Juniper SRX 340 configuration import/export

Question

Good morning,

I have a Juniper SRX 340 Cluster (15.1X49-D70.3) in a professional environment, and a third firewall (same model) that I'd like to use as a test firewall. Is there any simple way to export the configuration from the cluster and import it into a third one?

Thanks to all, Gianluca

Answer 1

So a couple of things: first, I would recommend you upgrade from 15.1X49D70.3 immediately on both units, as there a a lot of issues with this code. The current (as of today) JTAC recommended version is 15.1X49D170.

Secondly, in order to copy the configuration over to your test firewall, I would recommend making it a single-member cluster. This way all of your interface references will match the clustered unit and you can keep the two in sync fairly easily (obviously you may need unique IP addresses depending on how connected your test environment is).

1. On your test SRX Issue the commands:

   configure
   delete security
   delete interfaces
   delete vlans
   delete protocols
   commit and-quit
   

2. Now on the test SRX issue

   set chassis cluster cluster-id 2 node 0 reboot
   

This will bring your stand-alone unit up as node 0 of cluster-id 2 (we use 2 here to ensure there are no conflicts with your production unit which is most likely cluster-id 1).

3. While your test unit is rebooting, log into your production cluster and issue:

   show configuration | no-more
   

4. Select and copy all this output to a decent Text Editor (Notepad++/Sublime Text)

5. Log back into your test SRX and issue:

   configure
   load override terminal
   

6. Paste in the configuration from your text editor - depending on how long it is, you may need to do this in sections.

7. Hit Enter and then ctrl-d
8. commit your configuration

Now you have a complete clone of your production environment. You may see alarms on your stand-alone unit, but this will be because it is "missing" the secondary node and associated interfaces.