Juniper: How to reset to factory default a SRX

SRX: different way to reset to factory-default

so, you may know the standard way, the teached way, i mean pushing during 15 secondes the reset micro-button. This method work fine on J-series, but not on somes SRX, not on MX series...

so, i will try to write down somes of the method i used to reset to factory default the juniperdevices.

Factory Default, really ?

First, i need, we need to define what exactly is a factory-default reset. Is it just putting back the configuration to its initial state ? just this ? and what do you do with all the logs files ? the debug files ? the configurations saved ?

It is a security breach to lets everything inside the box, so putting a device back to the factory-default state is not just the configuration, it is mainly everything, even the ssh key: we want to generate a new one, because the old is not trusted anymore.

Lets start.

Loose the root password.
the common process is the boot in single user mode:

at the boot, after the u-boot, when the bootstrap is loaded, you can hit the spacebar:

 

Hit [Enter] to boot immediately, or space bar for command prompt.

 

so you should see:

FreeBSD/MIPS U-Boot bootstrap loader, Revision 1.5
(builder@ormonth.juniper.net, Fri Oct  9 10:55:15 UTC 2009)
Memory: 1024MB
[0]Booting from nand-flash slice 2
Un-Protected 1 sectors
writing to flash...
Protected 1 sectors
Loading /boot/defaults/loader.conf
/kernel data=0x97d8ac+0xd70d0 syms=[0x4+0x79c50+0x4+0xadd2e] 

Hit [Enter] to boot immediately, or space bar for command prompt.

Loader>

Loader> watchdog disable

Loader> boot –s

root@host% cli

root@host> edit

root@host# set system root-authentication plain-text-password

New password: juniper1

Retype new password: juniper1

root@host# commit

commit complete

root@host# run request system reboot

Reboot the system ? [yes,no] (no) yes

Root passwd on SRX Platform
on SRX Branch platforms and JUNOS 10.0R1 or later, there is a condition in which the password recovery process does not work. After issuing recovery command, system never reaches the point where root password can be changed. System reboots instead. So we need to apply a specific procedure to recover root password for SRX Branch devices running on Junos version 10.0R1 or later. This involves disabling watchdog functionality to allow for system to properly boot into single-user mode.

 

Hit [Enter] to boot immediately, or space bar for command prompt.

Booting [kernel] in 9 seconds...

Loader>

Loader> watchdog disable

Loader> boot –s

change the root passwd, reboot, and don't forget to enable the watchdog, and boot in normal mode

 

Hit [Enter] to boot immediately, or space bar for command prompt.

Booting [kernel] in 9 seconds...

Loader>

Loader> watchdog enable

Loader> boot

Damned, HA is enabled

If you're lucky, your device is in master mode, so you can just diasble the HA:

{primary:node1}
root@titi> set chassis cluster disable reboot
Successfully disabled chassis cluster. Going to reboot now

But if you're not, lucky i mean, your device is on hold, and you're trying to reset the root passwd on single user mode, but you can't:

Starting CLI ...
{hold:node1}
root> edit
warning: Clustering enabled; using private edit
error: shared configuration database modified

Please temporarily use 'configure shared' to commit
outstanding changes in the shared database, exit,
and return to configuration mode using 'configure'

{hold:node1}
root>

Ok, so deleting all the interfaces in the configuration seems to allow me to finally commit.

Then reboot and disable the cluster :

root@>set chassis cluster disable

TRUE Factory default

so, to delete all the logs, the dumps, the rollback, the root password in the factory-default config, and even to reset the host ssh key, you need to zeroize the device:

root> request system zeroize
warning: System will be rebooted and may not boot without configuration
Erase all data, including configuration and log files? [yes,no] (no) yes

warning: zeroizing re0

....

....

Local package initialization:.
starting local daemons:.
kern.securelevel: -1 -> 1
Creating JAIL MFS partition...
JAIL MFS partition created

Database Initialization Utility
RDM Embedded 7 [04-Aug-2006] http://www.birdstep.com
Copyright (c) 1992-2006 Birdstep Technology, Inc.  All Rights Reserved.

secdb initialized

Database Initialization Utility
RDM Embedded 7 [04-Aug-2006] http://www.birdstep.com
Copyright (c) 1992-2006 Birdstep Technology, Inc.  All Rights Reserved.

dfacache initialized

Boot media /dev/da0 has dual root support
** /dev/da0s2a
FILE SYSTEM CLEAN; SKIPPING CHECKS
clean, 58564 free (44 frags, 7315 blocks, 0.0% fragmentation)
Tue Mar 29 14:41:31 UTC 2011

Amnesiac (ttyu0)

login: root

--- JUNOS 10.2R3.10 built 2010-10-16 20:36:59 UTC

root@%

EX series TIPS

LINECARD

sometimes, your switch can be in the linecard state, which means that there is no routing engine running in it. So you first need to enable one.

Example off linecard prompt:

root@:LC:0% cli
{linecard:0}
root>

To enabled the RE mode:

root> request virtual-chassis reactivate

This member split from a virtual chassis. Please make sure that no active
switch belonging to this virtual chassis has conflicting configuration.

Do you want to continue ? [yes,no] (no) yes

{linecard:0}
root>
Amnesiac (ttyu0)

login:
Amnesiac (ttyu0)

login:
Amnesiac (ttyu0)

root@:RE:0%      

so now you can configure the switch.

 

MEMBER-ID is not 0

so, if your switch was member of a virtual-chassis, and it member-id was from 1 to 9, you can't let it as is, because all your interfafce configuration that belongs to ge-0/0/0-47 won't be enabled...

So you need to renumber your device:

{master:1}
root> request virtual-chassis renumber new-member-id 0 member-id 1

Note: change 1 with your actual id.

prompt changed:

{master:0}
root>

That's all for the moment.

lvextend

Howto quickly extend a lvm partition

First, verify you have enough space available.

# pvs
  PV                VG       Fmt  Attr PSize   PFree
  /dev/block/104:17 lebowski lvm2 a-   273,45g 142,77g
  /dev/block/104:5  lebowski lvm2 a-   135,42g      0

 So, here we have about 142 Go free.

 Next, extend the logical volume, here i added 20 Go

# lvextend -L+20G /dev/lebowski/home
  Extending logical volume home to 251,54 GiB
  Logical volume home successfully resized

Finally, resize the partition to fit the physical available space:

# resize2fs /dev/lebowski/home
resize2fs 1.41.12 (17-May-2010)
Le système de fichiers de /dev/lebowski/home est monté sur /home ; le changement de taille doit être effectué en ligne
old desc_blocks = 15, new_desc_blocks = 16
En train d'effectuer un changement de taille en ligne de /dev/lebowski/home vers 65939456 (4k) blocs.
Le système de fichiers /dev/lebowski/home a maintenant une taille de 65939456 blocs.


Checking:

# df -h /home/
Sys. de fichiers    Taille  Uti. Disp. Uti% Monté sur
/dev/mapper/lebowski-home
                      248G  217G   19G  93% /home

FECN, BECN and DE bits

The FECN, BECN and DE bits are used for network congestion control.


The Forward Explicit Congestion Notification (FECN) and Backward Explicit Congestion Notification (BECN) bits can be used to notify an end station, such as a router, of network congestion.

FECN bits notifies devices downstream that congestion is occurring. Downstream means destination.

BECN bits indicates to routers that could be contributing to congestion that they should slow down transmission.

Discard Eligible (DE) bits indicate that the frame is eligible for discard if congestion occurs.
Most routers set frames to be discards  eligible if the traffic exceeds the PVC's Commited Information Rate (CIR).
The CIR is the transmission rate guaranteed by the service provider.

Screenos: Anti-Spam: Adding custom SBL

The anti-spam portion uses a Spam Block List (SBL) which is more commonly known as a Relay Block List (RBL). The SBL/RBL that Juniper offers is updated and maintained by Symantec and contains the Top 100 known spammers.

G1S1-> set anti-spam profile ns-profile
G1S1(anti-spam:ns-profile)-> unset sbl msgsecurity.juniper.net
G1S1(anti-spam:ns-profile)-> set sbl sbl.spamhaus.org input-type ip
G1S1(anti-spam:ns-profile)-> set sbl dnsbl.sorbs.net input-type ip
G1S1(anti-spam:ns-profile)-> set sbl bl.spamcop.net input-type ip
G1S1(anti-spam:ns-profile)-> set sbl msgsecurity.juniper.net input-type ip

G1S1(anti-spam:ns-profile)-> get sbl
  *SBL Blacklist Server:
    sbl.spamhaus.org
    dnsbl.sorbs.net
    bl.spamcop.net
    msgsecurity.juniper.net
G1S1(anti-spam:ns-profile)-> exit

View the Status:

G1S1-> get anti-spam

  profile: ns-profile
  *Whitelists (0):
  *Blacklist (1): baddomain.com;
  *Blacklist[ip range] (0):
  *SBL Blacklist Server:
    sbl.spamhaus.org
  *Default setting:
    *Action: tag mail subject as ***SPAM***


DNS Server:
  Primary  :          10.1.75.111, Src Interface: Null
  Secondary:        172.16.165.22, Src Interface: Null
  Tertiary  :              0.0.0.0, Src Interface: Null


  Total connections:    8
  Total greetings:      8
  Total emails:         8

  Total permit emails:  1
  Total deny actions:   0
  Total tag emails:     7

  errors:               8
  timeouts:             8

  Statistics start time: 12/07/2010 09:43:21

With it with string:

G1S1-> exec anti-spam testscan baddomain.com
AS: anti spam result: action Tag email subject, reason: Match local blacklist

With IP:

G1S1-> exec anti-spam testscan 192.203.178.57
Please wait for a few seconds.
If the result does not display, please check the debug buffer with the "get dbuf stream" command.
G1S1->  anti spam result: action Pass, reason: Timeout
 

View the config: