This article explains how to update the IDP security-package on a cluster node that has been replaced via an RMA.

• RMA of the faulty node was done; replacement device was received and needs to be updated.

• Device is a node within a cluster.

Perform the following:

1. Transfer the License from the old device to the new device with the help of below link. 

https://supportportal.juniper.net/s/article/Transfer-license-keys-to-an-RMA-replacement-device

1. Install the license on the replacement device:

>request system license add terminal

3. Update the IDP security-package by using one of two methods:

   1. Online update of the database. Select from one of two methods:

      1. Add the node back into the cluster and then perform the update . Refer to KB21134 - [SRX] RMA replacement of a node in a Chassis Cluster [juniper.net] for more information.

1. Disable IDP.

Note : IDP should be disabled on the primary node; otherwise the secondary node will go into a disabled state due to configuration-synchronization failure. 

#deactivate security idp
#commit

Note: Run the following commands on the primary node.

2. Download the IDP security-package on the device:

>request security idp security-package download

3. Check the status of the download:

>request security idp security-package download status

4. Install the IDP security-package on the device:

>request security idp security-package install

5. Check the status of the installation:>request security idp security-package install status

2. Update the IDP security-package first in standalone mode (with Internet access enabled on this node), and then add the node back into the cluster. Note that all the steps in the following section should be performed on the new node in standalone mode before adding it back to the cluster.

   1. Download the IDP security-package on the device:

>request security idp security-package download 

2. Check the status of the download:

>request security idp security-package download status

3. Install the IDP security-package on the device:

>request security idp security-package install 

4. Check the status of the installation:

>request security idp security-package install status

5. Enable security IDP:

#activate security idp
#commit

2. Offline update of the database. In offline update, there are two methods to select.

   1. Join and then copy.

      1. Disable IDP.

         Note : IDP should be disabled on the primary node; otherwise, the secondary node will go into a disabled state due to configuration-synchronization failure.

#deactivate security idp
#commit

2. Add the node back into the cluster.

3. Copy offline-update.tar.gz to the RG0 primary node and perform offline installation. See KB32399 - [SRX] How to update IDP Signature Database off-line [juniper.net] for more details.

4. After the IDP security-package update is completed, verify that both the nodes are showing the correct IDP security-package-version.

>show security idp security-package-version

6. Enable security IDP:

#deactivate security idp
#commit

2. Copy and then join.

   1. Perform offline installation on the standalone device. See KB32399 - [SRX] How to update IDP Signature Database off-line [juniper.net] for more details.

   2. After the installation is complete, add the node to the cluster.

   3. After the IDP security-package update is completed, verify that both the nodes are showing the correct IDP security-package version.

>show security idp security-package-version

2021-11-23: Steps in "Offline update of the database" section in Solution modified to reflect the correct information

• Downloading and Installing the Junos OS Application Signature Package As Part of the IDP Security Package