You have entered an invalid full tunnel client package. Please specify a valid file". It obviously is a bug on CPE. The option way is to upload pkg directly to the router's flash memory card. Then choose the file in router's flash memory and install it.

Or following following process to install it from command line:

a.- Copy the .pkg into the ROOT flash directory:
 #copy ftp: flash:

b.- Make sure there's enough room to accommodate the installation package. At least same amount of free space as the actual size of the .pkg file copied over at the previous step. Reason is that the IOS copies the file to the flash:/webvpn directory when issuing the below command.

c.- Install the .pkg (run it from config mode, type the full command to run it although the command is not present)
#webvpn install svc flash:anyconnect-win-3.1.05160-k9.pkg seq 1
(wait for a couple of seconds...)
SSLVPN Package SSL-VPN-Client (seq:1): installed successfully

R1(config)#webvpn install svc flash:anyconnect-macosx-i386-4.3.02039-k9.pkg seq 2
SSLVPN Package SSL-VPN-Client (seq:2): installed successfully

5. Verify

Lauch web page from broswer:

After log into SSLVPN Service portal, choose Start for Application Access:

Another Web page will be opened to try to load AnyConnect Secure Mobility Client. It also provide link to manual Installation for AnyConnect VPN client which has been uploaded into Router at step 4.

Cisco AnyConnect Secure Mobility Client launched:
 

Reference:

• AnyConnect VPN (SSL) Client on IOS Router with CCP Configuration Example
• CONFIGURING CISCO SSL VPN ANYCONNECT (WEBVPN) ON CISCO IOS ROUTERS