IDP Scio command

[How to run the NSM GUI under Mac OS X]

How to run the NSM GUI under Mac OS X
How to setup a route-based VPN on a NetScreen
How to make your PPTP VPN client work through a NetScreen/SSG
Setting up a dial-up VPN and NetScreen Remote
How the Global Zone Works (It's probably not what you think)
How to configure NetScreen/SSG devices to work with the built in Mac OS X VPN client
How to Configure Dial-up VPN with route-based tunnels, XAuth, and use IPSecuritas

[Marclor]

Hi everyone,

We have a Juniper IDP 75. It was used in demos for clients. I've upgraded it from 4.1r2 to 5.0r2. The upgrade succeeded.
I didn't link it to NSM yet. I've noticed that when I want to use the scio command, I get this message:

[root@idp ~]# scio management
[14:33:46] Error: sc_device.c: sc_dev_open: connect to server call failed 0
[14:33:46] Error: sc_device.c: sc_dev_construct: sc_dev_open() failed
[14:33:46] Error: scio.c: scio: can't construct idp device for cpu 0

Can anyone help me? Thanks.

[Marclor]

Hi,

I've noticed that processes are stopped and restarted over and over again!

The service --status-all command show that:

service --status-all
anacron (pid 19857) is running...
atd (pid 19895) is running...
crond (pid 19824) is running...
dc_client is stopped
dc_server is stopped
hald (pid 19919) is running...
httpd (pid 19921 19917 19913 19802) is running...
Retrieving status...
idpinit...........................................off
idpengine_0.......................................off
idpLogReader......................................off
agent.............................................off
idpHMD............................................off
sciod.............................................off
pkid..............................................off
Usage: /etc/init.d/idprepservice {start|stop|restart}
Kdump is operational
insmod: error inserting '/usr/idp/device/lib/bpctl2.ko': -1 File exists
cat: /sys/module/jnet_igb/sections/.text: No such file or directory
cat: /sys/module/jnet_igb/sections/.data: No such file or directory
mcstransd is stopped
dbus-daemon (pid 18774) is running...
multipathd is stopped
netconsole module not loaded
netplugd is stopped
Configured devices:
lo eth0 eth1 eth2
Currently active devices:
lo eth0 eth2 eth1
ntpd is stopped
Process accounting is disabled.
rdisc is stopped
smartd (pid 20072) is running...
snmpd (pid 18950) is running...
snmptrapd is stopped
sshd (pid 18963) is running...
syslogd (pid 18696) is running...
klogd (pid 18702) is running...

[ScottDennis]

Try this:

Log into the IDP's ACM and run though the setup process again and save it. It looks like the ACM settings may not have taken  on the IDP.
ACM Access: http://<IDP_IP_Address>/admin


JNCIA-IDP, JNCIS-FWV, JNCIS-ER

[Volcanoman]

Hi, the problem you face is a bug in my opinion. I did some tests a while back and reported this bug which was accepted by TAC.

The issue occurs when you upgrade from 4.x to 5.x with no policy installed.

If you do the following all will work:

factory reset with the USB key
upgrade to 4.1r3 (earliest that will upgrade direct to 5)
connect to NSM and push any policy
upgrade to 5

The policy can be anything. Use one of the example ones available. You can change it later. It is an annoyance as it would be nice to be able to upgrade direct to the latest without having to use NSM. However, every USB key I've seen was built with 4.1r2

I suspect there will be a migration to using SRX as the host for future IDP so there might not be the development in such issues. But that's another discussion...

[ScottDennis]

Actually there are several known issues like this, however the one he is getting is directly connected to his upgrade so re-imaging will not fix the issue. There was a bug causing the restarting of processes over and over again in 4.1r2 and was fixed in 4.1r3 and all subsequent code releases. These are two separate issues. We saw that when IDPs were upgraded to 5.x code that the processes would restart constantly. The fix I gave should resolve the issue without you having to re-image the IDP. I have done it many times.   

Also there could be other issue with that box. Take a look at the techsupport.

Here is how to get run the tech support scripts:
Log into the IDP  as admin
"su -"
put in roots password

Tech Support without core files:
"sh /usr/idp/device/utils/tech-support"

Tech Support with core files:
"sh /usr/idp/device/utils/tech-support -c"

Core files will need to be analyzed by Juniper's engineers so you will need a case with JTAC and have the case escalated to ATAC. The only caveat here is that this is a Demo box. If you have core files then don't waste your time putting in a case with JTAC as they will just have you re-image the box anyway and put the 4.1r2 code on, then upgrade to 4.1r4 or 5.0r2. Most likely the 5.0r2 as the 4.1r4 is going to be EOL soon.

As a side note:
Whenever you get a demo box it is always good practice to re-image the box as the images get destroyed by previous users and the IDPs are not always re-imaged.


Enjoy!

[Marclor]

Hi all,

Thanks a lot for your replies. This is the first time I'm working with an IDP. What are core files?
The box doesn't contain a policy. I'm able to connect to ACM.
Do I have to re-image the box? Thanks

[ScottDennis]

I could not say for sure if you need to re-image or not. Just run through the ACM setup process and then see if the processes are all running.

What is a core file:
Please refer to this link.
http://www.unixguide.net/linux/faq/07.13.shtml

[Marclor]

Hi Scott,

Thanks. I'll do it sunday and will update the post.

[Marclor]

Hi everyone,

I've run the ACM setup process. It worked fine and all the processes were running. The processes stopped rebooting endlessly, even after rebooting the box. I think that the problem is solved. Your solution was very helpful. Thanks.

•      Forum/Home
•      Store
•      Articles
•        Tech Articles
•        Industry News
•        Site News
•      Knowledgebase
•        JUNOS/Routing
•        NS/ISG/SSG/NSM
•        SSL VPN
•      Downloads

Please consider donating if we've saved you time or money. It helps pay for the bandwidth, equipment, and hosting charges to keep this site running

Submit Article/KB - Do not submit questions here.

[Today]

• Problem telnet over Netwo... by jeroenvanassche [Today at 10:11:37 AM]
• SSG-320M Howw to log all ... by x0rerror [Today at 09:58:59 AM]
• www.shoeswarm.com cheap ... by nikewarm [Today at 09:00:47 AM]
• www.shoeswarm.com cheap ... by nikewarm [Today at 08:59:05 AM]
• redundant vpn between 2 s... by rubella [Today at 08:58:26 AM]
• cheap sale ugg 5734 boots... by shoeshive [Today at 08:10:56 AM]
• wholesale cheap Lacoste w... by shoeshive [Today at 08:10:09 AM]
• wholesale cheap Air Jorda... by shoeshive [Today at 08:09:19 AM]
• china sell urban Men Loui... by shoeshive [Today at 08:08:30 AM]
• china wholesale Alife sho... by shoeshive [Today at 08:07:52 AM]

Members

• Total Members: 22472
• Latest: mijones@hotmail.com

Stats

• Total Posts: 40480
• Total Topics: 11163
• Online Today: 73
• Online Ever: 393
• (August 06, 2008, 07:40:57 AM)

Users Online

Users: 0
Guests: 32
Total: 32