Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[CSO] ISSU upgrade failure via CSO



Article ID: KB37410 KB Last Updated: 17 Sep 2021Version: 1.0

This article explains a workaround for upgrading SRX CPE devices via CSO when upgrading from a specific platform version.


If upgrade is done between the following versions, an issue maybe occur due to PR1537386- AMR packets not going through expected path after interface flap.

  • 19.3R2-S5 --> 20.2R3-S2
  • 20.2R2-S3 --> 20.2R3-S2
  • 19.3R2-S4 --> 20.4R2-S2
  • 20.2R2-S3 --> 20.4R2-S2
However, there is no issue from: 20.2R3-R2 --> 20.4R2-S2

The APBR issue as described in PR1537386 causes core while ISSU process is underway. The core causes the priorities to be 0, leading to ISSU failure because it needs priority to clear for the secondary to take over traffic and primary reboot to upgrade.



  1. Stage Image on Device by navigating to Home > Resources > Images. Select the image and click on "Stage” option (image gets downloaded to primary node).

  2.  Access Primary node by navigating to Home > Resources >Devices. Select the device radio button and click "More". Then select "Remote Console” to connect to the device.

  3. Check the image copied to /var/tmp/ and copy the image to Secondary node: file copy /var/tmp/<file name> node<0/1>:/var/tmp/

  4. Login to Secondary node using:

    request routing-engine login node <0/1>

  5. Upgrade Secondary Node: Execute the following command manually on secondary node:

    request system software add <image path> no-validate reboot

  6. After rebooting Secondary node and it has is started, exit back to Primary node.

  7. Upgrade Primary node: Execute the following command manually on primary node

    request system software add <image path> no-validate reboot

    Note: This is the stage where traffic disruption may occur since both nodes are rebooting to be upgraded.

  8. Once the cluster is built up, login to POSTMAN and install telemetry agent using following API:

     https://<CSO IP/Hostname>/fmpm-provider/device_agent_install
    "input": {
To get device_uuid take the following steps:
  1. Navigate to Home > Resources > Device
  2. Gather the cluster UUID and punch it at "<device_uuid>" in the API request in step 8

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search