Search our Knowledge Base sites to find answers to your questions.
Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles[Subscriber Management] - Dual-Stack handling of separate IA_NA and PD Solicits over a single PPP session using DHCPv6 Local Server
This article explains the behavior of Enhanced-Subscriber Management for Dual-Stack PPP subscribers using DHCPv6 to request an IPv6 IA_NA and PD (Prefix-Delegation) via separate Solicits over a single PPP session.
That following behavior maybe seen when a DHCPv6 CPE device sends a separate Solicit requesting an IA_NA (Global Address) address and a separate Solicit for a PD (prefix-delegated) address over the same PPP session. The major complaint is that the first Solicit will be serviced, and a binding created. The other address type will be seen trying over and over as the CPE fails to get the other requested address assigned.
In the example below, the MX is acting as an L2TP LNS for PPP subscribers performing Dual-Stack for both IA_NA and Prefix-Delegation. Radius is providing both the IPv6 Framed address and IPv6 Delegated-Prefix upon client login. The CPE will a send a separate DHCPv6 Solicit for PD first and then another for IA_NA which will fail. The expectation is for the Enhanced Subscriber Management to service both Solicits individually. However, this is not the case in some scenarios which will be discussed.
Example:
L2TP PPP session logs in to establish IPv4 connectivity and Link-Local address for IPv6. The Ipv6 IA_NA and Prefix-Delegated address is returned via Radius AVP during the PPP authentication phase:
labroot@MX480-R060> show subscribers extensive Type: L2TP User Name: brian/brian IP Address: 74.0.18.80 IP Netmask: 255.255.255.255 IPv6 Address: 2607:f2c0:8006::2 ****IA_NA Global Address IPv6 Prefix: 2607:f2c0:fffa:200::/56 *** Prefix-Delegated Address Logical System: default Routing Instance: default Interface: si-2/3/0.3221225492 Interface type: Dynamic Underlying Interface: si-2/3/0.3221225492 Dynamic Profile Name: dsl-template-default Dynamic Profile Version: 1 State: Active Radius Accounting ID: 21 Session ID: 21 PFE Flow ID: 118 Login Time: 2019-06-11 17:53:24 IDT IPv6 Address Pool: dsl-tsi6-ndra-128 ***IA_NA address matches predefined IA_NA Local Pool IPv6 Framed Interface Id: 0:0:0:15 IPv4 Input Filter Name: blockport25-si-2/3/0.3221225492-in IPv4 Output Filter Name: egress-dsl-si-2/3/0.3221225492-out IPv6 Input Filter Name: dsl-in-block-smtp-v6-si-2/3/0.3221225492-in IPv6 Output Filter Name: dsl-out-block-dns-v6-si-2/3/0.3221225492-out Accounting interval: 600 Dynamic configuration: junos-input-filter: blockport25 junos-input-ipv6-filter: dsl-in-block-smtp-v6 junos-output-filter: egress-dsl junos-output-ipv6-filter: dsl-out-block-dns-v6
The CPE negotiates using DHCPv6, a Prefix-delegated address which is successful:
labroot@MX480-R060# run show subscribers extensive Type: L2TP User Name: brian/brian IP Address: 74.0.18.80 IP Netmask: 255.255.255.255 IPv6 Prefix: 2607:f2c0:fffa:200::/56 Logical System: default Routing Instance: default Interface: si-2/3/0.3221225492 Interface type: Dynamic Underlying Interface: si-2/3/0.3221225492 Dynamic Profile Name: dsl-template-default Dynamic Profile Version: 1 State: Active Radius Accounting ID: 21 Session ID: 21 PFE Flow ID: 118 Login Time: 2019-06-11 17:53:24 IDT IPv6 Address Pool: dsl-tsi6-ndra-128 IPv6 Framed Interface Id: 0:0:0:15 IPv4 Input Filter Name: blockport25-si-2/3/0.3221225492-in IPv4 Output Filter Name: egress-dsl-si-2/3/0.3221225492-out IPv6 Input Filter Name: dsl-in-block-smtp-v6-si-2/3/0.3221225492-in IPv6 Output Filter Name: dsl-out-block-dns-v6-si-2/3/0.3221225492-out Accounting interval: 600 Dynamic configuration: junos-input-filter: blockport25 junos-input-ipv6-filter: dsl-in-block-smtp-v6 junos-output-filter: egress-dsl junos-output-ipv6-filter: dsl-out-block-dns-v6 Type: DHCP IPv6 Prefix: 2607:f2c0:fffa:200::/56 ****Prefix-Delegated Address Logical System: default Routing Instance: default Interface: si-2/3/0.3221225492 Interface type: Static Underlying Interface: si-2/3/0.3221225492 MAC Address: 00:5f:01:00:00:01 State: Active Radius Accounting ID: 24 Session ID: 24 Underlying Session ID: 21 PFE Flow ID: 118 Login Time: 2019-06-11 18:05:15 IDT DHCP Options: len 56 00 08 00 02 00 00 00 01 00 0a 00 03 00 01 00 5f 01 00 00 01 00 06 00 10 00 02 00 07 00 08 00 11 00 12 00 17 00 18 00 1f 00 19 00 0c 00 00 00 0a 00 00 00 00 00 00 00 00 IPv6 Address Pool: dsl-tsi6-ndra-128 IPv6 Delegated Address Pool: dsl-tsi6-pd [MASTER][edit] labroot@MX480-R060# run show dhcpv6 server binding detail Session Id: 24 Client IPv6 Prefix: 2607:f2c0:fffa:200::/56 Lease Expires: 2019-06-12 18:05:15 IDT Lease Expires in: 86239 seconds Preferred Lease Expires: 2019-06-12 18:05:15 IDT Preferred Lease Expires in: 86239 seconds Client DUID: LL0x1-00:5f:01:00:00:01 State: BOUND(DHCPV6_LOCAL_SERVER_STATE_BOUND) Lease Start: 2019-06-11 18:05:15 IDT Last Packet Received: 2019-06-11 18:05:16 IDT Incoming Client Interface: si-2/3/0.3221225492 Client Pool Name: dsl-tsi6-ndra-128 Client Prefix Pool Name: dsl-tsi6-pd Client Id Length: 10 Client Id: /0x00030001/0x005f0100/0x0001
The CPE now sends a new Solicit requesting an IA_NA address. This fails and there is no subscriber entry or binding. The Solicit is seen and in some cases the Advertisement will be sent out as well. In the output below, the Received Solicit count increased by 3 and the Sent Advertisement increased by 3, indicating that JDHCPD is receiving the Solicits and is sending the Advertisements in response. However, you will notice that the Received Requests do not increment:
labroot@MX480-R060# run show dhcpv6 server statistics Dhcpv6 Packets dropped: Total 0 Advertise Delay: DELAYED 0 INPROGRESS 0 TOTAL 0 Messages received: DHCPV6_DECLINE 0 DHCPV6_SOLICIT 75 DHCPV6_INFORMATION_REQUEST 0 DHCPV6_RELEASE 5 DHCPV6_REQUEST 13 DHCPV6_CONFIRM 0 DHCPV6_RENEW 1 DHCPV6_REBIND 0 DHCPV6_RELAY_FORW 0 DHCPV6_LEASEQUERY 0 Messages sent: DHCPV6_ADVERTISE 51 DHCPV6_REPLY 19 DHCPV6_RECONFIGURE 0 DHCPV6_RELAY_REPL 0 DHCPV6_LEASEQUERY_REPLY 0 DHCPV6_LEASEQUERY_DATA 0 DHCPV6_LEASEQUERY_DONE 0 [MASTER][edit] labroot@MX480-R060# run show dhcpv6 server statistics Dhcpv6 Packets dropped: Total 0 Advertise Delay: DELAYED 0 INPROGRESS 0 TOTAL 0 Messages received: DHCPV6_DECLINE 0 DHCPV6_SOLICIT 78 ****Increase by 3 DHCPV6_INFORMATION_REQUEST 0 DHCPV6_RELEASE 5 DHCPV6_REQUEST 13 ****No Change DHCPV6_CONFIRM 0 DHCPV6_RENEW 1 DHCPV6_REBIND 0 DHCPV6_RELAY_FORW 0 DHCPV6_LEASEQUERY 0 Messages sent: DHCPV6_ADVERTISE 54***Increase by 3 DHCPV6_REPLY 19 DHCPV6_RECONFIGURE 0 DHCPV6_RELAY_REPL 0 DHCPV6_LEASEQUERY_REPLY 0 DHCPV6_LEASEQUERY_DATA 0 DHCPV6_LEASEQUERY_DONE 0
Enabling JDHCPD traceoptions will provide more insight on this behavior. The traceoptions will show that the Solicit is seen and processed, but the sending status code is “NO_ADDR_AVAIL”:
[MSTR][DEBUG] dhcpv6_packet_new: PACKET - Allocated new v6 packet 0xa06aa00 [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] >>>>>>>>>> Decode message from == fe80::15/546 <<<<<<<<<< [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ msgtype == DHCPV6-SOLICIT ]-------------------------- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ len == 40 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ xid == 472b9b ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ Internally Unsupported Option [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 8, len 2, data 00 00 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ OPTION_CLIENTID [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 1, len 10, data 00 03 00 01 00 5f 01 00 00 01 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ OPTION_IA_NA [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 3, len 12, iaid 10, T1 0, T2 0 ]-- [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Start [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Done [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_packet_decode: dhcpv6 pkt parsing - End [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492][SID=24] dhcpv6_find_client_from_incoming_pdu: Found client 65548 in default:default INET6 client table entry [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492][SID=24] dhcpv6_packet_handle: RECEIVE DHCPV6-SOLICIT: stats_safd 0xa016a80 si-2/3/0.3221225492, incoming_safd 0xa016a80 si-2/3/0.3221225492, demux 0x0 , safd 0xa016a80 si-2/3/0.3221225492 [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492][SID=24] dhcpv6_get_option_request: POOL 0xa10c600, NO REQUESTED len 8 [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492][SID=24] dhcpv6_local_server_pdu_send: PDU SEND...Sending DUID-EN in packet [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492][SID=24] dhcpv6_option_encode_ia_option: Remaining packet size (1452) for OPTION IA_NA [MSTR][NOTE] [default:default][SVR][INET6][si-2/3/0.3221225492][SID=24] dhcpv6_option_encode_ia_no_v6_ia: No IA for the client, sending status code and message DHCPV6_STATUS_NO_ADDR_AVAIL
As no address is found for the IA_NA request, the Advertisement is still sent to the client but has no address assigned. This causes the client to resend the Solicit requesting an IA_NA address. Most CPEs may never stop trying:
[MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] >>>>>>>>>> Decode message from == fe80::15/546 <<<<<<<<<< [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ msgtype == DHCPV6-ADVERTISE ]-------------------------- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ len == 111 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ xid == 472b9b ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ OPTION_CLIENTID [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 1, len 10, data 00 03 00 01 00 5f 01 00 00 01 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ OPTION_SERVERID [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 2, len 26, data 00 02 00 00 05 83 37 38 3a 31 39 3a 66 37 3a 32 38 3a 64 66 3a 63 30 00 00 00 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ OPTION_IA_NA [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 3, len 59, iaid 10, T1 0, T2 0 ]-- [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Start [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ OPTION_STATUS_CODE [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 13, len 43, data 00 02 4e 6f 20 61 64 64 72 65 73 73 65 73 20 68 61 76 65 20 62 65 65 6e 20 61 73 73 69 67 6e 65 64 20 66 6f 72 20 49 41 5f 4e 41 ]-- [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Done [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_packet_decode: dhcpv6 pkt parsing - End [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492][SID=24] dhcpv6_local_server_pdu_send: SEND (2) DHCPV6-ADVERTISE: stats_safd 0xa016a80 si-2/3/0.3221225492, safd 0xa016a80 si-2/3/0.3221225492
DHCPv6 uses a client-id option. Typically, the client-id represents the clients MAC address. The client-id option is used to carry the DHCP Unique Identifier (DUID) as well. Each DHCPv6 client and server has a DUID. A DUID consists of a two-octet type code represented in network byte order followed by a variable number of octets that make up the actual identifier. A DUID can be no more than 128 octets long (not including the type code).
There are 3 main types of DUID. RFC3315 Section 9 describes in detail what each DUID type is in detail:
Only DUID type 2(DUID-EN) and type 3 (DUID-LL) will run into this issue where only the first Solicit (either request IA_NA or PD) will be serviced and the second will have NO_ADDR_AVAIL. This is because these two types of DUID do not change. Type 1 (DUID-LLT) will work fine as the type 1 is the link-layer and time. The time will be unique between the 2 solicits and both will be serviced.
How to determine what DUID type is used by the CPE:
Enable traceoptions for JDHCPD
set system processes dhcp-service traceoptions file DHCP.log set system processes dhcp-service traceoptions file size 100m set system processes dhcp-service traceoptions file files 10 set system processes dhcp-service traceoptions level all set system processes dhcp-service traceoptions flag
Find offending Solicit and look at option code 1 (client-id)
Note: Below are the DUID types in order (1,2 and 3)
DUID type 1 link-layer plus Time (DUID-LLT)
0x01 = Type 1 (LLT)
0x2492afad = Time (this option makes the DUID UNIQUE between the IA_NA and PD solicits)
0x005f01000001 = Link Layer (MAC)
[MSTR][DEBUG] dhcpv6_packet_new: PACKET - Allocated new v6 packet 0xa06aa00 [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] >>>>>>>>>> Decode message from == fe80::15/546 <<<<<<<<<< [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ msgtype == DHCPV6-SOLICIT ]-------------------------- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ len == 44 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ xid == 9eee03 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ Internally Unsupported Option [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 8, len 2, data 00 00 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ OPTION_CLIENTID [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 1, len 14, data 00 01 00 01 24 92 af ad 00 5f 01 00 00 01 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] --[ OPTION_IA_NA [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225492] OPTION code 3, len 12, iaid 10, T1 0, T2 0 ]-- [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Start [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Done [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_packet_decode: dhcpv6 pkt parsing - End [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225492] dhcpv6_find_client_from_incoming_pdu: Could not find client table entry in routing instance default:default [MSTR][DEBUG] dhcpv6_packet_handle: RECEIVE DHCPV6-SOLICIT: stats_safd 0x0 , safd 0xa016a80 si-2/3/0.3221225492 [MSTR][DEBUG] dhcpv6_packet_get_mac_address: MAC address(00:5f:01:00:00:01) derived from DUID LL_TIME
DUID Type 2 Vendor-assigned unique ID based on Enterprise number (DUID-EN)
0x02 = Type 2 (DUID-EN)
0x00000001 =Enterprise Number **both EN and Identifier will be same in both requests
0x0000000a = Identifier
[MSTR][DEBUG] dhcpv6_packet_new: PACKET - Allocated new v6 packet 0xa06aa00 [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] >>>>>>>>>> Decode message from == fe80::1c/546 <<<<<<<<<< [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] --[ msgtype == DHCPV6-SOLICIT ]-------------------------- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] --[ len == 40 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] --[ xid == e02fb1 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] --[ Internally Unsupported Option [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] OPTION code 8, len 2, data 00 00 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] --[ OPTION_CLIENTID [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] OPTION code 1, len 10, data 00 02 00 00 00 01 00 00 00 0a ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] --[ OPTION_IA_NA [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225499] OPTION code 3, len 12, iaid 10, T1 0, T2 0 ]-- [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225499] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Start [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225499] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Done [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225499] dhcpv6_packet_decode: dhcpv6 pkt parsing - End
DUID Type 3 Link Layer (DUID-LL)
0x03 = Type 3 (DUID-LL)
0x0001 =Hardware type Ethernet ***both HW and system link will be same in both solicits
0x006101000001 = System Link Layer address
[MSTR][DEBUG] dhcpv6_packet_new: PACKET - Allocated new v6 packet 0xa06aa00 [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] >>>>>>>>>> Decode message from == fe80::1e/546 <<<<<<<<<< [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] --[ msgtype == DHCPV6-SOLICIT ]-------------------------- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] --[ len == 40 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] --[ xid == d612fc ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] --[ Internally Unsupported Option [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] OPTION code 8, len 2, data 01 90 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] --[ OPTION_CLIENTID [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] OPTION code 1, len 10, data 00 03 00 01 00 61 01 00 00 01 ]-- [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] --[ OPTION_IA_NA [MSTR][INFO] [default:default][SVR][INET6][si-2/3/0.3221225501] OPTION code 3, len 12, iaid 10, T1 0, T2 0 ]-- [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225501] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Start [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225501] dhcpv6_option_parse: Parsing suboptions of OPTION_IA_NA - Done [MSTR][DEBUG][default:default][SVR][INET6][si-2/3/0.3221225501] dhcpv6_packet_decode: dhcpv6 pkt parsing - End
JUNOS needs to interpret each Solicit as being unique. LLT has this ability. The CPE will use the Link-Layer (MAC) address and a Time stamp. The Time Stamp is what makes the IA_NA solicit Unique from the PD solicit which contains its own time stamp. For clients using DUID Type 1 LLT, JUNOS will be able to handle each Solicit separately starting in 16.2 and up ONLY if Radius is supplying the Framed-IPv6-Address and Delegated-Prefix during initial PPP login.
For DUID types 2 and 3, since the DUID options will be the same in each Solicit, the first Solicit will be handled accordingly and the next Solicit will not be able to assign an address. For clients using DUID Type 2 or Type 3 Enhanced Subscriber Management requires that the following conditions are met:
A single Solicit requesting IA_NA and PD
RLI38500 was created to address separate Solicits for DUID type 2 and 3. There is NO ETA at this time.
Getting Up and Running with Junos
Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search