Upgrade commands are detailed in DX "Installation and Administration Guide" section "Upgrading the DX Application Acceleration Platform Software"

(1)

Appnote - topic

Administrator may need to upgrade DX devices for different reasons (new DX feature need, old release no longer supported, patch, …).

This AppNote describes how to upgrade DX and points to pay attention.

DX upgrade – How To

Upgrade commands are detailed in DX "Installation and Administration Guide" section "Upgrading the DX Application Acceleration Platform Software"

Important

Important points to keep in mind are:

points to keep in mind are:

The most current release is 5.1 and releases prior to 3.3 are no longer supported by Juniper. • Upgrade file (.pac) can be retrieved from Juniper web site

Go to www.juniper.net, Support, Download Software.

Note: You need to be registered. If any issue, contact Customer Care on 800-638-8296 (U.S. or Canada) or 408-745-9500 (all other countries).

• Upgrade can be done via scp or tftp

• When upgrading, DX should not be handling live traffic, as the upgrade will interrupt the traffic

flow and requires a reboot.

If applications are handled by a single device, this upgrade has to be done when there are no more clients.

If applications are handled by 2 or more DX (active/passive or active/active mode), upgrade may be done with live clients removing transparently one by one DX from production. This point is detailed below in technical note.

• DX license is preserved after upgrade.

But if administrator wants to use new feature available only on new release, DX license must be updated. New DX license can be retrieved automatically on Juniper web site.

Go to www.juniper.net, Contract & Product Management, License Key Generator.

Note: Your DX needs to be registered. If any issue, contact Customer Care on 800-638-8296 (U.S. or Canada) or 408-745-9500 (all other countries).

(2)

• Cluster, forwarder, redirector SSL listen keypass are not preserved with an upgrade from a release prior to 4.1.

With an upgrade from a release prior to 4.1, administrator must re-enter keypass in configuration (if any) at the end of upgrade.

Since release 4.1, these keypass are preserved with upgrade.

• WebUI SSL keypass are not preserved from a release prior to 5.1.6.

In case you use WebUI on SSL (https) AND you use a certificate with keypass, then on releases prior to 5.1.6 you need to re-enter the WebUI SSL keypass..

Since release 5.1.6, this keypass is preserved with upgrade.

• Configuration is preserved with an upgrade from a release after 2.0.

But configuration imported on new release is the one you had on DX at the moment you launched "install" command. If you do any configuration change after, those modifications won't be imported on new release.

Important Note: Unified Failover

Unified Failover (UFO) is a new feature added in release 5.1.

It simplifies DX failover configuration/management especially when DX configuration mixes cluster/SLB/activeN VIPs.

Juniper provides in its DX Manual "Installation and Administration Guide" steps to migrate a DX configuration to UFO in section "Migrating from Existing Failover to Unified Failover". This can be

performed just after 5.1 migration.

Upgrade DX on live

Upgrade DX on live environment

environment

DX upgrade can be done transparently on live traffic only if:

• applications on DX-VIP (SLB, cluster, forwarder or redirector) are web (http/https) • and DX-VIPs don't use clientIP sticky (no sticky or cookie sticky is OK)

• and 2 or more DX are in active/passive or activeN mode In all other cases, upgrade must be done when there is no traffic on DX.

Note: Those steps may be done via WebUI or CLI. This AppNote covers only CLI and doesn't mention "write" commands to do at the end of each step to save configuration change.

(3)

First step: Upgrade 1 DX

On single DX will be upgraded to validate new release on all applications.

1. Check DX status

• If Unified Failover used: "show failover" • If Unified Failover not used:

o SLB failover "show slb failover" o server failover "show server failover" o activeN failover "show activeN failover"

Note: We assume there are 2 DX devices. DX1 is master and DX2 standby.

2. Remove DX2-blade on all DX1 activeN groups (only if activeN used)

• Remove DX2-blade from all DX1 activeN groups: o Release prior to 5.1: "delete activeN blade x.x.x.x" o From release 5.1: "set activeN blade x.x.x.x hardpaused" Note: x.x.x.x is DX2-blade IP@

3. Remove DX2 from production from backup state

a. Disable service on DX2

o If SLB used: "set slb disabled"

o If cluster/forwarder/redirector used: "set server down" o If activeN used: 'set activeN disabled"

b. Disable failover on DX2

o If Unified Failover used: "set failover disabled" o If Unified Failover not used:

If SLB failover used: "set slb failover disabled" + "set slb failover forcemaster disabled" If server failover used: "set server failover disabled" + "set server failover forcemaster

disabled"

If activeN failover used: 'set activeN failover disabled" + "set activeN failover forcemaster disabled"

4. Upgrade DX2

Follow steps in DX "Installation and Administration Guide" section "Upgrading the DX Application Acceleration Platform Software"

5. Move production from DX1 (old release) to DX2 (new release)

a. Enable failover on DX2

o If Unified Failover used: "set failover enabled" o If Unified Failover not used:

If SLB failover used: "set slb failover enabled" If server failover used: "set server failover enabled" If activeN failover used: 'set activeN failover enabled" Note: DX2 is passive and DX1 still master.

b. Enable service on DX2

o If SLB used: "set slb enabled"

o If cluster/forwarder/redirector used: "set server up" o If activeN used: 'set activeN enabled"

(4)

c. Move traffic to DX2

o If Unified Failover used: on DX1 "set failover forcemaster disabled" and on DX2 "set failover forcemaster enabled"

o If Unified Failover not used: Disable service on DX1

If SLB used: "set slb disabled"

If cluster/forwarder/redirector used: "set server down" If activeN used: 'set activeN disabled"

Re-enable service on DX1 (after 30secs) If SLB used: "set slb enabled"

If cluster/forwarder/redirector used: "set server up" If activeN used: 'set activeN enabled"

Note: Traffic is now processed by DX2 master and DX1 is standby. In case of any issue on DX2, move back traffic to DX1 disabling both services and failover on DX2.

Second

Second step: Upgrade other

step: Upgrade other

step: Upgrade other DX

step: Upgrade other

DX

Once applications on new release are validated (may need a couple of days of live production through DX2 depending of company requirements), upgrade DX1.

6. Remove DX1-blade on all DX2 activeN groups (only if activeN used)

• Remove DX1-blade from all DX2 activeN groups: o Release prior to 5.1: "delete activeN blade x.x.x.x" o From release 5.1: "set activeN blade x.x.x.x hardpaused" Note: x.x.x.x is DX1-blade IP@

7. Remove DX1 from production

a. Disable service on DX1

o If SLB used: "set slb disabled"

o If cluster/forwarder/redirector used: "set server down" o If activeN used: 'set activeN disabled"

b. Disable failover on DX1

o If Unified Failover used: "set failover disabled" o If Unified Failover not used:

If SLB failover used: "set slb failover disabled" + "set slb failover forcemaster disabled" If server failover used: "set server failover disabled" + "set server failover forcemaster

disabled"

If activeN failover used: 'set activeN failover disabled" + "set activeN failover

forcemaster disabled"

8. Upgrade DX1

Follow steps in DX "Installation and Administration Guide" section "Upgrading the DX Application Acceleration Platform Software"

(5)

9. Move production from DX2 to DX1

a. Enable failover on DX1

o If Unified Failover used: "set failover enabled" o If Unified Failover not used:

If SLB failover used: "set slb failover enabled" If server failover used: "set server failover enabled" If activeN failover used: 'set activeN failover enabled" Note: DX1 is passive and DX2 still master.

b. Enable service on DX1

o If SLB used: "set slb enabled"

o If cluster/forwarder/redirector used: "set server up" o If activeN used: 'set activeN enabled"

Note: traffic is still processed by DX2 master, as DX1 is standby c. Move traffic to DX1

o If Unified Failover used: on DX2 "set failover forcemaster disabled" and on DX2 "set

failover forcemaster enabled"

o If Unified Failover not used: Disable service on DX2

If SLB used: "set slb disabled"

If cluster/forwarder/redirector used: "set server down" If activeN used: 'set activeN disabled"

Re-enable service on DX2 (after 30secs) If SLB used: "set slb enabled"

If cluster/forwarder/redirector used: "set server up" If activeN used: 'set activeN enabled"

Note: Traffic is now processed by DX1 master and DX2 is standby.

10. Put back DX-blade (only if activeN was used)

• Put back DX-blades on all DX activeN groups:

o Release prior to 5.1: "add activeN blade x.x.x.x" + "set activeN group all blade x.x.x.x" o From release 5.1: "set activeN blade x.x.x.x unpaused"