When attempting to upgrade SRX devices to 22.4 or above release via the Security Director Cloud or Junos Space GUI, the upgrade may fail if the device is managed using a non-root user. This issue affects image upgrade to vmhost-based SRX platforms.
Upgrade attempts from version 22.4 or later may fail with permission-related errors. The following error messages may be observed in the Netconf trace logs during the image deployment process:
Below error messages are generated when enabling the Netconf traceoptions on the affected device.
Sep 19 21:21:00 [NETCONF] Started tracing session: 4834
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <!-- No zombies were killed during the creation of this user interface -->
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <!-- user sduser, class j-super-user -->
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <nc:hello xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0">
…
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <nc:capability>http://yang.juniper.net/junos/jcmd?module=junos-configuration-metadata&revision=2021-09-01</nc:capability>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: </nc:capabilities>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <nc:session-id>4834</nc:session-id>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: </nc:hello>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: ]]>]]>
Sep 19 21:21:00 [NETCONF] - [4834] Incoming: <?xml version="1.0" encoding="UTF-8"?>
<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"><capabilities><capability>urn:ietf:params:netconf:base:1.0</capability></capabilities></hello>]]>]]>
Sep 19 21:21:00 [NETCONF] - [4834] Incoming: Received ']]>]]>' token which is split in two consecutive streams or has leading/trailing spaces/tabs or both.
<rpc message-id="job-id" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"><request-package-add><no-copy/><no-validate/><unlink/><package-name>/var/tmp/junos-srxhe-x86-64-23.4R2-S5.5.tgz</package-name></request-package-add></rpc>]]>]]>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <nc:rpc-reply xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos=http://xml.juniper.net/junos/22.4R0/junos message-id="job-id">
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <pipe>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <more-no-more/>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: </pipe>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <cli>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <ignore-signals>
hup
</ignore-signals>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: </cli>
Sep 19 21:21:00 [NETCONF] - [4834] Outgoing: <output>
Sep 19 21:21:11 [NETCONF] - [4834] Outgoing: Verified junos-srxhe-x86-64-23.4R2-S5.5 signed by PackageProductionECP256_2025 method ECDSA256+SHA256
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing:
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: WARNING: This package will load JUNOS 23.4R2 software.
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: WARNING: It will save JUNOS configuration files, and SSH keys
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: WARNING: (if configured), but erase all other files and information
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: WARNING: stored on this machine. It will attempt to preserve dumps
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: WARNING: and log files, but this can not be guaranteed. This is the
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: WARNING: pre-installation stage and all the software is loaded when
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: WARNING: you reboot the system.
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: Pushing Junos image package to the host...
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: Permission denied, please try again.
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: Permission denied (publickey,password).
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: lost connection
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: download_file /var/tmp/pkginst.4842/install-media-srx-summit-junos-23.4R2-S5.5.tgz failed, ret=1
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: ERROR: upgrade failed
Sep 19 21:21:33 [NETCONF] - [4834] Outgoing: ERROR: Failed to add junos-srxhe-x86-64-23.4R2-S5.5.tgz
Sep 19 21:21:34 [NETCONF] - [4834] Outgoing: </output>
Sep 19 21:21:34 [NETCONF] - [4834] Outgoing: <package-result>1</package-result>
Sep 19 21:21:34 [NETCONF] - [4834] Outgoing: </nc:rpc-reply>
Sep 19 21:21:34 [NETCONF] - [4834] Outgoing: ]]>]]>
From SD-Cloud GUI:
The above logs indicate that while the image verification and pre-installation steps complete successfully, the actual installation fails due to permissions issue.
You may also observe the following error during the upgrade
Image [23.4R2-S5.6] to be deployed :junos-vmhost-install-mx-x86-64-23.4R2-S5.6.tgz.Gathered Routing Engine Information.Master RE : re0, backup RE : re1.Completed copying file to the device.Completed copying file to the backup RE.Package installed in device Backup RE.Failed to execute RPC request-vmhost-reboot-backup in 0.692 seconds.Uncommitted changes are present in Device(s). Please perform "rollback" or "commit" in Device(s).Also use "request system reboot" command to complete the pending installation.
Image [23.4R2-S5.6] to be deployed :junos-vmhost-install-mx-x86-64-23.4R2-S5.6.tgz.
Gathered Routing Engine Information.
Master RE : re0, backup RE : re1.
Completed copying file to the device.
Completed copying file to the backup RE.
Package installed in device Backup RE.
Failed to execute RPC request-vmhost-reboot-backup in 0.692 seconds.
Uncommitted changes are present in Device(s). Please perform "rollback" or "commit" in Device(s).
Also use "request system reboot" command to complete the pending installation.
Workarounds based on platform:
If using Junos Space Network Management Platform:
1. Modify the device's authentication from Space UI to be the root user and then perform the upgrade: Modifying the Authentication Mode on the Devices.
2. Perform the upgrade from the device's CLI logged as root, and then let the new version sync to Space.
3. Delete and add the device back to Space with the root user so that the upgrade may be performed.
4. Perform a commit on the device end before proceeding with the upgrade of the managed device from Junos Space.
If using Security Director Cloud:
1. Perform the image upgrade via device's CLI logged as root in place of SD Cloud.
There are no specifics steps required when performing an upgrade via CLI with SD-Cloud connection. You can follow the standard Junos Upgrade procedure.
After upgrade is complete, the device will automatically sync the new version with SD-Cloud.
If the issue persists, please contact HPE Juniper support for further assistance.