Partial ZTP Failure Across 40 New Switches
Forty new QFX5120-48Y switches are being staged with ZTP. A DHCP relay on the spine points to an ISC DHCP server; option 43 supplies the Junos image name and a configuration file. Thirty-two switches complete ZTP and join the fabric. Eight switches repeatedly obtain a lease, download the image, reboot, and return to ZTP with the old image. Two of the eight received addresses from the management scope instead of the in-band scope. The staging team has no console access to all eight and cannot disturb the 32 working switches. The image server is reachable and the checksum on the server matches the published value. You have a four-hour staging window.
1. What are the first checks on a failing switch, and how do you separate a DHCP-scope problem from an image problem?
Read the worked answer
First separate lease/scope problems from image problems. On a failing switch, show dhcp client shows the lease, server, and options received; compare the subnet with the intended in-band scope. show system software shows whether the image actually changed after reboot. show log messages | match -i 'ztp|dhcp|tftp|autoinstall' shows whether the download completed or the file was rejected. The two switches with management-scope addresses point to a relay/scope selection issue; the other six likely receive a valid lease but an image path or checksum mismatch. A wrong image name in option 43 or a TFTP path that differs in case will cause a loop: download, reboot, old image remains.
2. How would you remediate the eight without touching the 32 working switches?
Read the worked answer
Create a temporary DHCP scope or host reservations for the eight MAC addresses, correct option 43 to the known-good image and config, and verify the TFTP path. Then zeroize each failing switch with request system zeroize and let ZTP restart; if console access is unavailable, use the staging VLAN's DHCP server to force the corrected options. Do not change the global scope used by the working switches during the window. For the two with management leases, fix the relay's interface/scope selection or add a reservation so they land in the in-band scope.
3. What design change would prevent this class of partial ZTP failure at scale?
Read the worked answer
Use per-rack or per-role DHCP scopes with unique option 43 values, pre-create reservations for every serial/MAC, and validate image checksums before staging. Add a ZTP monitoring step that records lease, image version, and config hash per switch, so a loop is caught immediately. Prefer Apstra ZTP or a phone-home workflow that reports status centrally. Finally, document a rollback path such as a USB image or console for switches that fail ZTP, because a four-hour window with 40 devices leaves little room for serial troubleshooting.