Support Support Downloads Knowledge Base Apex Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[Junos Fusion]: Unable to convert a stand-alone switch to satellite mode due to error code 67

1

0

Article ID: KB34021 KB Last Updated: 02 Apr 2019Version: 1.0
Summary:

This article explains the reason for the "JUNOS->SNOS Mode Response TLV: Satellite image must be signed (code: 67)" error that is encountered while trying to convert a stand-alone switch to satellite mode via an aggregation device as part of a Junos Fusion setup, and details the requirements to succeed with the conversion.  

 

Symptoms:

While converting a stand-alone switch to satellite mode via an aggregation device, the conversion might fail with the "JUNOS->SNOS Mode Response TLV: Satellite image must be signed (code: 67)" error.

Example

Following are the software images used in the example:

  • Aggregation device: MX480  16.1R3-S1.3

  • Satellite device: QFX5100-48S-6Q   JUNOS:14.1X53-D45.3

  • SNOS image: 1.0R4.2

 

Error Output

  • The QFX device currently has Junos OS release 14.1X53-D45.3 image and we are trying to push SNOS image version 1.0R4.2 as follows: 

labroot@jtac-mx480-r2030-re0# run show chassis satellite neighbor

Interface   State      Port Info   System Name  Model           SW Version
xe-4/2/1    Standalone xe-0/0/48:1              QFX5100-48S-6Q  JUNOS:14.1X53-D45.3
xe-4/2/0    Standalone xe-0/0/48:0              QFX5100-48S-6Q  JUNOS:14.1X53-D45.3
 
  • Observe that the satellite gets stuck at ModeChanging and ModeChangeFail as shown:

{MASTER}[edit]
labroot@jtac-mx480-r2030-re0# run show chassis satellite  

                        Device          Cascade      Port       Extended Ports
Alias            Slot   State           Ports        State      Total/Up
_sd66            66     ModeChangeFail  xe-4/2/0     present                <<< conversion failed 
                                        xe-4/2/1     present  
 
  • An extensive output shows that the QFX device is complaining about the SNOS image not being signed, despite the fact that we used a signed image for SNOS.

labroot@jtac-mx480-r2030-re0# run show chassis satellite neighbor xe-4/2/1 extensive

Interface   State      Port Info   System Name  Model           SW Version
xe-4/2/1    Standalone xe-0/0/48:1              QFX5100-48S-6Q  JUNOS:14.1X53-D45.3

  Adjacency up-down transition count: 7 Last transition: 15:08:01
  Device Serial Number: VF3715220090 Chassis ID: 30:7c:5e:87:7c:14
  Device Family Name: i386
  System Description: Juniper Networks, Inc. qfx5100-48s-6q Ethernet Switch, kernel JUNOS 14.1X53-D45.3, Build date: 2017-07-28 01:31:44 UTC Copyright (c) 1996-2017 Juniper Networks, Inc.

  Hello interval (msec): 10000
  Satellite hello interval (msec): 200000
  Local assigned primary address:
        Local-end: 10.2.32.5/30 Remote-end: 10.2.32.6/30
<…………………………………>
 
       Source-Mac Address: 30:7c:5e:87:7c:14
        Dst-Mac Address: 01:80:c2:00:00:0e
        Chassis-ID: Type: 4, Value: 30:7c:5e:87:7b:e0
        Port-ID: Type: 7, Value: 516
        TTL: 120
        Port Description: xe-0/0/48:1
        System Description: Juniper Networks, Inc. qfx5100-48s-6q Ethernet Switch, kernel JUNOS 14.1X53-D45.3, Build date: 2017-07-28 0
        System Capability: 20
                Enabled: 20
        JUNOS->SNOS Mode Response TLV: Satellite image must be signed (code: 67)  
        Serial Number: VF3715220090
 
  • Note that the same issue is seen in traceoptions on the aggregation device.

{MASTER}
labroot@jtac-mx480-r2030-re0> show log satellite.log | find "Oct 10 15:15:"

Oct 10 15:15:09.750036 Received message on interface xe-4/2/0
Oct 10 15:15:09.750074 Incoming Message on: xe-4/2/0
Oct 10 15:15:09.750090  Source-Mac Address: 30:7c:5e:87:7c:13
Oct 10 15:15:09.750104  Dst-Mac Address: 01:80:c2:00:00:0e
Oct 10 15:15:09.750118  Chassis-ID: Type: 4, Value: 30:7c:5e:87:7b:e0
Oct 10 15:15:09.750128  Port-ID: Type: 7, Value: 522
Oct 10 15:15:09.750137  TTL: 120
Oct 10 15:15:09.750146  Port Description: xe-0/0/48:0
Oct 10 15:15:09.750155  System Name: jtac-qfx5100-48s-6q-r2052
Oct 10 15:15:09.750165  System Description: Juniper Networks, Inc. qfx5100-48s-6q Ethernet Switch, kernel JUNOS 14.1X53-D45.3, Build date: 2017-07-28 01:31:44 UTC Copyright (c) 1996-2017 Juniper Networks, Inc.
Oct 10 15:15:09.750174  System Capability: 20
Oct 10 15:15:09.750183          Enabled: 20
Oct 10 15:15:09.750193  JUNOS->SNOS Mode Response TLV: Satellite image must be signed (code: 67)
Oct 10 15:15:09.750203  Serial Number: VF3715220090
Oct 10 15:15:09.750227 Interface: xe-4/2/0 Event: Discovery Mes

 

Cause:

While converting a stand-alone switch to satellite mode via the aggregation device, if SNOS image version 1.Rx (where x is 0-4) is used on a switch that is running Junos OS release 14.1X53-D43 and later, the conversion will fail with the above error message. This is because Junos OS release 14.1X53-D43 and later requires each sub-component of the satellite package to also be signed in addition to the overall satellite package.

 

Solution:

To convert a stand-alone switch to satellite mode via the aggregation device, the minimum version required on the stand-alone switch is Junos OS release 14.1X53-D16 or later. A stand-alone switch that is running Junos OS release 14.1X53-D43 or later would therefore require SNOS image version SNOS 3.0, SNOS 1.0R5, or SNOS 2.0R2 in order to be successfully converted to a satellite device. See PR1249877 for additional details.

However, if there is a need to use SNOS image version 1.Rx (where x is 0-4), the stand-alone device should be running Junos OS release 14.1X53-D40 or earlier.

 

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search