Description

This article explains why an Application Signature deployment on an SRX device may fail from a Contrail Service Orchestration (CSO) perspective and what must be done to troubleshoot the problem further.

Symptoms

On the CSO UI, you may see that the Application Signature deployment job on the spoke device has failed.

Task: Install Signature_Juniper_CFTS_JNP02-1001
May 29, 2022, 4:00:16 AMTask started
May 29, 2022, 4:00:16 AMSignature install setting applied {'Generate alarm': False, 'Enable Micro apps': False, 'Retry when device is Up': False, 'Install trigger': u'auto', 'Install IDP signature': False}
May 29, 2022, 4:00:16 AMInstalling only APP-ID Signatures as IDP is not enabled.
May 29, 2022, 4:00:25 AMMicro-apps setting disabled and not configured on device
May 29, 2022, 4:00:31 AMCopying and Installing Signature files on the device from CSO.
May 29, 2022, 4:00:44 AMSignature bundle folder for platform jsrx version 20.4 is 281
May 29, 2022, 4:00:51 AMInitiating signature download cmd.
May 29, 2022, 4:01:01 AMReceived response ['Please use command\t"request services application-identification download status" to check download status']
May 29, 2022, 4:01:45 AMChecking signature download status on device.
May 29, 2022, 4:01:50 AMInitiating signature install cmd.
May 29, 2022, 4:01:50 AMReceived response Signature command successful, ['Downloading application package 3495 succeeded.']
May 29, 2022, 4:01:56 AMReceived response ['Please use command\t"request services application-identification install status" to check install status']
May 29, 2022, 4:02:26 AMChecking signature install status on device. This would take some time..
May 29, 2022, 4:17:44 AMSignature command failed, ['Install Application package 3495 and Protocol bundle failed ( Application package installation failed in pfe with error (apppack cfg failed [11] in pic [-1.-1]))Please run "request services application-identification rollback status" for rollback status']
May 29, 2022, 4:17:44 AMTask complete

 

Solution

When you review the error closely, you see that "apppack cfg failed [11] in pic [-1.-1])" defines the state of the spoke device. The spoke in this case is an SRX device and "pic [-1. -1]" denotes the status of the Packet Forwarding Engine (PFE). 

You can log in to the device and check the status of the Flexible PIC Concentrator (FPC) in the SRX device by using the following command:

show chassis fpc pic-status
root> show chassis fpc pic-status 
Slot 0   Online       FPC
  PIC 0  Online       8xGE,8xGE SFP Base PIC
Note: The correct state is as stated above.

pic[-1, -1] denotes the state of the Slot/PIC as either Online, Down, or Offline.

When the Slot/PIC is not online, the application signature package will not get pushed to the PFE, resulting in the error.

If you determine that the PFE is in a bad state, contact Support to investigate and troubleshoot the problem further.

 

The workflow for Application Signature deployment via CSO is as follows:

Note: In this example, consider that the Application Signature that is deployed on the device is version 3472. This version needs to be updated to the new Application Signature version 3495 and installed on the SRX device.

  1. CSO creates a job and pushes the same to the SRX device.

  2. CSO executes the command to install the said signature package.

    • If the status of deployment is success, a success message is returned when you check the status.

    • If the status of deployment is failed, the SRX device will automatically roll back the Application Signature database to the old database (CSO has no role in rolling back the old signature database).

Modification History

2022-06-30: Initial version