Table of Contents
Advertisement
Copyright © 2011, Juniper Networks, Inc.
Issues in Junos OS Release 10.4 for SRX Series Services Gateways and J Series Services Routers
The SSL function is known to take an exponentially large amount of time when the
key size is increased. Key sizes of 1024 bits and 2096 bits are OK to process because
their processing time is below the watchdog threshold, but the key size of 4096 bits
should not be used when sending stress traffic. Also, IDP uses SSL hardware for <=
1024-bit keys. The throughput is much higher for the traffic using <= 1024-bit SSL
private keys. [PR/524452 ]
On SRX3400, SRX3600, SRX5600, and SRX5800 devices, when packet-logging
functionality is configured with an improved pre-attack configuration parameter value,
the resource usage increases proportionally and might affect the performance.
[PR/526155]
On SRX100, SRX210, SRX220, SRX240, and SRX650 devices, IDP policies greater than
19 MB do not get loaded. [PR/540856]
On SRX100 and SRX240 High Memory devices, whenever the folder
deleted or any folder
/var/db/idpd/db
the system must be rebooted for proper functioning of idpd. [PR/551412]
IPv6
Proxy-ndp does not work in IPv6. Hence, the following issues exist:
proxy-ndp cannot be configured under
publish MAC for specific IPv6 addresses will not work under
[PR/549969]
ISSU
In-service software upgrade (ISSU) is not supported for upgrading VPN, NAT, IPv6,
FTP ALG, TFTP ALG, or IDP functionality. If ISSU is used while the noted functionality
is enabled, SRX Series devices might be left in an invalid state. The upgrade options
are either to disable unsupported ISSU features prior to the upgrade or to use a standard
upgrade procedure with a reboot. [PR/558566, PR/530035].
J-Flow
SRX3400, SRX3600, SRX5600, and SRX5800 devices support the 4-byte autonomous
system (AS) for BGP configuration. However, J-Flow template versions 5 and 8 do not
support 4-byte AS because these J-Flow templates have 2 bytes for the SRC/DST AS
field. [PR/416497]
On SRX3400, SRX3600, SRX5600, and SRX5800 devices, J-Flow sampling on the
virtual router interface does not show the values of autonomous system (AS) and
mask length. The AS or mask length values of
the packet on the virtual router interface. [PR/419563]
that is under the folder
var/db/idpd
>
Security
NAT
Interfaces
cflowd
packets show
is
/var/db/idpd
is deleted,
>
set interfaces
0
while sampling
163
Advertisement
Table of Contents
