You said:
hi , you are a technical ciso that had passed many DR situations and today you had a
juniper SRX 340 firewall out of service and you need to fix the issue and restore the service
as fast as possible , you will document all the steps in very detailed matter to fix the issue
as you found the firewall only boot to the loader and shows errors like can't open kernel and
can't open kernel.old
ChatGPT said:
Here’s a detailed step-by-step process for troubleshooting and restoring a Juniper SRX 340
firewall that is stuck in the loader prompt and displaying errors like:
• "can't open kernel"
• "can't open kernel.old"
Incident Report: Juniper SRX 340 Boot Issue – Recovery Process
1. Initial Assessment & Root Cause Analysis
When the SRX340 firewall boots into the loader prompt, it indicates that the device is
failing to load the Junos OS. The errors "can't open kernel" and "can't open kernel.old"
suggest:
• Corrupt or missing Junos OS image.
• Filesystem corruption.
• Failed/damaged storage or internal flash memory.
To proceed with recovery, follow these steps:
2. Recovery Process
Step 1: Connect to the Console
1. Physically connect a console cable from your computer to the SRX 340 console
port.
2. Use a terminal emulator such as:
o PuTTY (Windows)
o Minicom (Linux)
o screen (Mac)
3. Set the console parameters:
o Baud Rate: 9600 or 115200
o Data Bits: 8
o Parity: None
o Stop Bits: 1
o Flow Control: None
4. Power on the firewall and observe the boot process.
Step 2: Check Bootloader Status
Once in the loader prompt (loader>), confirm available boot devices:
loader> printenv
Look for the boot sequence and boot device information.
Step 3: Manually Boot Junos OS
Try booting Junos manually:
loader> boot –s
If this fails and still shows missing kernel errors, proceed with recovery.
Step 4: Reinstall Junos OS from USB
Since the system cannot boot normally, reinstall Junos OS using a USB drive.
(A) Prepare the USB Drive
1. Download the correct Junos OS image for SRX 340 from Juniper's official website.
o Example filename: junos-srxsme-20.4R3.8.tgz
2. Format a USB drive as FAT32.
3. Copy the Junos OS image to the USB drive.
(B) Install Junos from USB
1. Insert the USB drive into the firewall.
2. List available storage devices:
loader> show disk
Look for something like da0 (this represents the USB drive).
Manually start the installation:
loader> install --format file:///da0/junos-srxsme-20.4R3.8.tgz
Wait for the installation to complete and reboot the firewall:
4. loader> reboot
5.
Step 5: Verify Boot and Configuration Restoration
1. Once Junos boots up successfully, verify the version:
show version
Restore configuration if needed:
• If you have a backup, restore it:
2.
o load override <backup-config>
o commit
o
If no backup is available, reconfigure the necessary settings manually.
3. Test connectivity to ensure firewall functionality is restored.
o
Step 6: Post-Recovery Actions
• Check system logs for any hardware errors:
show log messages | last 50
Run a filesystem check:
• request system storage cleanup
•
•
If the issue recurs, consider replacing the internal flash memory or contacting
Juniper support.
Incident Report: Juniper SRX 340 Boot Failure – TFTP Recovery Process
1. Incident Overview
Issue Description:
The Juniper SRX 340 firewall failed to boot and dropped into the loader prompt (loader>)
with the following errors:
• "can't open kernel"
• "can't open kernel.old"
Initial Findings:
• The firewall was unable to locate a valid Junos OS image.
• Attempts to manually boot Junos OS from the loader failed.
• The system did not detect a USB drive when attempting a USB-based recovery.
• TFTP recovery was chosen as an alternative method to reinstall Junos OS.
2. Recovery Process
Step 1: Connect to the Console
1. Physically connect a console cable from your computer to the SRX 340 console
port.
2. Use a terminal emulator such as:
o PuTTY (Windows)
o Minicom (Linux)
o screen (Mac)
3. Set the console parameters:
o Baud Rate: 9600 or 115200
o Data Bits: 8
o Parity: None
o Stop Bits: 1
o Flow Control: None
4. Power on the firewall and observe the boot process until it stops at the loader>
prompt.
Step 2: Set Up a TFTP Server
Since the USB was not detected, a TFTP server was used to transfer the Junos OS image.
1. Set up a TFTP server on a PC:
o Use TFTPD32 (Windows) or tftpd-hpa (Linux/Mac).
o Place the Junos OS image in the TFTP root directory.
o Example image: junos-srxsme-20.4R3.8.tgz
o Assign a static IP to the TFTP server, e.g., 192.168.1.10.
2. Physically connect the TFTP server to the SRX 340 using an Ethernet cable.
o Use Port 0 (or the first available interface) on the SRX.
o Configure the PC with a static IP (e.g., 192.168.1.10).
Step 3: Configure Network in Loader Mode
1. In the loader prompt, set up the network interface:
loader> set ip 192.168.1.1 255.255.255.0
loader> set server 192.168.1.10
loader> set gateway 192.168.1.1
Verify connectivity to the TFTP server:
2. loader> ping 192.168.1.10
3.
o If the ping fails, check the network cable, firewall rules on the PC, or restart
the TFTP service.
Step 4: Load Junos OS via TFTP
1. Begin the transfer of the Junos OS image:
loader> tftpboot 192.168.1.10 junos-srxsme-20.4R3.8.tgz
Once the file is downloaded, install the image:
2. loader> install --format junos-srxsme-20.4R3.8.tgz
3.
4. Wait for the installation to complete.
Step 5: Reboot and Verify Installation
1. Reboot the firewall:
loader> reboot
Allow the system to boot into Junos OS.
Log in and check the Junos OS version:
show version
Restore the configuration if needed:
4. load override <backup-config>
5. commit
6.
3. Post-Recovery Actions
• Check system logs for errors:
show log messages | last 50
Run a storage cleanup to prevent future corruption:
request system storage cleanup
Backup the configuration for future recovery:
• request system snapshot media internal
• Monitor the device for any further issues.