ARM Blog

Recently I got an old Juniper SSG5 router which was taken out of service. The unit itself dates back from 2010 and never received updates while it was operational. Before taking it into production again I want to make sure that the firmware is up-to-date.

Prerequisites:
Before we can start updating the unit we need to download the firmware. Since the device is EOL we can download the firmware free of charge (but requires you to register once). You can find the download page here.

Although not required, a TFTP server is needed to save the initial configuration and load the new firmware from. In this guide I assume that a TFTP server is available in the network. In this guide my TFTP server listens on IP-address 192.168.0.75.

If you are going to upgrade from a firmware earlier than the 6.3 release you need to download a new key file as well which holds the MD5 checksums for the new images.

Factory resetting the switch:
As this unit came out of production it holds a certain configuration and password I don’t know. So in order to use the device we need to reset it to the factory defaults first. With a paperclip you can reset the device (reset button is on the back) as follows:

1: While the device is running press and hold the reset button for ~6 seconds and release
2: Wait ~2 seconds
3: Press the reset button again for around ~6 seconds and release

The unit should now reboot and restore the factory image into flash. This may take up to 5 minutes to finish.

If you already have this unit in production do not perform these steps as it will wipe your entire configuration!

Logging in on the switch:
The switch has a serial console port which is the most convenient way to administer it. It is also possible to use telnet and/or SSH to log in but it has to be enabled manually per port on the device and is by default disabled.

The console settings are 9600baud 8N1 with no flow control.

The default username and password are both “netscreen“. When logged in successfully you will see the following prompt:
login: netscreen
password:
ssg5-serial->

Checking the current software version:
When logged in to the switch perform the following command to see the current version:

ssg5-serial-> get system
Product Name: SSG5-Serial
Serial Number: 0162122010003603, Control Number: 00000000
Hardware Version: 0710(0)-(00), FPGA checksum: 00000000, VLAN1 IP (0.0.0.0)
Flash Type: Samsung
Software Version: 6.2.0r5.0, Type: Firewall+VPN
Feature: AV-K
Compiled by build_master at: Thu Jan 28 11:42:26 PST 2010
Base Mac: 28c0.dae8.e140
File Name: ssg5ssg20.6.2.0r5.0, Checksum: 23364b4e
, Total Memory: 256MB

There is more output to be shown, you can press CONTROL + C to cancel the listing.

Saving the configuration:
This step is only needed when you already have the device in production. If you have just factory reset the device this step can be skipped.

When logged in to the console enter the following to save the configuration:
save config to tftp 192.168.0.75 ssg5_31-8-2016.cfg

This will save the current configuration with filename “ssg5_31-8-2016.cfg” to the TFTP server running on 192.168.0.75. If this goes well you should see:
Read the current config.
Save configurations (4935 bytes) to ssg5_31-8-2016.cfg on TFTP server 192.168.0.75.
!!!!!!!!!!!!!!!!!!!!!!
tftp transferred records = 10
tftp success!

TFTP Succeeded
ssg5-serial->

Preparing the firware:
The latest firmware for the SSG5 as of writing is version 6.3.0r22. You should have a file called “ssg5ssg20.6.3.0r22.0.zip”. Unzip the contents of the zip into your TFTP directory (usually /srv/tftp/).

Optionally you may have a bootloader update as well as I had to update as well. You will also have a file called “Loadssg5ssg20v132.d.zip” which needs to be unzipped in the TFTP directory as well.

Updating the firmware:
If you want to update the firmware and are coming from a release before 6.3 you need to update the image MD5 keys first. Make sure you have extracted the zip file containing the keys in your TFTP directory. After unzipping you will have a “imagekey.cer” file that we need to flash first.

You may want to check the keys installed first. you can do this with:
ssg5-serial-> exec pki test skey
exec pki test .
Flash base = 0x51000000, Flash end = 0x0, sector size= 0x4000

KEY1 N/A len =432
308201ac02010002818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f800

KEY2 N/A len =432
308201ac02010002818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f800

KEY3 N/A len =432
308201ac02010002818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f800

You see that the string starts with 308201ac. It’s eigth character is a c which indicates that you have a firmware prior to 6.3 running and you have to update the keys first. Firmware releases in the 6.3 branch have the c replaced with a d.