0

Good morning,

I have a Juniper SRX 340 Cluster (15.1X49-D70.3) in a professional environment, and a third firewall (same model) that I'd like to use as a test firewall. Is there any simple way to export the configuration from the cluster and import it into a third one?

Thanks to all, Gianluca

3

So a couple of things: first, I would recommend you upgrade from 15.1X49D70.3 immediately on both units, as there a a lot of issues with this code. The current (as of today) JTAC recommended version is 15.1X49D170.

Secondly, in order to copy the configuration over to your test firewall, I would recommend making it a single-member cluster. This way all of your interface references will match the clustered unit and you can keep the two in sync fairly easily (obviously you may need unique IP addresses depending on how connected your test environment is).

  1. On your test SRX Issue the commands:

    configure
    delete security
    delete interfaces
    delete vlans
    delete protocols
    commit and-quit
    
  2. Now on the test SRX issue

    set chassis cluster cluster-id 2 node 0 reboot
    

This will bring your stand-alone unit up as node 0 of cluster-id 2 (we use 2 here to ensure there are no conflicts with your production unit which is most likely cluster-id 1).

  1. While your test unit is rebooting, log into your production cluster and issue:

    show configuration | no-more
    
  2. Select and copy all this output to a decent Text Editor (Notepad++/Sublime Text)

  3. Log back into your test SRX and issue:

    configure
    load override terminal
    
  4. Paste in the configuration from your text editor - depending on how long it is, you may need to do this in sections.

  5. Hit Enter and then ctrl-d
  6. commit your configuration

Now you have a complete clone of your production environment. You may see alarms on your stand-alone unit, but this will be because it is "missing" the secondary node and associated interfaces.

  • Hi Benjamin. Thanks a lot! It worked perfectly! – Gianluca Aug 6 at 9:00
  • no problem - feel free to mark is as accepted in case anyone else has the issue – Benjamin Dale Aug 6 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.