Upgrading ScreenOS through NSM (supplement of TSB16495)

Transcription

1 Upgrading ScreenOS through NSM (supplement of TSB16495) This Application Notes provides an alternative method to upgrade ScreenOS, which is signed with the new image key through NSM. Prior to installing the ScreenOS, you need to install the following special ScreenOS firmware. Once the special ScreenOS firmware is installed, it will install the new image key automatically while the device boots up. Special ScreenOS Firmware Names for version 6.2 and 6.3 SSG 20/140/320M/350M/520/520M/550/550M : dhq1.0 dhq1.0 dhq1.0 dhq1.0 crp1.0 crp1.0 crp1.0 crp1.0 ISG1000/2000, NS5200/NS5400 (boot loader upgrade is required) : M2A.r17- dht1.0 M3A.r17- dht1.0 IDP1.r17- dht1.0 dht1.0 IDP1.r17- dht1.0 dht1.0 M2A.r18- crq1.0 M3A.r18- crq1.0 IDP1.r18- crq1.0 crq1.0 IDP1.r18- crq1.0 crq1.0 NOTE: If you cannot download the above ScreenOS firmwars due to login restriction, please contact JTAC. Juniper Networks, Inc. 1

2 1. Deleting the Old Image Key through NSM Before installing the special patch on the SSG Series, NS5200/5400 and ISG1000/2000 platforms, the installed old image key must be deleted. Otherwise, the special patch cannot be installed on the device because it is signed with the new image key, which requires installing the new image key to authenticate the special ScreenOS firmware Create a New Screen OS/IDP Template (e.g., Delete Image Key ) under Device Manager > Device Templates > click + sign on Device Template Tree tab 1.2. Under Advanced > Supplemental Cli > click + sign, set the Priority value to 0, type delete crypto auth-key in the Cli content field, then click OK button. You will see Delete Image Key template under Device Templates Juniper Networks, Inc. 2

3 1.3. Create a New Group that you want to delete the installed old image key under Device Manager > Devices > click + sign on Device Tree > select Group, and add members, then click OK button. NOTE: If you already defined a group, skip this step and go to next step Configure Template Operations under Menu : Devices > Configuration > Template Operations 1.5. Select Devices and Templates to apply, and select Add templates with highest priority, then click OK button Juniper Networks, Inc. 3

4 1.6. Before updating the devices, please make sure to review the Delta Config Summary under Device Manager > Devices > select the target device group on Device Tree tab, then right click on the mouse, select Summarize Delta Config NOTE: If right click does not work on the mouse, go to Menu : Devices > Configuration > Summarize Delta Config On the Delta Config Summary, you should see delete crypto auth-key under Details Juniper Networks, Inc. 4

5 1.7. Update target devices, select the target device group under Device Manager > Devices > Device Tree tab, then right click on the mouse, then select Update Device The CLI delete crypto auth- key command was successfully sent and all the devices do not have any installed image key. Juniper Networks, Inc. 5

6 2. Installing the Special ScreenOS firmware through NSM NOTE: If you want to upgrade ScreenOS firmware on multiple devices at the same time, generally the recommended number of devices is eight in a single batch of upgrade Add the Special ScreenOS firmware into NSM under Menu : Tools > Software Manager, click + sign to add the ScreenOS into Software Manager 2.2. Install the Special ScreenOS firmware on the selected group under Menu : Devices > Software > Install Device Software Juniper Networks, Inc. 6

7 Select the Software Image and Devices for the same platform NOTE: During the installation process, the device will be rebooted. Juniper Networks, Inc. 7

8 After successful installation, you should not see any error message, then click Close Verify the Running OS Version under Device Manager > Devices > Device List 2.4. (Optionaly) Verify the New Image Key on the Device On the get event output, you should see the following events. SSG5_1- > get event Date Time Module Level Type Description :44:27 system notif PKI: Succeed to load image key :44:27 system notif PKI: Successfully loaded image signer's public key.... You can verify the image key via the CLI exec pki test skey command as well. SSG5_1- > exec pki test skey... KEY1 N/A len = ad fd7f53811d df4a9c2eece4e7f611b7523cef4400c31e3f80b651 KEY2 N/A len = ad fd7f53811d df4a9c2eece4e7f611b7523cef4400c31e3f80b651 KEY3 N/A len = ad fd7f53811d df4a9c2eece4e7f611b7523cef4400c31e3f80b651 magic1 = f7e9294b magic2=0 magic1 = f7e9294b magic2=0 magic1 = f7e9294b magic2=0 NOTE: If the value starts with ac, it indicates the old image key. If the value starts with ad, this indicates the new image key. Juniper Networks, Inc. 8

9 3. Upgrading ScreenOS signed with the New Image Key NOTE: Download ScreenOS firmware signed with the new image key from the Software Download site. For customer specific patches (CSPs), you can contact JTAC. NOTE: After successful installation of the special ScreenOS firmware, the new image key is installed on the device during the boot up process. Therefore, you do not need the custom device template anymore, which includes delete pki authkey command. Otherwise, this template will be executed whenever you update configuration changes to the device. To delete it, select the configured device template and click - button under Device Manager > Device Templates > Device Template Tree Alternatively, you can remove selected template for selected devices under the Template Operations (Menu : Devices > Configuration > Template Operations > Select Device(s) > Select Templates > Remove templates) to avoid the execution of the custom device template after successful installation of the special ScreenOS firmware. Juniper Networks, Inc. 9

10 3.1. Before updating the devices, please make sure to review the Delta Config Summary under Device Manager > Devices > select the target device group on Device Tree tab, then right click on the mouse, select Summarize Delta Config On the Delta Config Summary, you SHOULD NOT see delete crypto auth-key under any of the sections. On SSG 20/140/320M/350M/520/520M/550/550M : You DO NOT require updating the current boot loader because the integrity check of boot loader happens only during the installation of boot loader using the image key. Therefore, the integrity check of boot loader is not done while the device boots up. You can follow the regular upgrade procedures that are described below Add the ScreenOS firmware signed with the new image key into NSM under Menu : Tools > Software Manager, click + sign to add the ScreenOS into Software Manager Juniper Networks, Inc. 10

11 3.3. Install the ScreenOS firmware on the selected group under Menu : Devices > Software > Install Device Software Select the Software Image and Devices for the same platform NOTE: During the installation process, the device will be rebooted. After successful installation, you should not see any error message, then click Close button 3.4. Verify the Running OS Version under Device Manager > Devices > Device List Juniper Networks, Inc. 11

12 4. Upgrading Bootloader signed with the New Image Key through NSM On ISG1000/2000, NS5200/NS5400 (boot loader upgrade is required) : You MUST update the bootloader (OS Loader) prior to upgrading to a ScreenOS firmware that is signed with the new image key. Normally a console connection is required to update the bootloader via a TFTP server. However, the special ScreenOS firmware (installed in the previous steps 1.1 to 3.1) includes a new CLI command to update the bootloader (OS Loader) on the CLI without a console connection via TFTP server. NOTE: If you already installed the special ScreenOS firmware on the above steps, please follow the next step. Otherwise, you need to follow the steps from 1.1 to To update the bootloader (OS Loader) through NSM, create a new Screen OS/IDP Template under Device Manager > Device Templates > click + sign on Device Template Tree tab 4.2. Under Advanced > Supplemental Cli > click + sign, set the Priority value to 0, type save osloader from tftp (IP address of TFTP server) (Filename of Bootloader) to flash in the Cli content field, then click OK buttons. NOTE: As long as the device can reach to the TFTP server through any interface, you can upgrade the boot loader. Juniper Networks, Inc. 12

13 You will see Update Bootloader template under Device Templates 4.3. Configure Template Operations under Menu : Devices > Configuration > Template Operations 4.4. Select Devices and Templates to apply, and select Add templates with highest priority, then click OK buttons Juniper Networks, Inc. 13

14 4.5. Before updating the devices, please make sure to review the Delta Config Summary under Device Manager > Devices > select the target device group on Device Tree tab, then right click on the mouse, select Summarize Delta Config NOTE: If right click does not work on the mouse, go to Menu : Devices > Configuration > Summarize Delta Config Juniper Networks, Inc. 14

15 On the Delta Config Summary, you should see save osloader from tftp under Details 4.6. Update target devices, select the target device group under Device Manager > Devices > Device Tree tab, then right click on the mouse, then select Update Device Juniper Networks, Inc. 15

16 The CLI save osloader tftp... command was successfully sent. NOTE: After successful installation of bootloader (OS Loader), you do not need the custom template any more (e.g., Upgrade Bootloader ), which include save osloader tftp command. To delete it, select the configured device template and click - button under Device Manager > Device Templates > Device Template Tree, OR remove the selected template for selected devices under the Template Operations (Menu : Devices > Configuration > Template Operations > Select Device(s) > Select Templates > Remove templates). NOTE: After successful installation of bootloader (OS Loader), you do not need to reboot the system to take effect. Next, proceed with step 4.7 to upgrade the ScreenOS version signed with the new image key Add the ScreenOS firmware signed with the new image key into NSM under Menu : Tools > Software Manager, click + sign to add the ScreenOS into Software Manager 4.8. Install the ScreenOS firmware on the selected group under Menu : Devices > Software > Install Device Software Select the Software Image and Devices for the same platform Juniper Networks, Inc. 16

17 After successful installation, all the selected devices will reboot for the change to take effect. You should not see any error message. Finally, click the Close button Verify the Running OS Version under Device Manager > Devices > Device List Juniper Networks, Inc. 17