Alright, I have tried to boot different files from the SRX series, EX series, and EX MP series switches.
As long as a USB stick is formatted as FAT32, uBoot will mount the USB stick and allow you to look at files and make some minor changes.
I tried copying over the kernel file from the jinstall-ex-4300-21.4R3-S10.9.tgz which is a PowerPC or cisco 4500 32-bit ELF file.
After connecting the USB stick, I ran the following commands to load the kernel into memory and try to boot the switch using the ELF file:
I have tried similar things with other ELF images from SRX and MP switches, all with similar results.
I then tried to use the loader file from the SRX switches to see if I could at least get that loaded and try to update the software. I copied over the loader file and ran the following commands:
I tried various uBoot images that I found in the tar files of all the different types of switches, but I never did find one that would work.
I took a look at possibly paying for a support ticket with Juniper, but I saw the price was around $1K, and since these switches are EOL, there is no guarantee that they would even try to help. But even if they did, there is no guarantee that they would be able to help me to solve the problem.
At this point, unless someone has any other suggestions, I plan to cut my losses and just toss these into the dumpster (e-waste properly).
Thank you all for your help with this. I hope that if someone else runs into this problem this post may help them out.
Original Message:
Sent: 05-11-2025 19:19
From: KEN HARVEY
Subject: EX4300-48T Password Reset on WindRiver Linux 6.0.0.21
I have made a little more progress, but not much.
First, what I tried and that didn't work:
I fired up one of my other 4300's and created a backup USB drive. The problem that I ran into though, is I could not get the switch to boot off of the USB stick. I am still trying to download the EX4300-MP image to try and see if that works any better.
I have finally been able to gain access to the command prompt on the switch. I found the info by opening the switch up and pulling out the flash module installed. The pin out of the flash module matched that of USB headers on a PC motherboard. So I installed the flash module onto a spare computer...you know just in case, and powered the PC up , and I was able to mount the drives (5 in total) to examine them. Digging through the files I found different boot options that I could execute in uBoot.
To gain access to the shell I did the following:
- Connect a console cable to the switch
- Power cycle the switch
- Press Ctrl+c repeatedly until I made it to the uBoot prompt =>
- At the uBoot prompt type in printenv
- Note down the bootargs section it should look something like this bootargs=root=LABEL=ROOT rw console=ttyS0,9600n8 quiet usbcore.autosuspend=-1 memmap=64M$0x40000000
- Change the bootargs parameter by entering setenv bootargs root=LABEL=ROOT rw console=ttyS0,9600n8 shell usbcore.autosuspend=-1 memmap=64M$0x40000000
Please note that you have to replace the = directly after bootargs with a space, and that you have to replace quiet with shell - To boot the switch, type in boot
This will boot the switch into a temp Linux OS and dump you out at a shell prompt. This is just an expanded initrd.cpio found on the first partition of the flash partition. So that means that any changes you make at this prompt will not be saved past a reboot.
To make changes, you have to chroot into the OS on the switch:
- Mount the 3rd partition which appears to be the actual switch OS by running mount /dev/sda3 /mnt
- Load the OS by using chroot by running chroot /mnt
- Add a new user to the switch by running useradd me
- Change the password to your new user by running passwd me
- Add the new user to the super user group by running usermod -a -G superuser me
- Next we need to exit the chroot and finish booting the switch by type in exit twice
Then the switch will finish booting, and you can sign into the switch with your new username and password.
Now I am to the next part that I am stuck on. Once I am signed on, and I run cli this is all that I get:
localhost:~$ cli> ? d [device-name] Establish the CLI session>
I don't know what to do with the device name. I would love to wipe this switch and completely start over, but I don't know how to proceed. Every thing that I enter into the > prompt, just display the d [device-name]. To actually exit the prompt, I have to enter in d something and then exit.
localhost:~$ cli> ? d [device-name] Establish the CLI session> exit d [device-name] Establish the CLI session> d exit exit> exitExiting CLIlocalhost:~$ uname -aLinux localhost 3.10.62-ltsi-WR6.0.0.21_standard #1 SMP PREEMPT Fri Nov 10 02:13:55 PST 2017 ppc ppc ppc GNU/Linuxlocalhost:~$
It appears that this is running the Wind River Linux still. When I dig around the OS, I found some info about how it has a snos_3.3R1.1.ppc package. I don't really know what this is yet.
So as of right now, I have access to the shell on the switch, but I can't do anything with the switch. And I still haven't figured out how to boot a USB stick on the switch.
Any suggestions on next steps?
------------------------------
KEN HARVEY
Original Message:
Sent: 05-08-2025 19:52
From: spuluka
Subject: EX4300-48T Password Reset on WindRiver Linux 6.0.0.21
I see in the ex download area there is no img file with the standard ex-4300 but the EX4300 MULTIGIGABIT does have that USB img file.
This might be worth a try.
------------------------------
Steve Puluka BSEET - Juniper Ambassador
IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP - Retired)
http://puluka.com/home
Original Message:
Sent: 05-07-2025 11:16
From: KEN HARVEY
Subject: EX4300-48T Password Reset on WindRiver Linux 6.0.0.21
Thank you for your response.
I read through the link that you gave, and I have not been able to find an .img file in the downloads for the EX4300. I have extracted the tar files that I was able to download, and there are no .img files for me to copy over to a USB stick. It appears that the EX4300 files are just the straight OS, and not actually packaged into anything.
I tried searching for information on how to update the EX4300 and everything that I have found thus far says that I need to make it to the loader prompt and copy over the tar file and install it that way. But since I am unable to make it to the loader prompt, I am back at square one.
Is there documentation somewhere for creating a bootable USB that works with the EX4300 files?
Is there another way to do the install?
A lot of the documentation says that I need to select boot from USB from the boot menu, which I still do not have access to. But there is a command in the Uboot prompt called usbboot which I hope will actually boot from the USB.
------------------------------
KEN HARVEY
Original Message:
Sent: 05-06-2025 19:26
From: spuluka
Subject: EX4300-48T Password Reset on WindRiver Linux 6.0.0.21
Another option would be to download the install media for your model and create a bootable USB drive to do a fresh format install.
https://supportportal.juniper.net/s/article/EX-How-to-format-install-EX2300s-and-EX3400s-via-USB?language=en_US
------------------------------
Steve Puluka BSEET - Juniper Ambassador
IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP - Retired)
http://puluka.com/home
Original Message:
Sent: 05-06-2025 17:54
From: KEN HARVEY
Subject: EX4300-48T Password Reset on WindRiver Linux 6.0.0.21
I have acquired a couple of EX4300-48T switches from an auction, and I am attempting to reset the root password on the switches so that I can wipe the configs and rebuild them.
I have tried searching the forum and the documentation, and everything that I have found says that I need to get to the loader> prompt to boot into single user mode to reset the password Junos. Or I need to get into the grub menu to make changes to reset the password from there QFX. Or I need to select an option from the boot menu to reset the password 48MP.
The problem that I have is none of those options exist on these switches. The only thing that I have been able to do is access the U-Boot prompt => and make changes to environment variables to no avail.
I have tried booting the system multiple times pressing different keys trying to get a different menu. I have tried [space bar] as per the Junos documentation, I have tried e based on the QFX documentation. I have tried [esc]. And I have tried Ctrl-c which is how I found the U-Boot prompt. I have waited until after the U-Boot prompt and pressed Ctrl-C and I still have been unable to find a different menu.
I did find one thread that I was hopeful for Set unattend environment variable
But setting the environment variable and booting did not work either.
setenv boot_unattended
I have also tried using the LED screen to reset to factory defaults. But the LED screens are blank, even after pressing either the menu button or the ENTER button. I have also tried holding down each of the buttons in different combinations for different times, but the LED stays blank. During bootup, the LED screen does turn on, but it just displays gibberish.
Here is the boot sequence of one of these switches:
U-Boot 2011.06 (Jun 19 2013 - 20:41:32), Build: jenkins-DEV_X_132_X50_BRANCH-exdc-42Flash: Bank 1 is activeswitch bank[0]->bank[1]U-Boot 2011.12-00062-gf837a99 (Jul 11 2014 - 13:47:59)CPU0: P20BJE, Version: 1.1, (0x82190111)Core: E500MC, Version: 2.2, (0x80230022)Clock Configuration:CPU0:1500 MHz, CPU1:1500 MHz, CCB:600 MHz,DDR:600 MHz (1200 MT/s data rate) (Asynchronous), LBC:75 MHzFMAN1: 500 MHzPME: 300 MHzL1: D-cache 32 kB enabledI-cache 32 kB enabledReset Configuration Word (RCW):00000000: 4c580000 00000000 1e140000 0044000000000010: 648e20c1 ffc02000 fe000000 4100000000000020: 00000000 00000000 00000000 f05b410100000030: 00000000 00000000 00000000 00000000Board: EX4300-48T 6.10EPLD: Version 10.0 (0x88)I2C: readyDRAM: InitializingDetected UDIMM TS256MLK72V3N DDR: 2 GiB (DDR3, 64-bit, CL=8, ECC on)FLASH bank: 1Flash: 8 MiBL2: 128 KB enabledCorenet Platform Cache: 1024 KB enabledSERDES: bank 2 disabledSERDES: bank 3 disabledPCIe2: Root Complex, x2, regs @ 0xfe201000PCIe2: Bus 00 - 01In: serialOut: serialErr: serialFirmware Version: 02.00.00Net: Initializing FmanHardcoded FMAN at 0x3ff935c4Fman1: Uploading microcode version 101.8.0FM1@DTSEC1 [PRIME]USB: Register 10011 NbrPorts 1USB EHCI 1.00Register 10011 NbrPorts 1USB EHCI 1.00scanning bus for devices... Root Hub 0: 2 USB Device(s) foundRoot Hub 1: 1 USB Device(s) foundscanning bus for storage devices... 1 Storage Device(s) foundreading uimage.bin5418749 bytes readreading EX4300T.dtb31901 bytes readreading ramdisk.ub14625773 bytes readWARNING: adjusting available memory to 30000000## Booting kernel from Legacy Image at 01000000 ...Image Name: Linux-3.10.62-ltsi-WR6.0.0.21_stImage Type: PowerPC Linux Kernel Image (gzip compressed)Data Size: 5418685 Bytes = 5.2 MiBLoad Address: 00000000Entry Point: 00000000Verifying Checksum ... OK## Loading init Ramdisk from Legacy Image at 03000000 ...Image Name: ramdiskImage Type: PowerPC Linux RAMDisk Image (gzip compressed)Data Size: 14625709 Bytes = 13.9 MiBLoad Address: 40000000Entry Point: 00000000Verifying Checksum ... OK## Flattened Device Tree blob at 02000000Booting using the fdt blob at 0x02000000Uncompressing Kernel Image ... OKreserving fdt memory region: addr=40000000 size=4000000Loading Ramdisk to 2f20d000, end 2ffffbad ... OKLoading Device Tree to 03fe5000, end 03fffc9c ... OKsetup_arch: bootmemarch: exitFreescale FM module (Nov 10 2017:02:12:44), FMD API version 21.1.0Freescale FM Ports module (Nov 10 2017:02:12:44)First Level Bootstrap using initramfs...sd 0:0:0:0: [sda] No Caching mode page foundsd 0:0:0:0: [sda] Assuming drive cache: write throughsd 0:0:0:0: [sda] No Caching mode page foundsd 0:0:0:0: [sda] Assuming drive cache: write throughsd 0:0:0:0: [sda] No Caching mode page foundsd 0:0:0:0: [sda] Assuming drive cache: write throughMounting boot device LABEL=LINUX-BOOTUnpacking initrd.cpio.gz ....496969 blocksUnmount boot device LABEL=LINUX-BOOTINIT: Mouting VAR to /varStarting udevrunning pre rc steps on EX4300-48TExecuting application pre-initilizationStarting monit daemon with http interface at [localhost:2812]/usr/sbin/app_pre_init: line 97: dmidecode: command not found[ OK ] Application Pre initialization.Wind River Linux 6.0.0.21Starting Bootlog daemon: bootlogd.ault.rp_filter = 1net.ipv4.conf.all.rp_filter = 1kernel.core_pattern = |/etc/init.d/zipcore.sh /var/tmp/corefiles/ %h.%e.%p.%t.core %ehwclock: Timed out waiting for time change.localhost login: nlevel: 3starting rsyslogd ... donedone.rk interfaces... done.Restoring archived files to /var/log ...hwclock: Timed out waiting for time change.ware Clock does not contain a valid time, so we cannot set the System Time from it.Unable to set system clock.starting rsyslogd ... doneBooting normal on EX4300-48TExecuting /usr/local/bin/cjobWind River Linux 6.0.0.21 localhost consolelocalhost login:
I have tried all of the default usernames and passwords that I was able to find online, and none of them have worked.
Is there a way for me to reset the password on these switches? Is there something that I can search for that will tell me more about the OS these
------------------------------
KEN HARVEY
------------------------------