Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

Juniper - Junos 11.4R8 based Olive

This is a step by step guide to create a Junos 11.4R8.4 based Olive box for testing purposes.

1st Step: Install FreeBSD 7.0 32bit
Create a VM (Custom, Other, FreeBSD 32bit). Select the hardware resources, I used 1 GB of RAM, LSI SAS adapter, 6GB IDE drive and it worked for me.

Junos 11.4 is based on FreeBSD7, so add FreeBSD7 i386 iso as CD (connect at power on) and boot the machine.

When installing FreeBSD7, create a single slice from the whole disk (Pressing "A"), select the slice and make it bootable (very important) by pressing "S".

Press ESC, select "Standard Boot" and next create the labesl.

This is a very important step because FreeBSD 7.0 creates labels a b d e (e for /var) and Junos requires label "f" for /var, so manually create the labels in following order and size (worked for me):


Press "Q", confirm what needs to be confirmed and then select "Minimal" installation and CD/DVD as source.

Now, FreeBSD 7.0 should be installed. What needs to be done is to:
- set the IP address and default route (to copy the junos image)
- set root password
- enable ssh root login
- enable sshd and start it
(how to do the above is not in this article)

Copy the jinstall-11.4R8.4-domestic-signed.tgz file to /var/tmp (using winscp for example) and then there are 3 decompressions and 3 compressions.

Step 2: Prepare Olive 11.4R8.4 olive.

Decompress the signed Junos image

Remove checksum files


Edit the "+INSTALL" (outer one) file as below:


Going further, we decompress the /var/tmp/jinst/jinstall-11.4R8.4-domestic.tgz file and edit inner "+INSTALL" and "+REQUIRE" files.


The Junos script runs "disklabel" command on /dev/ad0s1a. But on FreeBSD7.0 this gives an error, leaving the "rootdev_size" variable being empty and the check for root device space will fail and also these scripts check the RE sysctl which doesn't exist.


Now that we have 2nd compression done, there is one more tweak: replace "checkpic" Junos binary with "true" FreeBSD binary.


Step 3: Cleaning up and re-creating the packages:

Step 4: Installing Junos Olive 11.4R8


Now there is the final step. Making sure we can login into new Junos Olive box on the video console, otherwise, it's useless in most cases:


Now reboot the box. Some installation messages will appear on the console and a new reboot will take place. After the 2nd reboot, Junos is installed.
The prompt on your console until Junos boots up is:

and when it booted, the login prompt appears.

And that's it:

Features working:
BGP FlowSpec routes distribution:


Features NOT working:
BGP FlowSpec actions - no action is taken on firewall filters (ACLs) created by flowspec rules:

Firewall filters - you can configure them, but they block all traffic. This is because Juniper products (MX/SRX) apply filters as close as possible to the interface (on the interface cards - IOC depending on platforms) so Olive doesn't have these.