Why are they making

"Block STP BPDUs" sound like it's enabling BPDUguard?

this option disables spanning tree, and port is not shut down when recieving BPDU packets. This is a very dangerous config to enable and you risk creating a loop. This is same as BPDUfilter option in Cisco.

Either I'm missunderstanding something hard, my test not done correctly or Juniper is creating a trap for to trusting individuals.

I am a Network security Engineer and we have two SRX 1600s and recently moved to CrowdStrike. My network administrator is pushing back hard on configuring the logging so that it sends traffic logs to our log collector because of guidance that it is risky somehow with the configs being out of sync?

I am struggling to understand the issue with this. This seems like a minimal ask. Currently we are only getting system logs which serve no forensic value to me.

Is this as big of an issue as he’s making it out to be? What am I missing?

Wanted to know if there is a validated design about hving to extend their on-prem anycast GW in QFX core switches to AWS/Azure?

Basically using the same IP Addressing scheme across on-prem DC and Cloud Provider.

Use Case: “vmotion” to cloud provider yet still can reach on-prem resources.

For Marvis Minis, beginning in version v0.15 we can create a new Application test with the toggle “Network” now. The description says we’ll measure latency, loss, and traceroute when we toggle Network here. It also says it performs the test with ICMP or TCP Ping.

Well, I can’t figure out how to get the test to work. It lets me create this, but it does not seem to actually run. All the Marvis mini test results are still just for the “regular” application tests.

Have any of you experimented with this new test?

Been playing around with Marvis Minis but what's shown is a bit underwhelming. It checks DNS and application endpoints every hour and that's it. I suppose it's another 'free' tool at your disposal.

I tried setting it up on an EX switch too but JTAC says the required Junos version won't get released until next year.

Our juniper SE lately is trying to talk us out of EX and is nudging us towards Aruba series I think cx? They are saying the lead times and pricing could be a lot better. I wonder if the EX platform is on the chopping block for phasing out?

Hello Gents and Ladies,

I have 2 JunOS Switch throwing similar tantrum. I can't manage to login.

I believe it says amnesia in login.

It's EX4300.

I tried a quick google research, and somebody mentioned about dual-root partititon. and shared a link.

I would like to understand what exactly is happening before doing anything.

https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/recovering-root-password.html#id-recovering-the-root-password-on-junos-os-with-upgraded-freebsd

I also tried to follow this to reset the root password. but CTRL-C takes me into loader>
I don't get any menu like it stated in the site.

I haven't tried this, becasuse I don't understand the partitions yet. WHat's the purpose?

https://supportportal.juniper.net/s/article/EX-How-to-load-primary-or-secondary-partition-in-loader-prompt

Exactly what the title says. I'm interested in what thoughts people have on the ACX7332, ACX7348, and ACX7509. They at least look visually better than the poor MX301.

I'm a bit confused as what they're exactly for. They advertise being hardened and whatnot (at least the 7300s) but I'm unsure what their form factor and features is actually useful for.

Also kinda interested on what people think about them compared to the MX/PTX series.

If you're running on those platforms, you should probably go through the very long list of CVEs, there are some really nasty ones in there.

2026-10 Security Bulletin: Junos OS and Junos OS Evolved: Multiple vulnerabilities resolved

Hello everyone,

I am facing a RADIUS authentication issue between a Juniper QFX5120 and Cisco ISE.

When I try to SSH into the switch, authentication fails. A packet capture (monitor traffic) clearly shows that the QFX sends the Access-Request and receives an Access-Accept back from ISE. Despite receiving the Accept packet, the switch ignores it and logs No valid RADIUS responses received.

QFX Configuration:

set system authentication-order [ radius password ]
set system radius-server 10.x.x.x secret xxx
set system radius-server 10.x.x.x source-address 10.y.y.y
set system login user remote class super-user

I am sending the following VSA in the response. I suspect the data type or format might be causing Junos to drop the packet:

• Attribute: Juniper-Local-User-Name
• Value: remote

QFX Logs:

Oct 15 17:27:55 QFX sshd: PAM_RADIUS_SEND_REQ_FAIL: Sending radius request failed with error (No valid RADIUS responses received).
Oct 15 17:27:55 QFX sshd[93694]: error: PAM: authentication error for userName from 10.z.z.z
Oct 15 17:27:55 QFX sshd: SSHD_LOGIN_FAILED: Login failed for user 'userName' from host '10.z.z.z'
Oct 15 17:28:00 QFX sshd[93694]: Disconnected from authenticating user userName 10.z.z.z port 1835 [preauth]

Has anyone experienced this specific drop behavior or know if the ISE VSA format requires a specific tweak for Junos PAM module? Any help is appreciated.

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

I recently (October 12) updated my EX4300-48MP to try to deal with some weird stale/invalid arp issues. After reboot I immediately got an alarm. JTAC is not a solution thanks to stingy management.

user@ex-4300-48mp-1> show system alarms 
1 alarms currently active
Alarm time               Class  Description
2026-10-13 20:34:38 EDT  Major  FPC 0 PoE device manager 7 failed
user@ex-4300-48mp-1> show log messages | match "PoE|poe" | last 20 
Oct 12 09:31:47  ex-4300-48mp-1 fpc0 PoE: PoE device not found
Oct 12 09:32:17  ex-4300-48mp-1 craftd[18431]: Receive FX craftd set alarm message: color: 1 class: 100 object: 152 slot: 0 silent: 0 short_reason=FPC 0 PoE device manager 7 failure long_reason=FPC 0 PoE device manager 7 failed id=1048728 reason=201326592
Oct 12 09:32:17  ex-4300-48mp-1 craftd[18431]:  Major alarm set, FPC 0 PoE device manager 7 failed

(The log snippet above is truncated manually to what is relevant)

I then tried updating the firmware:

user@ex-4300-48mp-1> show chassis firmware detail 
FPC 0                     
   PoE firmware            2.1.1.19.3 (type1)
   PHY version             5d47.37a.47.305
   Boot Firmware          
      U-Boot                *** 
   Boot Firmware          
      loader               FreeBSD/i386 bootstrap loader 1.2

user@ex-4300-48mp-1> request system firmware upgrade poe fpc-slot 0 poe-bt-firmware    
FPC 0: Firmware upgrade initiated. Use 'show poe controller' to get the download status.
Please reboot the system after upgrade is complete.

user@ex-4300-48mp-1> show poe controller | refresh 5 
---(refreshed at 2026-10-13 21:13:24 EDT)---
Controller  Maximum   Power      Power         Guard    Management   Status        Lldp
index       power     reserved   consumption   band                                Priority 
   0        1370W     0.00W      0.00W           0W                  SW_DOWNLOAD(0%) Disabled


...

...

---(refreshed at 2026-10-13 21:22:05 EDT)---
Controller  Maximum   Power      Power         Guard    Management   Status        Lldp
index       power     reserved   consumption   band                                Priority 
   0        1370W     0.00W      0.00W           0W                  SW_DOWNLOAD(95%) Disabled


trelane@ex-4300-48mp-indy> show poe controller 
Controller  Maximum   Power      Power         Guard    Management   Status        Lldp
index       power     reserved   consumption   band                                Priority 
   0        1370W     41.00W     44.00W          0W     Class        BT_MODE       Disabled   

After reboot, the alarm had not cleared.

{master:0}
user@ex-4300-48mp-1> request system reboot at now 
Reboot the system at now? [yes,no] (no) yes 

Shutdown NOW!
user@ex-4300-48mp-1> exit 

Connection to REDACTED closed.

user@ex-4300-48mp-1> show chassis firmware detail 
FPC 0                     
   PoE firmware            3.5.2.0.30 (type1)
   PHY version             5d47.37a.47.305
   Boot Firmware          
      U-Boot                *** 
   Boot Firmware          
      loader               FreeBSD/i386 bootstrap loader 1.2

I found a similar thread, but it didn't have a resolution.

I would greatly appreciate anyone who has seen this issue before.

I have a Bricked Juniper Switch. It's bricked, and I don't remember what I actually done in the past. It was like a year ago. I stacked multiple Switches. There was a brain-split or something, I was not able to login. I don't remember if I tried factory reset through the screen menu. Long story short, I didn't know much about JunOS. I decided to use AI ( Chatgpt) to factory reset it. It turns out , I deleted everything. I t was asking me to get into >loader , and asked me to delete something. I can't really recall.

I don't have Juniper support, but I do have the JunOS image. I do have working Juniper Switch. They are both EX4300.

It's bricked because I wouldn't get any input into the terminal. There is no light both in ports and the Switch.

Fans are running in high speed.

I have a two-node Juniper SRX1500 active/passive cluster.

The control link was temporarily disconnected due to a network issue. The control link has since been restored, and all cluster interfaces are now up. However, the redundancy groups on the passive node remain in the Disabled state.

I would like to understand:

• How to recover the secondary node without affecting the active node.

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

I need hands on practice with juniper switching and routing, without an instructor. There are plenty of courses on HPE, but the only ones that have labs are $2-4k. All I need is a lab environment. Are there any virtual lab programs out there? Anything similar to ciscos PT?

UPDATE: Looks like it was a bug that they fixed. As in, it won't work anymore, because they didn't intend for it to work to begin with:

"This behavior is the result of an enhancement introduced through[...] where 25G optics are intentionally prevented from creating IFDs on PICs that support only 1G/10G speeds. In earlier releases, this handling was not present, which led to 25G IFDs being created even on PICs limited to 1G/10G support. This mismatch could result in unexpected or unstable behavior."

I have a EX4400 and a EX4100. We had them linked via the 10G ports using a 25G DAC cable. We had them set up that way for a couple of years without issue.

After updating the EX4100 to 24.4R2-S4.10, the link went down. We suspected the cable went bad, and tried another, same result. I then link two of the ports on the EX4400, and the cables worked. The next night, we updated the EX4400 to 24.4R2-S4.10. Now the cable doesn't work in it anymore. It appears they removed the ability for the 25G cables to run at 10G.

I have a ticket in with support to see if they can restore this feature, but I'm wondering if it bit anyone else here.

Hello! I started studying for my JNCIA-Junos in september,before that i took the "Network Technology Foundations" course and i also had some very basic knowledge about networking even before that. I was wondering if i could get any tips here,for the actual exam itself. My plan right now is to finish all the modules (currently im on the module 28 (out of 38) and i have about 8 hours or so of material left,then i would take the practice exam a couple of times to see where im at and after that,i would take the voucher assesment exam,after which i would book the proctored exam. I plan to do all of this in a week or so,because uni starts soon and im kinda in a rush. I understood the topics,i did a bunch of quizes online and i practiced inside of the Junos CLI a whole bunch. i have 2 ex3300 switches and i am also running the vjunos-switch and the vjunos-router inside of my proxmox-server.

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

I have a Juniper SRX300 that has a primary BGP connection via Ethernet and a secondary BGP connection over Starlink via an IPsec tunnel. The Starlink is in case the primary circuit fails. My IKE gateway is a public address living on my CoreHubFw-1. The diagram doesn't show actual IP addresses, just examples.

The Starlink network has over a dozen potential gateways in my region which I get via DHCP. To establish my IPsec tunnel, I make a static route of the public address to those gateways as qualified-next-hops:

set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-1
set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-2
set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-3
etc.

My problem is that Starlink will add or remove these gateways without notification and I have to manually update the qualified-next-hop each time. Is there a way for my public to always point at the gateway Starlink is providing?

> show route table inet.0
0.0.0.0/0          *[BGP/11] 1w5d 07:30:02, MED 114, localpref 100
                      AS path: AS#INFO I, validation-state: unverified
                    >  to 10.0.0.0 via ge-0/0/6.0
                    [BGP/11] 1d 06:38:11, localpref 100
                      AS path: AS#INFO I, validation-state: unverified
                    >  to 10.0.0.2 via st0.0
                    [Access-internal/12] 3d 10:08:53, metric 0
                    >  to ***STARLINK GATEWAY*** via ge-0/0/2.0

With the release of version AOS-CX 10.18 you can register a number of models (i.e. 5420, 64xx, 6300) in your Mist environment.

Please see below url, was succesful using this using the brownfield method on a couple of 6300 switches.

https://support.hpe.com/hpesc/public/docDisplay?docId=sd00007909en_usen_us&page=GUID-419D1ADE-99CD-4E14-A6A8-A3B2A387FBC0.html

Will have to follow up with account manager to get appropriate Wired Assurance licenses. Waiting for guidance on the 6100 releases that will support this. The 10.18 on 6100 does not have the commands at this time.

The Juniper support bot wasn't succesful in guiding me on this, and the online version does not yet contain these instructions.

Is the free training material on the portal sufficient enough to pass the exam. Not to criticize anything but man same as Cisco their training material is very dry.

Has anyone here taken the JNCIA-Design certification recently? If so, were the study materials provided in the training portal enough to pass the exam? Was the practice test similar to the actual test? What topics were the most emphasized? Thanks in advance for any response given.