Page 1: Table Of Contents
These release notes accompany Release 10.1R3 of the JUNOS Software. They describe device documentation and known problems with the software. JUNOS Software runs on all Juniper Networks M Series, MX Series, and T Series routing platforms, SRX Series Services Gateways, J Series Services Routers, and EX Series Ethernet Switches.
Page 2 Upgrading from JUNOS Release 9.2 or Earlier on a Router Enabled for Both PIM and NSR ..............104 Downgrade from Release 10.1 ............105 JUNOS Software Release Notes for Juniper Networks SRX Series Services Gateways and J Series Services Routers ..........107 New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers ............107...
Page 3 Security ..................131 WLAN .....................131 Known Limitations in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers ..........132 [accounting-options] Hierarchy ............132 AX411 Access Point ...............132 Chassis Cluster ................132 Command-Line Interface (CLI) ............133 Dynamic VPN .................134 Flow and Processing ...............134 Hardware ..................135 Interfaces and Routing ..............136 Intrusion Detection and Prevention (IDP) ........138...
Page 4 JUNOS 10.1 Software Release Notes Dual-Root Partitioning Scheme Documentation for SRX Series Services Gateways ..................175 Dual-Root Partitioning Scheme ............175 Maximizing ALG Sessions ..............183 Using Dual Chassis Cluster Control Links: Upgrade Instructions for the Second Routing Engine ..............184 Upgrade and Downgrade Instructions for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers ....185 JUNOS Software Release Notes for EX Series Switches ........186 New Features in JUNOS Release 10.1 for EX Series Switches ....186...
Page 5 Upgrade and Downgrade Issues for JUNOS Release 10.1 for EX Series Switches ..................200 Upgrading or Downgrading from JUNOS Release 9.4R1 for EX Series Switches ..................200 Upgrading from JUNOS Release 9.3R1 to Release 10.1 for EX Series Switches ..................200 Upgrading from JUNOS Release 9.2 to Release 10.1 for EX Series Switches ..................201 Downgrading from JUNOS Release 10.1 to Release 9.2 for EX4200 Switches ..................202...
Page 6: Junos Software Release Notes For Juniper Networks M Series Multiservice Edge Routers, Mx Series Ethernet Service Routers, And T Series Core Routers
[edit interfaces] [Class of Service] JUNOS Software Release Notes for Juniper Networks M Series Multiservice Edge Routers, MX Series Ethernet Service Routers, and T Series Core Routers...
Page 7 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Distribute excess bandwidth among different services for a subscriber (MX Series routers with Trio MPC/MIC interfaces) Service providers often use tiered services that must carry excess bandwidth as traffic patterns vary. By default, excess bandwidth between a configured guaranteed rate and shaping rate is shared equally among all queues, which might not be optimal for all subscribers to a service.
Page 8 JUNOS 10.1 Software Release Notes statement at the link-protection [edit interfaces aex aggregated-ether-options link-protection] hierarchy level. To display the active, primary, and backup link for an aggregated Ethernet interface, use the operational mode command show interfaces redundancy aex [Class of Service, Network Interfaces] Re-marking of MVPN GRE encapsulation DCSP at ASBR (MX Series routers with Trio MPC/MIC interfaces) Enables you to configure DSCP marking for GRE encapsulated packets that aligns with the service provider core CoS policy...
Page 9 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers GMRP GVRP LACP PVST xSTP The Layer 3 protocols supporting the preclassifier are: IGMP IPv4/IPv6 ICMP IPv4/IPv6 ISIS IPv4/IPv6 OSPF IPv4/IPv6 PIM IPv4 Router Alert IPv4/IPv6 RSVP IPv4/IPv6 VRRP The Layer 4 protocols supporting the preclassifier are:...
Page 10 JUNOS 10.1 Software Release Notes Flexible Ethernet encapsulation (JUNOS Release 10.0R2) Graceful Routing Engine switchover (GRES) (JUNOS Release 10.0R2) Ingress differentiated (JUNOS Release 10.0R2) Differentiated Services code point rewrite (DSCP) (JUNOS Release 10.0R2) Intelligent oversubscription (JUNOS Release 10.0R2) Integrated routing and bridging (IRB) (JUNOS Release 10.1R1) Intermediate System-to-Intermediate System (IS-IS) (JUNOS Release 10.0R2) Internet Group Management Protocol (IGMP) (excludes snooping) (JUNOS Release 10.0R2)
Page 11 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Shaping at the queue level Scheduling of queues based on weighted round-robin (WRR) per priority class Tricolor marking Weighted random early detection (WRED) QoS per virtual LAN (VLAN): (JUNOS Release 10.0R2) Accounting, filtering, and policing IEEE 802.1p rewrite Classification...
Page 12: High Availability
JUNOS 10.1 Software Release Notes IEEE 802.1ak-2007 MVRP (MX Series routers) The Multiple VLAN Registration Protocol (MVRP) is a standards-based Layer 2 network protocol used among switches to dynamically share and update VLAN information with other bridges. VLAN information exchanged includes: The set of VLANs that currently have active members The ports through which the active members can be reached To operate MVRP, edge ports should have the static VLAN configuration.
Page 13 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers New 20-port Gigabit Ethernet MIC with SFP (model number MIC-3D-20GE-SFP) Supported on MX Series routers. For a list of supported MPCs, see the MX Series Line Card Guide. New Modular Port Concentrators (MPCs) and Modular Interface Cards (MICs) Supported on MX Series platforms.
Page 14 JUNOS 10.1 Software Release Notes (and so on) is not supported. Use the offline procedures to upgrade and integrate the remaining T1600 routers into the routing matrix. [TX Matrix Plus Hardware, System Basics and Services Command Reference] Per-unit scheduling for GRE tunnels using IQ2 PICs (M7i, M10i, M120, and M320 routers with E3 FPC) Supports enhanced IQ2 PIC and IQ2E PIC performance, adding all functionality of tunnel PICs.
Page 15 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Two new AC power supply modules in chassis The JUNOS Software now supports two new AC power supply modules on T640 and T1600 routers: AC Power Entry Module 10kW US and AC Power Entry Module 10kW EMEA (for U.S.
Page 16 JUNOS 10.1 Software Release Notes packets contain the correct input and output interface SNMP index, the source and destination AS numbers, and the source and destination mask. There are two ways to verify the sampled packets. The first is to include the file sampled statement at the...
Page 17 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The JUNOS Software also supports M13 mapped T1 interfaces under CAU4. To configure a T1 interface under CAU4, use the statement at the [edit interfaces cau4-fpc/pic/port:unit partition partition-number interface-type t1] [edit interfaces hierarchy level.
Page 18: Junos Xml Api And Scripting
JUNOS 10.1 Software Release Notes JUNOS XML API and Scripting New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers...
Page 19 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers New JUNOS XML API operational request tag elements Table 1 on page 19 lists the JUNOS Extensible Markup Language (XML) operational request tag elements that are new in JUNOS Release 10.1, along with the corresponding CLI command and response tag element for each one.
Page 20 JUNOS 10.1 Software Release Notes Table 1: JUNOS XML Tag Elements and CLI Command Equivalents New in JUNOS 10.1 (continued) Request Tag Element CLI Command Response Tag Element <get-mvrp-registration-state> show mvrp registration-state <mvrp-registration-information> get_mvrp_registration_state <get-mvrp-interface-statistics> show mvrp statistics <mvrp-interface-statistics> get_mvrp_interface_statistics <get-idp-subscriber-policy-list>...
Page 21: Mpls Applications
New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers [JUNOS XML API Operational Reference] MPLS Applications Static LSPs at the ingress router You can now configure a named static LSP at the ingress router. This feature allows you to configure multiple static LSPs between two specific routers.
Page 22: Multiplay
JUNOS 10.1 Software Release Notes [MPLS] Static LSP revert timer You can now configure a revert timer for ingress and transit static LSPs. After traffic has been switched to a bypass static LSP, it is typically switched back to the primary static LSP when it comes back up. There is a configurable delay in the time (called the revert timer) between when the primary static LSP comes up and when traffic is reverted back to it from the bypass static LSP.
Page 23: Routing Policy And Firewall Filters
New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Integrated Multi-Services Gateway (IMSG) failed call reporting Provides more extensive statistics on failed calls through improved command output. show You can use the following existing command to display statistics on failed calls: show services border-signaling-gateway calls-failed gateway gateway-name [Multiplay Solutions, System Basics Command Reference] Integrated Multi-Services Gateway (IMSG) media release Enables the IMSG...
Page 24: Routing Protocols
By default, the tracking bit is set to 1 and PIM join suppression is disabled. This is the default behavior for JUNOS Release 10.0 and earlier for Juniper Networks routers. With join suppression disabled (T-bit=1), a downstream receiving router will send join messages even if it receives identical joins for the same upstream router, as long as no other router in the network has join suppression enabled.
Page 25 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers specified by the timer. This is a random timer with value ranges between 0 to Max Override Interval. The timer is reset each time join suppression is triggered, and the defer period is dependent on other settings in the LAN prune delay, including propagation-delay and override-interval.
Page 26 JUNOS 10.1 Software Release Notes hierarchy level on all PE routers group-address source source-address pim-ssm] participating in the MVPN. Include the threshold-rate statement and specify zero as the threshold value at the [edit routing-instances routing-instance-name provider-tunnel selective group group-address source source-address] hierarchy level on all PE routers participating in the MVPN.
Page 27: Services Applications
New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Services Applications FlowTapLite enhancements Extend support for interception of IPv6 packets on MX Series, M120, and M320 routers. For IPv6, the global filter taps packets from the default IPv6 routing table and does not tap packets from other VRFs.
Page 28 JUNOS 10.1 Software Release Notes JUNOS subscriber access scaling values (M120, M320, and MX Series routers) Table 2 on page 28 lists the DHCP, PPP, and PPPoE scaling values supported for subscriber access in this release of M120, M320, and MX Series routers.
Page 29 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers In this case, each subscriber connection consumes two logical interfaces: one for the VLAN logical interface and one for the pp0 logical interface. The M120, M320, and MX Series routers support a maximum of 2000 different dynamic profiles per chassis.
Page 30 JUNOS 10.1 Software Release Notes To enable IPv6 addressing for a static VLAN subscriber interface, include the statement at the family inet6 [edit dynamic profiles profile-name interfaces interface-name unit logical-unit-number] hierarchy level. To enable IPv6 addressing for a demux subscriber interface, include the family inet6 statement at the...
Page 31 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Attribute Number Attribute Name 26-129 IPv6-NdRa-Prefix 26-151 IPv6-Acct-Input-Octets 26-152 IPv6-Acct-Output-Octets 26-153 IPv6-Acct-Input-Packets 26-154 IPv6-Acct-Output-Packets 26-155 IPv6-Acct-Input-Gigawords 26-156 IPv6-Acct-Output-Gigawords 26-157 IPv6-NdRa-Pool-Name You can monitor IPv6 statistics by issuing the show subscribers show commands.
Page 32 JUNOS 10.1 Software Release Notes interfaces pp0 { unit $junos-interface-unit { keepalives interval seconds; no-keepalives; pppoe-options { underlying-interface "$junos-underlying-interface"; server; ppp-options { chap; pap; family inet { unnumbered-address interface-name; address address; service { input { service-set service-set-name <service-filter filter-name>; output { service-set service-set-name <service-filter filter-name>;...
Page 33 (retailers). In a Juniper Networks subscriber access network, you accomplish Layer 3 partitioning through the use of logical systems (LSs) and routing instances. Logical systems enable you to divide a physical router into separate, distinct, logical administrative domains.
Page 34 JUNOS 10.1 Software Release Notes When configuring PPPoE Layer 3 wholesale for a subscriber access network, keep the following in mind: PPPoE Layer 3 wholesaling supports the use of only the default logical system using multiple routing instances. Each routing instance must contain a loopback with one or more addresses to be used for the unnumbered interface.
Page 35 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers level), the statements do not support any additional chap configuration options, including the passive statement. PPP dynamic interfaces are supported only on PPPoE interfaces ( ) for this interface pp0 release.
Page 36: System Logging
JUNOS 10.1 Software Release Notes For information about how to configure subscriber secure policy traffic mirroring, see the Subscriber Access Configuration Guide. [Subscriber Access] Support for PPP/PPPoE subscriber interfaces on the Trio MPC/MIC family of products (MX Series routers) Enables you to configure PPP/PPPoE subscriber interfaces that are running over the Trio MPC/MIC family of products when used on MX Series routers.
Page 37 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers FCD Describes messages with the FCD prefix. They are generated by the Fibre Channel process (fcd) which connects servers to disks and tape devices in a storage area network. GPRSD Describes messages with the GPRSD prefix.
Page 38: User Interface And Configuration
JUNOS 10.1 Software Release Notes RPD_RA_DYN_CFG_SES_ID_MISMATCH RPD_RT_CFG_BR_CONFLICT The following system log messages are no longer documented: DFWD_CONFIG_FW_UNSUPPORTED LLDPD_PARSE_ARGS LLDPD_PARSE_BAD_SWITCH LLDPD_PARSE_CMD_ARG LLDPD_PARSE_CMD_EXTRA LLDPD_PARSE_USAGE LPDFD_DYN_SDB_OPEN_FAILED User Interface and Configuration Enhanced support for up to 64 ECMP next hops for load balancing on M10i routers with Enhanced CFEB, M320, M120, MX Series, and T Series Core routers The JUNOS Software supports configurations of 16, 32, or 64 equal-cost multipath (ECMP) next hops for RSVP and LDP LSPs on M10i routers with an...
Page 39 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The enhanced ECMP limit of up to 64 ECMP next hops is also applicable for Layer 3 VPNs, Layer 2 VPNs, Layer 2 circuits, and VPLS services that resolve over an MPLS route, because the available ECMP paths in the MPLS route can also be used by such traffic.
Page 40 JUNOS 10.1 Software Release Notes login { class class-name { access-start HHMM; access-end HHMM; To configure user access on specific days of the week for a specified duration, include the , and statements. allowed-days access-start access-end [edit system] login { class class-name { allowed-days days-of-the-week;...
Page 41 New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers interfaces on which it might run. However, in a subscriber access network, static configuration of the router advertisement protocol becomes impractical because the number of interfaces that potentially need the router advertisement protocol increases substantially.
Page 42: Changes In Default Behavior And Syntax In Junos Release 10.1 For M Series, Mx Series, And T Series Routers
JUNOS 10.1 Software Release Notes Changes in Default Behavior and Syntax in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Class of Service Forwarding class to queue number maps not supported on Multiservices link services intelligent queuing (LSQ) interfaces If you configure a forwarding class map associating a forwarding class with a queue number, these maps are not supported on Multiservices link services intelligent queuing ( ) interfaces.
Page 43 Changes in Default Behavior and Syntax in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers interface. If you do not configure a bandwidth for the logical interface, it is automatically set to the bandwidth configured for the physical interface. [Network Interfaces] Support for line-rate mode on 10-port 10-Gigabit Oversubscribed Ethernet (OSE) PIC (T640, T1600, TX Matrix Plus platforms)
Page 44 JUNOS 10.1 Software Release Notes [Network Interfaces] Commit-time warning messages at the hierarchy level are [edit interfaces] now system logged CLI commit-time warnings displayed for configuration at [edit interfaces] hierarchy level have been removed and are now logged as system log messages. This change is applicable to JUNOS Release 10.1R1 and later, 10.0R2, and 9.3R4.
Page 45 Changes in Default Behavior and Syntax in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers [System Basics Command Reference] Modification to the output of the show interfaces extensive command output For IQ2E interfaces, the command output no show interfaces extensive longer displays the schedulers...
Page 46: Layer 2 Ethernet Services
JUNOS 10.1 Software Release Notes [System Basics Command Reference] Layer 2 Ethernet Services Modification to the output of the show dhcp (relay or server) binding commands The output of the show dhcp server binding summary command, command, and the show dhcp relay binding summary show dhcpv6 server binding command has been modified to include the number of clients in the init...
Page 47: Multiplay
Changes in Default Behavior and Syntax in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Multiplay Border gateway function (BGF) improved efficiency and scalability through use of service interface pools You can now use service interface pools to improve the maintainability and scalability of your service set configurations.
Page 48: Services Applications
JUNOS 10.1 Software Release Notes Increase in limit to external paths accepted for BGP route target filtering You can now specify for BGP to accept up to 256 external paths for route target filtering. Previously, the maximum number that you could configure was 16. The default value remains one (1).
Page 49 Changes in Default Behavior and Syntax in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Default idle timeout value for UDP- and TCP-based applications Upon identification by AppID, the default idle timeout value is set to 30 seconds for UDP-based applications and 1 hour for TCP-based applications.
Page 50: Subscriber Access Management
JUNOS 10.1 Software Release Notes new-transaction-input-policies [policy-and-policy-set-names] new-transaction-output-policies [policy-and-policy-set-names] [Services Interfaces, System Basics and Services Command Reference] Requirement for client-to-servicer and server-to-client signatures For certain applications that have signatures for both client-to-server and server-to-client directions, APPID (DAA) needs to see the data packets in both directions on the same session to finish the identification process.
Page 51: User Interface And Configuration
Changes in Default Behavior and Syntax in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers RADIUS interim accounting When subscriber management receives the RADIUS Acct-Interim-Interval attribute (attribute 85), RADIUS interim accounting is performed based on the value in the attribute. The router uses the following guidelines: Attribute value is within the acceptable range (10 to 1440 minutes) Accounting is updated at the specified interval.
Page 52: Vpns
JUNOS 10.1 Software Release Notes [System Basics] VPNs Mirroring IRB packets as Layer 2 packets (MX Series router) If you associate an IRB with the bridge domain (or VPLS routing instance), and also configure within the bridge domain (or VPLS routing instance) a forwarding table filter with port-mirror port-mirror-instance action, then the IRB packet is mirrored as...
Page 53 Changes in Default Behavior and Syntax in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The M Series routing platforms continue to support only inet traffic for Layer 2.5 VPNs. [Network Interfaces, Translational Cross-Connect and Layer 2.5 VPNs Feature Guide, VPNs] New configuration statement for removing dynamically learned MAC addresses from the MAC address database Media access control (MAC) flush...
Page 54: Issues In Junos Release 10.1 For M Series, Mx Series, And T Series Routers
JUNOS 10.1 Software Release Notes edge (NPE) router goes down, causing the multitenant unit switch to switch to the this NPE router. NOTE: This option has a similar effect in a VPLS multihoming environment with multiple multitenant unit switches connected to NPE routers, where both multitenant unit switches have pseudowires that terminate in a mesh group with local-switching configured.
Page 55 Juniper Networks default setting. As a workaround, do not issue the command. [PR/274399] On the Juniper Control System (JCS) platform, the control and management traffic for all Routing Engines shares the same physical link on the same switch module.
Page 56 JUNOS 10.1 Software Release Notes The MX DPC might reboot with the error message: "EZ: ezchip_get_srh_msg_from_srhq". [PR/310223] The bridge-domain MAC learn limit on the Packet Forwarding Engine can sometimes become negative if the bridge domain is deleted and added immediately as part of a configuration change. If that happens, the MAC learning on that bridge domain can be affected.
Page 57 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The output of the command displays the voltage show chassis environment pem used in FPC slots 0 through 3, even after the FPC is taken offline. [PR/528821] If no dot1p classifier is explicitly configured for the logical interface of vid=0, to accept priority tagged packets, packets without an IP header such as STP will determine the forwarding class based on the priority tag value.
Page 58 JUNOS 10.1 Software Release Notes Network Management SNMP may stop working after a router reboot, DPC/FPC/MPC restart, or a graceful Routing Engine switchover. [PR/525002] MPLS Applications column in the output of the command and the show mpls lsp active route counter in the output of the show mpls lsp extensive command are incorrect...
Page 59 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers On T Series and M320 routers, multicast traffic with the "do not fragment" bit is being dropped due to configuring a low MTU value. The router might stop forwarding all traffic transiting this interface if the command is clear pim join...
Page 60 JUNOS 10.1 Software Release Notes The SFC management interface is often displayed as in several warning fxp0 messages. [PR/454074] The VPN label does not get pushed on the label stack for Routing Engine–generated traffic with l3vpn-composite-next-hop activated. As a workaround, configure per-packet load balancing to push the VPN/tunnel labels correctly.
Page 61 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers user-vlan-id user-vlan-id-except VPLS flood FTF and input FTF Simple filters Filter action 'then ipsec-sa' Filter action 'then next-hop-group' Mac-filter output accounting and output policing [PR/466990] When a firewall loopback filter exists and the default term is discard, the multicast forwarding cache entries will be created since the resolve request is dropped at the Packet Forwarding Engine level.
Page 62 JUNOS 10.1 Software Release Notes The Juniper Networks rendezvous point (RP) does not process PIM Register messages from a first-hop router in an IPv6 embedded RP group when the Register message does not have the null-bit set. [PR/486902] When a PPMD delegation of BFD sessions is configured over AE interfaces, graceful Routing Engine switchover and NSR do not work.
Page 63 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers does not detect the attack on the non-standard port (for example, junos:ftp on port 85). [PR/477748] In the export version of the JUNOS Software, the signature download does not work for AppID and IDP features in the Dynamic Application Awareness (DAA) suite.
Page 64 JUNOS 10.1 Software Release Notes The logical system administrator can modify and delete master administrator-only configurations by performing local operations such as issuing the load override load replace , and load update commands. [PR/238991] The “replace:” tag is missing from the output of the command from save terminal inside a configuration object.
Page 65 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The licenses are not synced between the master and backup Routing Engine unless the statement is configured. system license traceoptions file file-name [PR/501443] Invalid XML characters such as &#x11 (0x11) or &#20 (0x14) are allowed to be loaded into the router.
Page 66 JUNOS 10.1 Software Release Notes Resolved Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Class of Service When you set the port speed of a multirate SONET Type 2 PIC to OC3, the class-of-service (CoS) speed value is not changed correctly within the Packet Forwarding Engine.
Page 67 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Interfaces and Chassis When forwarding-options is configured without route-accounting, commit goes through with the message, "Could not retrieve the route-accounting." However, no functionality is affected. [PR/312933: This issue has been resolved.] The backup Routing Engine can fail to obtain mastership in the following cases: re0 gets stuck and doesn't reboot.
Page 68 JUNOS 10.1 Software Release Notes no impact on the traffic. To solve this issue, take the PIC offline and bring it back online. [PR/516411: This issue has been resolved.] On an M120, M7i, or M10i router with Enhanced CFEB running JUNOS Release 10.0 and a VRF routing instance configured with vrf-table-label, the VPN traffic might not flow when an ATM II IQ PIC is used for a core-facing link.
Page 69 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The SNMP MIB OID tree under dot3adAggPort fails. This issue may occur when virtual LAN tagging is not configured on the AE interface, and if the mib2d process is restarted using the command.
Page 70 JUNOS 10.1 Software Release Notes Setting the TCP maximum segment size (MSS) may not change the actual MSS value. [PR/514196: This issue has been resolved.] On M120 and MX Series routers, when an AE interface (with LACP enabled) is used as a core-facing interface for L3VPN, non-MPLS traffic received on the AE interface can sometimes get black-holed.
Page 71 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Routing Policy and Firewall Filters On some M, MX, and T Series routers, when a family CCC filter is applied on multiple interfaces that belong to different L2VPN routing instances, packet loss may occur after the routing instances are deactivated and activated.
Page 72 JUNOS 10.1 Software Release Notes Services Applications A performance-related issue may occur when the IDP plug-in is enabled. The connection per second for HTTP (64 bytes) with AACL, AI, and IDP (with Recommended Attacks group) plug-ins has been downgraded to 7.6K through 7.9K per second.
Page 73: Previous Releases
Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Previous Releases Release 10.1R2 Class of Service The following operations may result in large incorrect queue statistics on IQ2 interfaces: When the IQ2 PIC is restarted, or the interface is deactivated and reactivated, while traffic is on and the configuration defines a high priority queue on the interface.
Page 74 JUNOS 10.1 Software Release Notes Interfaces and Chassis The following messages are displayed on both the primary and secondary RLSQ MS 500 PICs: “SCHED: %PFE-0: Thread 7 ran for x ms without yielding," "Scheduler Oinker." [PR/286357: This issue has been resolved.] CFMD might crash when the following are configured and commited at once on a VPLS setup: Encapsulation VLAN-VPLS on a physical and logical interface...
Page 75 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers On 40x1 Gigabit Ethernet PICs, very short fragments of fragmented TCP, UDP, and ICMP packets may be incorrectly dropped with the diagnostic L4 length too short. [501526: This issue has been resolved.] The configured TTL set for GRE traffic is set properly for locally generated Routing Engine packets, but is not set properly for transit packets.
Page 76 JUNOS 10.1 Software Release Notes The local protocol MTU on an interface with PPP encapsulation might become higher than the configured media MTU after the PPP negotiation when the remote end has a higher media MTU configured. [PR/514079: This issue has been resolved.] The monitor traffic interface (tcpdump) does not produce an outbound output with matching option when used with the encapsulation...
Page 77 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Network Management Under certain SNMP conditions, the following log message is displayed: M10i-RE0 pfed: PFED_NOTIF_GLOBAL_STAT_UNKNOWN: Unknown global notification stat: transit options/ttl-exceeded (re-injected) M10i-RE0 pfed: PFED_NOTIF_STAT_UNKNOWN: Unknown notification type stat: Unknown This log message might also be displayed during the installation of AI Scripts (version 2.1R2 or above) on the router.
Page 78 JUNOS 10.1 Software Release Notes The syslog usually logs data only when the per-fabric-stream counter increases. However, the syslog starts logging even though the counter value was not increasing. [PR/493384: This issue has been resolved.] The Source Class Usage (SCU) statistics counter value may drop occasionally when it is used with the accounting profile.
Page 79 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Routing Protocols If a static route points to a discard configuration, a failure might occur when the router attempts to collect the multicast statistic data. [PR/434298: This issue has been resolved.] Deleting a logical system causes the routing protocol process to be stuck in an infinite loop.
Page 80 JUNOS 10.1 Software Release Notes Services Applications If the Juniper-Firewall-Attribute attribute in a RADIUS server configuration file names a policer that sets a bandwidth limit for Layer 2 Tunneling Protocol (L2TP) sessions but not an exclude-bandwidth limit, the bandwidth limit might not be set correctly.
Page 81 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Engine might access the file every 30 seconds, causing excessive /var/pdb/rdm.taf writes to the hard disk drive. This problem does not occur when GRES is enabled. [PR/506691: This issue has been resolved.] VPNs When different prefixes are advertised to the same source by different PE routers,...
Page 82 JUNOS 10.1 Software Release Notes Forwarding and Sampling The output firewall filter counter does not work when the firewall is configured for discard next hop. [PR/404645: This issue has been resolved.] Policers cannot be modified after a system upgrade due to a flaw in the parser routine.
Page 83 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Both the working and protect circuit are stuck in the “disabled” state when the TX cable is unplugged and the RX cable is plugged for protect circuit after an Automatic Protection Switching (APS) switchover.
Page 84 JUNOS 10.1 Software Release Notes With GRES configured, a container interface (CI) configuration can trigger a kernel core on the backup Routing Engine. [PR/488679: This issue has been resolved.] Container interfaces with ATM children with OAM may not initiate sending of OAM cells after Automatic Protection Switching (APS) switchovers.
Page 85 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers When ilmid uses a large amount of memory, the following error message displays: “/kernel: Process (1702,ilmid) has exceeded 85% of RLIMIT_DATA: used 129084 KB Max 131072 KB.” [PR/495645: This issue has been resolved.] The one-port OC12-3 PIC cannot support eight queues when the no-concatenate option is configured.
Page 86 JUNOS 10.1 Software Release Notes On M7i and M10i routers, the syncer process writes to the file every 30 seconds. [PR/511901: This issue has /var/rundb/chassisd.dynamic.db been resolved.] Under certain circumstances, the chassisd process might crash on a backup Routing Engine while a configuration is commited. [PR/512044: This issue has been resolved.] Layer 2 Ethernet Services On an MX Series router, the DHCP ACK messages are dropped when a client...
Page 87 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers MPLS Applications No point-to-multipoint LSPs are reported when the show mpls lsp p2mp command is issued. As a workaround, execute the command before you show mpls lsp execute the show mpls lsp p2mp command.
Page 88 JUNOS 10.1 Software Release Notes Platform and Infrastructure The output of the show route forwarding-table family vpls multicast command may display an unexpected output such as “rtinfo” with the multicast statement because this statement is supported only with inet and inet6 families and is not supported for the ISO, NTP, MPLS, UNIX, and VPLS families.
Page 89 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The fxp0 packet counter statistics are inconsistent between the physical interface and the logical interface as the statistics are updated twice. [PR/486200: This issue has been resolved.] Jtree corruption may be observed when the DCU is configured on ES-FPCs.
Page 90 JUNOS 10.1 Software Release Notes Routing Protocols If a static route is pointing to a discard configuration, a failure might occur when the router attempts to collect the multicast statistic data. [PR/434298: This issue has been resolved.] Deleting a logical system causes the routing protocol process to be stuck in an infinite loop.
Page 91 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The routing protocol process may core frequently because of malformed BGP updates generated by the JUNOS Software. This might be because of the total length and the path attribute length. [PR/489891: This issue has been resolved.] When multicast RPF routes are configured, the command show route rib-groups...
Page 92 JUNOS 10.1 Software Release Notes Services Applications If the Juniper-Firewall-Attribute attribute in a RADIUS server configuration file names a policer that sets a bandwidth limit for Layer 2 Tunneling Protocol (L2TP) sessions but not an exclude-bandwidth limit, the bandwidth limit might not be set correctly.
Page 93 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers The core files cannot be removed using the command unless the file delete Routing Engine name is included in the path. [PR/469168: This issue has been resolved.] deactivate configuration statement cannot be blocked through the...
Page 94: Errata And Changes In Documentation For Junos Software Release 10.1 For M Series, Mx Series, And T Series Routers
JUNOS 10.1 Software Release Notes Errata and Changes in Documentation for JUNOS Software Release 10.1 for M Series, MX Series, and T Series Routers Changes to the JUNOS Documentation Set The title of the JUNOS Hierarchy and RFC Reference is now JUNOS Hierarchy and Standards Reference.
Page 95 Errata and Changes in Documentation for JUNOS Software Release 10.1 for M Series, MX Series, and T Series Routers If RSVP LSPs are configured with bandwidth allocation, for ECMP next hops with more than 16 LSPs, traffic is not distributed optimally based on bandwidths configured.
Page 96 JUNOS 10.1 Software Release Notes version for client interfaces. The following example provides the appropriate syntax for setting the IGMP interface to obtain the IGMP version from RADIUS: [edit dynamic-profiles access-profile protocols igmp interface $junos-interface-name] user@host# set version $junos-igmp-version The Subscriber Access Configuration Guide and the System Basics Configuration Guide contain information about the override-nas-information statement.
Page 97 Errata and Changes in Documentation for JUNOS Software Release 10.1 for M Series, MX Series, and T Series Routers User Interface and Configuration show system statistics bridge command displays system statistics on MX Series routers. [System Basics Command Reference] VPNs mac-tlv-receive mac-tlv-send statements were removed from Release 10.0...
Page 98: Upgrade And Downgrade Instructions For Junos Release 10.1 For M Series, Mx Series, And T Series Routers
JUNOS 10.1 Software Release Notes Upgrade and Downgrade Instructions for JUNOS Release 10.1 for M Series, MX Series, and T Series Routers This section discusses the following topics: Basic Procedure for Upgrading to Release 10.1 on page 98 Upgrading a Router with Redundant Routing Engines on page 101 Upgrading Juniper Routers Running Draft-Rosen Multicast VPN to JUNOS Release 10.1 on page 101 Upgrading the Software for a Routing Matrix on page 103...
Page 99 Upgrade and Downgrade Instructions for JUNOS Release 10.1 for M Series, MX Series, and T Series Routers NOTE: Before upgrading, back up the file system and the currently active JUNOS configuration so that you can recover to a known, stable environment in case the upgrade is unsuccessful.
Page 100 States and Canada) (all other customers) https://www.juniper.net/support/csc/swdist-ww/ Log in to the Juniper Networks authentication system using the username (generally your e-mail address) and password supplied by Juniper Networks representatives. Download the software to a local host. Copy the software to the routing platform or to your internal software distribution site.
Page 101: Upgrading A Router With Redundant Routing Engines
Upgrade and Downgrade Instructions for JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Adding the command reboots the router after the upgrade is validated reboot and installed. When the reboot is complete, the router displays the login prompt. The loading process can take 5 to 10 minutes.
Page 102 VPN network, you had to perform additional configuration. Remove that configuration from both the Juniper Networks routers and the other vendors’ routers. This configuration should be on Juniper Networks routers and on the other vendors’...
Page 103: Upgrading The Software For A Routing Matrix
Upgrade and Downgrade Instructions for JUNOS Release 10.1 for M Series, MX Series, and T Series Routers For more information about configuring the draft-rosen Multicast VPN feature, see the JUNOS Multicast Configuration Guide. Upgrading the Software for a Routing Matrix A routing matrix can use either a TX Matrix router as the switch-card chassis (SCC) or a TX Matrix Plus router as the switch-fabric chassis (SFC).
Page 104: Upgrading Using Issu
JUNOS 10.1 Software Release Notes To upgrade the software for a routing matrix, perform the following steps: Disable graceful Routing Engine switchover (GRES) on the master Routing Engine (re0) and save the configuration change to both Routing Engines. Install the new JUNOS Software release on the backup Routing Engine (re1) while keeping the currently running software version on the master Routing Engine (re0).
Page 105: Downgrade From Release 10.1
Upgrade and Downgrade Instructions for JUNOS Release 10.1 for M Series, MX Series, and T Series Routers enabled, use the standard reboot or ISSU procedures described in the other sections of these instructions. Because the statement was not available in JUNOS Release nonstop-routing disable 9.2 and earlier, if both NSR and an incompatible PIM feature are enabled on a router to be upgraded from JUNOS Release 9.2 or earlier to a later release, you must disable...
Page 106 JUNOS 10.1 Software Release Notes New Features in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers Related Topics on page 6 Changes in Default Behavior and Syntax in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers on page 42 Issues in JUNOS Release 10.1 for M Series, MX Series, and T Series Routers on page 54 Errata and Changes in Documentation for JUNOS Software Release 10.1 for M...
Page 107: Junos Software Release Notes For Juniper Networks Srx Series Services
JUNOS Software Release Notes for Juniper Networks SRX Series Services Gateways and J Series Services Routers JUNOS Software Release Notes for Juniper Networks SRX Series Services Gateways and J Series Services Routers Powered by JUNOS Software, Juniper Networks SRX Series Services Gateways provide robust networking and security services.
Page 108: Software Features
JUNOS 10.1 Software Release Notes Software Features Application Layer Gateways (ALGs) DNS ALG This feature is supported on SRX3400, SRX3600, SRX5600, and SRX5800 devices in addition to existing support on SRX100, SRX210, SRX240, SRX650. JUNOS Software for SRX Series devices provides Domain Name System (DNS) support.
Page 109 New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers SQL ALG This feature is now supported on SRX3400, SRX3600, and SRX5600, and SRX5800 devices in addition to existing support on SRX100, SRX210, SRX240, SRX650, and J Series devices. Enabling the Structured Query Language (SQL) ALG on an SRX Series or a J Series device allows SQL*Net traffic in SQL redirect mode to traverse an SRX Series device by creating a TCP pinhole.
Page 110 JUNOS 10.1 Software Release Notes to have a LAG link configured and 802.3ad enabled for each redundant Ethernet interface LAG on both nodes so that the aggregate links will be recognized. Standalone link aggregation group interfaces ( ) are supported on clustered devices but cannot be added to redundant Ethernet interfaces.
Page 111 RTP packets and direct them to a higher priority queue in order to achieve better voice quality when packet traffic is congested. Juniper Networks devices provide classification, priority queuing, and other kinds of CoS configuration under the Class-of-Service configuration hierarchy.
Page 112 JUNOS 10.1 Software Release Notes DOCSIS 1.1 DOCSIS 1.0 The DOCSIS Mini-PIM is supported on the following SRX Series Services Gateways: SRX210 SRX240 The DOCSIS Mini-PIM has the following key features: Provides high data transfer rates of over 150 Mbps downstream Supports four downstream and four upstream channel bonding Supports quality of service (QoS) Provides interoperability with any DOCSIS-compliant cable modem...
Page 113 New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Operation, Administration, and Maintenance (OAM) support for ADSL/ADSL/ADSL2+ ATM mode ATM QoS (supported only when the VDSL2 Mini-PIM is operating in ADSL2 mode) MLPPP (supported only when the VDSL2 Mini-PIM is operating in ADSL2 mode) MTU size of 1500 bytes (maximum) Support for maximum of 10 PVCs (only in ADSL/ADSL2/ADSL2+ mode)
Page 114 JUNOS 10.1 Software Release Notes You configure BA classifiers and rewrite rules on transparent mode devices in the same way as on devices operating in Layer 3 mode. For transparent mode devices, however, you apply BA classifiers and rewrite rules only to logical interfaces configured with the configuration statement.
Page 115 The TLVs leverage this information from parameters that have already been configured in the Juniper Networks JUNOS Software. LLDP-MED goes one step further, exchanging IP-telephony messages between the device and the IP telephone. These TLV messages provide detailed information on PoE policy.
Page 116 JUNOS 10.1 Software Release Notes To enable promiscuous mode on an interface, use the promiscuous-mode statement at the [ edit interfaces ] hierarchy. [Junos OS Interfaces and Routing Configuration Guide] Intrusion Detection and Prevention (IDP) IDP in an active/active chassis cluster This feature is supported on SRX3400, SRX3600, SRX5600, and SRX5800 devices.
Page 117 New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers IDP now provides logging for application-level DDoS events. IDP generates three types of application-level DDoS event logs: attack, state transition, and ip-action. These event logs provide visibility into the application-level DDoS state and provide notifications on occurrences of application-level DDoS attacks for each protected application server.
Page 118 JUNOS 10.1 Software Release Notes NOTE: Note that this package should be of the same version as that of the corresponding JUNOS, example, on a device with a 10.2 JUNOS package installed, the jloader-srxsme package should also be of version 10.2. Install the package using the request system software add <path to jloader-srxsme package>...
Page 119 New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers version version Routing Engine 0 RE BIOS Routing Engine 0 RE BIOS Backup 1 Perform indicated firmware upgrade ? [yes,no] (no) yes Firmware upgrade initiated. Monitor the status of upgrade using the show system firmware command.
Page 120 JUNOS 10.1 Software Release Notes Routing Engine 0 RE BIOS Backup 1 PROGRAMMING Routing Engine 0 RE FPGA 12.3.0 root> show system firmware Part Type Current Available Status version version Routing Engine 0 RE BIOS Routing Engine 0 RE BIOS Backup UPGRADED SUCCESSFULLY Routing Engine 0...
Page 121 New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers statement includes a new radio-router attribute that replaces the interfaces resource-component-variables attribute. The radio-router attribute contains the parameters used for rate-based scheduling and OSPF link cost calculations. It also includes a new attribute to indicate that credit-based packet scheduling credit...
Page 122: Hardware Features
JUNOS 10.1 Software Release Notes PADG Credits: enabled Dynamic bandwidth: enabled Virtual LANs (VLANs) Flexible Ethernet services This feature is supported on SRX210, SRX240, SRX650, and J Series devices. Use flexible Ethernet services encapsulation when you want to configure multiple per-unit Ethernet encapsulations.
Page 123: Changes In Default Behavior And Syntax In Junos Release 10.1 For Srx Series Services Gateways And J Series Services Routers
3 Mbps. The SRX210 device has a 3G ExpressCard slot on the back panel. The SRX210 device supports the Juniper Networks wireless modems listed in Table 6 on page 123. Table 6: Juniper Networks Wireless Modems Supported by the SRX210 Device Wireless Cards Release Supported EXPCD-3G-HSPA-T- 3G UMTS ExpressCard Sierra Wireless AC503 ExpressCard JUNOS Release 10.1.
Page 124: Chassis Cluster
JUNOS 10.1 Software Release Notes show security alg msrpc portmap show security alg sunrpc portmap CLI command has a chassis cluster show security alg msrpc object-id-map node option to permit the output to be restricted to a particular node or to query the entire cluster.
Page 125: Command-Line Interface (Cli)
Changes In Default Behavior and Syntax in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Command-Line Interface (CLI) On SRX Series devices, the show security monitoring fpc 0 command is now available. The output of this CLI command on SRX Series devices differs from previous implementations on other devices.
Page 126 JUNOS 10.1 Software Release Notes user@host# set wlan access-point mav0 radio 2 radio-options mode ? Possible completions: 2.4GHz Radio Frequency --2.4GHz-n bg Radio Frequency -bg bgn Radio Frequency -bgn On SRX Series devices, the command now displays show system storage partitions the partitioning scheme details on SRX Series devices.
Page 127: Configuration
Changes In Default Behavior and Syntax in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Now this CLI command displays the following possible completions: Example 1: user@host# set wlan access-point ap6 radio 1 radio-options channel number ? Possible completions: 36 Channel 36 40 Channel 40...
Page 128: Flow And Processing
JUNOS 10.1 Software Release Notes On SRX100, SRX210, SRX240 and, SRX650 devices, the current JUNOS Software default configuration is inconsistent with the one in Secure Services Gateways, thus causing problems when users migrate to SRX Series devices. As a workaround, users should ensure the following steps are taken: ge-0/0/0 interface should be configured as the Untrust port (with the DHCP client enabled).
Page 129: Interfaces And Routing
Changes In Default Behavior and Syntax in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Remove link-layer-overhead from [ls-0/0/0 unit 0] , if configured. If the LFI forwarding class is mapped to no-fragmentation fragmentation-map and the configuration hierarchy is enabled on in JUNOS Release lsq-0/0/0 10.1, then...
Page 130: J-Web
JUNOS 10.1 Software Release Notes and destination address is blocked. For more information, see the Junos OS CLI Reference. On SRX3400 and SRX3600 devices in Layer 2 and Layer 3 integrated mode, mode, 30 percent to 40 percent of the logs created in IDP are not exited from IDP.
Page 131: Security
Changes In Default Behavior and Syntax in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers save reset Once the system is booted from the USB storage device, take a snapshot on the external CompactFlash using the request system snapshot media external command.
Page 132: Known Limitations In Junos Release 10.1 For Srx Series Services Gateways And J Series Services Routers
JUNOS 10.1 Software Release Notes Known Limitations in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers [accounting-options] Hierarchy On SRX210 and SRX240 devices, the accounting source-class , and statements in the hierarchy level are not destination-class [accounting-options] supported.
Page 133: Command-Line Interface (Cli)
Known Limitations in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers The default configuration for other SRX Series devices and all J Series devices does not enable Ethernet switching. However, if you have enabled Ethernet switching, be sure to disable it before enabling clustering on these devices too.
Page 134: Dynamic Vpn
JUNOS 10.1 Software Release Notes Dynamic VPN SRX100, SRX210, and SRX240 devices have the following limitations: The IKE configuration for the dynamic VPN client does not support the hexadecimal preshared key. The dynamic VPN client IPsec does not support the Authentication Header (AH) protocol and the Encapsulating Security Payload (ESP) protocol with NULL authentication.
Page 135: Hardware
Known Limitations in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers On SRX5800 devices, network processing bundling is not supported in Layer 2 transparent mode. On SRX3400, SRX3600, SRX5600, and SRX5800 devices, downgrading is not supported in low-impact in-service software upgrade (ISSU) chassis cluster upgrades (LICU).
Page 136: Interfaces And Routing
JUNOS 10.1 Software Release Notes On SRX650 devices, the T1/E1 GPIMs (2 or 4 port version) do not work in 9.6R1. This issue is resolved in JUNOS Release 9.6R2 and JUNOS Release 10.1, but if you roll back to the 9.6R1 image, this issue is still seen. Interfaces and Routing On SRX650 devices, MAC pause frame and FCS error frame counters are not supported for the interfaces...
Page 137 Known Limitations in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers show msdp sa group group set protocols pim interface interface family inet6 set protocols pim disable interface interface family inet6 set protocols pim family inet6 set protocols pim disable family inet6 set protocols pim apply-groups group disable family inet6 set protocols pim apply-groups group family inet6...
Page 138: Intrusion Detection And Prevention (Idp)
JUNOS 10.1 Software Release Notes Intrusion Detection and Prevention (IDP) On SRX3400, SRX3600, SRX5600, and SRX5800 devices, application-level distributed denial-of-service (application-level DDoS) detection does not work if two rules with different application-level DDoS applications process traffic going to a single destination application server. When setting up application-level DDoS rules, make sure you do not configure rulebase-ddos rules that have two different application-ddos objects while the traffic destined to one application server can process more than one rule.
Page 139: J-Web
Known Limitations in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Getting_Started IDP_Default Recommended Web_Server IDP deployed in both active/active and active/passive chassis clusters has the following limitations: No inspection of sessions that fail over or fail back. The IP address action table is not synchronized across nodes.
Page 140: Netscreen-Remote
JUNOS 10.1 Software Release Notes NetScreen-Remote On SRX Series devices, NetScreen-Remote is not supported in JUNOS Release 10.1. Network Address Translation (NAT) On SRX3400, SRX3600, SRX5600, and SRX5800 devices, IKE negotiations involving NAT traversal do not work if the IKE peer is behind a NAT device that will change the source IP address of the IKE packets during the negotiation.
Page 141: Performance
J Series devices now support IDP and UTM functionality. Under heavy network traffic in a few areas of functionality, such as NAT and IPsec VPN, performance is still being improved to reach the high levels to which Juniper Networks is consistently committed.
Page 142: Issues In Junos Release 10.1 For Srx Series Services Gateways And J Series Services Routers
JUNOS 10.1 Software Release Notes New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Related Topics Series Services Routers on page 107 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers on page 142 Errata and Changes in Documentation for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers on page 165 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services...
Page 143 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Authentication On J Series devices, your attempt to log in to the router from a management device through FTP or Telnet might fail if you type your username and password in quick succession before the prompt is displayed, in some operating systems.
Page 144 JUNOS 10.1 Software Release Notes On SRX Series devices in a chassis cluster, configuring the set system process jsrp-service disable command only on the primary node causes the cluster to go into an incorrect state. [PR/292411] On SRX Series devices in a chassis cluster, using the set system processes chassis-control disable command for 4 to 5 minutes and then enabling it causes...
Page 145 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers [PR/414663] If an SRX210 device receives more traffic than it can handle, node 1 either disappears or gets disabled. [PR/416087] On SRX3400, SRX3600, SRX5600, SRX5800, and J Series devices in an active/active chassis cluster, when the fabric link fails and then recovers, services with a short time-to-live...
Page 146 JUNOS 10.1 Software Release Notes same doubled value after LICU, when the LICU upgrade is performed for JUNOS Release 10.0R2 to 10.1R2.[PR/491834] On SRX5600 and SRX5800 devices, the shaping rate is not honored during LICU upgrades. During LICU upgrades, when the secondary node is upgraded to the primary node, the shaping rate is doubled and continues to be the same doubled value after the LICU upgrade is finished.
Page 147 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers DHCP On SRX210 and SRX240 devices, when autoinstallation is configured to run on a particular interface and the default static route is set with options discard, retain and no-advertise, then the DHCP client running on the interface tries fetching the configuration files from the TFTP server.
Page 148 JUNOS 10.1 Software Release Notes On SRX240 devices, traffic flooding occurs when multiple multicast IP group addresses are mapped to the same multicast MAC address because multicast switching is based on the Layer 2 address. [PR/418519] On SRX650 devices, the input DA errors are not updated when packets are dropped because of MAC filtering on the following: SRX240 device SRX210 device...
Page 149 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers detected at a higher rate when the per-network processor rate reaches the threshold. [PR/442376] On SRX5600 devices, equal-cost multipath (ECMP) does not work at Layer 4 when transit traffic is passed.
Page 150 JUNOS 10.1 Software Release Notes On SRX240 devices, the Mini-PIM LEDs glow red for a short duration (1 second) when the device is powered on. [PR/429942] On SRX240 devices, the file installation fails on the right USB slot when both of the USB slots have USB storage devices attached.
Page 151 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers On SRX210 devices with Integrated Convergence Services, the call hold feature does not work for Xlite softphones. [PR/432725] At least one time slot must be configured for data for voice channels on T1 lines to work.
Page 152 JUNOS 10.1 Software Release Notes If one side is set to autonegotiation mode and the other side is set to forced speed, the behavior is indeterminate and not supported. [PR/423632] On SRX and J Series devices, the RPM operation will not work for the probe-type tcp-ping when the probe is configured with the option destination-interface.
Page 153 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers On SRX210 Low Memory devices, the E1 interface will flap and traffic will not pass through the interface if you restart forwarding while traffic is passing through the interface.
Page 154 JUNOS 10.1 Software Release Notes because there is a bug in the SAR engine, which will not set the ATM connection until the first packet has been dropped due to no ATM connection. [PR/493099] The destination and destination-profile options for address and unnumbered-address within family inet and inet6 are allowed to be specified within a dynamic profile but not supported.
Page 155 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers On SRX3400, and SRX3600 devices, the logging rate is slightly less in SPUs operating in combo mode as compared to SPUs operating in non-combo mode. [PR/457251] On SRX3400, SRX3600, SRX5600, and SRX5800 devices in maximize-idp-sessions mode, there is an IPC channel between two data plane...
Page 156 JUNOS 10.1 Software Release Notes On SRX210, SRX240, and SRX650 devices, the complete contents of the ToolTips are not displayed in the J-Web Chassis View. As a workaround, drag the Chassis View image down to see the complete ToolTip. [PR/396016] On SRX100, SRX210, SRX240, and SRX650 devices, the LED status in the Chassis View is not in sync with the LED status on the device.
Page 157 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers This feature is not supported, and the user cannot obtain or configure any value under these filter options. [PR/460244] On SRX100, SRX210, SRX240, SRX650, and J Series devices, in the J-Web interface, the Traceoptions tab in the Edit Global Settings window of the OSPF Configuration page (Configuration>Routing>OSPF Configuration) does not display the available flags (tracing parameters).
Page 158 JUNOS 10.1 Software Release Notes On SRX5800 devices, rebooting is required for any NP bundle configuration change to take effect. Currently there is no notification displayed after the bundle configuration change to notify that a reboot is required for the change to take effect.
Page 159 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers On SRX210 devices, the fourth access point connected to the services gateway fails to boot with the default Power over Ethernet (PoE) configuration. As a workaround, configure all the PoE ports to a maximum power of 12.4 watts.
Page 160 JUNOS 10.1 Software Release Notes Unified Access Control (UAC) On J Series devices, MAC address-based authentication does not work when the router is configured as a UAC Layer 2 Enforcer. [PR/431595] Unified Threat Management (UTM) On SRX210 High Memory devices, content filtering provides the ability to block protocol commands.
Page 161 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Disable the dialer interface. root@noky# set interfaces dl0 disable root@noky# commit Restart the forwarding daemon. root@noky# run restart forwarding Forwarding Daemon started, pid 1407 root@noky# delete interfaces dl0 disable root@noky# commit Enable the dialer interface.
Page 162: Resolved Issues In Junos Release 10.1 For Srx Series Services Gateways And J Series Services Routers
JUNOS 10.1 Software Release Notes attachment unit (MAU) information always propagates as "Unknown". [PR/480361] On SRX100 High Memory devices and SRX210 Low Memory devices, dot1x unauthenticated ports accept Link Layer Discovery Protocol (LLDP) protocol data units (PDUs) from neighbors. [PR/485845] For SRX210 High Memory devices, during configuration of access and trunk ports, the individual VLANs from the vlan-range are not listed.
Page 163 Issues in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers AX411 Access Point On AX411 Access Points, an access point would not synchronize with the newly associated configuration (by changing or swapping the MAC address) and also would not join the changed cluster when it was associated to a new config block in the WLAN access point configuration.
Page 164 JUNOS 10.1 Software Release Notes On SRX210 High Memory devices, only six logical interfaces was came up on the G.SHDSL ATM interface (including OAM channel), and the other two logical interfaces were down. [PR/466296: This issue has been resolved.] On SRX3400, SRX3600, SRX5600, and SRX5800 devices, link speeds of 100 Mbps and 1 Gbps were not configured on the ae0 interface with child interfaces configured because when you commited the configuration, the system displayed an error that there was a mismatch between the ae0 and child interfaces.
Page 165: Errata And Changes In Documentation For Junos Release 10.1 For Srx Series Services Gateways And J Series Services Routers
Errata and Changes in Documentation for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Errata and Changes in Documentation for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers on page 165 Errata and Changes in Documentation for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers This section lists outstanding issues with the documentation.
Page 166: Cli Reference
JUNOS 10.1 Software Release Notes CLI Reference ® The “Services Configuration Statement Hierarchy” section in the JUNOS Software CLI Reference refers to the JUNOS Services Interfaces Configuration Guide, which has the following error in the sections “Data Size” and “Configuring the Probe”: The minimum data size required by the UDP timestamp probe is identified as 44 bytes.
Page 167: Hardware Documentation
Errata and Changes in Documentation for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers For a J Series Services Router, if the buffer size percentage is set to zero for T1 interfaces, traffic does not pass. Hardware Documentation On SRX100 devices, the Alarm LED is off, indicating that the device is starting Note that when the device is on, if the Alarm LED is off, it indicates that no...
Page 168: Installing Software Packages
JUNOS 10.1 Software Release Notes Installing Software Packages The current SRX210 documentation does not include the following information: On SRX210 devices, the hierarchy is hosted in a separate partition (instead /var of the root partition). If JUNOS Software installation fails as a result of insufficient space: Use the command to delete temporary files.
Page 169: Integrated Convergence Services
Errata and Changes in Documentation for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers To install the software image on the specified boot media: Go to the Loader prompt. For more information on accessing the Loader prompt, see “Accessing the Loader Prompt”...
Page 170: Intrusion Detection And Prevention (Idp)
JUNOS 10.1 Software Release Notes When Q-in-Q tunneling is configured for a service provider’s VLAN, all routing engine packets, including packets from the routed VLAN interface, that are transmitted from the customer-facing access port of that VLAN will always be untagged Intrusion Detection and Prevention (IDP) The JUNOS Software Security Configuration Guide does not state that custom...
Page 171 Errata and Changes in Documentation for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers Syntax: user@host# set security idp security-package automatic download-timeout ? Possible completions: < download-timeout > Maximum time for download to complete (1 - 60 minutes) [edit] user@host# set security idp security-package automatic download-timeout...
Page 172: J-Web
JUNOS 10.1 Software Release Notes J-Web The following information pertains to SRX Series and J Series devices: J-Web security package update Help page The J-Web Security Package Update Help page does not contain information about download status. J-Web pages for stateless firewall filters There is no documentation describing the J-Web pages for stateless firewall filters.
Page 173: Transceiver Compatibility For Srx Series And J Series Devices
SRX Series and J Series interface modules. Different transceiver types (long-range, short-range, copper, and others) can be used together on multiport SFP interface modules as long as they are provided by Juniper Networks. We cannot guarantee that the interface module will operate correctly if third-party transceivers are used.
Page 174: J Series Compactflash And Memory Requirements
JUNOS 10.1 Software Release Notes Table 7: Supported Storage Devices on the J Series Services Routers Manufacturer Storage Capacity Third-Party Part Number SanDisk Cruzer Mini 2.0 256 MB SDCZ2-256-A10 SanDisk 512 MB SDCZ3-512-A10 SanDisk 1024 MB SDCZ7-1024-A10 Kingston 512 MB DTI/512KR Kingston 1024 MB...
Page 175: Dual-Root Partitioning Scheme Documentation For Srx Series Services Gateways
Dual-Root Partitioning Scheme Documentation for SRX Series Services Gateways Upgrade and Downgrade Instructions for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers on page 185 Errata and Changes in Documentation for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers on page 165 Dual-Root Partitioning Scheme Documentation for SRX Series Services Gateways Dual-Root Partitioning Scheme...
Page 176 JUNOS 10.1 Software Release Notes SRX650 devices boot from the following storage media (in order of priority): Internal CompactFlash card (default; always present) External CompactFlash card (alternate) USB storage device (alternate) With the dual-root partitioning scheme, the SRX Series device first tries to boot the JUNOS Software from the primary root partition and then from the backup root partition on the default storage media.
Page 177 Dual-Root Partitioning Scheme Documentation for SRX Series Services Gateways The following upgrade methods format the internal media before installation: Installation from the boot loader using a TFTP server Installation from the boot loader using a USB storage device Installation from the CLI using the special partition option (available in JUNOS Release 10.1)
Page 178 JUNOS 10.1 Software Release Notes Each of the aforementioned methods of installing JUNOS 10.1 with dual-root partitioning is described in detail in the following sections: Installing from the Boot Loader Using a TFTP Server on page 178 Installing from the Boot Loader Using a USB Storage Device on page 178 Installing from the CLI Using the partition Option on page 179 Upgrading the Boot Loader on page 179 Installing from the Boot Loader Using a TFTP Server...
Page 179 Dual-Root Partitioning Scheme Documentation for SRX Series Services Gateways Format a USB storage device in MS-DOS format. Copy the JUNOS Software image onto the USB storage device. Plug the USB storage device into the SRX Series device. Stop the device at the loader prompt and use the following command: loader>...
Page 180 JUNOS 10.1 Software Release Notes Installing JUNOS Release 9.6 or Earlier Release on Systems with Dual-Root Partitioning JUNOS Release 9.6 and earlier is not compatible with the dual-root partitioning scheme. These releases can only be installed if the media is reformatted with single-root partitioning.
Page 181 Dual-Root Partitioning Scheme Documentation for SRX Series Services Gateways Format a USB storage device in MS-DOS format. Copy the JUNOS Software image onto the USB storage device. Plug the USB storage device into the SRX Series device. Stop the device at the loader prompt and use the following command: user@host>...
Page 182 JUNOS 10.1 Software Release Notes properly, and so this device has booted from the backup copy. Please re-install JUNOS to recover the active copy in case it has been corrupted. *********************************************************************** Because the system is left with only one functional root partition, you should immediately restore the primary JUNOS Software image.
Page 183: Maximizing Alg Sessions
Maximizing ALG Sessions Creation date: Jul 24 16:17:13 2009 JUNOS version on snapshot: junos : 10.1I20090724_0719-domestic NOTE: You can use the show system snapshot media internal command to determine the partitioning scheme present on the internal media. Information for only one root is displayed for single-root partitioning, whereas information for both roots is displayed for dual-root partitioning.
Page 184: Using Dual Chassis Cluster Control Links: Upgrade Instructions For The Second Routing Engine
JUNOS 10.1 Software Release Notes TCP Proxy connection capacity: 40,000 sessions per flow SPU NOTE: Flow session capacity will be reduced to half per flow SPU and the above capacity numbers will not change on the central point SPU. You can configure maximum ALG sessions as follows: security { forwarding-process { application-services {...
Page 185: Upgrade And Downgrade Instructions For Junos Release 10.1 For Srx Series Services Gateways And J Series Services Routers
Upgrade and Downgrade Instructions for JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers dd if=installMedia of=/dev/externalDrive bs=64k where Refers to the removable media name. For example, the externalDrive removable media name on an SRX5000 line device is for both Routing Engines.
Page 186: Junos Software Release Notes For Ex Series Switches
JUNOS 10.1 Software Release Notes If your device is running an earlier release, upgrade to one of these releases and then to the 10.1 release. For example, to upgrade from Release 9.2R1, first upgrade to Release 9.2R4 and then to Release 10.1R2. For additional upgrade and download information, see the JUNOS Software Administration Guide and the JUNOS Software Migration Guide.
Page 187: Hardware
New Features in JUNOS Release 10.1 for EX Series Switches Hardware EX2200 switch The EX2200 switch is a fixed-configuration switch that is available in four models 24-port or 48-port models with either all ports equipped for Power over Ethernet (PoE) or none of the ports equipped for PoE. All EX2200 models provide network ports that have 10/100/1000BASE-T Gigabit Ethernet connectors and uplink ports that support 1-gigabit small form-factor pluggable (SFP) transceivers for use with fiber connections and copper...
Page 188: Class Of Service (Cos)
JUNOS 10.1 Software Release Notes Class of Service (CoS) Port shaping and queue shaping Port shaping and queue shaping (the shaping-rate configuration statement) is now available on EX8200 switches. Infrastructure IPv6 support on EX8200 switches EX8200 switches now support configuration of IPv6 addresses.
Page 189: Mpls
Changes in Default Behavior and Syntax in JUNOS Release 10.1 for EX Series Switches MPLS MPLS enhancements On EX3200 and EX4200 switches, MPLS supports class of service (CoS), IP over MPLS, and fast reroute to reroute the label-switched path in cases of link failure. Packet Filters IPv6 support for firewall filters on EX3200 and EX4200 switches On EX3200 and EX4200 switches, you can apply match conditions to IPv6 traffic on Layer...
Page 190: Layer 2 And Layer 3 Protocols
JUNOS 10.1 Software Release Notes Layer 2 and Layer 3 Protocols EX Series switches now support the show multicast rpf instance instance-name command. option is not available in the command because it is not show pfe route supported on EX Series switches. Infrastructure On EX Series switches, the statement in the...
Page 191: Access Control And Security
Limitations in JUNOS Release 10.1 for EX Series Switches Access Control and Security When you have configured more than 1024 supplicants on a single interface, 802.1X authentication might not work as expected and the 802.1X process dot1xd ) might fail. Class of Service On EX8200 switches, classification of packets using ingress firewall filter rules with forwarding-class and loss-priority configurations does not rewrite the DSCP...
Page 192: Interfaces
JUNOS 10.1 Software Release Notes , and commands to display dot3PauseTable show snmp mib walk dot3ControlTable the output at the table level. When you issue the request system power-off command, the switch halts instead of turning off power. In the J-Web interface, the Ethernet Switching monitoring page might not display monitoring details if there are more than 13,000 MAC entries on the switch.
Page 193: Outstanding Issues In Junos Release 10.1 For Ex Series Switches
Outstanding Issues in JUNOS Release 10.1 for EX Series Switches command might display double counting of show interface detail | extensive packets or bytes for the transit statistics and traffic statistics counters. You can use the counter information displayed under the Physical interface section of the output.
Page 194: Infrastructure
JUNOS 10.1 Software Release Notes If you are configuring an interface as part of an aggregated Ethernet interface and also configuring CoS on that interface, do not commit both configurations using a single commit operation. Use separate commit operations to commit the two configurations.
Page 195 Outstanding Issues in JUNOS Release 10.1 for EX Series Switches [PR/400814] If an SRE module, RE module, SF module, line card, or Virtual Chassis member is in offline mode, the J-Web interface might not update the dashboard image accordingly. [PR/431441] In the J-Web interface, in the Port Security Configuration page, you are required to configure when you configure...
Page 196: Resolved Issues In Junos Release 10.1 For Ex Series Switches
JUNOS 10.1 Software Release Notes Resolved Issues in JUNOS Release 10.1 for EX Series Switches The following are the issues that have been resolved since JUNOS Release 10.1R2 for EX Series switches. The identifier following the descriptions is the tracking number in our bug database.
Page 197: Class Of Service
Resolved Issues in JUNOS Release 10.1 for EX Series Switches Class of Service On an EX2200 switch, when a queue is oversubscribed and you modify a scheduler with the buffer-size exact option on it such that it reduces the allocated buffers on the queue, the queue can stop dequeueing packets.
Page 198: J-Web Interface
JUNOS 10.1 Software Release Notes The DHCP snooping database is not built after graceful Routing Engine switchover (GRES) is performed twice. Even though packets are coming from the DHCP server, they are not inserted in the DHCP relay. [PR/461318: This issue has been resolved.] If an interface is assigned to a VLAN before the interface's stg state is set, loops might form in the network if a VLAN ID is assigned to the VLAN while the...
Page 199: Switches
Errata in Documentation for JUNOS Release 10.1 for EX Series Switches In the J-Web interface, in the OSPF Configuration page, no flags are displayed for the Traceoptions tab in OSPF Global Settings. [PR/461558: This issue has been resolved.] In the J-Web interface, in the BGP Configuration page (Configuration > Routing >...
Page 200: Upgrade And Downgrade Issues For Junos Release 10.1 For Ex Series Switches
JUNOS 10.1 Software Release Notes Resolved Issues in JUNOS Release 10.1 for EX Series Switches on page 196 Upgrade and Downgrade Issues for JUNOS Release 10.1 for EX Series Switches on page 200 Upgrade and Downgrade Issues for JUNOS Release 10.1 for EX Series Switches The following pages list the issues in JUNOS Release 10.1R3 for EX Series switches regarding software upgrade or downgrade: Upgrading or Downgrading from JUNOS Release 9.4R1 for EX Series...
Page 201: Upgrading From Junos Release 9.2 To Release 10.1 For Ex Series Switches
Upgrade and Downgrade Issues for JUNOS Release 10.1 for EX Series Switches Upgrading from JUNOS Release 9.2 to Release 10.1 for EX Series Switches For JUNOS Release 9.3 and later for EX Series switches, during the upgrade process, the switch performs reference checks on VLANs and interfaces in the 802.1X configuration stanza.
Page 202: Downgrading From Junos Release 10.1 To Release 9.2 For Ex4200 Switches
JUNOS 10.1 Software Release Notes In the configuration, if is not configured for the ethernet-switching-options action number of MAC addresses allowed on the interface (under secure-access-port in the CLI or in the Port Security Configuration interface interface-name mac-limit page in the J-Web interface), and you try to commit the configuration, the commit will fail.
Page 203: Junos Documentation And Release Notes
Juniper Networks website at http://www.juniper.net/techpubs/ Juniper Networks supports a technical book program to publish books by Juniper Networks engineers and subject matter experts with book publishers around the world. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration using the Junos operating system (Junos OS) and Juniper Networks devices.
Page 204 CLI before contacting support: user@host> request support information | save filename To provide a core file to Juniper Networks for analysis, compress the file with the gzip utility, rename the file to include your company name, and copy it to .
Page 205: Revision History
Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312, 6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785.

This manual is also suitable for:

Networks junos 10.1

Juniper JUNOS 10.1 - RELEASE NOTES REV 4 Release Note

Quick Links

Release Notes

Related Manuals for Juniper JUNOS 10.1 - RELEASE NOTES REV 4

Summary of Contents for Juniper JUNOS 10.1 - RELEASE NOTES REV 4

This manual is also suitable for:

Table of Contents