[j-nsp] SNMP ifIndex 0 on MX after ISSU

2013-03-08 Thread Jonas Frey (Probe Networks)
Hello, did anyone ever notice problems with wrong/changed SNMP ifIndex settings after ISSU? We ISSU upgraded a MX from 10.4R9.2 to 11.4R7.5 and after this some of the ifIndex changed. When doing the ISSU it brought down FPC-1 (which is a MPC Type 2). Maybe thats why the ifIndex were changed. (We

Re: [j-nsp] SNMP ifIndex 0 on MX after ISSU

2013-03-08 Thread Tobias Heister
Hi, Am 08.03.2013 16:33, schrieb Jonas Frey (Probe Networks): did anyone ever notice problems with wrong/changed SNMP ifIndex settings after ISSU? We ISSU upgraded a MX from 10.4R9.2 to 11.4R7.5 and after this some of the ifIndex changed. We had that a couple of time with the MX series (with

[j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Andy Litzinger
We're evaluating SRX clusters as replacements for our aging ASAs FO pairs in various places in our network including the Datacenter Edge. I was reading the upgrade procedure KB: http://kb.juniper.net/InfoCenter/index?page=contentid=KB17947 and started to have some heart palpitations. It

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Tim Eberhard
I would never, ever follow that KB. It's just asking for a major outage.. With that said, you have two options. 1) ISSU and 2) Reboot both close to the same time and take the hit. Depending on your hardware it might be 4 minutes, it might be 8-10 minutes. If option one is the path you choose to

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Aaron Dewell
Not that I've had to do it - but I'd probably break the cluster to do the upgrade and run on one during the procedure. On Mar 8, 2013, at 10:50 AM, Andy Litzinger wrote: We're evaluating SRX clusters as replacements for our aging ASAs FO pairs in various places in our network including the

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Mark Menzies
Yes the upgrade process is not the best. The link above puts names on tasks to do do effectively split the cluster in such a way that you can reconnect it without loss of connectivity. The best approach, which does NOT include minimal downtime is to upgrade both nodes and then reboot them both

Re: [j-nsp] SNMP ifIndex 0 on MX after ISSU

2013-03-08 Thread Jonas Frey (Probe Networks)
Hi, btw, i already tried restart mib-proess and restart snmp, none of both were of any help. Also i can actually see the ifIndex in /var/db/dcd.snmp_ix (which is 560 for this interface) but while trying to read via snmp it always returns 0 despite carrying traffic. Am Freitag, den 08.03.2013,

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Eric Van Tol
-Original Message- From: juniper-nsp-boun...@puck.nether.net [mailto:juniper-nsp- boun...@puck.nether.net] On Behalf Of Mark Menzies Sent: Friday, March 08, 2013 1:03 PM To: Andy Litzinger Cc: juniper-nsp@puck.nether.net Subject: Re: [j-nsp] SRX upgrade procedure -ready for

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Aaron Dewell
I tried ISSU twice, both times on 3 MX routers during a single maintenance window, going from 10.x to 11.x. It failed spectacularly on the second router, requiring manual recovery via the console (mastership was not assumed by the backup before the primary rebooted), so I completely gave up

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Andy Litzinger
what pieces of the KB do you think contribute to the possibility of major outages? Not having tested anything it already makes me nervous that failover is initiated solely by shutting down the interfaces on the active node... -Original Message- From: Tim Eberhard

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Mark Tees
From 11.2 R2 onwards you have ICU for SRX100, SRX210, SRX220, SRX240, and SRX650 http://www.juniper.net/techpubs/en_US/junos11.4/topics/task/operational/chassis-cluster-upgrading-both-device-with-icu.html This with the no-tcp-syn-check option (thanks Craig) might possibly make life easier. I

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Andy Litzinger
ICU sounds interesting. Any idea why it's not supported on the 550? or is that just documentation lag? -Original Message- From: Clay Haynes [mailto:chay...@centracomm.net] Sent: Friday, March 08, 2013 3:08 PM To: Andy Litzinger; juniper-nsp@puck.nether.net Subject: Re: [j-nsp] SRX

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Mike Devlin
Mark/Andy, thanks for the input, i have a cluster of 100s in my lab im going to test this out on. Been a nightmare doing it in the past. looking forward to testing this out now :) On Fri, Mar 8, 2013 at 6:13 PM, Andy Litzinger andy.litzin...@theplatform.com wrote: ICU sounds interesting.

Re: [j-nsp] SRX upgrade procedure -ready for enterprise?

2013-03-08 Thread Clay Haynes
I've had really good luck with the ICU Upgrade for branch series. You upload the software package to the active SRX, run the commands, and it handles copying the package to the backup unit and all reboots. There is still a drop in traffic for up to 30 seconds, but for the most part it's much safer