Description

After Junos upgrade on the SRX5000 series chassis, in rare cases, the following alarm can be observed:
"FPC PIC LTC FW Version Mismatch" 
root@SRX5800> show chassis alarms no-forwarding

1 alarms currently active
Alarm time               Class  Description
2023-09-22 00:47:10 +01  Major  FPC 0 PIC 0 LTC FW Version Mismatch


This indicates that the FPC 0 PIC 0 has a firmware problem - during the Junos upgrade the firmware was not correctly installed or cannot start correctly.

Symptoms

root@SRX5800> show chassis alarms no-forwarding

1 alarms currently active
Alarm time               Class  Description
2023-09-22 00:47:10 +01  Major  FPC 0 PIC 0 LTC FW Version Mismatch

root@SRX5800> show chassis hardware detail no-forwarding

Hardware inventory:
Item                   Description
Chassis                SRX5800
Routing Engine 0       SRX5k RE-1800X4
CB 0                   SRX5k SCB3
CB 1                   SRX5k SCB3
FPC 0                  SPC3        <<< SRX 5000 chassis with SPC3 card

Solution

1.  Check if the IKE package is installed on the device: 
user@host> show version | match ike 
user@host> show version | match kmd

- If only the KMD package is installed and the IKE package is missing -> IKE package needs to be reinstalled.

2. If the IKE package is installed on the device, verify if it has started correctly and is running: 
root@SRX5800> show system processes extensive no-forwarding | matching kmd
9412 root         20    0   730M    18M nanslp   0   0:00   0.00% kmd

root@SRX5800> show system processes extensive no-forwarding | matching ike

If no IKED daemon is running -> IKE package needs to be re-installed.


To install the Junos IKE package on your SRX Series Firewall, use the following command:

user@host> request system software add optional://junos-ike.tgzVerified junos-ike signed by PackageProductionECP256_2022 method ECDSA256+SHA256
Rebuilding schema and Activating configuration...
mgd: commit complete
Restarting MGD ...

WARNING: cli has been replaced by an updated version:
CLI release 20220208.163814_builder.r1239105 built by builder on 2022-02-08 17:07:55 UTC
Restart cli using the new version ? [yes,no] (yes)

To check the installed junos-ike package, use the following command:

user@host> show version | grep ike 
JUNOS ike [20190617.180318_builder_junos_182_x41]
JUNOS ike [20190617.180318_builder_junos_182_x41]

{primary:node0}
After installation verify if the IKED daemon is running on the system - IKED is mandatory for SPC3 functionality.
  
root@SRX5800> show system processes extensive no-forwarding | matching ike

If IKED is not running  -> reboot the device after IKE package installation to re-initialize all daemons.

An alternative to adding the missing IKE Junos package is to repeat the Junos upgrade using the same release that is currently running.

Modification History

2023-09-29