Juniper EX4400: How to rollback to the previous image after a failed upgrade

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

What this guide covers

Rollback to the previous image after a failed upgrade on a Juniper EX4400 (Junos OS).

Step-by-step

1. Confirm there's a previous image still on flash.
2. Set the boot variable to that previous image.
3. Reboot.
4. Verify the version is back to the prior release.
5. Investigate the upgrade failure separately, do not re-attempt without root cause.

CLI / commands

# Boot recovery prompt: loader>

# Verify image
show version

# Upgrade
request system software add /var/tmp/junos-install.tgz

# Save / commit
commit

# Rollback
rollback 1

Recovery options

• Boot loader recovery (loader>)
• Rollback to the previous image with rollback 1
• Force failover to a known-good standby (HA platforms)

Frequently asked questions

Will this work on my specific Junos OS version?

The procedure reflects current Junos OS behaviour. Older releases may need minor syntax adjustments: use the CLI help (? or tab-completion) to verify.

Should I open a JTAC case immediately?

Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.

Where can I find the Juniper official documentation?

https://kb.juniper.net/, search the product family + feature name.

Is this procedure safe in production?

Test in a lab or maintenance window first. Capture pre-change state so you can roll back.

Related guides

• All Juniper fix guides → /juniper/
• All vendor guides → /vendors/

Related fixes

Related guides worth a look while you sort this one out:

• Juniper EX2300: How to rollback to the previous image after a failed upgrade
• Juniper EX3400: How to rollback to the previous image after a failed upgrade
• Juniper EX4300-MP: How to rollback to the previous image after a failed upgrade
• Juniper Mist AP43: How to rollback to the previous image after a failed upgrade
• Juniper Mist AP63: How to rollback to the previous image after a failed upgrade
• Juniper MX204: How to rollback to the previous image after a failed upgrade

References

• Juniper support portal: https://support.juniper.net
• Juniper knowledge base: https://kb.juniper.net/
• Juniper security advisories: https://supportportal.juniper.net/s/global-search/Security%20Advisory
• Open a case: https://supportportal.juniper.net/s/case

Reference material, not professional advice. Validate against your specific Junos OS version and test in a non-production environment before applying.

What changed recently?

Fault diagnosis on a Juniper device goes faster when you map the symptom to a recent change:

• Did firmware update in the last 7 days?
• Did the network (router, ISP, VPN) change?
• Was the device moved physically?
• Did paired devices (phone, hub, app) update?
• Were any accessories swapped in or out?

The answer narrows the root cause to a manageable subset.

Before you start

A few things to confirm so the Juniper device fix goes cleanly:

• Latest firmware downloaded if you're going to update.
• Warranty + support contract status checked. opening sealed parts may void it.
• Backup of current configuration (where applicable) taken.
• Spare parts on hand if you anticipate replacement.
• Adequate workspace, lighting, and time, rushing causes regressions.

Quick verification

Before you walk away from a Juniper device fix, run through:

1. Reproduce the original trigger: does the issue reappear? 2. Check the device's status / health screen for any new alerts. 3. Confirm paired devices (app, hub, controller) reconnected. 4. Save / commit any configuration changes per the device's normal workflow. 5. Note the change in your maintenance log with date + firmware version.

Escalation guide

For a Juniper device, the right escalation depends on impact:

• Cosmetic / minor: log a ticket via the Juniper app or web portal. Response 1-3 business days.
• Mid-impact: phone support. Have your serial number ready.
• Critical (production down, safety issue): in-person dealer / TAC visit. Bring proof of purchase.
• Out of warranty: third-party repair shop with manufacturer-certified technicians.

More frequently asked questions

Why is this happening on a brand-new unit?

Out-of-box defects do occur. If you've owned the device under 30 days and the symptom persists after a factory reset, escalate to the seller for replacement under DOA terms before opening a manufacturer support case.

Does this affect other devices on my network?

Generally no. The procedure is local to this device. Network-side changes (firmware updates that affect TLS, SMB, or routing) are flagged explicitly in the steps.

What if the fix returns after a reboot?

Persistent fault returns mean either: a hardware fault (escalate), a configuration that's being overwritten by a sync source (check cloud profiles), or a regression in a recent firmware update (rollback).

How often should I run preventive checks?

Quarterly for most consumer devices; monthly for production / commercial devices. Set a calendar reminder so the device stays healthy between issues.

Are there safer alternatives for non-technical users?

Yes, the manufacturer's self-service troubleshooter (HP Smart, LG ThinQ, Samsung Members, similar) usually walks through the same steps in a guided UI. Use that first if you're not comfortable with menu paths.

Topology deep dive. where this fits in a BFSI data center

Picture the typical India BFSI two-tier campus the way I see it at the Hyderabad Hi-Tech City Kotak DC. North-south traffic comes off the dual-PE handoff from the carrier (commonly Reliance Jio Business IP-1 link as the secondary path, BGP AS 55836 announcing /29 customer prefix), terminates on a pair of MX240 or SRX1500 firewalls, and the EX4400 stack sits behind that as the leaf into the trading-floor server racks. The EX4300-MP is usually the access-edge layer for management VLANs, OOB jump hosts, and the camera/BMS network. That topology decides how risky a Junos upgrade actually is for you.

Junos uses FreeBSD underneath. `start shell` drops you into a real shell. `tcpdump`, `top`, `df -h` all work. SOC engineers from Linux backgrounds adapt fastest.

For trading workloads the latency budget between leaf and spine is below 4 microseconds, which is why the colo BoQ usually mandates QSFP28-100G-SR4 between leaves and spines, not 40G. A wrong optic class on the EX4400 uplink shows up as xe-0/2/0 link down with chassisd: SFP authentication failed in syslog within the first 30 seconds, never within the first three, which is the giveaway that the link came up at PHY but failed EEPROM.

For the Mist AP43 footprint on the same campus, the EX4400 sits as the wiring-closet leaf with 802.3at PoE+ on the access ports. The Mist cloud talks back via TLS 1.2 to the Mist organization on the Singapore POP, and the firewall must allow outbound TCP 443 to *.mistsys.net from the AP management VLAN. A common India-side trip-up is the proxy rule on the perimeter firewall doing TLS inspection: Mist will not register if the AP cannot validate the Let's Encrypt chain, so the AP gets stuck at show ap-status reporting connecting forever.

Configuration walkthrough, the operational ritual

Whatever the symptom, the Junos response sequence on `request system software rollback` vs alternate-slice boot is the same shape: capture state first, then plan the change, then run a commit-confirmed window so you have a free rollback. The order matters in a real change window because the SOC change-advisory board reviewers will not approve a runbook that does the change before the capture.

Here is the ritual I run in the BFSI colos. It is unglamorous and that is the point.

# Stack / Virtual Chassis health
show virtual-chassis status
show virtual-chassis vc-port
show virtual-chassis device-topology

# Hardware health
show chassis fpc pic-status
show chassis hardware extensive | match "Status|Serial|Part"
show chassis power
show chassis environment
show chassis fan
show chassis temperature-thresholds

# Interface diagnostics
show interfaces diagnostics optics xe-0/2/1
show interfaces et-0/0/48 extensive
show interfaces media et-0/0/48
clear interfaces statistics all

# Junos snapshot + recovery
request system snapshot
show system snapshot media internal
request system zeroize
loader> install --format file:///junos-install-22.4R3-S4.tgz

Two things to watch out for. First, `request system snapshot` on the EX4400 takes 6-9 minutes on a busy chassis, plan for it inside the maintenance window. Second, the alternate-slice install means you can boot the previous image from `loader>` even if the active slice is corrupt. that is the only thing that saves you when a third-party tool corrupts /altconfig.

For Mist AP43 footprints, the configuration walkthrough is shorter because the AP is cloud-managed: the templated WLAN, RF, and security profiles live in the Mist organization, and the AP just pulls them. Local CLI is for diagnostics, not config push. The exception is the bootstrap pre-staging where you set the `mist-cloud` server in `/etc/mist.conf` for air-gapped sites that can't reach terminator.mistsys.net at first boot.

Troubleshooting commands by platform

Real syslog signatures from the colos. If you see any of these on a Junos device, the playbook is different:

• kernel: panic: vm_page_alloc, clear the alarm with the relevant `request` command, then capture `show system core-dumps` before reload. The core file tells JTAC whether it is software or hardware.
• jbuf overflow detected: usually correlates with an in-flight commit or a PFE drift. `show pfe statistics traffic` shows whether the data plane is actually impacted; the control plane error rarely affects forwarding by itself.
• loader: cannot load /kernel, almost always optic-related on the EX4400 family. Pull the optic, blow it clean with isopropyl alcohol (95%+) on a fibre wipe, reseat, capture `show interfaces diagnostics optics xe-0/2/1` for the Rx power reading.

For multi-vendor comparison, the equivalent commands look like:

Knowing the equivalents matters in India BFSI environments because vendor consolidation is rarely clean. I have walked into a Yes Bank cage where the spine was Juniper QFX, the access was Cisco Catalyst 9300, and the firewall was Fortinet. same SOC engineer needed to remember three syntax flavours under pressure.

India compliance + deployment notes

Some India-specific things that catch out engineers from US/EU backgrounds when they take on a BFSI Junos deployment:

• DoT trusted-source order (2021): Any device handling carrier-grade telco interconnect needs to be from a trusted-source-list vendor. Juniper is on the list; that's why BSNL/MTNL Tier-2 town backhaul refreshes have shifted to EX/MX from earlier Huawei kit.
• MeitY DPDP Act 2023: Personal data of Indian users must stay in India. For BFSI customer data flows through your EX/MX path, syslog and NetFlow exports must terminate at an India-located collector. Reliance Jio Business IP-1 link as the secondary path, BGP AS 55836 announcing /29 customer prefix.
• CERT-In 6-hour rule: Any incident on BFSI gear must be reported within 6 hours to CERT-In, with the prescribed format. Build your runbook to capture `request support information` and `show log messages | last 500` before any reload, otherwise the forensics window is gone.
• RBI master direction: The Junos device handling banking traffic must reside in a MeitY-empaneled facility. GeM tender GEM-2024-LB-019847 for Junos 22.4 LTS, EX4400-48MP at INR 8.4 lakh per unit with 5-year care.
• GeM procurement: Public-sector BFSI buys (SBI, Bank of Baroda, Canara Bank) go through GeM tenders. The JTAC AMC line item is named "OEM TAC Support 24x7x4" and runs about INR 1.85L per year for EX4400 class. Negotiate hard, the published rate has 18-22% headroom.
• STPI bond imports: EX4400 chassis under STPI bond saves 18% IGST for export-oriented BFSI captives. Make sure the chassis serial is logged in the STPI Form A within 7 days of receipt.

Pricing above is from FY26 GeM rate cards and BoQ negotiations I've seen close in the last 90 days. INR figures are rate-card; expect 8-12% discount on tender at scale.

A real-world deployment I did

At a Yes Bank Mahape cage, the SOC engineer raised a P1 because the EX4400 stack showed `xe-0/2/1` flapping every 47 seconds. Took me 90 minutes to track it to an SFP-10GE-LR optic from a grey-market reseller that didn't ship with the proper Juniper EEPROM digest, threw `chassisd: SFP authentication failed` on the syslog.

The lesson stuck. Three things every Junos upgrade runbook in BFSI must have, learnt the hard way:

1. md5/sha256 verify before activate. Never trust the mirror. Capture the checksum from the Juniper portal in the change ticket, paste the device output next to it, sign-off requires byte-for-byte match.
2. Snapshot the alternate slice. `request system snapshot slice alternate` before you start. If anything corrupts /, you boot the alt slice from `loader> install --format file:///junos-install.tgz`.
3. Console + IPMI dual-access. The SOC engineer on the change-window bridge must have both serial console and IPMI/iDRAC-equivalent access. SSH only is the failure mode that wakes you at 03:00 IST.

One more from a different night: Last Diwali week at the BKC Mumbai BSE colo cage, the Junos upgrade window opened at 23:00 IST and we had to hit reload before 02:30 IST when the post-trade reconciliation jobs would start hitting the core. Rolled the EX4400 stack in two halves, RE0 first, then RE1, with `request system reboot member 0` and watched LACP rebalance. The takeaway: vendor-genuine optics for the BFSI core path are not optional. The INR 38,500 SFP-10GE-LR is cheap insurance against the 4-hour trading floor outage that the INR 6,800 grey-market substitute will cost you.

Frequently asked questions, extended

Does this procedure work on the EX4600 or QFX5120?

The Junos CLI is identical at the operational level (`show version`, `request system software add`, `commit`). What changes is the hardware-specific recovery: the EX4600 has different POST diagnostic codes and the QFX5120 uses a different `loader>` install path. Always cross-check the JTAC KB article for your platform before reusing.

Will the change need a JTAC case open before I start?

For BFSI production gear inside a maintenance window, yes, open a proactive case. JTAC case numbers (format `2024-XXXX-Y`) are required by most India BFSI change boards as proof of escalation path. Cost is included in J-Care Care Plus at INR 1.85L per year.

How do I know which Junos release is the right LTS GA right now?

Check the Juniper EoL/EoS matrix at https://support.juniper.net for the EX-family. As of mid-2026, 22.4R3-Sx is the recommended LTS-equivalent for EX4400. 23.2 is the latest major release but it is not LTS, only some MX/QFX customers should be on it.

What is the realistic India lead time for an RMA?

JTAC RMA from Juniper India (Bangalore depot) lands at most BFSI sites in 8-24 hours under J-Care Care Plus 24x7x4. Tier-2 towns add 24 hours. Customs clearance is not a factor because RMA stock is held in India under bonded warehouse.

Can I use a Mist AP43 with a non-Juniper switch upstream?

Yes, the AP43 only needs 802.3at PoE+ and DHCP. I have run them off Cisco Catalyst 9300 and Aruba CX 6300 with no issue. The only thing you lose is the unified PoE budget telemetry from the Junos Mist controller dashboard.

How do I handle a brick during the upgrade?

Console in, hit interrupt at boot, drop to `loader>`. From there, `install --format file:///mfsroot/junos-install-22.4R3-S4.tgz` if you have a recovery image on the internal media. If the internal media is corrupt, USB rescue is next. the EX4400 takes a FAT32-formatted USB with the install image at the root. Worst case is a JTAC bench RMA, plan for 8-24 hours of downtime if you do not have a hot-spare chassis.