Juniper SSG5 Boot Loader升級詳細流程

- 10月 27, 2017

Juniper SSG5 Boot Loader升級詳細流程

在繼續閱讀前請先看過以下連結，非常重要!!

Juniper SSG5 關於imagekey的問題及移除與載入imagekey

Juniper SSG 5升級boot loader所需環境如下：

boot loader版本：Boot Loader Version 1.3.2
下載的新版本boot loader：Loadssg5ssg20v133.d
PC電腦：已啟動tftpd64 TFTP Server(CD中有免安裝版)，其預設根目錄預設為D:\TFTP，必須先將Loadssg5ssg20v133.d先放置到該目錄下。

PC電腦的ip地址是192.168.1.11(設定成固定IP，因為升級boot loader過程SSG5會重開機，而在boot loader模式下SSG5 沒有DHCP功能，不會自動分派ip位址。)。

然後使用超級終端機連接到SSG5 console port。

可參考連結 TFTPSERVER架設。

可參考連結 如何連線JuniperSRX/SSG Colsole Port

boot loader升級流程可分成兩個部分來討論：版本6.3.0r18(含)以前及版本6.3.0r19(含)以後。

一、版本6.3.0r19(含)以後

從6.3.0r19開始，升級防火牆OS要先載入image key，也導致無法直接將boot loader升級，必須先移除image key後，才能將boot loader升級成新版本，待升級完成之後再載入image key。

否則ssg系列升級BootLoader時會失敗,過程中則會出現以下錯誤訊息：

********Invalid DSA signature

********Bogus image - not authenticated

若要解決此問題有以下2個解決方法:

1.Update the New Image Authentication Key

2.using CLI delete crypto auth-key

我則是用第二種方法，連接登入CONSOLE後在CLI輸入下列命令來移除image key：

ssg5-serial-> delete crypto auth-key 刪除image key

之後重開SSG5：

然後參照Juniper SSG 5升級boot loader步驟即可

開機後再登入CONSOLE後在CLI輸入以下命令來載入image key

ssg5-serial-> save image-key tftp 192.168.1.11 imagekey.cer 載入image key

Load file from TFTP 192.168.1.11 (file: imagekey.cer).

!!!!!

tftp received octets = 863

tftp success!

Done

TFTP Succeeded

ssg5-serial->

PS:在執行delete crypto auth-key後會造成開機出現訊息

Loading default system image from on-board flash disk...

Done! (size = 13,402,112 bytes)

Ignore image authentication! (沒有image key無法認證)

所以必須執行save image-key tftp 192.168.1.11 imagekey.cer，開機出現訊息

Loading default system image from on-board flash disk...

Done! (size = 13,402,112 bytes)

Image authenticated! (認證成功)

大功告成!!

以下開始示範整個升級流程，乃超級終端機經由COM3接入CONSOLE埠後，超級終端機上顯示的畫面

System change state to Active(1)

password:

ssg5-serial-> delete crypto auth-key　　　　刪除 image key

ssg5-serial-> reset 重開機

System reset, are you sure? y/[n] y 按y

In reset ...

中間的部分省略，請自行參考”一、版本6.3.0r18(含)以前”的內容。

password:

ssg5-serial-> save image-key tftp 192.168.1.11 imagekey.cer 載入image key

Load file from TFTP 192.168.1.11 (file: imagekey.cer).

!!!!!

tftp received octets = 863

tftp success!

Done

TFTP Succeeded

ssg5-serial->

大功告成!!

執行過save image-key tftp 192.168.1.11 imagekey.cer後，重開機會出現訊息

Loading default system image from on-board flash disk...

Done! (size = 13,402,112 bytes)

Image authenticated!　　　　認證成功

上述做法乃是標準做法，若您運行中的ScreenOS版本的範圍是在新的Image Key適用版本之內(適用於6.3.0r19以後之版本)，您就必須採用此辦法。

二、版本6.3.0r18(含)以前

而若您運行中的ScreenOS版本的範圍是在舊的Image Key適用版本之內(適用於6.3.0r18以前之版本)，則您的升、降bootloader版本的程序就可以省略移除與載入Image Key的步驟。

以下開始示範整個升級流程，乃超級終端機登入CONSOLE埠後，超級終端機上顯示的內容：

System change state to Active(1)

password:

ssg5-serial-> reset 重開機

System reset, are you sure? y/[n] y

In reset ...

Juniper Networks SSG5 Boot Loader Version 1.3.2 (Checksum: A1EAB858)

Total physical memory: 128MB

Test - Pass

Initialization - Done

Hit any key to run loader

Hit any key to run loader 記得要按個鍵......

Serial Number [0162112011005923]: READ ONLY

HW Version Number [0710]: READ ONLY

Self MAC Address [78fe-3d95-7e80]: READ ONLY

Boot File Name [screenos_image]: Loadssg5ssg20v133.d 輸入新的檔名

Self IP Address [192.168.2.27]: 192.168.1.7 輸入SSG IP位址，必須避開192.168.1.1這個位址

TFTP IP Address [192.168.2.100]: 192.168.1.11 輸入TFTP SERVER IP位址

Loading file "Loadssg5ssg20v133.d"...

rtatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat

atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat

atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatata

Loaded Successfully! (size = 408,395 bytes)

Image authentication!

Save to on-board flash disk? (y/[n]/m) No! 千萬要按 N，因為升級boot loader是一次性的行為，不需要存入on-board flash。

Run downloaded system image? ([y]/n) Yes! 千萬要按 Y

******************************************************************

* *

* SSG5/SSG20 BOOT LOADER UPDATE UTILITY *

* ============================================== *

* *

* ---------------------------------------------- *

* Boot Loader Version: 1.3.3 *

* Date : 05/26/2006 *

* *

* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! *

* ! ! *

* ! Please don't power off during update. ! *

* ! Otherwise, the system can not boot again. ! *

* ! ! *

* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! *

* *

* *** DON'T POWER OFF DURING BOOT LOADER UPDATE *** *

* *

******************************************************************

Check on-board Boot Loader... Update needed!

Are you sure you want to update Boot Loader? (y/n) y 千萬要按 Y

Read product information of on-board boot flash device:

Manufacturer ID = 1f

Device ID = 13

Additional Device ID = 10

Boot flash device is AT49LV040B

Erase on-board boot flash device.......... Done

Update Boot Loader..............................................................

................................................................................

................................................. Done

Verify Boot Loader... Done

Boot Loader has been updated successfully!

Please hit any key to reboot the system... 按任意鍵即可重開機

Juniper Networks SSG5 Boot Loader Version 1.3.3 (Checksum: D8BC25A8) 已更新為1.3.3

Total physical memory: 128MB

Test - Pass

Initialization - Done

Hit any key to run loader

Loading default system image from on-board flash disk...

Done! (size = 13,402,112 bytes)

Image authentication!

Start loading...

.................................................................

......

Done.

Juniper Networks, Inc

SSG5/SSG20 System Software

Version 6.3.0r23.0

Cksum:57a4ef6e

Load Manufacture Information ... Done

Initialize FBTL 0........ Done

Load NVRAM Information ... (6.3.0)Done

Install module init vectors

Changed to l3 mode

Install modules (0127c800,020b8000) ...

PPP IP-POOL initiated, 256 pools

HW crypto initialized

Initializing DI 1.1.0-ns

System config (1672 bytes) loaded

Done.

Load System Configuration ......................................................

.....................modem is not detected

....................................................Disabled licensekey auto update

.................Done

system init done..

ethernet0/4 interface change physical state to Up

bgroup0 interface change physical state to Up

System change state to Active(1)

搜尋此網誌

查理王的電腦部落格

Juniper SSG5 Boot Loader升級詳細流程

Juniper SSG5 Boot Loader升級詳細流程

這個網誌中的熱門文章

如何測試網路連線--網路斷線了怎麼辦?

筆記電腦刷BIOS失敗無法開機—用CH341A編程器重刷BIOS教學！

查理王的電腦部落格-首頁