Description

ISSU upgrade of SRX 1500 cluster is failing when upgrading to either of the below Junos codes.
21.4R3-S6,22.2R3-S3,22.3R3-S2,23.2R2, etc
.

 

Symptoms

ISSU upgrade of SRX 1500 cluster is failing when upgrading from 21.4R3-S5 to 21.4R3-S6.

After secondary is upgraded primary upgrade fails with the below error timing out.

[Apr  8 07:52:06]: node1 became secondary.
[Apr  8 07:52:06]: Waiting for node1 to be ready for failover
ISSU: Preparing Daemons
Current time: Mon Apr  8 07:52:06 2024
Max. time to complete: 60min 0sec.
Note: For real time ISSU status, open a new management session and run 
       for detail information
[Apr  8 08:52:49]: timeout waiting for secondary node node1 to sync(error-code: 6.1)

 

Solution

The issue is caused because of the Cold-sync timeout timer for VPN was never set for 1500 platform, This prevented the secondary device post upgrade to set VPN COLD SYNC ready state and hence the ISSU failed.

Issue is only applicable for SRX1500, Doing ISSU upgrade to a fixed version is enough and issue will not be seen.

The issue is fixed in below versions through PR mentioned below:

https://prsearch.juniper.net/problemreport/PR1803376

junos:21.4R3-S7 (Released)

junos:22.2R3-S4

junos:22.3R3-S3

junos:23.2R2-S1

junos:23.4R2

junos:24.2R1

Modification History

2024-05-13 : Article Created
2024-0602 : Article Modified and published