SRX

Hi,

Is anyone using ISSU on the high end SRX?  If so does it work well?  The documentation is very unclear as to wether both nodes need the software image or if you can simply put it on the active node and it will push it across.

Thanks!

Hi,

You only need to put the package on the node you are running the upgrade command on.

I cannot vouch for how well it works however, its not a method I use.

You need to make sure that all redundancy groups are on a single node. You may get a failed upgrade if RG0 is on node0 but RG1 is on node for example.

See below the start of an upgrade, notice the "pushing bundle to node0", should answer your question about the package not being needed on both nodes:

user@srx> request system software in-service-upgrade junos-srxsme-10.4R4.5-domestic.tgz reboot
Chassis ISSU Started
Chassis ISSU Started
ISSU: Validating Image
Inititating in-service-upgrade
Inititating in-service-upgrade
Checking compatibility with configuration
Initializing...
Verified manifest signed by PackageProduction_10_1_0

...snipped for brevity...

Validation succeeded
ISSU: Preparing Backup RE
Pushing bundle to node0

...snipped for brevity...

Saving state for rollback ...
Finished upgrading secondary node node0
Rebooting Secondary Node
Shutdown NOW!
[pid 1969]
ISSU: Backup RE Prepare Done
Waiting for node0 to reboot.
node0 booted up.
Waiting for node0 to become secondary
node0 became secondary.
Waiting for node0 to be ready for failover
ISSU: Preparing Daemons
Secondary node0 ready for failover.
Failing over all redundancy-groups to node0
ISSU: Preparing for Switchover
Initiated failover for all the redundancy groups to node1
Waiting for node0 take over all redundancy groups

Hi,

there is quite a few issues with ISSU.

Please look at these KB articles.

# ISSU
http://kb.juniper.net/InfoCenter/index?page=content&id=KB20959
http://kb.juniper.net/InfoCenter/index?page=content&id=KB17946
http://kb.juniper.net/InfoCenter/index?page=content&id=KB17627

Cheers

Personally I would not use it at the present time. We just finished a POC for a customer and that was one of the "sign off's" and it was very problematic. 

Thanks for the input!  I wonder if you saw the same problem I was seeing in my POC.

Bascily one node would upgrade and the other would stay at the old code, no errors, nothing.  The weird part was the cluster kept running with one node being a higher version then the other.  We then upgraded the second node by hand.  Doing the upgrade this way technically caused no outage but it seemed SUPER flaky.

Hi,

I never actually tried it due to the many known issues.

JTAC/KB states you cannot do the ISSU if you have any of the features enabled that have issues.

I really wanted to do the ISSE for my customers many times, but I am still waiting.

I suppose when I move them to 11.4R5+ or 12.1 might be able if I disable VPN tunnels.

No our issue during testing was that the upgrade took down node0 hard. We had to wipe the box and bring it up fresh to recover.