User Interfaces

3. Junos Configuration Hierarchy

Hello and welcome back. In this lecture, we're going to talk about the Junos configuration hierarchy. It's a short lecture, and we're going to talk about the two different configuration hierarchies on a Juno device. If you're ready, let's begin. So on a Juno's device,there are two possible configuration hierarchies. Or in other words, there are two levels at which you can configure your Junos device. Number one, you can configure your device from the top of the configuration hierarchy. Second, you can navigate into a specific configuration hierarchy and perform your configurations from there.

Let's take a look at it. Let's dive straight into the terminal. As you can see, I've already logged into a journalist device. I'm going to enter the configuration mode with the edit command or the configure command. We'll look at an example of configuring a policy from a trust zone to an untrust zone. And we'll do this at two different levels. We'll first try it from the top of the hierarchy, and next we'll try it by entering into the policy configuration mode. Let's take a look at it. So I'm going to start with the set command. I'm going to say set security policies. That is the keyword for configuring your security policy. The starting zone is going to be trust. The to zone will be suspect. And I'm going to name this policy "permit all" and I'm going to say match the source address as any. We don't have to worry about the syntax of that command because we are going to discuss that in a separate lecture. We're just worried about the length of that command. You'll notice it's a really long command. So I'm going to say enter. Next, I'm going to configure the destination of this policy. So I'm going to say set security policies from zone trust to zone untrust policy.

And now I can just hit P andtab and that would fill up for me because I've already configured the policy name over here. I'll say match destination address. Next, we need to match the type of traffic. So I'm going to say set security policies from zone trust to zone untrust. The same policy name, which permits all matches, This time I'm going to say application, which would be any time I've matched my sourceaddress, my destination address, and my application. Next, I need to permit or reject that traffic. So I'm going to say set security policies from zone trust to zone untrust policy permitting all. Now I'm going to say, "Permit." My policy is now created. If I wanted to take a look at that policy, I'd do something like this. show security policies from zone trust to zone untrust policy allows everything And that is the policy that I just created. Now the thing that we need to note is the length of that command. Each time I had to type in the same exact keywords, only the last portion of that command was changing. I could actually make this much better by navigating into the Policy configuration mode. I'll show you how to do that. So I'm going to do an edit. Earlier I did the set command. Now I'm doing the edit command. The Set command is used to set the values while the Edit command is used to navigate into a specific configuration hierarchy. So I'm going to say edit security policies from zone trust to zone untrust policy. And I'll give it a different name. Let's call it "allow all." It's going to be the same policy but with a different name.

Now I'll start setting the source address, destination address, and so on. So I'm going to say set match,source, address any set, match, destination address,any set, match application any set. Then permit. You'll notice the change in the length of that command. It is drastically reduced because we are in a specific configuration mode. If I did a show right now, it would only show me the output of that policy because I'm in the specific policy configuration mode. If I did show from the top of the configuration mode, the output would look like this. I get everything in the output, so that's another difference. The length of the output is also reduced, and I'll show you something more when I do a set question mark. Notice I am right now at the top of the configuration mode. A question mark will show me a really long list of commands that I can type instead if I go into a specific configuration mode like the Policy configuration mode. There you go, the Edit Policy configuration mode. If I did a set and a question mark over here,I would only see a much smaller list of commands. It would only show me the commands that are allowed or valid at that configuration level. So those are the two levels at which you can configure your device. Configuring the device from the item specific configuration hierarchy has its benefits, which is what we saw right now.

First up, it reduces the length of the commands. Second, it only shows you commands that are allowed at that specific configuration hierarchy level and it only shows you the output at that specific level. Now let's look at some CLI navigation commands, and there are four of them. You have to edit up top and exit configuration mode. So I'm back at the terminal. As you already know, the Edit command is used to enter a specific configuration mode. For example, I can say Edit interfaces and that will take me into the interface configuration mode. Or I could do something like this: Edit system and that would take me into the system configuration mode. So it's the Edit command that helps you navigate or enter a specific configuration mode. You then have the up command, which takes you one level above. For example, if I did up and enter. That would take me one level above. Let's try this. Let's go into the Policy ConfigurationMode and let's try and set it up. From here, up and enter would take me one level above. I could also do something like this in Space Two. That would take me two levels up.

Let's try that. And that takes me two levels up, right? So the next level can be used to move one level above or one level up. Next you have the Top command, which is used to move back to the top of the configuration hierarchy. We'll do the same command again, which is edit, and we'll try a top this time. So I'm going to do it and enter. That brings me to the top of the Configuration Mode. Lastly, you have the exit configuration mode. This command can be used at any level in the Configuration Mode when you want to discard all your changes and go back into the Operational Mode. Let's try that. So I'm back in policy configuration mode. If I did Exit Configuration Mode, that would discard all the changes and take me straight into the Operational Mode. As you can see over here, it has also given me the information that the configuration has been changed but not committed. So those are the four important CLI navigation commands. In the next lecture, we're going to talk about Juno's configuration commands. That's all for this lecture Thank you very much, and I'll see you in the next lecture. Thank you.

4. Junos Configuration Commands

Welcome back. In this lecture, we're going to talk about Juno's configuration commands. So we have seven commands that we're going to be discussing in this lecture. We have the Set command, we have the Delete command. We then have to deactivate, rename,replace, copy, and annotate. To take a look at these commands, let's go into the terminal. So I've logged into a Junows terminal. I'm going to navigate into the configuration mode. So I'm going to say configure. Let's take a look at the first command, which is the Set command. So I'm going to do Set and let's try to set the IP address of an interface. Set two interfaces, unit zero, and family integer addresses 170, 216, and 1124. Right now we don't have to worry about the syntax of that command. We have a dedicated lecture for interface configuration. We're just trying to understand what the use of the Set command is. Now I'm going to enter and see if the command works. As a result, the Set command is used to configure the Juno device or set values on the Juno device. The opposite of this is the delete command. The Delete command can be used to delete the values that you've set with the Set command. For example, I'm going to do this: deleteinterfacesfe two, unit zero, family inetaddressand that would be one, 7216, and 1124. You hit Enter and the configuration is deleted.

So the Set command is for setting the configuration items. The delete command is to delete the configuration items. Next we have the deactivate command. Let's take a look at that. First of all, I'm going to navigate into the Policy configuration mode. So I'm going to say edit security policies from zone trust to zone untrust. I'll hit enter. So right now we are in the Policy Configuration mode. Let's do a show. We have three policies. Let's try to deactivate this policy. The command to do that would be to deactivate policy. Allow all to hit enter. When we try the show command,it says the policy is now inactive. So the deactivate command can be used to deactivate a certain portion of the configuration. If we wanted to reactivate it,we could use the activate command. For example, I'm going to say Active or Activate Policyallow all, hit Enter, and let's write a show. And now we notice that the inactive label that was there earlier has now been removed. So that's how you would use deactivate and activate. The next one on that list is Rename. The rename command can be used to rename a specific configuration item. Let's take a look at it. Let's try to rename the policy, which is called "Allow All." So let's do Rename Policy and we'll hit a question mark. It says, "Enter the policy name." So I'm going to say allow all question marks and two question marks policy.

And now we need to enter the new policy name. Let's rename this policy "allow all traffic." So the policy known as "Allow All" will now be renamed "Allow All Traffic." Let's try that. I'll hit Enter, which works fine, and let's do a show. As we can see right now, the policy has now been renamed as Allow All Traffic. Isn't that cool? Instead of actually having to delete the policy and then recreate another one with a new name, we can actually go and rename that policy. The next command on that list is replace. The replace command can be used to replace a specific pattern in the configuration. Let's take a look at that. So I'm back in configuration mode. First up, we're going to configure some items, and for that I already have the commands in a notepad just to save some time. So let me open that up. There you go. These are the commands that I'm going to type in. So I'm just going to copy and paste it over here. These commands are used to configure static host mappings. We don't have to worry about that. We are just going to take a look at the output.

Before we do that, Let's get into the specific configuration mode. So I'm going to say edit system, statichost mapping, and we'll do a show. Now we'll use the replace command to replace the pattern one with two two.Let's take a look at that. So I'm going to say replace question mark pattern question mark and it says what is the pattern that you want to replace? So I'm going to say one question mark with a question mark and I'm going to replace that with two dots, two dot two.What that means is when you find the pattern,one dot, one dot, one, go ahead and replace that with two dots, two twodot.Let's try that. It's done. Now let's do a show, commandant. You notice what just happened? All the items that had one have now been replaced with two two.So that's how you would actually use the replace command. The next command on that list is the copy command. The copy command can be used to copy a specific configuration item. Let's take a look at that. I'm back at the terminal. First I'll go to the top and then I'm going to enter the policy configuration mode, which isedits security policies from zone trust to zone untrust. Let's take a look at the policies with the show command. First of all, I'm going to delete a couple of policies. I'm going to say delete policy permit all and I'll repeat that with delete policy allow all traffic. So both the policies are gone. Now we only have one policy left, which is the policy of Trust to Untrust. Now let's try the copy command. So I'm going to do a copy policy and then we have to input the policy name, which is Trust to Untrust. And I'm going to say to the lowercase two questions, policy, and we have to now provide the new name. So I'm going to now say allow all policies. And now we have the policy trust to untrustcopyover, which allows all policy Now I can go back and edit specific items in that newly created policy.

The final command that we're going to take a look at is the annotate command. The annotate command can be used to add comments to your configuration. Let's take a look at that. Let's do this. Let's try to add a comment to the policy known as the "Allow All Policy." So the command for that would be annotate question mark policy. question mark. It says, "Which policy do you want to annotate?" I'm going to say allow all policies. And it says, "Now input your string." So I'm going to say this policy allows all traffic. Close the quotations and enter. We will verify that with a show command. And as you can see, it has now added a comment. So an annotation can be really useful if there are multiple people who are handling the configuration. So when somebody else looks at your configuration, they can immediately find out what the purpose of that configuration is or why did you add that configuration? So those are the configuration commands that I wanted to discuss with you in this lecture. In the next lecture, we are going to look at a very interesting topic known as Juno's Commit. That's all for this lecture. I'd like to thank you for watching, and I'll catch you in the next lecture. Thank you.

5. Junos Commit

Hello and welcome back. In this lecture we are going to talk about a very interesting topic known as the Junos commit. We'll understand how the commit function works on a Juno device. Let's begin with the examples that we've already seen. I'm sure you already know that the commit command is used to commit or finalise the changes. In one of the last few lectures, we discussed the concept of Active and Candidate Configuration. We say that the configuration that is live and running on the device is known as the Active Configuration. When you enter the configuration mode, a copy of the active configuration is created,known as the Candidate Configuration. All changes that we make are made to the Candidate Configuration only. When we commit, we save the candidate configuration as the active configuration. When we issue the commit command, before Juno actually commits the changes, it performs a commit check in the background. The commit check is to look for configuration errors and syntax errors. Juneau will prompt you with an error message if the configuration is found to have any errors,juneau will prompt you with an error message.Let's take a look at that. So I'm back in the terminal.

I'm going to enter the configuration mode. Let's try to create a new policy. This time we'll do it from the untrust zone to the trust zone and we'll actually write an incomplete policy,which means we are not going to provide everything that is needed to create that policy and we'll see how Junos validates that policy for us. Let's begin. So I'm going to say set security policies from zoneentrust to zone trust policy and we'll name the policyas out to in, from the outside zone or the untrusted zone to the inside zone or the trusted zone. We'll say any source address matches. Now we are supposed to follow that up with the destination address, with the application type, the permit or the rejected action. But right now we're not going to do that. We'll issue the commit command and see what happens. So let's do commit and straightaway it says there's something missing. It says missing mandatory statement,destination address, missing the application, and missing the statement. So when you issue the commit command, genos is actually doing a syntax check and a configuration check. You can do this manually as well. You don't have to actually issue the commit command to see if it's working or not. You can do it manually by saying "Commitcheck" and you'll get the same output. I recommend this as a best practise to all my students. When you're doing configuration changes on a Junos device, before you actually go in and commit those changes, always do a commit check to make sure that Junos will accept your changes.

We also have the Show Compare command, which can be used to view the changes before you go ahead and commit them. Let's take a look at that. We've already made some changes back at the terminal. We've added a policy statement along with this. I'm going to go in and delete something, so I'm going to say delete security policies from zonetrust to zone untrust policy question mark. Now this is a policy that we created in the last lecture. I'm going to delete that allow all policy. Delete it. Let's do a show comparison and see what the changes that we've made so far. So I'm going to do a show pipecompare and look at this output. It's so beautiful. Juno's actually tells you what the statements that have been deleted are and what the statements that have been added. Anything with a plus is what has been added, and anything with a minus is what has been removed. Isn't that cool? To get a nice overview of what's going to happen when you issue the commit command, the commit at command can be used to schedule a commit, which means if you don't want to commit the changes right now but want them to be committed at a future time,you can use the commit at command. First of all, I'm going to exit the configuration mode.

Do you want to exit with unpermitted changes? I'm going to say yes. I'm going to enter the configuration mode one more time. I'll quickly make a change. I'm going to say set security zones security zone and I'm going to call it DMZ. This command is used to create a security zone. I'm going to say enter and instead of doing acommit, I'm actually going to do a commit at.So if you issue a question mark, you can see that is an acceptable keyword. So I'm going to commit at the time on my computer right now, which is 06:24 p.m. Now let's say I want to commit to changes at 7:00 p.m. So I'm going to say commit at 1900 hours and I'm going to enter that. It actually gives you some error messages, which means the previous changes have not been cleared. So what I'm going to do is I'm going to clear those changes. I'm going to delete that security policy from zone untrust to zone trust policy out to in. Let me do a commit check first just to make sure the changes are acceptable.

So now the committee is going to work fine. So I'm going to commit at 1900 hours and this time it should work fine. There you go. So it says the configuration check has succeeded,the commit will be executed, that is today's date at 1900 hours IST, and also notice we were actually in the configuration mode. Once the command has been executed, it has exited the configuration mode and brought us back into the operational mode. Let's say after performing this command, you changed your mind. You don't want the commit to happen anymore. You can clear that with the clear system commit command. All the pending commits will now be cleared. Let us return to configuration mode and commit one more time. Let's say I want to commit not today but four days from today. So today is June 1 June.Let's say I want to commit on June 5 June.So I would do something like this: 20176, which is the month of five, which is the date space, 1900 hours, which is the time on the 5th of June when I actually want to commit my changes. I hit Enter, and the commit has now been scheduled for June 5, 2017 at 1900 hours. IST, I'm going to go ahead and clear that commit. So I'm going to say clear system commit. great. Now let's go back. The next command that we'll be discussing is the Commit Confirmed command. This is one of my favourite commands on Juno. The Commit Confirmed command allows you to commit changes and then confirm them before making the changes permanent. After you issue the initial Commit Confirmed command, another commit needs to be issued,else the changes will be rolled back. And what that essentially means is that once you issue the Commit Confirmed command, you have ten minutes to issue another commit command. If you do not issue another commit command in the next ten minutes, all the changes will be rolled back. If you do issue a commit command, the changes will be finalized. What could be a possible use case for this? Think about this. Let's say I'm sitting at my corporate headquarters and I'm configuring a device that is sitting at my branch office. I'm making some changes to the interface IPaddress, and it's the public interface on which I'm connected that I'm actually modifying. If anything goes wrong with that configuration, that would mean that I have no connectivity at all. In such cases, I would always want to ensure that my changes will work properly before finalising them. And Commit Confirmed is going to be very handy in these situations. Let's try that. I'm going to go back over here, and I'm going to go into configuration mode, and I'm going to try Commit Confirmed.If you hit Enter right now, the default timer is going to be ten minutes, but you can tweak that with your own value, so you can say Commit Confirmed.

Let's do a question mark first, and it says you can actually enter your timeout value between 1 minute and 65535 minutes. Let's do this. Instead of doing the default ten minutes,I'm going to say three minutes. So I have three minutes before I have to issue the next commit command, otherwise my changes will be rolled back. Hit Enter. It informs you that unless you confirm the commit, it will be automatically rolled back in three minutes. What's happening right now is my changes have been committed, but with a timer on them. If I had made any changes, the changes would have been applied right now, but they would also be rolled back in three minutes if I did not commit it one more time. So to finalise my changes, I will do acommit, and that will clear that message off. There you go. Now, this message has been cleared. The last command is commit and quit.

This command can be used to commit your changes and directly exit out of the operational mode. So right now I'm in configuration mode. Let's say I'm saying commit and quit. I hit enter. So it does the commit operation and comes back to the operational mode. Now, there's one more command that I want to discuss, and then we'll wrap up this lecture. There's a command known as "show system commit." This command can be used to view the commitoperations that have been performed on the device. Let's try that. Enter, show system commit. And it shows you the commits that have been performed on your device with their timestamps on them. All right, so we've discussed a bunch of important stuff in this lecture. In the next lecture, we're going to look at another interesting topic known as Juno's rollback. That's it for this lecture. Please let me know if you have any questions. If not, I'd like to thank you for watching, and I'll catch up in the next lecture. Thank you.

6. Junos Rollback

Hello and welcome back to this lecture on Juno's rollback. In the last lecture, we looked at Juno's commit model. In this lecture, we are going to talk about the Juno's rollback model. It's a short lecture. However, it's a very interesting one. If you're ready, let's begin. So, first up, what do we mean by a rollback? Well, a rollback is a configuration that's stored on aJuno's device that allows you to go back in time. It allows you to restore a previously saved configuration. A Junos device can store up to 50 committed versions of the configuration, which can be rolled back. It's interesting to note that the rollbackversion numbers actually start from zero and go all the way up to 490. 49, for a total of 50 saved configurations. We can use the rollback command to view the available rollback files. Let's dive into the command line interface and take a look at that.

As you can see right now,I've logged into the terminal. We are first going to go into the configuration mode with the edit command or the configure command. Hit Enter, and we are in configuration mode. Now I'm going to say rollback and I'm going to do a question mark to see how many rollbacks are saved on the device. And as you can see right now, I have a total of six rollback files on the device,starting from rollback zero to rollback five. And you also notice the timestamp associated with that rollback. Also, take a look at rollback three and rollback five. It's interesting because it was actually done via COMMIT confirmed right in the last lecture. very important. Rollback zero is the most recent configuration. It is the active configuration of the device. So rollback zero can be used to discard the candidate configuration and return to the active configuration. Once a rollback has been performed, you need to follow it up with a commit command. Let's look at this on the terminal, back at the terminal. Let's do this. Let's actually make some changes to the device. I'm just going to remove this command and say set system, host name. This command is used to set the host name.

So I'm going to say SRX 101 is my host name. I'm going to do Enter. So right now I've actually made some changes and the changes have been stored in the candidate configuration. Now, let's say I changed my mind and I want to discard the changes that I made. The right way to do that would be to rollback to zero. Excuse me. Rollback to zero, hit Enter because rollbackzero is the active configuration. As soon as we do that, all pending changes will be discarded and we'll go back to the active configuration. Let's try that. Rollback zero, it says load complete and we need to follow that up with a commit command, right? So the commit is finished. Now, this is a very crucial understanding. Rollback zero is the active configuration. And it can be used to discard any pending changes. Or in other words, it can be useful to discard the Candidate configuration. It is interesting to note that it is possible to compare the Candidate configuration with other rollback files using the Show Compare command, and I'll show you this on the device. Let's make the change one more time. So I'm going to say, Set system hostname SRX 101. That is going to be my new host name. We already know the show.compare command. It shows us the changes that have been made to the device, right? So let's take a look at that. When it says Show Compare, Hit Enter. It says in the Edit System Hierarchy, you are actually adding the hostname command.

Now this command, which is the Show Compare command,is the same as doing this Show Compare rollbackzero and you'll get the same output because this command, which is Show Compare, is essentially comparing your candidate configuration with your active configuration. The active configuration is nothing but rollback zero, which is why you get the exact same output for Show Compare and Show Compare rollback zero. Now, let's say we wanted to compare the candidate configuration with a previous rollback version. We could do something like this. Hit the question mark and it says you can compare with all these rollback versions. Let's compare with the oldest version, which is rollback five, and we'll hit Enter. Notice now it says that you're adding the hostname SRX 100. By the way, I just noticed that the X is missing. It's just SR. That's fine. It also shows you that these lines, or thesecommands, have been removed when compared to rollback five. Isn't this really interesting? It allows us to compare what we're doing right now to a version or to a configuration that was saved in the past. Finally, remember that you can change the number of rollback files saved on the device using a command that is Set System Max Configuration Rollbacks.

Let's try that command back at the terminal. First of all, I'm going to discard any changes with rollback zero, and I'm going to follow it up with a commit command. Perfect. Now we can change the number of rollbackfiles using the command Set System Max Configuration. So I'll type in Max and I'll do a tab. It fills in. Max configuration. Let's try "question mark." As you can see, there are a couple of commands which look very similar, but we areaiming for the first one, Max Configuration Rollbacks. So I'm going to say Set System Maxconfiguration rollbacks with a question mark and it says you can actually enter a number from zero to 49, which means the maximum number of rollbacks that can be stored on the device is 50. If you wanted to store only ten rollback files, you would give the number nine because rollback versions start from zero all the way up to the number that you specify. In this case, zero to nine would mean ten rollback files. I'm going to do 49 because I want to save 50 rollback versions. I'm going to follow that up with a commit command. Commit complete. Let's go back to the slides. All right. So that was about the rollback model on a Dunno device. In the next lecture, we're going to look at a very interesting topic, which is known as Juno configuration files. I'd like to thank you for watching, and I'll catch you in the next lecture. Thank you.

Study with ExamSnap to prepare for Juniper JNCIA-Junos Practice Test Questions and Answers, Study Guide, and a comprehensive Video Training Course. Powered by the popular VCE format, Juniper JNCIA-Junos Certification Exam Dumps compiled by the industry experts to make sure that you get verified answers. Our Product team ensures that our exams provide Juniper JNCIA-Junos Practice Test Questions & Exam Dumps that are up-to-date.