Description

This article explains syntax errors seen while upgrading SRX from versions below Junos OS Release 21.4R1 to any higher versions where dynamic-VPN/ pulse-secure is configured.

Symptoms

  • Validation fails with the below errors:
    root@SRX> request system software validate <upgrade-image>
    Checking compatibility with configuration
    Initializing...
    Validating against /config/juniper.conf.gz
    /config/juniper.conf:166:(15) syntax error at 'dynamic-vpn'
    [edit security]
    'dynamic-vpn {'
    syntax error
    /config/juniper.conf:182:(5) error recovery ignores input until this point at '}'
    [edit security]
    '}'
  • Errors are seen during the upgrade:
    root@SRX> request system software add <upgrade-image>
    Initializing...
    .
    < trimmed output >
    .
    Validation failed
    ERROR: Current configuration not compatible with /altroot/cf/packages/install-tmp/junos
    ERROR: Configuration validation failed with /altroot/cf/packages/install-tmp/junos

Solution

Starting in Junos OS Release 21.4R1, the dynamic VPN remote access solution is deprecated. This means that you cannot use Pulse Secure Client on these devices.
As part of this change, the [edit security dynamic-vpn] hierarchy level and its configuration options are deprecated, as are the show and clear commands under the [dynamic-vpn] hierarchy level.

You can refer to What’s Changed in Release 21.4R1 for more details.

Alternatively, you can use the Juniper Secure Connect remote access VPN client we introduced in Junos OS Release 20.3R1. 

Modification History

2024-02-05 : Article Created