[Junos Fusion]: Unable to convert a stand-alone switch to satellite mode due to error code 67

Description

This article explains the reason for the "JUNOS->SNOS Mode Response TLV: Satellite image must be signed (code: 67)" error that is encountered while trying to convert a stand-alone switch to satellite mode via an aggregation device as part of a Junos Fusion setup, and details the requirements to succeed with the conversion.

Symptoms

While converting a stand-alone switch to satellite mode via an aggregation device, the conversion might fail with the "JUNOS->SNOS Mode Response TLV: Satellite image must be signed (code: 67)" error.

Example

Following are the software images used in the example:

Aggregation device: MX480 16.1R3-S1.3
Satellite device: QFX5100-48S-6Q JUNOS:14.1X53-D45.3
SNOS image: 1.0R4.2

Error Output

The QFX device currently has Junos OS release 14.1X53-D45.3 image and we are trying to push SNOS image version 1.0R4.2 as follows:

labroot@jtac-mx480-r2030-re0# run show chassis satellite neighbor

Interface   State      Port Info   System Name  Model           SW Version
xe-4/2/1    Standalone xe-0/0/48:1              QFX5100-48S-6Q  JUNOS:14.1X53-D45.3
xe-4/2/0    Standalone xe-0/0/48:0              QFX5100-48S-6Q  JUNOS:14.1X53-D45.3

Observe that the satellite gets stuck at ModeChanging and ModeChangeFail as shown:

{MASTER}[edit]
labroot@jtac-mx480-r2030-re0# run show chassis satellite  

                        Device          Cascade      Port       Extended Ports
Alias            Slot   State           Ports        State      Total/Up
_sd66            66     ModeChangeFail  xe-4/2/0     present                <<< conversion failed 
                                        xe-4/2/1     present

An extensive output shows that the QFX device is complaining about the SNOS image not being signed, despite the fact that we used a signed image for SNOS.

labroot@jtac-mx480-r2030-re0# run show chassis satellite neighbor xe-4/2/1 extensive

Interface   State      Port Info   System Name  Model           SW Version
xe-4/2/1    Standalone xe-0/0/48:1              QFX5100-48S-6Q  JUNOS:14.1X53-D45.3

  Adjacency up-down transition count: 7 Last transition: 15:08:01
  Device Serial Number: VF3715220090 Chassis ID: 30:7c:5e:87:7c:14
  Device Family Name: i386
  System Description: Juniper Networks, Inc. qfx5100-48s-6q Ethernet Switch, kernel JUNOS 14.1X53-D45.3, Build date: 2017-07-28 01:31:44 UTC Copyright (c) 1996-2017 Juniper Networks, Inc.

  Hello interval (msec): 10000
  Satellite hello interval (msec): 200000
  Local assigned primary address:
        Local-end: 10.2.32.5/30 Remote-end: 10.2.32.6/30
<…………………………………>
 
       Source-Mac Address: 30:7c:5e:87:7c:14
        Dst-Mac Address: 01:80:c2:00:00:0e
        Chassis-ID: Type: 4, Value: 30:7c:5e:87:7b:e0
        Port-ID: Type: 7, Value: 516
        TTL: 120
        Port Description: xe-0/0/48:1
        System Description: Juniper Networks, Inc. qfx5100-48s-6q Ethernet Switch, kernel JUNOS 14.1X53-D45.3, Build date: 2017-07-28 0
        System Capability: 20
                Enabled: 20
        JUNOS->SNOS Mode Response TLV: Satellite image must be signed (code: 67)  
        Serial Number: VF3715220090

Note that the same issue is seen in traceoptions on the aggregation device.

{MASTER}
labroot@jtac-mx480-r2030-re0> show log satellite.log | find "Oct 10 15:15:"

Oct 10 15:15:09.750036 Received message on interface xe-4/2/0
Oct 10 15:15:09.750074 Incoming Message on: xe-4/2/0
Oct 10 15:15:09.750090  Source-Mac Address: 30:7c:5e:87:7c:13
Oct 10 15:15:09.750104  Dst-Mac Address: 01:80:c2:00:00:0e
Oct 10 15:15:09.750118  Chassis-ID: Type: 4, Value: 30:7c:5e:87:7b:e0
Oct 10 15:15:09.750128  Port-ID: Type: 7, Value: 522
Oct 10 15:15:09.750137  TTL: 120
Oct 10 15:15:09.750146  Port Description: xe-0/0/48:0
Oct 10 15:15:09.750155  System Name: jtac-qfx5100-48s-6q-r2052
Oct 10 15:15:09.750165  System Description: Juniper Networks, Inc. qfx5100-48s-6q Ethernet Switch, kernel JUNOS 14.1X53-D45.3, Build date: 2017-07-28 01:31:44 UTC Copyright (c) 1996-2017 Juniper Networks, Inc.
Oct 10 15:15:09.750174  System Capability: 20
Oct 10 15:15:09.750183          Enabled: 20
Oct 10 15:15:09.750193  JUNOS->SNOS Mode Response TLV: Satellite image must be signed (code: 67)
Oct 10 15:15:09.750203  Serial Number: VF3715220090
Oct 10 15:15:09.750227 Interface: xe-4/2/0 Event: Discovery Mes

Solution

While converting a stand-alone switch to satellite mode via the aggregation device, if SNOS image version 1.Rx (where x is 0-4) is used on a switch that is running Junos OS release 14.1X53-D43 and later, the conversion will fail with the above error message. This is because Junos OS release 14.1X53-D43 and later requires each sub-component of the satellite package to also be signed in addition to the overall satellite package.

To convert a stand-alone switch to satellite mode via the aggregation device, the minimum version required on the stand-alone switch is Junos OS release 14.1X53-D16 or later. A stand-alone switch that is running Junos OS release 14.1X53-D43 or later would therefore require SNOS image version SNOS 3.0, SNOS 1.0R5, or SNOS 2.0R2 in order to be successfully converted to a satellite device. See PR1249877 for additional details.

However, if there is a need to use SNOS image version 1.Rx (where x is 0-4), the stand-alone device should be running Junos OS release 14.1X53-D40 or earlier.