I got a new error while updating a SRX650 from the Juniper Network and Security Manager. The error started after I upgraded the SRX650 to 12.1X47-D30. The error I got is shown below:
Error Code:
Error Text:
Update fails UpdateDevice Results
sanityCheckCmd Success.
lock Success.
GenerateEditConfig Failed .
<?xml version="1.0" encoding="UTF-8"?>
<rpc-reply message-id="1" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/12.1X47/junos" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0">
<rpc-error>
<error-severity>error</error-severity>
<error-info>
<bad-element>dst-port</bad-element>
</error-info>
<error-message>syntax error</error-message>
</rpc-error>
<rpc-error>
<error-severity>error</error-severity>
<error-info>
<bad-element>dst-port</bad-element>
</error-info>
<error-message>syntax error</error-message>
</rpc-error>
</rpc-reply>
unlock Success .
Error Details:
Logs:
<configuration>
<version>12.1X47-D25.4</version>
<system>
<host-name>casur-srx650-cluster</host-name>
</system>
<security>
<nat>
<destination>
<rule-set>
<name>ca-camera</name>
<rule>
<name>camera-01-8200</name>
<dest-nat-rule-match>
<destination-port operation="delete">
<name>8200</name>
</destination-port>
<destination-port operation="create">
<dst-port>8200</dst-port>
</destination-port>
</dest-nat-rule-match>
</rule>
</rule-set>
</destination>
</nat>
</security>
</configuration>
It’s saying that the destination nat section has problems setting the dst-port. For some reason it was deleting the value and creating it with a new command (dst-port).
I then checked the supported Junos versions on the NSM and I discovered that the last supported version was 12.1X47-D25. Did the downgrade and updated the OS in the NSM. Still the same error as before.
Spoke to JTAC and they informed me that this error was known and that it would help downgrading to D15. This was due to a changed command in Junos. I downgraded to D15 but still the same issue. Researched a bit myself and discovered that it was introduced between X46 and X47.
Earlier it had not been possible to downgrade the versions in NSM. But for some reason I was able to do it now. First from D30 to D25, and after that from X47D15 to X46D40. When I reached X46D40 I was able to run the update and everything was working.
Networks and rants 