SRX

Hello,

I need to upgrade a cluster of two Juniper SRX345 (22.x -> 23.x).

I've only done this once using the "request system software add" command.

But I recently read about ICU, is this really a working feature?

I'm worried about the cluster's stability; it's in production and there's no spare hardware.

Should I use ICU or is it better to follow a proven "request system software add" on both nodes and then reboot?

For going to 23.4 specifically, check out this article: https://supportportal.juniper.net/s/article/SRX300-series-requirements-for-upgrade-to-Junos-24-4R1-and-higher-from-earlier-releases. There is a new partition scheme that needs to be applied in order to support higher JunOS version. So this pretty much makes the choice for you.

In general, in my experience ICU is a mixed bag. When it works right, it's less disruptive to traffic than simultaneous reboot. When it doesn't work right, it may leave you in a situation that's a bit tricky to recover from, but you'll probably have at least one of the two firewalls in working order. With simultaneous reboot, if something goes wrong, there's some chance it goes wrong in the same way with both nodes simultaneously.

ICU does take significantly longer to complete than a simultaneous reboot though, so your maintenance window needs to account for that.

All that being said, it's best that you have console connectivity to both devices as well as someone on site to physically reboot the units if necessary. Having someone on site also enables the option of doing the convoluted minimum downtime upgrade procedure. If that's a luxury you don't have available, it seems safer to me to do the simultaneous reboot method you alluded to rather than ICU.

I took the risk and decided to use ICU - everything went well. It took longer but downtime was minimal.