SRX: different way to reset to factory-default
so, you may know the standard way, the teached way, i mean pushing during 15 secondes the reset micro-button. This method work fine on J-series, but not on somes SRX, not on MX series...
so, i will try to write down somes of the method i used to reset to factory default the juniperdevices.
Factory Default, really ?
First, i need, we need to define what exactly is a factory-default reset. Is it just putting back the configuration to its initial state ? just this ? and what do you do with all the logs files ? the debug files ? the configurations saved ?
It is a security breach to lets everything inside the box, so putting a device back to the factory-default state is not just the configuration, it is mainly everything, even the ssh key: we want to generate a new one, because the old is not trusted anymore.
Lets start.
Loose the root password.
the common process is the boot in single user mode:
FreeBSD/MIPS U-Boot bootstrap loader, Revision 1.5
(builder@ormonth.juniper.net, Fri Oct 9 10:55:15 UTC 2009)
Memory: 1024MB
[0]Booting from nand-flash slice 2
Un-Protected 1 sectors
writing to flash...
Protected 1 sectors
Loading /boot/defaults/loader.conf
/kernel data=0x97d8ac+0xd70d0 syms=[0x4+0x79c50+0x4+0xadd2e]
Hit [Enter] to boot immediately, or space bar for command prompt.
Root passwd on SRX Platform
on SRX Branch platforms and JUNOS 10.0R1 or later, there is a condition in which the password recovery process does not work. After issuing recovery command, system never reaches the point where root password can be changed. System reboots instead. So we need to apply a specific procedure to recover root password for SRX Branch devices running on Junos version 10.0R1 or later. This involves disabling watchdog functionality to allow for system to properly boot into single-user mode.
change the root passwd, reboot, and don't forget to enable the watchdog, and boot in normal mode
Damned, HA is enabled
If you're lucky, your device is in master mode, so you can just diasble the HA:
{primary:node1}
root@titi> set chassis cluster disable reboot
Successfully disabled chassis cluster. Going to reboot now
But if you're not, lucky i mean, your device is on hold, and you're trying to reset the root passwd on single user mode, but you can't:
Starting CLI ...
{hold:node1}
root> edit
warning: Clustering enabled; using private edit
error: shared configuration database modified
Please temporarily use 'configure shared' to commit
outstanding changes in the shared database, exit,
and return to configuration mode using 'configure'
{hold:node1}
root>
Ok, so deleting all the interfaces in the configuration seems to allow me to finally commit.
Then reboot and disable the cluster :
root@>set chassis cluster disable
TRUE Factory default
root> request system zeroize
warning: System will be rebooted and may not boot without configuration
Erase all data, including configuration and log files? [yes,no] (no) yes
warning: zeroizing re0
Local package initialization:.
starting local daemons:.
kern.securelevel: -1 -> 1
Creating JAIL MFS partition...
JAIL MFS partition created
Database Initialization Utility
RDM Embedded 7 [04-Aug-2006] http://www.birdstep.com
Copyright (c) 1992-2006 Birdstep Technology, Inc. All Rights Reserved.
secdb initialized
Database Initialization Utility
RDM Embedded 7 [04-Aug-2006] http://www.birdstep.com
Copyright (c) 1992-2006 Birdstep Technology, Inc. All Rights Reserved.
dfacache initialized
Boot media /dev/da0 has dual root support
** /dev/da0s2a
FILE SYSTEM CLEAN; SKIPPING CHECKS
clean, 58564 free (44 frags, 7315 blocks, 0.0% fragmentation)
Tue Mar 29 14:41:31 UTC 2011
Amnesiac (ttyu0)
login: root
--- JUNOS 10.2R3.10 built 2010-10-16 20:36:59 UTC
root@%
{linecard:0}
root>
root> request virtual-chassis reactivate
This member split from a virtual chassis. Please make sure that no active
switch belonging to this virtual chassis has conflicting configuration.
Do you want to continue ? [yes,no] (no) yes
{linecard:0}
root>
Amnesiac (ttyu0)
login:
Amnesiac (ttyu0)
login:
Amnesiac (ttyu0)
root@:RE:0%
{master:1}
root> request virtual-chassis renumber new-member-id 0 member-id 1
Note: change 1 with your actual id.
prompt changed:
{master:0}
root>
That's all for the moment.
