Auto Image Upgrade: To stop, on CLI apply
"delete chassis auto-image-upgrade" and commit
Auto Image Upgrade: TIMEOUT, reset all enabled DHCP clients
Auto Image Upgrade: DHCP INET Client State Reset : em0.0
Auto Image Upgrade: DHCP INET6 Client State Reset : em0.0
Auto Image Upgrade: DHCP INET Options for client interface em0.0 ConfigFile:
ztp_agent.py Gateway: 10.4.12.1 DHCP Server: 10.30.40.44 File Server:
10.30.40.44 Options state:
Partial Options::Config File set,Image File not set,File Server set
Auto Image Upgrade: Active on INET client interface : em0.0
Auto Image Upgrade: Interface:: "em0"
Auto Image Upgrade: Server:: "10.30.40.44"
Auto Image Upgrade: Image File:: "NOT SPECIFIED"
Auto Image Upgrade: Config File:: "ztp_agent.py"
Auto Image Upgrade: Gateway:: "10.4.12.1"
Auto Image Upgrade: Protocol:: "http"
Auto Image Upgrade: Start fetching ztp_agent.py file from server 10.30.40.44 th
rough em0 using http
Auto Image Upgrade: File ztp_agent.py fetched from server 10.30.40.44 through e
m0
Auto Image Upgrade: Executing script ztp_agent.py
Auto Image Upgrade: ztp_agent.py execution failed. See /var/log/script_output
/var/log/script_output
/usr/sbin/image_load: /usr/bin/python3: Operation not permitted
When trying to provision new devices with ZTP and a Python script for the configuration, the script execution will fail on MXs with the following logs:
We can see in the logs that the execution of ztp_agent.py fails:
Mar 11 16:44:03 image_load[21758][21761]: Auto Image Upgrade: DHCP INET Options for client interface em0.0 ConfigFile: ^Mztp_agent.py Gateway: 10.4.12.1 DHCP Server: 10.30.40.44 File Server: ^M10.30.40.44 Options state: ^MPartial Options::Config File set,Image File not set,File Server set
Mar 11 16:44:24 image_load[21794][21820]: /usr/sbin/image_load -G 10.30.40.44 -I em0 -O install_reboot -D /var/tmp -W 3 -C ztp_agent.py -T http -R 10.4.12.1
Mar 11 16:44:25 image_load[21794][21848]: Auto Image Upgrade: Interface:: "em0" Auto Image Upgrade: Server:: "10.30.40.44" Auto Image Upgrade: Image File:: "NOT SPECIFIED" Auto Image Upgrade: Config File:: "ztp_agent.py" Auto Image Upgrade: Gateway:: "10.4.12.1" Auto Image Upgrade: Protocol:: "http"
Mar 11 16:44:28 image_load[21794][21875]: fetch http://10.30.40.44/ztp_agent.py
Mar 11 16:44:30 image_load[21794][21883]: Auto Image Upgrade: Start fetching ztp_agent.py file from server 10.30.40.44 through em0 using http
Mar 11 16:44:30 image_load[21794][21891]: Auto Image Upgrade: File ztp_agent.py fetched from server 10.30.40.44 through em0
Mar 11 16:44:30 image_load[21794][21902]: Copied /var/tmp/ztp_agent.py to /var/db/scripts/op
Mar 11 16:44:30 image_load[21794][21908]: Auto Image Upgrade: Executing script ztp_agent.py
Mar 11 16:44:30 image_load[21794][21918]: Auto Image Upgrade: ztp_agent.py execution failed. See /var/log/script_output
Mar 11 16:44:30 image_load[21794][21931]: Unlink /var/tmp/ztp_agent.py status 0
Provisioning a device using a python script is only supported Devices running Junos OS Evolved, or Junos OS with Enhanced Automation. For security reasons, Junos OS has strict requirements for running unsigned Python scripts on devices running Junos OS. Only devices running Junos OS with Enhanced Automation and devices running Junos OS Evolved support using unsigned Python scripts in DHCP option 43 suboption 01. MX10008s don't have Junos OS with enhanced support available. This software bundle is identical to the other software bundle except that Veriexec is disabled, which enables you to run unsigned programs, such as programs that you develop with Python, Chef, and Puppet.
https://www.juniper.net/documentation/us/en/software/junos/junos-install-upgrade/topics/topic-map/zero-touch-provision.html#id-zero-touch-provisioning__d30956e271
https://www.juniper.net/documentation/us/en/software/junos/automation-scripting/topics/concept/junos-flex-overview.html
The alternative is to use slax or shell for the script, or use a plan text file to load the config via ZTP.