Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

SRX platforms running Junos Software

Alert Description

Junos Software Service Release version 24.4R2-S1 is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

NOTE: Starting on August 30th, 2024, we include PR's severity with each entry. See KB86335 [juniper.net] for the definition of PR's Severity

Junos Selective Update (JSU) feasible

Not applicable

Call to Action

This is the SRN for SRX platforms running JUNOS Software

Solution

Junos Software service Release version 24.4R2-S1 is now available.

24.4R2-S1 - List of Fixed issues

PR NumberSynopsisCategory: chassisd related issues for high-end SRX platforms
1887000
Minor		SRX4600 node 1 enters hardware failure during upgrade
Product-Group=junos
Severity=Minor		On SRX4600 platforms running Junos OS and configured in High Availability (HA), a hardware alarm is triggered during Low Impact Cluster Upgrade (LICU) procedures due to incorrect alarm logic tied to control link status. This condition affects Node 1 and causes Redundancy Group 1 (RG1) to failover to Node 0, even if Node 0 interfaces are not yet active, resulting in a traffic outage.
PR NumberSynopsisCategory: A20/A40 IOC card
1883027
Minor		SRX Firewalls with IOC3 triggers a temperature alert on the FPC 2 PLX PCIe Switch Chip
Product-Group=junos
Severity=Minor		On SRX5400, SRX5600, and SRX5800 platform with MPC3-40G10G and MPC3-100G10G (IOC3) interface card, a temperature alarm is triggered when the Peripheral Component Interconnect Express (PCIe) switch chip temperature exceeds 75 Celsius degrees.
PR NumberSynopsisCategory: Border Gateway Protocol
1898734
Major		The rpd process crashes in an Inter-AS Option-AB L3VPN with BGP multipath list-nexthop enabled
Product-Group=junos
Severity=Major		On all Junos and Junos OS Evolved platforms, in an Inter-AS (Autonomous System) Option-AB L3VPN (Layer3 Virtual Private Network) scenario, if 'bgp multipath list-nexthop' is configured and a VRF (Virtual Routing and Forwarding) generates a route with list-nexthop that is advertised to an Option-AB peer, the rpd process crashes and generates a core-dump.
PR NumberSynopsisCategory: Lacp related problems and issues.
1898531
Major		AE interfaces flap during GRES following an RE reboot on all Junos Evolved platforms
Product-Group=junos
Severity=Major		On all Junos Evolved platforms, Aggregate Ethernet (AE) interfaces with LACP configured will experience a flap due to a timing issue when Graceful Routing Engine Switchover (GRES) is performed after a Routing Engine (RE) reboot, resulting in traffic loss during the flap.
PR NumberSynopsisCategory: EVPN control plane issues
1846266
Major		The inet filters attached to the IRB interface will not function as expected
Product-Group=junos
Severity=Major		On Junos QFX5k and EX4k platforms, in an Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) scenario, inet filters applied to Integrated Routing and Bridging (IRB) interfaces will not function as expected, and the associated actions of the filter are not enforced.
PR NumberSynopsisCategory: EVPN Layer-2 Forwarding
1848993
Major		The data plane will be out of sync when migrating to EVPN A/A stitching with Vanila VXLAN (PIM Multicast)
Product-Group=junos
Severity=Major		On MX platforms, to improve the convergence of node failures in EVPN MH interconnects with Data Plane VXLAN, migrating to an Active-Active setup may cause the data plane to become out of sync for ARP entries. The gateway learns the MAC address and advertises it to the peer gateway. However, on the peer gateway, some MAC-IP entries may remain stuck in the 'Unresolved' (Ur) state.
PR NumberSynopsisCategory: SRX1500 platform software
1896794
Major		On SRX1500 platforms, after PFE crash, FPC cannot come online
Product-Group=junosvae
Severity=Major		On SRX1500 platforms, when transit packets get stuck, PFE crash and PFE core-dump is generated. FPC remains 'present' state until reboot, all the services running on that FPC will be impacted.
PR NumberSynopsisCategory: Integrated Routing & Bridging (IRB) module
1871420
Major		Fragmented packets dropped in EVPN-MPLS scenario due to the IRB interface MTU limitation
Product-Group=junos
Severity=Major		On all Junos platforms running in EVPN-MPLS (Ethernet Virtual Private Network over Multiprotocol Label Switching) scenarios, host-generated packets exceeding the IRB interface MTU (Maximum Transmission Unit) are fragmented. Only the first fragment is forwarded, while remaining fragments are dropped, leading to loss of control-plane traffic.
PR NumberSynopsisCategory: JFlow bug tracker for SRX platforms
1863356
Minor		The flowd process crash on SRX with IPFIX and MPLS enabled
Product-Group=junos
Severity=Minor		On all SRX Series platforms, enabling IPFIX (IP Flow Information Export) on devices configured with MPLS (Multiprotocol Label Switching) results in flowd process crash. Traffic is interrupted due to the crash.
PR NumberSynopsisCategory: SRX PFE side GRE/IPIP/DS-Lite/IPSec/PIM/VXLAN tunnel
1901678
Major		[SRX_TYPE_5_USECASE] SRX4700 performance improvement for TYPE5 VXLAN scenario
Product-Group=junos
Severity=Major		Introduced per thread VXLAN tunnel session for type 5 VXLAN tunnel and FTI VXLAN tunnel to improve the throughput. "show security flow session tunnel" will see every thread has one VXLAN tunnel session for one VXLAN tunnel with specified source IP, destination IP and conn_tag (VNI is used as conn_tag), and VXLAN tunnel session's source port is the core ID.
PR NumberSynopsisCategory: High Availability/NSRP/VRRP
1895790
Major		Backup node stuck in cold sync failure after all FPCs reset due to SPC crash files in SRX chassis cluster
Product-Group=junos
Severity=Major		On all SRX platforms, in a chassis cluster scenario, the SPCs on the backup node crash. After the crash files are fully generated, this triggers a reset of all FPCs. Following the crash and FPC resets, the backup node enters a cold sync failure state and remains in that state until it is manually rebooted.
PR NumberSynopsisCategory: Firewall Policy
1882193
Critical		On SRX platform flowd process is generating crash files.
Product-Group=junos
Severity=Critical		On Junos OS SRX platforms, a crash in the flowd process occurs when the system attempts to retrieve interface information. During this process, an invalid memory address is accessed while copying the interface memory address from the database. This issue typically arises when accessing interface details to check session status on the backup device.
PR NumberSynopsisCategory: Multicast for L3VPNs
1902405
Major		The rpd process crash is observed with MVPN and RIB sharding enabled
Product-Group=junos
Severity=Major		On Junos MX and Junos Evolved PTX platforms , with RIB sharding enabled and if either IPv4 or IPv6 address family is disabled in MVPN (multicast virtual private network), the unicast route flow from shard tries to access MVPN data structures without validation leading to rpd (Routing Protocol Daemon) process crash.
PR NumberSynopsisCategory: OS IPv4/ARP/ICMPv4
1881956
Major		IPv6 default route gets deleted from FIB by slaac daemon after an upgrade with an unsupported configuration
Product-Group=junos
Severity=Major		On all Junos OS platforms , deletion of IPv6 default route from FIB (Forward Information Base) by slaacd (Stateless Address AutoConfiguration Daemon ) is observed while recovering the device from amnesiac state after the OS upgrade with any unsupported or incompatible configuration.
PR NumberSynopsisCategory: Kernel Tunnel Interface Infrastructure
1897240
Major		Chassis-Control restart triggers when configuring GRE interface across multiple routing-instances leading to kernel crash
Product-Group=junos
Severity=Major		On Junos series devices, the kernel crash occurs when creating and configuring a identical GRE(Generic Routing Encapsulation) interface across different routing-instances.
PR NumberSynopsisCategory: KRT Queue issues within RPD
1830588
Critical		The rpd process crashes on all Junos and Junos OS Evolved platforms when recursively resolved routes are changed or deleted
Product-Group=junos
Severity=Critical		On all Junos and Junos OS Evolved platforms when recursively resolved routes are changed or deleted, route churn will potentially lead to the rpd process crash.
PR NumberSynopsisCategory: Resource Reservation Protocol
1896022
Major		More bandwidth may be admitted onto a TE link when Label Switched Paths (LSPs) undergoing make-before-break re-route over the same link carrying the bypass LSP during local repair
Product-Group=junos
Severity=Major		If Label Switched Paths (LSPs) undergo local repair and subsequently undergo global repair in make-before-break fashion such that the LSPs are re-routed over the same TE link that carries the bypass LSP that protect the LSPs during local repair, then more re-routed LSPs may be admitted on the TE link carrying the bypass LSP than that should be admitted. This may result in some re-routed LSPs remaining on the TE link causing additional traffic sent on the TE link than the capacity of the TE link.
PR NumberSynopsisCategory: SRX branch platforms
1859188
Minor		Branch SRX unstable NTP issue
Product-Group=junos
Severity=Minor		On Branch SRX platforms (SRX300, SRX320, SRX340, SRX345 and SRX380), NTP time reset message is often seen due to SRX NTP issue
1893957
Minor		After upgrade of Junos to 23.4R2-S5, DHCP not working for clients connected to the SRX(DHCP server) Also, devices connected to the SRX is unable to resolve ARP to the default GW (SRX).
Product-Group=junos
Severity=Minor		After upgrade of Junos to 23.4R2-S5, DHCP not working for clients connected to the SRX(DHCP Server). Also, devices connected to the SRX is unable to resolve ARP to the default GW (SRX).
PR NumberSynopsisCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1873253
Major		The "show system storage" command output should show only true and distinct storages
Product-Group=junos
Severity=Major		On all Junos platforms, the "show system storage" command output is modified to list only all real UFS filesystem ie { 'ffs', 'tmpfs', 'ufs' } instead of virtual filesystem like '/var/jails/rest-api'.

 

 

24.4R2-S1 - List of Known issues

PR NumberSynopsisCategory: ISSU
1898501
Major		EX4650/QFX5120-48Y: ISSU incompatibility with previous releases
Product-Group=junos		EX4650/QFX5120-48Y: Older releases (that do not contain the 1882472 fix) are ISSU incompatible with current releases that have 1882472 fix.

Resolved In:
PR NumberSynopsisCategory: "agentd" software daemon
1820119
Major		Sensor data is not streamed via gNMI
Product-Group=junos		On all Junos Evolved Platforms, sensor data is not streamed via gNMI.

Resolved In: evo:22.3R3-S4-EVO evo:22.3X50-EVO evo:22.3X80-D45-EVO evo:22.3X80-D46-EVO evo:22.4R0-J0-EVO evo:22.4R3-S5-EVO evo:23.2R2-S3-EVO evo:24.2R1-S2-EVO evo:24.2R2-EVO evo:24.3R1-EVO evo:24.4R1-EVO evo:25.1R1-EVO junos:22.3R3-S4 junos:22.3X60 junos:22.4R3-S4 junos:22.4R3-S5 junos:22.4X4 junos:22.4X50 junos:23.2R2-S3 junos:23.4R2-S3 junos:23.4X30-D30 junos:24.2R1-S1 junos:24.2R2 junos:24.2X1 junos:24.4R1 junos:25.1R1
PR NumberSynopsisCategory: Border Gateway Protocol
1861799
Major		The "advertise-inactive" configuration does not work as expected when "add-path multipath" is configured and negotiated with the neighbor
Product-Group=junos		On all Junos and Junos Evolved platforms with "advertise-inactive" configured under Border Gateway Protocol (BGP), inactive routes are not advertised to peers when "add-path multipath" is configured and negotiated with the neighbor.

Resolved In: evo:22.3X50-EVO evo:22.3X50-J3-EVO evo:22.3X80-D49-EVO evo:25.2R1-EVO junos:20.3X75-D442 junos:20.3X75-D52 junos:22.3X60 junos:23.2R2-S5 junos:25.2R1
1889749
Major		BGP Prefix-SID Label collision causing RPD crash
Product-Group=junos		On all Junos and Junos OS Evolved platforms, In Segment Routing the RPD ( Routing Protocol Daemon ) crash was observed due to different prefixes were trying to use same label, when Bgp prefix SID ( Segment Identifier ) feature was configured and labels were derived using the SID index.

Resolved In: evo:24.2R2-S3-EVO evo:25.2R1-S1-EVO evo:25.2R2-EVO evo:25.3R1-EVO evo:25.4R1-EVO junos:21.2R3-S8-J22 junos:25.2R1-S1 junos:25.2R2 junos:25.3R1 junos:25.4R1
PR NumberSynopsisCategory: EVPN control plane issues
1839959
Critical		The MAC+IP table and mac-table are not in sync in the EVPN-MPLS active-active multihomed scenario leading to traffic loss
Product-Group=junos		On all Junos and Junos OS Evolved platforms that supports ESI lag interface and in an EVPN-MPLS (Ethernet Virtual Private Network - Multi Protocol Label Switching) active-active multihomed scenario, when the multihomed access interfaces are flapped in quick succession, it results in an unresolved destination route for the specific IP host. This is occurred due to race condition within l2ald (Layer 2 Address learning daemon) followed by an interface flap which causes the locally learned MAC to go missing from the mac-table on the other PE router.

Resolved In: evo:21.4R3-S10-EVO evo:22.2R3-S6-EVO evo:22.4R3-S7-EVO evo:23.2R2-S4-EVO junos:21.4R3-S10 junos:21.4R3-S4-J26 junos:22.2R3-S6 junos:22.4R3-S7 junos:23.2R2-S4 junos:23.4R2-S4 junos:23.4R2-S5 junos:24.4R1
PR NumberSynopsisCategory: ISIS routing protocol
1886347
Major		partial traffic drops seen on NSR switchover for Indirect route Going over L-ISIS transport route having "sensor-based-stats" configured under protocols isis
Product-Group=junos		On Junos and EVO platforms, After a Graceful Routing Engine Switchover (GRES), in New master, Indirect routes gets updated to the PFE and result in traffic loss when the transport is L-ISIS with telemetry traffic sensors enabled. In this scenario, Indirect routes going over L-ISIS route. Reason for Indirect route change is due to Underlying L-ISIS route next-hop getting changed. L-ISIS route next-hop getting changed due to ?Sensor-based-stats? configuration which does not support NSR functionality. Hence After Switchover, New Master Create sensors and Installed in the L-ISIS next-hop result in L-ISIS next-hop changed. Once L-ISIS routes nex-thop gets changed, Indirect routes under going for re-resolution which cause traffic impact.

Resolved In:
PR NumberSynopsisCategory: Flow Module
1876536
Major		Configuring tunnel over tunnel can leads to traffic disruption on SRX/VSRX platforms
Product-Group=junos		On all Junos SRX/VSRX platforms when tunnel over tunnel scenario is configured, the tunnel MTU (Maximum Transfer Unit) gradually decreases below the minimum MTU. As a result, this condition can lead to a srxpfe crash and traffic drop. In scenarios where a FPC (Flexible PIC Concentrator) is present, the traffic drop will be seen over the specific FPC, and after the crash happens, the FPC is restarted. In cluster scenarios, traffic on RG (Redundancy Group) will fail over to the backup node.

Resolved In: junos:22.4R3-S8 junos:23.2R2-S3-J13 junos:23.2R2-S3-J15 junos:23.2R2-S5 junos:23.4R2-S5 junos:23.4R2-S6 junos:24.2R2-S2 junos:25.3R1
1895420
Major		First path SM interest check fail on SRX4100
Product-Group=junos		When traffic is processed application services which uses tcp proxy in flowd, the usage of object cache increases and possible to drop traffic.

Resolved In: junos:24.2R2-S3 junos:25.2R2 junos:25.4R1
PR NumberSynopsisCategory: IPSEC/IKE VPN
1877966
Minor		Some new VPN tunnels are not coming up on SRX5K platforms with SPC3
Product-Group=junos		On SRX5K platforms with SPC3 installed, IPSec (Internet Protocol Security ) tunnels with iked which reuses the same IKE (Internet Key Exchange) gateway peer IP, could be observed not re-establishing.

Resolved In: junos:22.4R3-S8 junos:24.2R2-S2 junos:24.4R2-S2 junos:25.3R1
PR NumberSynopsisCategory: Key Management Daemon
1869769
Major		The kmd process crashes when device with MS-MPC has DPD enabled and a SA is deleted
Product-Group=junos		On all MX platforms with MS-MPC (Multiservices Modular PIC Concentrator), when DPD (Dead Peer Detection) is enabled under IPsec/IKE (Internet Key Exchange) VPN settings and for any reason an IPsec SA (Security Association) is deleted, the kmd process crashes. Due to the kmd process restart some disruption in tunnel establishment is seen.

Resolved In: junos:22.4R3-S7
PR NumberSynopsisCategory: Port-based link layer security services and protocols
1909013
Major		EAPOL: Interface should be deleted only after deleting MACsec on the interface in question. Applies to MPC3E only
Product-Group=junos		On MPC3, delete MACsec provisioning before deleting interface

Resolved In: evo:26.1R1-EVO
PR NumberSynopsisCategory: Protocol Independant Multicast
1880262
Major		PIM neighbors timeout on backup RE due to inconsistent state with master
Product-Group=junos		On all Junos and Junos Evolved platforms with dual Routing Engines (REs), Protocol Independent Multicast (PIM) neighborship is not be maintained on the backup Routing Engine after a ppmd-agent restart. This can lead to loss of PIM neighbor state on the backup RE.

Resolved In: evo:23.4R2-S6-EVO evo:24.2R2-S2-EVO evo:25.2R2-EVO evo:25.3R1-EVO junos:22.4R3-S8 junos:23.2R2-S5 junos:23.4R2-S6 junos:24.2R2-S2 junos:25.2R2 junos:25.3R1
PR NumberSynopsisCategory: Shard routing infrastructure within RPD
1757915
Major		The rpd process crashes when processing multipath routes with mixed indirect and composite next-hops under rib-sharding
Product-Group=junos		On all Junos and Junos OS Evolved platforms, when rib-sharding is enabled and RT (Route Target) multipath routes containing both indirect and composite next-hop types are processed, the rpd (Routing Protocol Daemon) process will crash due to incorrect handling during the next-hop copy operation from RIB (Routing Information Base) shards to the main RIB thread. An rpd crash results in all routing protocols going down and causes a brief traffic disruption until the rpd process restarts.

Resolved In: evo:25.2R2-EVO evo:25.3R1-EVO junos:23.2R2-S2-J9 junos:23.4R2-S5 junos:25.2R2 junos:25.3R1
PR NumberSynopsisCategory: RPM and TWAMP
1908499
Minor		RFC2544/Y.1564 Reflection Mismatch
Product-Group=junos		There are limitations associated with the implementation features of the generator in the Broadcom chip. Multiple Y.1564/RFC2544 generators should not be used on the same interface. Juniper engineering recommend running tests one by one or distributing tests across different VLANs. This PR will commit code to ensure an error is presented when trying to run multiple tests

Resolved In: evo:26.1R1-EVO
PR NumberSynopsisCategory: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1899178
Critical		Service session drops are observed when CPU throttling is configured on platforms with service cards installed
Product-Group=junos		On all Junos MX platforms that have MS-MPC or MS-MIC service cards installed, the use of the CPU throttling can cause the production service sessions to be dropped.

Resolved In: junos:21.2R3-S10 junos:21.2R3-S6-J16
1901021
Major		Service-Set Configuration Bug Leading to Kernel Panic on Junos MX
Product-Group=junos		On Junos MX platforms with MS-MPC, when new rules are added to a service-set, the configuration size increases incrementally. This growth will cause failures during the commit process, potentially leading to a kernel panic. As a result, new configurations may not be successfully applied.

Resolved In: evo:25.2R2-EVO evo:25.4R1-EVO junos:25.2R2 junos:25.4R1
PR NumberSynopsisCategory: SRX branch platforms
1897579
Minor		Packet drops are observed on SRX380 platforms in packet mode
Product-Group=junos		On Junos OS SRX380 (cluster/standalone) platforms in packet mode, when L2 (Layer 2) encapsulation is configured on an ingress interface of the PE (Provider-Edge) device, the incoming packets are dropped because these packets are identified as L2 unknown unicast packets. This issue happens due to the default drop ACL (Access Control List) applied for L2 unknown unicast packets.

Resolved In: junos:25.2R2 junos:25.4R1
PR NumberSynopsisCategory: Junos Automation, Commit/Op/Event and SLAX
1872284
Major		master-eventd will fail after multiple RE switchover
Product-Group=junos		On Junos and Junos OS Evolved platforms with dual RE(Routing Engine) , master-eventd will fail to start after multiple RE switchovers when event-options policies are configured. This happens only if a process is still waiting for an action (like file transfer or SSH) to complete.

Resolved In: evo:23.4R2-S6-EVO evo:25.2R2-EVO evo:25.3R1-EVO evo:25.4R1-EVO junos:23.2R2-S5 junos:23.4R2-S6 junos:24.2R2-S3 junos:24.4R2-S2 junos:25.2R1-S2 junos:25.2R2 junos:25.3R1 junos:25.4R1
PR NumberSynopsisCategory: Issues related to YANG Data Models
1781023
Minor		Few yang package are occuring multiple place On Box
Product-Group=junos		Few yang package are occuring multiple place On Box

Resolved In: