Creating a J-series Junos or J-series Junos with Enhanced Services Olive - the easy way

Disclaimer


You cannot put the vmware virtual interfaces into a zone which makes these almost useless.

The jseries code is the same code feature-wise that runs on the new SRX firewall platform (the replacement for all screenos firewalls). The SRX are smoking fast by the way, I mean really fast. You will see a lot of similarities between the branch (low-end srx) and the Jseries.

 
Juniper cannot and does not support running their Junos software in a virtual machine. I use Olives to help me with certifications and my day to day activities.
 

J-series Olive vs Traditional Olive (M&T Series)

Traditional M&T olives should have less functionality that the J-series olives because many features with M&T are off-loaded to special hardware and that hardware is not present. As far I know, all J-series features are done on a generic i386 cpu which you have in vmware so you should have a more complete feeature set. However if you are studying to take a service provider exam, you might want to stick with the traditional olive. If you are taking the enterprise routing certification your best bet is the j-series olive.

I have tried this method with M&T series, but with no luck, looks to get hung on the virtual drive for some reason.
 

Limitations

 
Olive's have limitations on their functionality, I will try to outline the limitations on J-series Olives that I am aware of.
 

Junos ES

- I have not been able to get the firewall fully functional. You must rename interfaces from em0 to ge-0/0/0 or fe-0/0/0 to be able to assign them to a zone, then you are not able to perform packet dumps, in the unix shell or within the Junos cli. You can rename the interfaces within Junos, as such
rename interfaces em0 to ge-0/0/0
commit
 
 

Junos and Junos ES

- The web gui works for the most part but has limitations, mostly due to the ethernet interface types.
 

Prerequisites

 
Tried using the livefs cd from Freebsd, the shell they give you is not good for system recovery, it is missing a lot of comamnds.
- Vmware Workstation (You should be able to use Vmware Server 1.0, you need a vmware version that supports IDE devices, Junos does nto seem to support the vmware scsi drivers) I am using workstation 5.5
- Usb Flash drive greater than 256MB
- Junos or Junos ES Install Media, use the 256MB, these are located under the install bundles and packages.They are labled J-series Install Media 256 or J-series JUNOS with Enhanced Services Install Media 256 (junos-jseries-9.3R2.8-export-cf256.gz for regular Junos and junos-jsr-9.3R2.8-export-cf256.gz for Junos ES). Note you may have issues ssh to the export version, if so upgrade to domestic. Unfortunately there is not domestic image.
- A little bit of time ~45mins

*********************As of Junos 9.4 on the Jseries, traditional packet based Junos has been EOL'ed, the only software that will be available for the Jseries from 9.4 on out will be the flow based screenos replacement JunosES*********************************
 

Getting Started

Uncompress your junos image (junos-jseries-9.3R2.8-export-cf256.gz  or junos-jsr-9.3R2.8-export-cf256.gz) and place the uncompressed image on your usb flash drive.
Download fstab.mr (recommended), this is the new fstab that iwll tell junos how to mount the second harddisk, since we do not have a compact flash.
 
You can also copy and paste the below into a file, but if you are windows make sure you remove the windows newlines
 
 
 fstab.mr
  
 

# Device Mountpoint FStype Options Dump Pass#

/dev/md0 / cd9660 ro 0 0

proc /proc procfs rw 0 0

/dev/ad1s1d /config ufs rw 2 2

#/dev/bo0s1b none swap sw 0 0
  

Create Virtual Machine

 
1.) Create a new "Custom" Virtual Machine
2.) Choose "New - Workstation 5" - this might be different depending on the vmware workstation version
3.) Choose "Other" for your Guest Operating System and FreeBSD as your version
4.) Give it a name and location
5.) Assign one processor and then 512MB of Ram
6.) Set up your networking as whatever you want, probably bridged. If you do not know what to put, read my guide on Vmware Networking, it applies to all vmware networking in terms of concepts.
7.) Scsi adapters does not matter click Next, we are not going ot use SCSI.
8.) Under "Select a Disk" select "Create a new virtual disk"
9.) Disk type should be IDE (default)
10.) Disk size should be 1.0GB, don't check allocate all disk space now
11.) Click finish
12.) Now make sure a usb controller is present, if not install one. If you need to add one, click on the machine and choose settings as shown below
  
Diagram1 
 
13.) Add another 1.0GB IDE hard disk, click on the machine and choose settings as shown below
  
Diagram2 
 
Your vm configuration should look like this
 
Diagram3 
 

 

DD Junos to the 1st virtual disk 

 
14.) Boot the virtual machine with frenzy as the cd, you can either burn the frenzy iso image and put it in your physical cdrom drive or point you virtual machine's cdrom drive to the frenzy iso. When you see the virtual machine bios, press ESC to get a boot drive menu. Let Frenzy boot until you get the prompt
frenzy:~#
 
15.) Plug in your usb flash and give your virtual machine control of your usb drive. Shown below (Diagram4)
 
Diagram4 
 
You should see some info regarding your usb drive on your virtual machine console
 
17.) At the virtual machine command prompt type
frenzy:~# mkdir /mnt/usb
frenzy:~# mount -t msdosfs /dev/da0s1 /mnt/usb
frenzy:~# dd if=/mnt/usb/junos-jseries-9.3R2.8-domestic-cf256 of=/dev/ad0
or if you want Junos ES
frenzy:~# dd if=/mnt/usb/junos-jsr-9.3R2.8-domestic-cf256 of=/dev/ad0
 
Wait around 20 mins, for some reason the dd in the BSD seems to be much slower than in linux. If you wanted you could do the dd part in knoppix, it does save time, even with the reboots. I did frenzy here to Keep It Simple Stupid.
 
After this is finished, you will see /dev/ad0s1a and /dev/ad0s1e, among others. Those two are the important partitions.
 

Set up disk for Junos config files

 
18.) Execute the following
frenzy:~# mount -o rw /  (This allows us to create a dir to mount the new /config partition, where the Junos configs will be stored).
frenzy:~# mkdir /config
frenzy:~#  mount -t ufs /dev/ad0s1a /mnt/tmp
frenzy:~#  cp /mnt/usb/fstab.mr /mnt/tmp/cf/etc/
frenzy:~#  sysinstall
 
Sysinstall will allow you to slice and partition the second IDE drive so that Junos has a place to save its config files. Normally this is a compact flash, but since we don't have one, we are going to have the config files saved to a virtual disk. Also if you want to run multiple olives in a vmware server, its kind of hard to have a bunch of compact flash drives, this is more scalable and easier.
 
19.) In sysinstall menu, go to Configure->Fdisk
We are going to create a slice (BSD term, partition to everyone else)
 
Select ad1 as shown below
 
 
20.) You are now in the fdisk menu, press C to create a new slice and give it a value of 1000M, as shown below
 
 
21.) Leave the partition type at 165
22.) Type W to write changes and answer Yes
23.) In "Install Boot Manager for drive ad1?" select Standard (Install a standard MBR (no boot manager)) and hit OK, as shown below.
 
After you click ok, you are taken back to fdisk and your drive should now look like
 
 
24.) In fdisk type Q, to quit. You are then taken to "Select Drives".
25.) In "Select Drive(s)", select Cancel, as shown below.  You are taken back to "FreeBSD Configuration Menu"
 
 
 
26.) In "FreeBSD Configuration Menu" select Label. You are now in FreeBSD Disklabel Editor.
27.) In "FreeBSD Disklabel Editor" you should see Disk: ad1 Partition name: ad1s1, select C for create and enter 100M and select OK, as shown below. You will now be sent to "Please choose a partition type"
 
 
28.) In  "Please choose a partition type" select FS and select OK. You will now be sent to "Value Required" for the mount point.
29.) In "Value Required" (make sure you ran mkdir /config) enter /config and select OK, You are taken back to the disklabel editor.
30.) In the Disklabel editor, type W, You are prompted for "User Confirmation Requested".
31.) In  "User Confirmation Requested", select Yes. You are sent back to disklabel editor.
32.) In disklabel editor, type Q. You are taken back to "Select Drive(s)".
33.) In "Select Drive(s)" select Cancel. You are sent back to "FreeBSD Configuration Menu", select Exit and press OK. You are sent to "Sysinstall Main Menu"
34.) In "Sysinstall Menu" select Exit Install. You are back to the frenzy command prompt.
35.) At the frenzy command prompt type
frenzy:~# halt
 
Once the system has halted continue to setting your virutal ethernet driver to be E1000
 

Set virtual ethernet device to be E1000

 
36.) Make a  backup and then open up the .vmx file in wordpad for your virtual machine, if there is a .lck file, close the tab that has your vmware machine you just created open. Your .vmx will reside in the same directory as the rest of your virtual machine.
 
Below the line
ethernet0.present = "True"
add
Ethernet0.virtualDev = "e1000"
 
Junos does not recognize the standrard AMD Lance virtual ethernet device, so we will set it to use E1000 (Intel Server)

 

Your config file should look similar to this.
 
Freebsd.vmx
 

config.version = "8"

virtualHW.version = "4"

scsi0.present = "TRUE"

scsi0.virtualDev = "lsilogic"

memsize = "512"

MemAllowAutoScaleDown = "FALSE"

ide0:0.present = "TRUE"

ide0:0.fileName = "OliveJseries1.vmdk"

ide1:0.present = "TRUE"

ide1:0.fileName = "C:\downloads\frenzy-1.1-std-EN.iso"

ide1:0.deviceType = "cdrom-image"

floppy0.present = "FALSE"

ethernet0.present = "TRUE"

Ethernet0.virtualDev = "e1000"

usb.present = "TRUE"

sound.present = "FALSE"

sound.virtualDev = "es1371"

sound.fileName = "-1"

sound.autodetect = "TRUE"

displayName = "OliveJseries"

guestOS = "freebsd"

nvram = "FreeBSD.nvram"

ide0:1.present = "TRUE"

ide0:1.fileName = "Olivejseries2.vmdk"

ide1:0.autodetect = "TRUE"

ide0:0.redo = ""

ide0:1.redo = ""

ethernet0.addressType = "generated"

uuid.location = "56 4d 7a da be 3a 5f 0f-64 8f db c5 b7 22 27 25"

uuid.bios = "56 4d 7a da be 3a 5f 0f-64 8f db c5 b7 22 27 25"

ethernet0.generatedAddress = "00:0c:29:22:27:25"

ethernet0.generatedAddressOffset = "0"

 
  
 
 

Working Olive

 
You now should have a working olive, no need for serial connection, your console will display in the regular vmware console (VGA console). Login with root, no password.
 
I have written other documents on olives, check my blog at http://juniperhacks.wordpress.com/, look under the category olive. Two good articles to look at for setting up a complete mock network in vmware using the host-only/custom networks are
and
 
Comments are appreciated. Have fun and if you are taking a cert, good luck I am right there with ya!
 
 
 
 
 
 
 
 
 

Comments


Anonymous

Pre 9.X code

Thanks, for the tutorial

You can apply interfaces to zones pre-9.X

admin# show security zones
functional-zone management {
interfaces {
em0.0;
}
host-inbound-traffic {
system-services {
all;
telnet {
except;
}
}
}
}
security-zone trust {
interfaces {
em1.0;
}
}
security-zone untrust {
interfaces {
em2.0;
}
}

[edit]
admin# run show version
Model: olive
JUNOS Software Release [8.5R1.14] (Export edition)



Last edited Oct 28, 2009 12:27 AM
Report abusive comment

Anonymous

problem with ad0s1a

Hi,

After following instructions enter command:
dd if=/mnt/usb/junos-jseries-9.1R1.8-domestic of=/dev/ad0
Make sure the process runs well but when process completed, i don't see /dev/ad0s1a , /dev/ad0s1e?how can i impletement?

Best Regards,
Le Quoc Nguyen

Last edited Oct 23, 2009 2:04 PM
Report abusive comment

Anonymous

Problem with the Enhanced image on Olive

Hi,

After following Haim instructions regarding editing fstab.mr file in order to redirect the VM boot order i have managed to load 9.3R4.4 image and have a running Olive machine.
but now due to version 5 compatibility I'm limited to 3 NIC's only, further more the interfaces are named em0, em1 and em2 and i can't use the zones features!
Did someone has managed to overcome these problems?

Best Regards,
Tal

Last edited Oct 5, 2009 6:53 PM
Report abusive comment

Anonymous

No boot with Olive

Hi there,

Thanks for this tutorial !
I followed it step by step but when I reach the final step (halt then restart under Junos), my Olive does not boot.

I get the following logs:
"Loading /boot/loader
No /boot/loader
, next boot from alternate path
Loading /cf/boot/loader
_
BTX loader 1.00 BTX version is 1.02"

I guess the system can't find any acceptable boot loader, but I can't find why, and my knowledge with FreeBSD is quite limited...

Any idea of what could be the cause ?
For information I used the following file: junos-jsr-9.6R1.13-export-cf256
Thanks

Last edited Oct 2, 2009 7:02 AM
Report abusive comment

Anonymous

hi

HI Knol how r u good work really appreciated but the problem is u didn't give Juniper IOS that u mentioned in ur Post it will be really kind of u if u give a download link for the IOS images so it will be really helpful to make a JUNOS image keep it up this great work

Last edited Sep 29, 2009 3:08 AM
Report abusive comment

Anonymous

about Domestic

hi

i prepare to jun 330 and i wat emulator fo enhanced service

i try more and more junos software but its not support es

finally i download junos-jsr-9.4R1.8-domestic.tgz

is it support es cli or it want additional package
???
thanks for help

Last edited Sep 28, 2009 7:32 AM
Report abusive comment

Angelo

Can't DD to /dev/ad0

Hi,

I'm having the same problem as below with another user. I can see /dev/ad0 but it is not mounted nor can I mount it. DD fails with /dev/ad0 invalid argument.

I'm not expert in Unix, any ideas?

Also, I'm trying to load junos-jsr-9.6R1-13-domestic.

Thanks for your fine work!


Cheers

Last edited Sep 15, 2009 9:11 PM
Report abusive comment

Rom1

DD could be faster

Hi,

A little tips for DD to be faster :
Try dd if=/mnt/usb/junos-jseries-9.3R2.8-domestic-cf256 of=/dev/ad0 bs=1M

Thank you very much for your work.

Regards,
Rom

Last edited Sep 6, 2009 6:47 AM
Report abusive comment

Anonymous

J-WEB

hi,

thanks for the detailed steps to install junosES i was waiting for a long time to get that. copule of qus first how to install J-WEB in this setup i tried and get EOF error please advice. sec how to get interface apart from em0 interface i mean g0/0/0 or any other so i can use zone option and actuly test firewall options. third can you help me samulation juniper applience like IC,UAC,WX and stuff can you please guid me for that thanks once again

Last edited Aug 24, 2009 3:43 PM
Report abusive comment

Anonymous

Junos ES olive passes traffic without policy?

Hi!
I've sucessfully set up an olive (9.4R2.9) on a real PC with multiple NICs. Problem is, it works too well, i.e. the olive passes traffic between interfaces without any security policy and with all interfaces being in the default security zone 'Null'. AFAIK, a J-Router needs a security policy and at least one interface in a non-Null-security zone in order to pass traffic.
Is this just my problem or is this a general Olive issue?

Cheers,
Kai


Last edited Jul 11, 2009 8:55 PM
Report abusive comment
1 - 10 of 18   Older comments »   Show all comments
Article rating:
Your rating:

Activity for this knol

This week:

210pageviews

Totals:

6646pageviews
57comments
©2009 Google