Specifications

For Security ■ J-series Services Routers do not support the authentication order password radius
or password ldap in the edit access profile profile-name authentication-order
command. Instead, use the order radius password or ldap password.
Outstanding Issues
Authentication During user authentication, the firewall authentication table in the output of the
security firewall-authentication users command displays multiple failures even
■
though the network table in the output of show network-access requests statistics
shows successful authentications. [PR/250780]
■ Your attempt to log in to the router from a management device through FTP or
Telnet might fail if you type your username and password in quick succession
before the prompt is displayed, in some operating systems. As a workaround,
type your username and password after getting the prompts. [PR/255024]
Chassis Cluster ■ In a chassis cluster, the show interface terse command on the secondary routing
engine does not display the same details as that of the primary routing engine.
[PR/237982]
■ Because the clear security alg sip call command triggers a SIP RTO to synchronize
sessions in a chassis cluster, use of the command on one node with the node-id,
local, or primary option might result in a SIP call being removed from both nodes.
[PR/263976]
■ In a chassis cluster configuration, after redundancy group 1 fails over to the
secondary node, the statistics for the TCP SYN-ACK-ACK proxy screen are still
displayed for the primary node rather than the secondary. [PR/264790]
■ When a new redundancy group is added to a chassis cluster, the node with lower
priority might be elected as primary when the preempt option is not enabled for
the nodes in the redundancy group. [PR/265340]
■ In a chassis cluster, if you manually fail over redundancy groups to move the
system from active-passive mode to active-active mode during an active call, a
subsequent call transfer involving the endpoints of the existing call might fail.
[PR/265598]
■ When you commit a configuration for a node belonging to a chassis cluster, all
the redundancy groups might fail over to node 0. If graceful protocol restart is
not configured, the failover can destabilize routing protocol adjacencies and
disrupt traffic forwarding. To allow the commit operation to take place without
causing a failover, we recommend that you use the set chassis cluster
heartbeat-threshold 5 command on the cluster. [PR/265801]
■ In a chassis cluster, if a forwarding process restart or system reboot triggers a
cold synchronization during an active SIP call, the call might stay in both routing
nodes even after the endpoints hang up. As a workaround, use the clear security
alg sip call command to clear the call. [PR/267696]
■ In a chassis cluster, a high load of SIP ALG traffic might result in some call leaks
in active resource manager groups and gates on the backup router. [PR/268613]
■ In a chassis cluster, CA certificate enrollment from the secondary Routing Engine
does not work. As a workaround, enroll the CA certificate from the primary
Routing Engine. [PR/278420]
Outstanding Issues ■ 5
Outstanding Issues