HowToFixMe
Cable & Optic Selection

Juniper: 100G QSFP28 PSM4 vs CWDM4 vs LR4

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance
VendorJuniper
Operating systemJunos OS
CategoryCable & Optic Selection
Skill levelIntermediate to advanced
DIY-able?Yes with CLI access; some scenarios need JTAC + RMA.

Quick answer

PSM4 (500 m parallel SMF). CWDM4 (2 km WDM SMF). LR4 (10 km SMF).

How to pick the right cable / optic

  1. Identify the link speed (1G / 10G / 25G / 40G / 100G).
  2. Identify the distance (in-rack, in-room, cross-building, long-haul).
  3. Identify the connector type on each end (RJ-45, LC, MPO, QSFP).
  4. Check the Juniper supported transceiver matrix for your platform.
  5. Use OEM-branded for production; third-party for lab or non-critical.

CLI to verify installed optics

show interfaces terse
show interfaces ge-0/0/0 extensive

Frequently asked questions

Will this work on my specific Junos OS version?

The procedure reflects current Junos OS behaviour. Older releases may need minor syntax adjustments: use the CLI help (? or tab-completion) to verify.

Should I open a JTAC case immediately?

Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.

Where can I find the Juniper official documentation?

https://kb.juniper.net/, search the product family + feature name.

Is this procedure safe in production?

Test in a lab or maintenance window first. Capture pre-change state so you can roll back.

Related guides worth a look while you sort this one out:

References

Reference material, not professional advice. Validate against your specific Junos OS version and test in a non-production environment before applying.

Common patterns we see

When this symptom shows up on a Juniper: device, three patterns repeat:

1. Recent firmware update changed behavior. the symptom started within a week of an OTA push. Rollback or wait for the hotfix. 2. Environmental trigger, temperature, humidity, line voltage, network changes. Look at what changed in the environment. 3. Cumulative wear: components like batteries, gaskets, fans degrade over time. Replace the consumable rather than chasing a software fix.

Knowing which pattern applies saves time on the wrong fix.

Before you start

A few things to confirm so the Juniper: device fix goes cleanly:

Verification checklist

After applying the fix on your Juniper: device, confirm:

Escalation guide

For a Juniper: device, the right escalation depends on impact:

More frequently asked questions

Will this void my warranty?

Applying official firmware updates and following the user manual will not affect warranty. Opening sealed components, jumping safety circuits, or using third-party parts can void warranty in most jurisdictions.

Should I update firmware first or last?

Update firmware first if a release note specifically mentions your symptom. Otherwise, finish the troubleshooting flow first, then update; that way you can isolate whether the update or the underlying fix solved it.

Is it safe to apply during business hours?

If the device is in production use, apply during a scheduled maintenance window. Most procedures need 2-15 minutes of downtime. Capture pre-change state so you can roll back if needed.

How often should I run preventive checks?

Quarterly for most consumer devices; monthly for production / commercial devices. Set a calendar reminder so the device stays healthy between issues.

What if the fix returns after a reboot?

Persistent fault returns mean either: a hardware fault (escalate), a configuration that's being overwritten by a sync source (check cloud profiles), or a regression in a recent firmware update (rollback).

Topology deep dive

Around 70 percent of the Juniper QFX optics kit I run lives inside BFSI cages at the BKC and Mahape data centers in Mumbai. The standard build is a redundant pair on the perimeter with a third unit on the colo reserve rack for hardware swap, all under a NOC at Powai. The way you think about juniper: 100g qsfp28 psm4 vs cwdm4 vs lr4 on a Juniper QFX optics changes once you have actually wired one into a production fabric. Drawings on Visio hide a lot of cable mess. Reality bites at the patch panel.

On a typical India BFSI rollout I see three reference designs come up again and again. Design A: single QFX optics chassis with two diverse WAN uplinks, one to a state-run carrier (BSNL or MTNL for the mandatory leg, often demanded by SEBI guidance) and one to a private carrier (Airtel, Jio, Tata Comm). The second leg is the working leg; the BSNL/MTNL leg is the regulatory leg. The Juniper unit sees both as equal-cost paths.

Design B: HA pair of QFX optics, each in a separate row of the same hall, cross-cabled with two short DAC heartbeats and one fiber data sync. This is what I deploy when the customer signs a four-hour RTO clause in their RFP. Heartbeat goes through a dedicated VLAN that never touches the production fabric.

Design C: three-tier with QFX optics as the perimeter, followed by a separate north-south firewall layer and then the core. I use this for retail brokers connected to BSE and NSE, where the order gateway must be on a known IP and the perimeter does only stateless filtering plus rate limiting. Anything stateful happens one tier deeper.

Power planning matters more than people admit. A QFX optics at full load can draw 350-700 watts per PSU. In a Pune cage at 45 paise per unit commercial tariff, that adds up to roughly INR 7,000-8,000 a month per chassis just for primary power, before the cooling adder. Multiply by two for HA and you have an OPEX line worth defending in the AMC quote.

Configuration walkthrough

For juniper: 100g qsfp28 psm4 vs cwdm4 vs lr4, the Juniper QFX optics config I drop in by default looks like this. It is the version we use for an Indian BFSI cage with IST clock and an NPL NTP server at 14.139.60.103 (the National Physical Laboratory primary; it is the regulator-friendly reference). Adjust addresses to your fabric.

system {
    host-name srx-bfsi-mum-01;
    time-zone Asia/Kolkata;
    ntp { server 14.139.60.103; }
}
interfaces {
    ge-0/0/0 { description "ToAirtel-MPLS"; unit 0 { family inet { address 10.10.20.2/30; } } }
    reth0 { redundant-ether-options { redundancy-group 1; } }
}
security {
    policies from-zone trust to-zone untrust {
        policy DC-to-Branch { match { source-address any; destination-address any; application any; } then { permit; } }
    }
}

The bit that catches people is the trust-enable on Huawei vs security zone binding on Junos. Both serve the same purpose; you cannot pass traffic until the interface is bound to a zone with the right action set. I have seen a fresh QFX optics sit for two days before someone realised the security policy was empty and the chassis was silently dropping packets at zone boundaries.

After committing, verify with:

show security policies
show interfaces terse
show route summary

On Junos, the first command shows you the policy hit counters. If they read zero an hour after cut-over, the traffic is not arriving; go back and check VLAN tagging on the upstream switch. I do this check within five minutes of cut-over because BFSI change windows are tight and rollback is a phone call I do not enjoy making.

Troubleshooting commands by platform

This is my muscle-memory set on Juniper QFX optics (Junos). I run them in this order on every incident bridge so the JTAC engineer gets the same artefact set every time. Saves 30 minutes of back-and-forth.

CommandWhat it tells you
show versionRunning Junos image, model, uptime, last reboot reason.
show chassis hardwareInventory of FPCs, PICs, PSUs, fan trays, and serial numbers.
show log messages | last 200Tail of the on-box log; first place I look for FPC or PFE crashes.
show interfaces terseOperational state per IFL; check input-error and link-flap counts.
show route summaryPer-table prefix counts; useful to spot an aggregator that vanished.
show security policies hit-countPolicy match counters; zero hits after cut-over means the wrong zone.
request support informationOne-shot bundle for JTAC cases; attach before opening an SR.

One habit worth copying: pipe the output to a USB stick or a TFTP server before you reboot. On a hard reload the on-box buffer is lost and you lose the very evidence JTAC will ask for first. On Junos I script request support information | save tftp://10.0.0.5/qfx optics-rsi.txt and run it as part of my pre-change checklist, every time.

India compliance and deployment notes

If you are buying a Juniper QFX optics on a government RFP, the GeM portal is the default route. List prices on GeM run 8-15 percent above the partner-quoted price for the same SKU, but you avoid the L1 audit on a direct PO. For a Juniper QFX optics in a typical 3-year AMC, expect a 17.65 percent year-over-year escalation on labour and a flat material rate.

The INR 85,000 figure above is the annualised support renewal for a single QFX optics chassis on a 3-year SmartNet-equivalent at 8x5xNBD, India support, including software updates. 24x7x4 with on-site response pushes that by 35-45 percent. For a BFSI customer running RBI's IT Outsourcing Master Direction, 24x7x4 is mandatory on any device in the critical payment path.

Under MeitY's DPDP Act (Digital Personal Data Protection, in force from 2025), logs that include personal data must be retained inside Indian borders. I push customers to ship syslog from the QFX optics to a local SIEM (Splunk on prem, or QRadar at a CtrlS data center) rather than a foreign cloud collector. Cross-border telemetry from the management interface is a separate question; if you turn on cloud analytics, document the data-flow in your DPIA.

RoHS, BIS, and WPC certifications are checked at customs. For a wireless variant of the QFX optics, the WPC Saral-Sanchar approval number must appear on the packing list or the consignment sits at the Bombay Custom House at JNPT until you produce it. I have lost two days to this; do not be me.

BSNL and MTNL accept Juniper kit on their approved-vendor list as of the last DOT circular I read; Airtel, Jio, and Tata Comm are vendor-neutral. That matters for the carrier handoff. The BFSI spine-leaf fabric, Mumbai I work with mostly does an Ethernet handoff with VLAN tag, and the QFX optics terminates the tag directly on a sub-interface.

Real-world deployment I did

I rolled out 14 Juniper QFX optics units for a retail brokerage customer with branches across Hyderabad, Vijayawada, and Vizag last quarter. Each branch needed a perimeter unit, dual ISP (Airtel primary, ACT secondary on a metro Ethernet handoff), and centralised management from the Mumbai NOC.

The bit that ate the most time was not the QFX optics configuration: that is a templated NETCONF push and a junior engineer can do it. The bit that ate time was the handoff with the carriers. ACT in particular hands off with a static-IP /30 and no BGP option on the metro tier; that constrains your HA design. We landed on a VRRP pair on the QFX optics with a tracked default route. Works fine, but the design choice has to happen before the PO goes out, not after.

End-state: branches up in 11 working days, AMC signed at INR 1.65 lakh per chassis per year for the QFX optics fleet, and a single Mist / Security Director console for ops. The customer is happy because the P1 ticket count dropped from roughly 18 a month to 3.

Extended FAQs

What does a Juniper QFX optics draw at idle vs full load?

Idle on a single PSU, around 180-220 watts. Full load with all ports lit and SSL inspection on, 350-700 watts depending on chassis size. Plan for the upper number in your rack power budget; running hot is what kills PSU lifetime first.

Can I mix Juniper QFX optics with another vendor in HA?

No. HA pairs must be the same chassis family and the same Junos release. You can have a different vendor at the next tier (a Cisco core upstream, an Arista leaf downstream), but the HA peer must be the same SKU. I have tried mixing major releases inside a pair and it half-worked. Half-working is worse than not working in a BFSI cage.

What is the realistic MTBF in an Indian data center?

Vendor spec sheets quote 200,000-400,000 hours. Real-world in a clean cage at CtrlS Hyderabad or NetMagic Mumbai, I see roughly one PSU failure per 50 units per year, one fan tray per 80 units per year, and one chassis logic-board failure per 200 units per year. Plan sparing accordingly: a single hot-spare per 25 chassis is my rule.

Do I need an India-based JTAC entitlement?

Yes if you want phone support in IST and an India-language engineer on the case. The default routing for SmartNet-equivalent contracts without the India tag will land you in a Manila or San Jose queue, and the time-to-engineer is roughly 4x slower for a P2 case.

What is the right way to back up the config?

SCP to an in-cage Linux box on a management VLAN, then rsync to two geographically separate locations. Email or web UI export is a snapshot, not a backup. I have lost a config once to a UI export that silently truncated; never trust the browser as a backup tool.

How long does an in-place Junos upgrade actually take?

On a QFX optics, plan for 35-50 minutes wall-clock for a non-HA chassis, including pre-checks, image transfer at 1 Gbps from local SCP, reload, and post-checks. On HA, add 15 minutes for the controlled failover. I never schedule a maintenance window shorter than 90 minutes for an upgrade on this class; if it goes well, you finish early and write the report. If it does not, you have time to roll back.