SRX

last person joined: 2 days ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.

  • 1.  SRX routing-engine bios uninterrupt - What is this exactly?

    Posted 04-24-2020 09:38
    https://www.juniper.net/documentation/en_US/junos/topics/topic-map/upgrading-bios-and-firmware.html#id-disabling-auto-bios-upgrade-on-srx-series-devices ","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":13,"length":152,"key":0}],"data":{}},{"key":"7rrkj","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"f47jf","text":"It states:","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"c3hui","text":" To disable the user inputs at u-boot, boot loader and Junos Kernel boot stage, use the chassis routing-engine bios command as following: ","type":"blockquote","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"3ilh6","text":"user@host# set chassis routing-engine bios uninterrupt","type":"code-block","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"dm3ak","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"7tld5","text":"If the device boots into loader what happens if this is enabled? ","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"f9sie","text":"Can you still reboot the device? ","type":"unordered-list-item","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"22jm1","text":"Can you install Junos from file with usb/tftp/etc?","type":"unordered-list-item","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"66d3n","text":"Does it auto reboot here if it stops on boot? Seems to be common occurence after upgrades or just a general reboot of the device.","type":"unordered-list-item","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"aahr3","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"1p2eh","text":"Something of note the documentation give a warning:","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"fuaj0","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"4l4uh","text":" On SRX Series devices, if both set system ports console insecure and set chassis routing-engine bios uninterrupt options are configured, there is no alternative recovery method available in case Junos OS fails to boot and the device might become unusable. ","type":"blockquote","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"dsmca","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}}]}">
    Does anyone know what exactly does this do? Why/What scenarios would this be used for?
     
     
    It states:
    To disable the user inputs at u-boot, boot loader and Junos Kernel boot stage, use the chassis routing-engine bios command as following:
    user@host# set chassis routing-engine bios uninterrupt
     
    If the device boots into loader what happens if this is enabled?
    • Can you still reboot the device?
    • Can you install Junos from file with usb/tftp/etc?
    • Does it auto reboot here if it stops on boot? Seems to be common occurence after upgrades or just a general reboot of the device.
     
    Something of note the documentation give a warning:
     
    On SRX Series devices, if both set system ports console insecure and set chassis routing-engine bios uninterrupt options are configured, there is no alternative recovery method available in case Junos OS fails to boot and the device might become unusable.
     

    #uninterrupt
    #loader
    #bios


  • 2.  RE: SRX routing-engine bios uninterrupt - What is this exactly?
    Best Answer

    Posted 04-25-2020 08:24

    These types of features are about locking down the boot process for devices where you are concerned about physical access security to the device itself.  This will prevent a malicous physical hands on actor from rebooting the device and taking over during the boot process to own the device.

     

    As the doc notes doing so also means you won't have access to those boot time interuptions yourself should they become necessary in actual problem situations.

     

    So this is a trade off between having a device fail in an unrecoverable way versus having the extra physical security.

     



  • 3.  RE: SRX routing-engine bios uninterrupt - What is this exactly?

    Posted 04-26-2020 07:13
    Thank you for the clear answer