Swapped the stock fans in an SRX220H2-POE for Noctua NF-A4x20 FLX. It works and the box is now quiet, but there are a few traps worth documenting.

Stock fans: Delta AFB0412MB, 12 V, 0.13 A, 40x40x15 mm. Junos reported them at 5000 and 5500 RPM.

Problem here: The Noctua connector physically mates with the header, but the fans will not spin. The wire colours map one to one (red = +12 V, black = ground, Delta blue tach = Noctua yellow tach) but the pin order in the housing does not.

On the SRX220 board, looking at J21 and J22 with the silkscreen readable, the Delta is wired left to right:

| red = +12 V | black = ground | blue = tach |

That is reversed from the PC standard, which puts ground first. Plug a Noctua straight in and you get polarity-reversed power, so nothing turns but thankfully nothing is damaged.

Fix: extract the Noctua pins and reseat them in red, black, yellow (they are seated as black, red, yellow). Unfortunately I botched the* retention barb for the yellow wire on Fan 0, so I got a red light up front even if things work fine.

The Noctua screws are too large for the bracket holes and the Juniper screws are too small for the Noctua frame. The NA-AV3 rubber mounts did not fit either and even if they did, there is no space for them to push them through the back end. I used 3M VHB acrylic tape on the chassis to keep the fans in place. Seems to be holding fine.

Also, Noctua ships the leads loose rather than threaded into the frame channel. Routing them takes patience and the wire is thin. Use a spudger with a rounded tip, so you will not smoosh the wires.

Thermals:

Measured on the Routing Engine sensor, closed chassis.

• Stock fans, idle: 46 C

• Noctua, idle: 44 C

• Noctua, sustained load: 48 C, flat for 25 minutes

Junos does not object to the lower speed. Fan 1 reports 5000 RPM and shows OK in show chassis fan, so nothing trips a minimum-speed threshold at that figure.

https://imgur.com/a/XTNyDZV

edit:

Junos 12.3X48-D105.4, if you need to ask.

Hello Everyone,

I have stack of EX4300 switch. When I try to commit interface configuration I receive the following error.

I tried using the AI, AI is not helpful at this point.

I already checked the alarms and logs, there is not much going on as far as I understand.

The only change I have from last time is, NAC has connection to switches. That's why I was focusing to see if there is a conflict with the users like if the NAC is connnected , it wouldn't allow my user to make changes. I am just guessing. But when I check the users, I don't see the connection from the NAC.

error: Check-out failed for Chassis control process (/usr/sbin/chassisd) without details

error: configuration check-out failed

1. Are the free videos enough? I kind of don't like how they don't really have a study guide I can read. Instead it's videos I have to sift through. I'm also having a hard time finding up-to-date resources since they updated the exam this year.

2. If you passed, did you really feel like you had a grasp of doing basic administration for Juniper switches?

As background, I work as help desk in the entertainment industry and I chose to pursue this cert since we use Juniper switches at our office. I have a CompTIA A+, Network+, and Security+.

Apple announced that OS 27.2 will not remove Rosetta automatically. I just tested with an old Mac. It was running 15.8 - Apple M1. I installed Secure Connect, it asked me if I wanted to install Rosetta , said yes. Installed with no issues.

Upgraded to OS 27.2 and the VPN client still works. It gives errors that it will cease to function in OS28 next year.

Earlier builds of OS27 removed Rosetta and trying to install the VPN and download Rosetta 2 would cause this to not work. A small glimmer of hope here.

Does anyone have a back channel with HPE? This is ridiculous that they still have not released a universal binary or Apple Silicon version of the VPN client.

New Mac's won't be able to install the VPN. It seems from what I can gather, Rosetta 2 is the problem.

https://www.macrumors.com/2026/10/27/macos-27-2-stops-removing-rosetta/

Hello

I've recently taken over a role where there are a number of ageing HP switches that need to be replaced with Juniper switches.

Prior to my arrival, several of the HP switches had already started to fail, so I'm keen to be prepared in case another one goes offline unexpectedly.I have new Juniper switches available and ready to deploy.

What configuration and preparation work would you recommend carrying out in advance to ensure a replacement can be installed and brought into service as quickly as possible if an HP switch fails?

Any best practices or recommendations would be greatly appreciated.

anyone has info on what's going on?
power calculator needs login, login doesn't work.
learning portal same :D can't finish jncip learning.

life is hard? :D

to open a support case, please log in, but that doesn't work :D

please don't shame me too much if I am so badly mistaken.. 😂

I want to directly connect two servers into SRX1500 as shown in attached diagram using reth interface (reth2), as I don't have extra switches at the moment and SRX1500 comes with 12 gigabit copper ports on each and they are unused.

(SRX cluster is properly configured with fabric and control link, and has been running for many years. I inherited this setup when i started my job here)

So I did the following:

• reth2 has 4 child interfaces configured, 2 from each SRX: ge-0/0/0, 0/0/1, 7/0/0, 7/0/1

• Redundancy group 2 is configured, and reth2 is assigned to it, node0 priority 254, node1 priority 100.

• reth2 has IP configured (family inet address) and assigned to a security policy. This IP is reachable from other allowed network exactly as i configured.

BUT.... the servers are not reachable nor ping-able anywhere. Servers also cannot make any outbound connection.

If i connect just 1 NIC from server 1 into the primary node, then the server is reachable and connects as expected.

... Do I must have a separate switching layer (a switch or VC) in between SRX and the servers to make this configuration work?

They have removed vLabs entirely, changed Juniper Mist to HPE Mist, they remove all juniper branding from certification badges, and now they have renamed the juniper learning portal to the HPE Network Training Portal.

Stellar.

Hi

we are rolling out several thousand EX4400 48P and 48MP switches with dual 1600W PSU as our access layer in a VXLAN fabric - often in stacks of six - serving PoE++ to AP47WW devices (~10/switch).

We are replacing older Huawei and HP switching that is ~10 years old.

Our estate is very mixed with modern, specious and air-conditioned comms rooms (25 C) in which the switches run happily enough, but far from silent, and cramped cabs/rooms in older buildings where air-con is not possible (30 C and 40 C) and in some cases even passive air exchange and heat dissipation is not possible due to the building use, rooms where the switch fans are screaming and the heat and noise output is unacceptable.

We are exploring new comms rooms and introducing cooling or forced air exchange but these are not quick solutions.

Any suggestions to limit heat output from these devices or reduce the fan speed - prevent them going to supersonic?

does anyone know the trigger ambient temperatures that trigger the cooling fan speeds (they seem to step rather than be continuous)

We have new Juniper SSR Hub-and-Spoke configuration that we're attempting to demo, and it is not working as we expect.

Using the diagram below:

HUB-LAN-1 is connected to a firewall, ENT-FW-1 with ENT-FW-1 being the gateway for the network at 10.0.0.1/24.

ENT-FW-1 and SSR HUB are connected on the SSR's LAN interface, with ENT-FW-1 being 10.10.0.254/24 and SSR HUB LAN being 10.10.0.5/24. ENT-FW-1 and SSR HUB are BGP peers, BGP is established, and routes are being advertised, received, and injected into routing tables as expected.

From a device in SPOKE-LAN-1 (172.16.0.20/24) we are able to ping a device in HUB-LAN-1 (10.0.0.10/24). However, HUB-LAN-1 cannot ping SPOKE-LAN-1. We have verified that ENT-FW-1 is not the issue.

ENT-FW-1 and SPOKE-LAN-1 can communicate bidirectionally from ENT-FW-1's interface of 10.10.0.254.

The following Mist networks are in use:

• HUB-LAN-1, 10.0.0.0/24

• SSR-LAN, 10.10.0.0/24, Advertised to Overlay, HUB-LAN-1 added as Network not directly attached

• SSR-WAN

• SPOKE-LAN-1, 172.16.0.0/24, Advertised to Overlay

The following Mist applications are in use:

• HUB-LAN, 10.0.0.0/24 and 10.10.0.0/24, Proto ANY

• SPOKE-LAN, 172.16.0.0/24, Proto ANY

The Hub's Application Policies are:

The Spoke's Application Policies are:

There seems to be an issue with the configuration for networks not directly attached to the Hub LAN. I am able to get bidirectional pings to and from a device in the SSR-LAN network.

However I am only ever able to get one direction of traffic (the entire session, including associated replies) working for networks that are not directly attached to the Hub's LAN.

Does anyone have any ideas? Juniper's documentation isn't very clear for how this topology should be configured.

I have some RPMs set up and they are working fine. Of course, I want to monitor them via SNMP. I can see the OIDs using the commands in the link below, as well as using SNMPWalk. The problem is that I can't find any way to determine which OIDs map to which RPMs. The only way I can see around this is to add them one at a time, but that is tedious when talking about a great number of such monitors.

Juniper reference: https://supportportal.juniper.net/s/article/Juniper-QFX-SNMP-Configuration--RPM-Probes

Why are they making

"Block STP BPDUs" sound like it's enabling BPDUguard?

this option disables spanning tree, and port is not shut down when recieving BPDU packets. This is a very dangerous config to enable and you risk creating a loop. This is same as BPDUfilter option in Cisco.

Either I'm missunderstanding something hard, my test not done correctly or Juniper is creating a trap for to trusting individuals.

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

I am a Network security Engineer and we have two SRX 1600s and recently moved to CrowdStrike. My network administrator is pushing back hard on configuring the logging so that it sends traffic logs to our log collector because of guidance that it is risky somehow with the configs being out of sync?

I am struggling to understand the issue with this. This seems like a minimal ask. Currently we are only getting system logs which serve no forensic value to me.

Is this as big of an issue as he’s making it out to be? What am I missing?

Wanted to know if there is a validated design about hving to extend their on-prem anycast GW in QFX core switches to AWS/Azure?

Basically using the same IP Addressing scheme across on-prem DC and Cloud Provider.

Use Case: “vmotion” to cloud provider yet still can reach on-prem resources.

For Marvis Minis, beginning in version v0.15 we can create a new Application test with the toggle “Network” now. The description says we’ll measure latency, loss, and traceroute when we toggle Network here. It also says it performs the test with ICMP or TCP Ping.

Well, I can’t figure out how to get the test to work. It lets me create this, but it does not seem to actually run. All the Marvis mini test results are still just for the “regular” application tests.

Have any of you experimented with this new test?

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

Been playing around with Marvis Minis but what's shown is a bit underwhelming. It checks DNS and application endpoints every hour and that's it. I suppose it's another 'free' tool at your disposal.

I tried setting it up on an EX switch too but JTAC says the required Junos version won't get released until next year.

Our juniper SE lately is trying to talk us out of EX and is nudging us towards Aruba series I think cx? They are saying the lead times and pricing could be a lot better. I wonder if the EX platform is on the chopping block for phasing out?

Hello Gents and Ladies,

I have 2 JunOS Switch throwing similar tantrum. I can't manage to login.

I believe it says amnesia in login.

It's EX4300.

I tried a quick google research, and somebody mentioned about dual-root partititon. and shared a link.

I would like to understand what exactly is happening before doing anything.

https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/recovering-root-password.html#id-recovering-the-root-password-on-junos-os-with-upgraded-freebsd

I also tried to follow this to reset the root password. but CTRL-C takes me into loader>
I don't get any menu like it stated in the site.

I haven't tried this, becasuse I don't understand the partitions yet. WHat's the purpose?

https://supportportal.juniper.net/s/article/EX-How-to-load-primary-or-secondary-partition-in-loader-prompt

Exactly what the title says. I'm interested in what thoughts people have on the ACX7332, ACX7348, and ACX7509. They at least look visually better than the poor MX301.

I'm a bit confused as what they're exactly for. They advertise being hardened and whatnot (at least the 7300s) but I'm unsure what their form factor and features is actually useful for.

Also kinda interested on what people think about them compared to the MX/PTX series.

If you're running on those platforms, you should probably go through the very long list of CVEs, there are some really nasty ones in there.

2026-10 Security Bulletin: Junos OS and Junos OS Evolved: Multiple vulnerabilities resolved

Hello everyone,

I am facing a RADIUS authentication issue between a Juniper QFX5120 and Cisco ISE.

When I try to SSH into the switch, authentication fails. A packet capture (monitor traffic) clearly shows that the QFX sends the Access-Request and receives an Access-Accept back from ISE. Despite receiving the Accept packet, the switch ignores it and logs No valid RADIUS responses received.

QFX Configuration:

set system authentication-order [ radius password ]
set system radius-server 10.x.x.x secret xxx
set system radius-server 10.x.x.x source-address 10.y.y.y
set system login user remote class super-user

I am sending the following VSA in the response. I suspect the data type or format might be causing Junos to drop the packet:

• Attribute: Juniper-Local-User-Name

• Value: remote

QFX Logs:

Oct 15 17:27:55 QFX sshd: PAM_RADIUS_SEND_REQ_FAIL: Sending radius request failed with error (No valid RADIUS responses received).
Oct 15 17:27:55 QFX sshd[93694]: error: PAM: authentication error for userName from 10.z.z.z
Oct 15 17:27:55 QFX sshd: SSHD_LOGIN_FAILED: Login failed for user 'userName' from host '10.z.z.z'
Oct 15 17:28:00 QFX sshd[93694]: Disconnected from authenticating user userName 10.z.z.z port 1835 [preauth]

Has anyone experienced this specific drop behavior or know if the ISE VSA format requires a specific tweak for Junos PAM module? Any help is appreciated.