Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[CSO] Troubleshooting on-boarding sites



Article ID: KB34173 KB Last Updated: 23 Aug 2019Version: 2.0

This article covers details about troubleshooting on-boarding sites in Contrail Service Orchestration (CSO).



Device does not pass stage 1 configuration or device workflow configuration fails.



To troubleshoot on-boarding sites in CSO, perform the following steps:

  1. Check the CSO version.
  2. Log in to the Administration Portal and click Help > About to determine the CSO version that is in use.

  1. Check the support available on a particular device by using the following links for the CSO version that was obtained in the above step: 
  1. Check all the required ports that need to be enabled: KB34169 - [CSO] List of ports to be opened on CSO VMs and their functions
  2. Check /var/log/messages or /var/log/PHC.log on the device, which has information about the device trying to connect to the phone-home server at the NFX redirect server website:

Note: Enable Phone Home Client (PHC) logging on JDM by using the following commands and observe if the device is trying to reach the Phone Home Server.

set system phone-home traceoptions file phc.log
set system phone-home traceoptions file size 10m
set system phone-home traceoptions flag all
  1. In the netstat -ant | grep <CSO ip> output as part of the device check, <CSO ip> should indicate Established state.

show system connections | grep <CSO IP> 
tcp4       0  x.x.x.x.49804                            ESTABLISHED x.x.x.x.7804    
  1. Check whether the activation code has been configured in the device templates and entered as part of the activation process.

  • Device templates can be checked under Global domain > Resources > Device Templates to see whether the activation code has been configured.

  • If you have not configured the activation code, the device will simply contact the Regional Microservices VM and the ZTP/provisioning process will be completed together. If an activation code has been configured, the Regional Microservices VM will refuse any contact from the device until the activation code has been entered.


Provisioning Stages

  • CREATED: The site has been created in the Administrator Portal. 

  • CONFIGURED: The site has been configured in the Administrator Portal. Usually, the site is in this state only for a short period of time before it moves to EXPECTED. 

  • EXPECTED: The device initially waits for contact from the NFX device (or is possibly waiting for device activation, that is, the activation code to be entered). The device remains in this state even after the NFX device contacts CSO while CSO configures the stage 1 configuration on JDM and JCP. The NFX device will reboot during this time period. 

  • ACTIVE: The NFX device downloads the GWR image (vSRX). After the image is downloaded, the GWR image is installed as a virtual network function on the NFX device. The device remains in this state until GWR comes alive on the NFX device (show virtual-network-functions). 

  • GWR_SPAWNED: The GWR stage 1 configuration is loaded. JDM’s jsxe IP address has been handed over to GWR. GWR is alive for a short period before it is rebooted as part of the image installation process. 

  • ACTIVE: GWR is alive again. It remains in this state for a short period before moving to PROVISIONED. CSO attempts to load any stage 2 configurations, if any exist. 

  • PROVISIONED: NFX and GWR are completely up and running.


Activation Verification

  1. Log in to kibana with the username admin and the Elasticsearch password that was generated during CSO installation.
  2. Using a web browser, access the URL for kibana: http://ha-proxy-IP-Address:5601. Add the filters service_app_name=activation-service, device-connectivity, and config-service dms-regional for the latest timestamp to see more information about device activation.

where ha-proxy-IP-Address is the IP address of the high availability (HA) proxy server. Use this option to monitor the microservices.

For a deployment without HA, use the IP address of the VM that hosts the microservices for the central POP.

For an HA deployment, use the virtual IP address of the central or regional POP that you provided for the HA proxy when you installed CSO.


Note: If any problems are found while performing these troubleshooting steps, contact Support for additional assistance.


Modification History:

2019-08-23: TSBs for 5.0.1, 5.0 and 4.1.1 added

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search