[SRX] Pre-Upgrade and Post-Upgrade Validation Checklist for Junos OS Software Upgrades

Description

This article provides a standardized checklist for performing pre-upgrade and post-upgrade validation on Juniper SRX Series platforms when upgrading Junos OS software. The checklist helps verify platform readiness, preserve configuration and diagnostic data, validate successful software installation, and confirm restoration of critical network and security services after the upgrade.

Symptoms

Administrators planning a Junos OS upgrade on SRX Series devices may require a consistent validation procedure to:

Verify platform readiness before the upgrade.
Preserve logs and diagnostic information.
Validate successful installation of the target Junos OS release.
Confirm restoration of routing, VPN, interface, and security services.
Reduce upgrade-related risk and downtime during maintenance activities.

Solution

Important Recommendations

Ensure the upgrade is performed during an approved maintenance window.
Notify all stakeholders of the planned activity.
Review and document the rollback plan prior to the maintenance window.
Ensure the current and target Junos OS releases support the intended upgrade path.
Ensure active console access is available throughout the maintenance activity.
Console sessions should be maintained and logged during:
Pre-upgrade validation
Software installation
Device reboot
Post-upgrade validation
Console logs provide valuable information when troubleshooting software installation issues, reboot failures, or unexpected platform behaviour.

Upgrade Image Preparation

Prior to the maintenance window:

Refer to the latest recommended target version, KB21476 [juniper.net]
Please verify if there are any special instructions provided in the above KB; if yes, make sure to follow them.
Please verify the release notification, release notes for known issues and any other details of the target version before proceeding. In case of any queries, raise a JTAC case.
Determine the upgrade path, refer to KB36620 [juniper.net]
Download the target Junos OS software image from the Juniper Software Downloads Portal.
Upload the software package to the SRX device.
Verify the image checksum before proceeding.
Example:
file checksum md5 /var/tmp/<junos-package>.tgz
The checksum calculated on the device must match the checksum published on the Juniper Software Downloads page.
For onsite upgrades, it is recommended that the Field Engineer (FE) have a USB drive prepared with the target Junos OS version.
This can be used for recovery in the event of boot media corruption or Routing Engine recovery scenarios.
Please make sure to have a laptop with internet connectivity and a USB port to prepare the USB as required.

Diagnostic Data Collection

It is recommended to collect diagnostics at least one day before the maintenance window.

Generate an RSI:
request support information | save /var/log/rsi1.log
Archive system logs:
file archive compress source /var/log/* destination /var/tmp/CURRENT-DATE.tgz
Verify archive creation:
file list /var/tmp/CURRENT-DATE.tgz detail

The RSI and archived logs can be attached to a support case or uploaded via SFTP if post-upgrade troubleshooting becomes necessary.

Pre-Upgrade Validation Commands

Run and save the outputs of the following commands before starting the upgrade.

show version | no-more

show chassis hardware | no-more

show chassis alarms | no-more

show system alarms | no-more

show chassis routing-engine | no-more

show chassis environment | no-more

show system uptime | no-more

show system processes extensive | no-more

show system storage | no-more

show ntp status | no-more

show system license | no-more

show system license keys | no-more

show interfaces terse | no-more

show route summary | no-more

show bgp summary | no-more

show ospf neighbor | no-more

show security flow session summary | no-more

show security flow session summary | save /var/tmp/session-dump-version <> .txt

show security ike security-associations | no-more

show security ipsec security-associations | no-more

show security nat source summary | no-more

show chassis cluster status | no-more

show chassis cluster interfaces | no-more

show chassis cluster statistics | no-more

show security idp security-package-version | no-more

NOTE:

Perform additional validation for features deployed in the environment as required, including: BGP, OSPF, IS-IS, RIP, VRRP, MNHA, MPLS, IPsec VPN, UTM, IDP, AppSecure, SecIntel, SSL Proxy, Sky ATP, CGNAT, etc..

Use feature-specific operational commands as applicable to the deployment.

Configuration Backup

Create both set-format and hierarchical configuration backups.

show configuration | display set | save /var/tmp/<config-set-backup>

show configuration | save /var/tmp/<config-backup>

Storage Cleanup (If Required)

Verify sufficient free space is available for the upgrade.

show system storage

Verify the files being deleted due to cleanup. If these files are necessary, download them to the PC/anything external.

request system storage cleanup dry-run | no-more

Clear the storage

request system storage cleanup no-confirm | no-more

Verify again sufficient free space is available for the upgrade.

show system storage

Upgrade Execution

Perform upgrade as required.

Standalone device - KB11409 [juniper.net]

Chassis cluster device - KB17235 [juniper.net]

Post-Upgrade Validation Commands

Run the following commands after the device has completed the upgrade and returned to service.

Make sure to run these commands on every hop if you are following the upgrade path.