SRX100 in bootloop. Flash storage problem

juniperjuniper-srxsrxtroubleshooting

About a month ago one of my SRX100 started to go into a bootloop for no obvious reason to me.

After some hours, it eventually stopped and booted up the system again (primary) and I was happy that I could create a rescue config. However, I did not have time to copy the configuration to a remote host before this issue started again.
The device boots up, give me a few error messages that varies, such as:

SUMMARY INFORMATION BAD
SALVAGE? yes

BLK(S) MISSING IN BIT MAPS
SALVAGE? yes

FREE BLK COUNT(S) WRONG IN SUPERBLK
SALVAGE? yes

Sometimes it also says (but as stated before, it varies):

INCORRECT BLOCK COUNT I=33517 (16 should be 0)
CORRECT? yes

So I started google a bit and found several posts that looked similar and they where all recommended to install a fresh version of JUNOS from a USB or TFTP server. So I did the same. I installed the newest version I could find (junos-12.1X45-D15.5-domestic) using TFTP with the --format option but I am still having the same problem.

Basically, the device is fine and can boot up, I can even log in (the interfaces haven't activated yet though), and after about 50-60 sec it just reboots again, without any messages on the console. Looks like it got a power reset or something.

I've also tried running the nand-mediack.sh utility (just running the script, no options) but it just comes back empty.

So, anyone have a clue of what's going on here? Is there any logs I can look at? Can I transfer my config out of there?

Thanks in advance.

Best Answer

Your config is possibly safe (if you care about them you should consider rancid or make manual backups) as it's on a different partition.

If you place the install image on a FAT32 formatted USB key you can reinstall JunOS from there, however you may need to use the reformat option which will wipe any config.

Juniper doc: http://www.trapezenetworks.com/techpubs/en_US/junos12.2/topics/task/installation/security-junos-os-boot-loader-usb-storage-device-srx-series-device-installing.html

Related Solutions

Juniper SRX240H loses connectivity to upstream router

Here's some version info that should help. I think that the other thing that immediately strikes me is autonegotiation being disabled, which shouldn't be necessary. Is this something that your provider is asking for, or based on learned behaviors? I recommend reading what's out there, since autonegotiation has been recommended for over 10 years. Anything you're connecting to should work fine with it as well (the last time I had issues was on a 3500XL - we're talking ooooold). Check out:

http://etherealmind.com/ethernet-autonegotiation-works-why-how-standard-should-be-set/

First off, Junos 11.4R7.5 is the supported release recommended for SRX240, as of 8 April 2013, per JTAC (since you mentioned versions).

http://kb.juniper.net/InfoCenter/index?page=content&id=KB21476 (need login)

Also, JTAC recommends EEOL releases on SRX or J Series for IPsec features (may or may not apply, but FYI). (For me, the only releases available for SRX240H on juniper.net are 10.4, 11.4, and 12.1 - that may help set your expectations on what to run.)

http://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2013-01-822&actionBtn=Search (need login)

You are also running a version that was released before the malformed TCP vulnerability came out. I shudder to think that a live exploit exists, but you definitely need to be on versions that were published around January or February 2013, or later. The versions you need for 11.2 are 11.2R5.5 or 11.2R7.5 (or higher)

http://osvdb.org/89751

I mentioned versions because the SRX is a 'rapidly evolving' platform as well, and anecdotal evidence and hearsay suggests that you'll want to upgrade more frequently.

Nat – ASA 5510 NAT stops working

Looking through the "fixed" bugs (8.2.5 Interim Release Notes):

CSCti62667 Connections stay open w/ 'sysopt connection timewait' & NetFlow
CSCtl06156 NAT Xlate idle timer doesn't reset with Conn.
CSCtr94429 ASA: Local-host and all conns are torn down when client hits conn limit

You've confirmed the system is not "Restricted(R)" -- unlimited interfaces and users. That's the most common reason for the failure mode you've described. (It stops allowing new connections.) Threat-detection could also result in new connections being dropped. Neither of these should cause traffic to stop for existing xlates.

clear xlate needs a follow up clear conn all to completely clear everything. If it's not clearing them, then there's something else wrong. (or they're being recreated instantly.)

Cisco documents the 5510 as supporting up to 50k (130k for a secplus license) concurrent connections. I'd be very surprised if you've hit that wall. (show conn count and look at the "most used". %ASA-5-321001 would be logged if you did.)

Beyond that, if it's not logging any reason(s) for dropping/refusing connections, I'm at a loss where else to look.

Best Answer

Related Solutions

Juniper SRX240H loses connectivity to upstream router

Nat – ASA 5510 NAT stops working

Related Topic