Internal eUSB issue of the Juniper SRX 300 series

     The Juniper SRX300 series represents the most affordable line of NGFW (Next-Generation Firewall) devices offered by Juniper Networks. Originally announced in 2016, these devices have been widely deployed to connect branch offices of various sizes to the Internet and to establish VPNs — including LAN-to-LAN and Remote Access configurations.

    Recently, there has been a noticeable increase in cases where SRX300 devices fail during operation or boot. In such scenarios, the system may hang and drop into the loader> or db> prompt, indicating a failure to complete the boot process.

⚠️ Problem Description

    All models in the SRX300 series — except for the SRX380 — are equipped with identical 8GB eUSB modules (personally verified on SRX300 and SRX340). Over time, the internal flash memory may degrade due to the limited number of write cycles. This degradation can prevent the device from booting properly, resulting in a fallback to loader> or db> mode.

The location of the internal eUSB module in the SRX300 is shown below:

SRX300

The location of the internal eUSB module in the SRX340 is shown below:

SRX340

These devices use the ATP AF8GSMGH-JP2 module, as illustrated in Figure 1.

Figure 1

During boot, the SRX detects the presence of the internal memory module but fails to load the system from it.

USB1:   Starting the controller
USB XHCI 1.00
scanning bus 1 for devices... 2 USB Device(s) found
USB0:   Starting the controller
USB XHCI 1.00
scanning bus 0 for devices... 2 USB Device(s) found
       scanning usb for storage devices... 2 Storage Device(s) found
Type the command 'usb start' to scan for USB storage devices.
Press SPACE to stop autoboot:  0 
SF: Detected SF with page size 256 Bytes, erase size 64 KiB, total 8 MiB
SF: 1048512 bytes Read: OK
SF: 1048576 bytes Read: OK
## Starting application ...
SF: Detected SF with page size 256 Bytes, erase size 64 KiB, total 8 MiB
[0]#3 Booting from eUSB slice 1
Consoles: U-Boot console  
Found compatible API, ver. 3.12
FreeBSD/MIPS U-Boot bootstrap loader, Revision 2.11
(builder@monarth, Sun Jul 26 18:59:02 PDT 2020)
Memory: 4096MB
[0]#3 Booting from eUSB slice 1
\
can't load '/kernel'
can't load '/kernel.old'
Press Enter to stop auto bootsequencing and to enter loader prompt.

🛠️ Recovery Options

To resolve this issue, there are two main approaches:

1. Boot from External USB Flash Drive

You can create a bootable external USB flash drive and configure the device to boot from it. This requires additional setup to ensure the SRX boots directly from the external USB upon restart, bypassing the internal eUSB. Detailed instructions will be provided in a future blog post.

Recommended specifications:

• Capacity: 8GB

• Interface: USB 2.0 (USB 3.0 is not supported)

Compatible USB flash drives (tested or recommended by Juniper):

• SanDisk Cruzer

• Kingston DataTraveler

• Transcend JetFlash

• Verbatim Store 'n' Go

• Corsair Flash Voyager

2. Replace the Internal eUSB Module

    You may replace the faulty eUSB module with the same model (ATP Electronics AF8GSMGH-JP2) or a compatible alternative. One proven substitute is the Swissbit U-48 8GB (SFUI008GJ2AB1T0-C-5S-2AP-STD), which is fully compatible and operational. Another option is the Swissbit U-48 8GB (SFUI008GJ2AB1T0-I-5S-2AP-STD), featuring an extended operating temperature range.

Figure 2

Recommendation

To minimize downtime, always keep a compatible bootable USB flash drive on hand — it can serve as a lifeline in case of system failure. The simplest way to create one is by connecting the USB flash drive to a working SRX device and executing the following command:

user@srx300> request system snapshot media usb

This command copies the full OS image, configuration, and file system structure from the internal eUSB to the external USB drive.

If you didn’t perform this step before the failure — and your devices are configured in a cluster — you can run the command on the healthy unit. This allows you to fully restore the failed device.