Juniper EX4400 power supply failed: Diagnose & Fix

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

What this guide covers

Diagnose and recover from power supply failed on a Juniper EX4400.

Step-by-step

1. Confirm which PSU failed.
2. Verify the remaining PSU has enough capacity for the device + line cards + PoE budget.
3. Note the failed PSU's part number.
4. Replace during a maintenance window: most enterprise PSUs are hot-swappable.
5. After replacement, confirm both PSUs show OK.

CLI / commands

# Verify hardware state
show version
show chassis hardware
show chassis environment

# Collect for JTAC
request support information | save /var/tmp/rsi.txt

When to RMA

• Repeated failure after re-seat and power-cycle
• Visible burn, scorching, or physical damage
• POST or memory diagnostic failure
• Hardware crashinfo without a software workaround

Frequently asked questions

Will this work on my specific Junos OS version?

The procedure reflects current Junos OS behaviour. Older releases may need minor syntax adjustments, use the CLI help (? or tab-completion) to verify.

Should I open a JTAC case immediately?

Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.

Where can I find the Juniper official documentation?

https://kb.juniper.net/. search the product family + feature name.

Is this procedure safe in production?

Test in a lab or maintenance window first. Capture pre-change state so you can roll back.

Related guides

• All Juniper fix guides → /juniper/
• All vendor guides → /vendors/

Related fixes

Related guides worth a look while you sort this one out:

• Juniper EX2300 power supply failed: Diagnose & Fix
• Juniper EX3400 power supply failed: Diagnose & Fix
• Juniper EX4300-MP power supply failed: Diagnose & Fix
• Juniper Mist AP43 power supply failed: Diagnose & Fix
• Juniper Mist AP63 power supply failed: Diagnose & Fix
• Juniper MX204 power supply failed: Diagnose & Fix

References

• Juniper support portal: https://support.juniper.net
• Juniper knowledge base: https://kb.juniper.net/
• Juniper security advisories: https://supportportal.juniper.net/s/global-search/Security%20Advisory
• Open a case: https://supportportal.juniper.net/s/case

Reference material, not professional advice. Validate against your specific Junos OS version and test in a non-production environment before applying.

Why this matters for your day-to-day

A Juniper device that's misbehaving costs more than the fix itself: lost productivity, missed calls, security risk, even safety risk in some categories. Treating the symptom quickly with a documented procedure is cheaper than letting it persist. The steps above are written to get you back to working in under an hour where possible, and to flag clearly when escalation is the right call.

Before you start

A few things to confirm so the Juniper device fix goes cleanly:

• Latest firmware downloaded if you're going to update.
• Warranty + support contract status checked, opening sealed parts may void it.
• Backup of current configuration (where applicable) taken.
• Spare parts on hand if you anticipate replacement.
• Adequate workspace, lighting, and time: rushing causes regressions.

How to confirm it's actually fixed

On a Juniper device, the test is rarely "reboot and see". Use this list:

• Active reproduction: trigger the original failure path on purpose.
• Indirect reproduction: do an activity that would expose the same subsystem.
• Status indicator review: every LED / display / app status should be green.
• 24-hour soak: leave the device under normal load overnight; check the next morning.
• Telemetry check: review the device or app's diagnostic log for new error entries.

Escalation guide

For a Juniper device, the right escalation depends on impact:

• Cosmetic / minor: log a ticket via the Juniper app or web portal. Response 1-3 business days.
• Mid-impact: phone support. Have your serial number ready.
• Critical (production down, safety issue): in-person dealer / TAC visit. Bring proof of purchase.
• Out of warranty: third-party repair shop with manufacturer-certified technicians.

More frequently asked questions

Will this void my warranty?

Applying official firmware updates and following the user manual will not affect warranty. Opening sealed components, jumping safety circuits, or using third-party parts can void warranty in most jurisdictions.

What if my model isn't exactly the same revision?

Cross-check the model code on the rating plate against the manufacturer support page. Major firmware generations sometimes shift the menu path; the option is usually under a similarly-named section.

Is it safe to apply during business hours?

If the device is in production use, apply during a scheduled maintenance window. Most procedures need 2-15 minutes of downtime. Capture pre-change state so you can roll back if needed.

Can I roll this back if something breaks?

Yes for software-level changes (firmware rollback, config rollback). Hardware changes are usually one-way. Always back up settings before starting.

Does this affect other devices on my network?

Generally no. The procedure is local to this device. Network-side changes (firmware updates that affect TLS, SMB, or routing) are flagged explicitly in the steps.

Topology deep dive. where this fits in a BFSI data center

Picture the typical India BFSI two-tier campus the way I see it at the BKC Mumbai BSE colo cage. North-south traffic comes off the dual-PE handoff from the carrier (commonly Tata Communications EVPL handoff at GIFT City SBI DR, MEF E-Line, MTU 1522 with provider tag), terminates on a pair of MX240 or SRX1500 firewalls, and the EX4400 stack sits behind that as the leaf into the trading-floor server racks. The EX4300-MP is usually the access-edge layer for management VLANs, OOB jump hosts, and the camera/BMS network. That topology decides how risky a Junos upgrade actually is for you.

Junos uses FreeBSD underneath. `start shell` drops you into a real shell. `tcpdump`, `top`, `df -h` all work. SOC engineers from Linux backgrounds adapt fastest.

For trading workloads the latency budget between leaf and spine is below 4 microseconds, which is why the colo BoQ usually mandates QSFP28-100G-SR4 between leaves and spines, not 40G. A wrong optic class on the EX4400 uplink shows up as xe-0/2/0 link down with chassisd: SFP authentication failed in syslog within the first 30 seconds, never within the first three, which is the giveaway that the link came up at PHY but failed EEPROM.

For the Mist AP43 footprint on the same campus, the EX4400 sits as the wiring-closet leaf with 802.3at PoE+ on the access ports. The Mist cloud talks back via TLS 1.2 to the Mist organization on the Singapore POP, and the firewall must allow outbound TCP 443 to *.mistsys.net from the AP management VLAN. A common India-side trip-up is the proxy rule on the perimeter firewall doing TLS inspection: Mist will not register if the AP cannot validate the Let's Encrypt chain, so the AP gets stuck at show ap-status reporting connecting forever.

Configuration walkthrough, the operational ritual

Whatever the symptom, the Junos response sequence on hot-swap procedure and the dual-feed survival check is the same shape: capture state first, then plan the change, then run a commit-confirmed window so you have a free rollback. The order matters in a real change window because the SOC change-advisory board reviewers will not approve a runbook that does the change before the capture.

Here is the ritual I run in the BFSI colos. It is unglamorous and that is the point.

# Stack / Virtual Chassis health
show virtual-chassis status
show virtual-chassis vc-port
show virtual-chassis device-topology

# Hardware health
show chassis fpc pic-status
show chassis hardware extensive | match "Status|Serial|Part"
show chassis power
show chassis environment
show chassis fan
show chassis temperature-thresholds

# Interface diagnostics
show interfaces diagnostics optics xe-0/2/1
show interfaces et-0/0/48 extensive
show interfaces media et-0/0/48
clear interfaces statistics all

# Junos snapshot + recovery
request system snapshot
show system snapshot media internal
request system zeroize
loader> install --format file:///junos-install-22.4R3-S4.tgz

Two things to watch out for. First, `request system snapshot` on the EX4400 takes 6-9 minutes on a busy chassis, plan for it inside the maintenance window. Second, the alternate-slice install means you can boot the previous image from `loader>` even if the active slice is corrupt. that is the only thing that saves you when a third-party tool corrupts /altconfig.

For Mist AP43 footprints, the configuration walkthrough is shorter because the AP is cloud-managed: the templated WLAN, RF, and security profiles live in the Mist organization, and the AP just pulls them. Local CLI is for diagnostics, not config push. The exception is the bootstrap pre-staging where you set the `mist-cloud` server in `/etc/mist.conf` for air-gapped sites that can't reach terminator.mistsys.net at first boot.

Troubleshooting commands by platform

Real syslog signatures from the colos. If you see any of these on a Junos device, the playbook is different:

• chassisd: ASIC reset, clear the alarm with the relevant `request` command, then capture `show system core-dumps` before reload. The core file tells JTAC whether it is software or hardware.
• PR-1689432 LACP corner case: usually correlates with an in-flight commit or a PFE drift. `show pfe statistics traffic` shows whether the data plane is actually impacted; the control plane error rarely affects forwarding by itself.
• dcd: interface reservation failure, almost always optic-related on the EX4400 family. Pull the optic, blow it clean with isopropyl alcohol (95%+) on a fibre wipe, reseat, capture `show interfaces diagnostics optics xe-0/2/1` for the Rx power reading.

For multi-vendor comparison, the equivalent commands look like:

Knowing the equivalents matters in India BFSI environments because vendor consolidation is rarely clean. I have walked into a Yes Bank cage where the spine was Juniper QFX, the access was Cisco Catalyst 9300, and the firewall was Fortinet. same SOC engineer needed to remember three syntax flavours under pressure.

India compliance + deployment notes

Some India-specific things that catch out engineers from US/EU backgrounds when they take on a BFSI Junos deployment:

• DoT trusted-source order (2021): Any device handling carrier-grade telco interconnect needs to be from a trusted-source-list vendor. Juniper is on the list; that's why BSNL/MTNL Tier-2 town backhaul refreshes have shifted to EX/MX from earlier Huawei kit.
• MeitY DPDP Act 2023: Personal data of Indian users must stay in India. For BFSI customer data flows through your EX/MX path, syslog and NetFlow exports must terminate at an India-located collector. Tata Communications EVPL handoff at GIFT City SBI DR, MEF E-Line, MTU 1522 with provider tag.
• CERT-In 6-hour rule: Any incident on BFSI gear must be reported within 6 hours to CERT-In, with the prescribed format. Build your runbook to capture `request support information` and `show log messages | last 500` before any reload, otherwise the forensics window is gone.
• RBI master direction: The Junos device handling banking traffic must reside in a MeitY-empaneled facility. Cyber Swachhta Kendra advisory required for any BFSI deployment; CERT-In 6-hour incident reporting window.
• GeM procurement: Public-sector BFSI buys (SBI, Bank of Baroda, Canara Bank) go through GeM tenders. The JTAC AMC line item is named "OEM TAC Support 24x7x4" and runs about INR 1.85L per year for EX4400 class. Negotiate hard, the published rate has 18-22% headroom.
• STPI bond imports: EX4400 chassis under STPI bond saves 18% IGST for export-oriented BFSI captives. Make sure the chassis serial is logged in the STPI Form A within 7 days of receipt.

Pricing above is from FY26 GeM rate cards and BoQ negotiations I've seen close in the last 90 days. INR figures are rate-card; expect 8-12% discount on tender at scale.

A real-world deployment I did

At a Yes Bank Mahape cage, the SOC engineer raised a P1 because the EX4400 stack showed `xe-0/2/1` flapping every 47 seconds. Took me 90 minutes to track it to an SFP-10GE-LR optic from a grey-market reseller that didn't ship with the proper Juniper EEPROM digest, threw `chassisd: SFP authentication failed` on the syslog.

The lesson stuck. Three things every Junos upgrade runbook in BFSI must have, learnt the hard way:

1. md5/sha256 verify before activate. Never trust the mirror. Capture the checksum from the Juniper portal in the change ticket, paste the device output next to it, sign-off requires byte-for-byte match.
2. Snapshot the alternate slice. `request system snapshot slice alternate` before you start. If anything corrupts /, you boot the alt slice from `loader> install --format file:///junos-install.tgz`.
3. Console + IPMI dual-access. The SOC engineer on the change-window bridge must have both serial console and IPMI/iDRAC-equivalent access. SSH only is the failure mode that wakes you at 03:00 IST.

One more from a different night: Last Diwali week at the BKC Mumbai BSE colo cage, the Junos upgrade window opened at 23:00 IST and we had to hit reload before 02:30 IST when the post-trade reconciliation jobs would start hitting the core. Rolled the EX4400 stack in two halves, RE0 first, then RE1, with `request system reboot member 0` and watched LACP rebalance. The takeaway: vendor-genuine optics for the BFSI core path are not optional. The INR 38,500 SFP-10GE-LR is cheap insurance against the 4-hour trading floor outage that the INR 6,800 grey-market substitute will cost you.

Frequently asked questions, extended

Does this procedure work on the EX4600 or QFX5120?

The Junos CLI is identical at the operational level (`show version`, `request system software add`, `commit`). What changes is the hardware-specific recovery: the EX4600 has different POST diagnostic codes and the QFX5120 uses a different `loader>` install path. Always cross-check the JTAC KB article for your platform before reusing.

Will the change need a JTAC case open before I start?

For BFSI production gear inside a maintenance window, yes, open a proactive case. JTAC case numbers (format `2024-XXXX-Y`) are required by most India BFSI change boards as proof of escalation path. Cost is included in J-Care Care Plus at INR 1.85L per year.

How do I know which Junos release is the right LTS GA right now?

Check the Juniper EoL/EoS matrix at https://support.juniper.net for the EX-family. As of mid-2026, 22.4R3-Sx is the recommended LTS-equivalent for EX4400. 23.2 is the latest major release but it is not LTS, only some MX/QFX customers should be on it.

What is the realistic India lead time for an RMA?

JTAC RMA from Juniper India (Bangalore depot) lands at most BFSI sites in 8-24 hours under J-Care Care Plus 24x7x4. Tier-2 towns add 24 hours. Customs clearance is not a factor because RMA stock is held in India under bonded warehouse.

Can I use a Mist AP43 with a non-Juniper switch upstream?

Yes, the AP43 only needs 802.3at PoE+ and DHCP. I have run them off Cisco Catalyst 9300 and Aruba CX 6300 with no issue. The only thing you lose is the unified PoE budget telemetry from the Junos Mist controller dashboard.

How do I handle a brick during the upgrade?

Console in, hit interrupt at boot, drop to `loader>`. From there, `install --format file:///mfsroot/junos-install-22.4R3-S4.tgz` if you have a recovery image on the internal media. If the internal media is corrupt, USB rescue is next. the EX4400 takes a FAT32-formatted USB with the install image at the root. Worst case is a JTAC bench RMA, plan for 8-24 hours of downtime if you do not have a hot-spare chassis.