Introduction to the Junos Operating System
Initial Configuration
The slide highlights the topic we discuss next.
www.juniper.net |
Initial Configuration • Chapter 4–7 |
Introduction to the Junos Operating System
Powering On a Device Running the Junos OS
Always refer to your platform-specific documentation and follow the safety guidelines when connecting power and powering on your device running the Junos OS. Once a device running the Junos OS is powered on and if power to that system is interrupted, the device automatically powers on when the power is restored. In other words, no manual intervention is required for the system to reboot in this situation.
Gracefully Shutting Down the Junos OS
The Junos OS is a multitasking environment. To ensure file system integrity, you should always gracefully shut down platforms running the Junos OS. Although unlikely, failure to gracefully shut down the system could possibly leave it unable to boot. As illustrated on the slide, you use the request system halt command to gracefully shut down the Junos OS. This command provides options that allow you to schedule the shutdown in a specified number of minutes or at an exact time, to specify the media from which the next boot up operation will use, and to log a message to the console and to the messages file.
For Junos devices that offer redundant Routing Engines (REs), you can halt both REs simultaneously using the request system halt both-routing-engines command. For EX Series switches participating in a virtual chassis, where multiple switches function as a single virtual device, you can halt all participating members simultaneously with the request system halt all-members command.
Chapter 4–8 • Initial Configuration |
www.juniper.net |
Introduction to the Junos Operating System
Some Junos devices offer an ezsetup utility that walks the user through the same configuration tasks listed on this slide. The system must be in a factory-default state for this option.
Initial Configuration Checklist
When you receive a device running the Junos OS from the factory, the Junos OS is preinstalled. Once you power on the device, it is ready to be configured. When the initial configuration is performed, the root authentication must be included. In addition to root authentication, we also recommend that you configure the following items:
•Hostname;
•System time;
•System services for remote access (Telnet, SSH); and
•Management interface and static route for management traffic.
As displayed on the slide, the Junos OS enforces password restrictions. All passwords are required to be no less than six characters and must include a change of case, digits, or punctuation.
The subsequent pages provide sample configuration syntax for the initial configuration tasks listed on the slide.
www.juniper.net |
Initial Configuration • Chapter 4–9 |
Introduction to the Junos Operating System
Logging In as Root
Remember when you receive a platform running the Junos OS from the factory, the root password is not set. To log in to the CLI for the first time, you must log in through the console port using the root username with no password.
When configured, the console login displays the hostname of the device. When no hostname is configured, such as is the case with a factory-default configuration, Amnesiac is displayed in place of the hostname.
Starting the CLI
When you log in as the root user, you are placed at the UNIX shell. You must start the CLI by typing the cli command. When you exit the CLI, you return to the UNIX shell. For security reasons, make sure you also log out of the shell using the exit command.
Entering Configuration Mode
After starting the CLI, you enter operational mode. You can make changes to the configuration only in configuration mode. Enter configuration mode by entering configure at the operational mode prompt, as shown on the slide.
Chapter 4–10 • Initial Configuration |
www.juniper.net |
Introduction to the Junos Operating System
Identification Parameters
The slide shows how to use the CLI to configure the hostname and a root password. As displayed on the slide, a check is made when the root password is entered to ensure that it has been entered correctly. In the event that both entered passwords do not match, an error will be generated, the change is not made, and the password will need to be reentered.
The example on the slide uses the plain-text authentication option. Unlike the software from some vendors, the Junos OS never actually displays the password in its plain-text format but rather encrypts the password for you. You can see the encrypted password by viewing the relevant configuration:
[edit system]
root# show root-authentication
encrypted-password "$1$ti58nUSg$8xnQtTJeA0dA/.eUjjZOq1"; ## SECRET-DATA
Because you cannot retrieve the passwords by looking at the configuration file, you should keep the configured passwords in a secure location. If you do forget the password and cannot log in, you can always perform the password recovery process, which we cover in a subsequent chapter.
www.juniper.net |
Initial Configuration • Chapter 4–11 |
Introduction to the Junos Operating System
Note that the system’s date and time defined in the example on the slide will be adjusted once the configuration is adjusted.
Time Parameters
The slide shows how to use the CLI to configure the time settings. You can configure the current date and time information along with the proper time zone for the device. The default time zone on Junos devices is UTC (Coordinated Universal Time, formerly known as Greenwich Mean Time, or GMT).
When you define the local time on a Junos device, you must account for the time difference between the defined time zone and the default time zone. Once the time zone is changed and committed, the local time is adjusted accordingly to account for the difference. If you do not want to make the necessary adjustments, you can simply set the system’s time after the defined time zone parameter has been committed.
Instead of setting the local time on each network device in your network, you might consider implementing the Network Time Protocol (NTP). We cover NTP in detail in the “Secondary System Configuration” chapter.
The services included in the factory-default configuration might vary between different devices running the Junos OS.
Management Access Parameters
The slide also shows how to use the CLI to enable SSH and Telnet access to a device running the Junos OS. Although not shown on the slide, you could also enable the HTTP service, which allows the device to be accessed and managed through a Web browser. When connecting to a device running the Junos OS using one of these access protocols, use the same user logins defined under the
[edit system login] hierarchy.
Continued on the next page.
Chapter 4–12 • Initial Configuration |
www.juniper.net |
Introduction to the Junos Operating System
Management Access Parameters (contd.)
In operational mode, you can control the Junos CLI environment. By default, an individual CLI session never times out after extended times, unless the idle-timeout statement has been included in the user’s login class configuration. The timeout can be 0–100,000 minutes. Setting the timeout to 0 disables the timeout.
user@router> set cli idle-timeout 60
Idle timeout set to 60 minutes
user@router> set cli idle-timeout 0
Idle timeout disabled
The CLI provides a method to display a login message to users. The login message is displayed when a user connects to the host using Telnet or SSH.
[edit system]
user@router# set login message “Insert login message here...”
[edit system] user@router# commit commit complete
Insert login message here...
router (ttyp2)
login: login: user
Password:********
--- JUNOS 12.1R1.9 built 2012-03-24 12:12:49 UTC user@router>
www.juniper.net |
Initial Configuration • Chapter 4–13 |
Introduction to the Junos Operating System
Management Network Parameters
The slide shows how to use the CLI to configure a management interface and a static route for management traffic. Note that we highly discourage using a default static route for management traffic! You should be as specific as possible. You can also use the no-readvertise option for the static route used for management traffic. The no-readvertise option marks the route ineligible for readvertisement through routing policy.
Note that the static route defined for management traffic (or any other traffic) is only available when the system’s routing protocol process (rpd) is running. When Junos devices boot, the routing protocol process is not running; therefore, the system has no static or default routes. To allow the device to boot and to ensure that it is reachable over the network if the routing protocol process fails to start properly, you configure a backup router, which is a router or gateway device that is directly connected to the local system (that is, on the same subnet). To configure a backup router running IPv4, include the backup-router statement at the [edit system] hierarchy level:
[edit system]
root# show backup-router
10.0.1.129 destination 10.0.15.0/24;
In this sample configuration, hosts on the 10.0.15.0/24 subnet are reachable through the backup router. If the destination statement is omitted, then all hosts are reachable through the backup router.
Continued on the next page.
Chapter 4–14 • Initial Configuration |
www.juniper.net |
Introduction to the Junos Operating System
Management Network Parameters (contd.)
To eliminate the risk of installing a default route in the forwarding table, you should always include the destination option, specifying an address that is reachable through the backup router. Specify the address in the format network/mask-length, as shown in the previous example, so that the entire network is reachable through the backup router.
When the routing protocols start, the address of the backup router is removed from the local routing and forwarding tables. To have the address remain in these tables, configure a static route for the desired destination prefix with the backup router as the next hop and the retain option as shown in the following capture:
[edit routing-options] root# show
static {
route 10.0.1.0/24 { next-hop 10.0.1.129; retain; no-readvertise;
}
}
Activating Your Configuration
Once you complete your initial configuration, use the commit command to apply your changes. You can include the and-quit option, as shown, to return to operational mode. In the example on the slide, we see that once the configuration changes are activated and the user returns to operational mode, the configured hostname is displayed. This displayed hostname is a sure sign that the active configuration has changed.
www.juniper.net |
Initial Configuration • Chapter 4–15 |
Introduction to the Junos Operating System
Viewing the Resulting Configuration
As the slide directs, use the operational-mode show configuration command to display the hierarchical configuration file as created by the initial configuration set statements. The complete configuration is not shown for the sake of brevity.
Chapter 4–16 • Initial Configuration |
www.juniper.net |
Introduction to the Junos Operating System
The J Series and EX Series platforms offer additional
options to restore the rescue configuration. The J Series has a config button which can be pressed to load and activate the rescue configuration. The EX Series has an option, through the LCD menu, to load and activate the rescue configuration. On all other Junos devices you must have console access (assuming disruption of remote access).
To the Rescue
A rescue configuration is a user-defined, known-good configuration that is designed to restore connectivity in the event of configuration problems. We recommend that the rescue configuration contain the minimum elements necessary to restore network connectivity. For added security, the rescue configuration must include a root password. By default, no rescue configuration is defined.
You can save the active configuration as the rescue configuration using the CLI’s operational-mode request system configuration rescue save command. If a rescue configuration already exists, the request system configuration rescue save command replaces the rescue configuration file with the contents from the active configuration. To manually delete the current rescue configuration, issue the request system configuration rescue delete command.
Once saved, you can load the rescue configuration by entering the rollback rescue configuration mode command. Because the rollback operation only replaces the contents of the candidate configuration, you must issue commit to activate the configuration.
www.juniper.net |
Initial Configuration • Chapter 4–17 |