Understanding Autoinstallation of Configuration Files (Junos OS)

Automatic Installation of Configuration Files

On SRX Series Firewalls, you can specify a remote server where configuration files are located. If a configuration file cannot be found on the device’s CompactFlash card, the device automatically retrieves the configuration file from this remote server. For security purposes, you can encrypt these remote files using the DES cipher, and once they have been retrieved, the device decrypts them for use on the server.

To encrypt the files, we recommend the OpenSSL tool. You can get the OpenSSL tool at http://www.openssl.org/. To encrypt the file, use the following syntax:

• passphrase—Passphrase used to encrypt the configuration file. The passphrase should be the name of the file without the path information or file extension.

• original-file—Unencrypted configuration file.

• encrypted-file—Name of the encrypted configuration file.

For example, if you are encrypting the active configuration file juniper.conf.gz, the passphrase is juniper.conf. The openSSL syntax used to encrypt the file is:

Supported Autoinstallation Interfaces and Protocols

Before autoinstallation on a device can take place, the device must acquire an IP address. The protocol or protocols you choose for IP address acquisition determine the device interface to connect to the network for autoinstallation. The device detects the connected interface and requests an IP address with a protocol appropriate for the interface. Autoinstallation is supported over an Ethernet LAN interface or a serial LAN or WAN interface. Table 1 lists the protocols that the device can use on these interfaces for IP address acquisition.

If the server with the autoinstallation configuration file is not on the same LAN segment as the new device, or if a specific device is required by the network, you must configure an intermediate device directly attached to the new device through which the new device can send Trivial File Transfer Protocol (TFTP), BOOTP, and Domain Name System (DNS) requests. In this case, you specify the IP address of the intermediate device as the location to receive TFTP requests for autoinstallation.

Typical Autoinstallation Process on a New Device

When a device is powered on for the first time, it performs the following autoinstallation tasks:

1. The new device sends out DHCP, BOOTP, RARP, or SLARP requests on each connected interface simultaneously to obtain an IP address.

   If a DHCP server responds, it provides the device with some or all of the following information:

   • An IP address and subnet mask for the autoinstallation interface.

   • The location of the TFTP (typically), Hypertext Transfer Protocol (HTTP), or FTP server on which the configuration file is stored.

   • The name of the configuration file to be requested from the TFTP server.

   • The IP address or hostname of the TFTP server.

     If the DHCP server provides only the hostname, a DNS server must be available on the network to resolve the name to an IP address.

   • The IP address of an intermediate device if the configuration server is on a different LAN segment from the new device.

2. After the new device acquires an IP address, the autoinstallation process on the device attempts to download a configuration file in the following ways:

   1. If the DHCP server specifies the host-specific configuration file (boot file) hostname.conf, the device uses that filename in the TFTP server request. (In the filename, hostname is the hostname of the new device.) The autoinstallation process on the new device makes three unicast TFTP requests for hostname.conf. If these attempts fail, the device broadcasts three requests to any available TFTP server for the file.

   2. If the new device cannot locate hostname.conf, the autoinstallation process unicasts or broadcasts TFTP requests for a default device configuration file called network.conf, which contains hostname-to-IP address mapping information, to attempt to find its hostname.

   3. If network.conf contains no hostname entry for the new device, the autoinstallation process sends out a DNS request and attempts to resolve the new device's IP address to a hostname.

   4. If the new device can determine its hostname, it sends a TFTP request for the hostname.conf file.

   5. If the new device is unable to map its IP address to a hostname, it sends TFTP requests for the default configuration file router.conf.

3. After the new device locates a configuration file on a TFTP server, autoinstallation downloads the file, installs the file on the device, and commits the configuration.

Autoinstallation is the automatic configuration of a device over the network from a preexisting configuration file that you create and store on a configuration server—typically a Trivial File Transfer Protocol (TFTP) server. You can use autoinstallation to configure new devices automatically and to deploy multiple devices from a central location in the network.

You enable autoinstallation so that the switches in your network implement autoinstallation when they are powered on. To configure autoinstallation, you specify a configuration server, an autoinstallation interface, and a protocol for IP address acquisition.

Typical Uses for Autoinstallation

Typical uses for autoinstallation of the software include:

• To deploy and update multiple devices from a central location in the network.

• To update a device—Autoinstallation occurs when a device that has been manually configured for autoinstallation is powered on.

Autoinstallation Configuration Files and IP Addresses

For the autoinstallation process to work, you must store one or more host-specific or default configuration files on a configuration server in the network and have a service available—typically Dynamic Host Configuration Protocol (DHCP)—to assign an IP address to the switch.

You can set up the following configuration files for autoinstallation on the switch:

• network.conf—Default configuration file for autoinstallation, in which you specify IP addresses and associated hostnames for devices on the network.

• switch.conf—Default configuration file for autoinstallation with a minimum configuration sufficient for you to telnet to the device and configure it manually.

• hostname.conf—Host-specific configuration file for autoinstallation on a device that contains all the configuration information necessary for the switch. In the filename, hostname is replaced with the hostname assigned to the switch.

If the server with the autoinstallation configuration file is not on the same LAN segment as the new device, or if a specific device is required by the network, you must configure an intermediate device directly attached to the new switch, through which the new switch can send TFTP, Boot Protocol (BOOTP), and Domain Name System (DNS) requests. In this case, you specify the IP address of the intermediate device as the location to receive TFTP requests for autoinstallation.

Typical Autoinstallation Process on a New Switch

When the switch configured for autoinstallation is powered on, it performs the following autoinstallation tasks:

1. The switch sends out DHCP or BOOTP requests on each connected interface simultaneously to obtain an IP address.

   If a DHCP server responds to these requests, it provides the switch with some or all of the following information:

   • An IP address and subnet mask for the autoinstallation interface.

   • The location of the (typically) TFTP server, Hypertext Transfer Protocol (HTTP) server, or FTP server on which the configuration file is stored.

   • The name of the configuration file to be requested from the TFTP server.

   • The IP address or hostname of the TFTP server.

     If the DHCP server provides the server’s hostname, a DNS server must be available on the network to resolve the name to an IP address.

   • The IP address of an intermediate device if the configuration server is on a different LAN segment from the switch.

2. After the switch acquires an IP address, the autoinstallation process on the switch attempts to download a configuration file in the following ways:

   1. If the DHCP server specifies the host-specific configuration file hostname.conf, the switch uses that filename in the TFTP server request. The autoinstallation process on the new switch makes three unicast TFTP requests for hostname.conf. If these attempts fail, the switch broadcasts three requests to any available TFTP server for the file.

   2. If the switch does not locate a hostname.conf file, the autoinstallation process sends three unicast TFTP requests for a network.conf file that contains the switch’s hostname-to-IP-address mapping information. If these attempts fail, the switch broadcasts three requests to any available TFTP server for the file.

   3. If the switch fails to find a network.conf file that contains a hostname entry for the switch, the autoinstallation process sends out a DNS request and attempts to resolve the switch's IP address to a hostname.

   4. If the switch determines its hostname, it sends a TFTP request for the hostname.conf file.

   5. If the switch is unable to map its IP address to a hostname, it sends TFTP requests for the default configuration file switch.conf. The TFTP request procedure is the same as for the network.conf file.

3. After the switch locates a configuration file on a TFTP server, the autoinstallation process downloads the file, installs the file on the switch, and commits the configuration.

Supported Autoinstallation Interfaces and Protocols

Before autoinstallation on a router can take place, the router must acquire an IP address or a USB key. The protocol or protocols you choose for IP address acquisition determine the router interface to connect to the network for autoinstallation. The router detects the connected interface and requests an IP address with a protocol appropriate for the interface. Autoinstallation is supported over an Ethernet LAN interface. For IP address acquisition, the JNU satellite router uses DHCP, BOOTP, or Reverse Address Resolution Protocol (RARP) on an Ethernet LAN interface.

If the server with the autoinstallation configuration file is not on the same LAN segment as the new router, or if a specific router is required by the network, you must configure an intermediate router directly attached to the new router, through which the new router can send HTTP, FTP, Trivial File Transfer Protocol (TFTP), BOOTP, and Domain Name System (DNS) requests. In this case, you specify the IP address of the intermediate router as the location to receive HTTP, FTP, or TFTP requests for autoinstallation.

Typical Autoinstallation Process on a New Router

When a router is powered on for the first time, it performs the following autoinstallation tasks:

1. The new router sends out DHCP, BOOTP, or RARP requests on each connected interface simultaneously to obtain an IP address.

   If a DHCP server responds, it provides the router with some or all of the following information:

   • An IP address and subnet mask for the autoinstallation interface.

   • The location of the TFTP (typically), HTTP, or FTP server on which the configuration file is stored.

   • The name of the configuration file to be requested from the HTTP, FTP, or TFTP server.

   • The IP address or hostname of the HTTP, FTP, or TFTP server.

     If the DHCP server provides only the hostname, a DNS server must be available on the network to resolve the name to an IP address.

   • The IP address of an intermediate router if the configuration server is on a different LAN segment from the new router.

2. After the new router acquires an IP address, the autoinstallation process on the router attempts to download a configuration file in the following ways:

   1. If the configuration file is specified as a URL, the router fetches the configuration file from the URL by using HTTP, FTP, or TFTP, depending on the protocol specified in the URL.

   2. If the DHCP server specifies the host-specific configuration file (boot file) hostname.conf, the router uses that filename in the TFTP server request. (In the filename, hostname is the hostname of the new router.) The autoinstallation process on the new router makes three unicast TFTP requests for hostname.conf. If these attempts fail, the router broadcasts three requests to any available TFTP server for the file.

   3. If the new router cannot locate hostname.conf, the autoinstallation process unicasts or broadcasts TFTP requests for a default router configuration file called network.conf, which contains hostname-to-IP address mapping information, to attempt to find its hostname.

   4. If network.conf contains no hostname entry for the new router, the autoinstallation process sends out a DNS request and attempts to resolve the new router’s IP address to a hostname.

   5. If the new router can determine its hostname, it sends a TFTP request for the hostname.conf file.

   6. If the new router is unable to map its IP address to a hostname, it sends TFTP requests for the default configuration file router.conf.

3. After the new router locates a configuration file on a TFTP server, the autoinstallation process downloads the file, installs the file on the router, and commits the configuration.

In a Junos Node Unifier (JNU) group that contains an MX Series router as a controller that manages satellite devices, such as EX Series Ethernet Switches, QFX Series devices, and ACX Series Universal Metro Routers, the autoinstallation functionality is supported for the satellite devices. JNU has an autoinstallation mechanism that enables a satellite device to configure itself out-of-the-box with no manual intervention, using the configuration available either on the network or locally through a removable media, or using a combination of both. This autoinstallation method is also called the zero-touch facility.

The zero-touch configuration delivers the following benefits:

• The router can be sent from the warehouse to the deployment site without any preconfiguration steps.

• The procedure required to deploy the device at the cell site is simplified, resulting in reduced operational and administrative costs.

• You can roll out large numbers of these devices in a very short time.

The factory default setting is autoinstallation-enabled. After you make the first configuration to the router, you can do either of the following:

• A JNU factory default file, jnu-factory.conf, is present in the /etc/config/ directory and contains the configuration to perform autoinstallation on satellite devices. The zero-touch configuration can be disabled by including the delete-after-commit statement at the [edit system autoinstallation] hierarchy level and committing the configuration. This way, the saved configuration is used the next time the system reboots.

• Alternatively, if the router must get the configuration from the server each time a system reboot occurs, the zero-touch configuration must not be changed (that is, you must not include the delete-after-commit statement at the [edit system autoinstallation] hierarchy level and commit the settings).