This page is to practice what you learned in Juniper’s PDF (part 1), chapter 2 and 3. So now it is time to get active and log in as root without any password.
First thing you should notice is that Amnesiac is the default host-name. This indicates that our JunOS is running with the factory-default configuration (you can use the load factory-default command in configuration mode to have a JunOS in this state).
You are logged in as root, you should see the UNIX shell prompt root@% where you can type UNIX commands like ls or ps but this is beyond our scope. What we want is the operational mode prompt root> that is started with the cli command.
Amnesiac (ttyd0)
login: root
--- JUNOS 10.1R1.8 built 2010-02-12 17:15:05 UTC
root@% cli
root>
Type show configuration to display the current factory-default configuration.
root> show configuration
## Last commit: 2011-02-17 00:34:21 UTC by root
version 10.1R1.8;
system {
syslog {
user * {
any emergency;
}
file messages {
any notice;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
## Warning: missing mandatory statement(s): 'root-authentication'
}
Note the missing mandatory statement warning, this means you will not be able to commit your changes until you set up a password for root.
Exercise 1 – root password
Go to configuration mode using the configure command and try to commit the current candidate configuration, then set a password for root and commit again.
Solution
Now your JunOS route is ready for new commits! Let’s see if you can apply the same configuration on your second router without looking at the solution above. Remember, you must first login, then go to operational mode and then to configuration mode. The command to set up the root password starts with set system, use ? to find the complete command. Finally, don’t forget to commit or your configuration will not be active!
root# set system ?
Possible completions:
> accounting System accounting configuration
+ apply-groups Groups from which to inherit configuration data
...
> tracing System wide option for remote tracing
Also try out the help topic command to display usage guidelines (if you want the all story), the help reference command to display summary information (the most useful when you want to know about all command options) and the help apropos command which displays the contexts (typically set commands) relevant to the configuration hierarchy level at which you are currently positioned (if you want help only for your current hierarchy level and nothing else).
[edit]
root# help topic system root-authentication
root# help reference system root-authentication
root# help apropos root-authentication
Exercise 2 – host-name
Have you noticed? We have exactly the same prompt on both routers; this is annoying as we want to know which is which. Let’s add a host-name for both routers. We’ll let you find the right command (hint: use set system ?)
Solution
Now compare the candidate configuration with the active configuration using show | compare. The + are lines that are going to be added to the active configuration when you commit and – lines are going to be removed. This is very useful to know exactly what is about to be changed. Do it on both routers and commit.
root# show | compare
[edit system]
+ host-name JUNOS1;
[edit]
root# commit
commit complete
Exercise 3 – rollback
On JUNOS2, configure a wrong hostname, anything. Commit your configuration and rollback to the one containing the right hostname.
Solution
Exercise 4 – edit
Let’s configure an IP address for the first interface on our JUNOS1 router using the edit command. Place yourself at the following level:interfaces em0 unit 0 family inet. em0 is the name for our first interface, give it this IP address and mask: 192.168.1.1/24
Solution
Exercise 5 – up
Go back up 3 levels and edit em1 in the same way as em0. Configure the following IP address and mask: 10.1.1.1/8
Solution
Exercise 6 – top & commit check
Go to the top level, check your configuration and commit.
Solution
Exercise 7 – set vs. edit & set
Configure the em0 (logical unit 0, IPv4 family) interface on JUNOS2 router with 192.168.1.2/24 IP address using the set command from the top level (remember ? is your friend).
Solution
Configure IP address 10.1.1.2/8 on em1 by placing yourself to the last level using edit.
Solution
Exercise 8 – telnet
Now we would like to configure telnet (SSH would be a better choice as it is secured) to remotely configure JUNOS2 from JUNOS1. First check that nothing is configured under system services level while staying at your current level (hint: use top). Then edit that level without going back to the top level. Configure telnet with the set command, exit to the top level, check what you are about to change and finally commit.
Solution
Add a user account to access this device using telnet and commit again.
Solution
Exercise 9 – run
Back to JUNOS1, without leaving configuration mode, ping and telnet to JUNOS2 (IP address: 192.168.1.2). Use Ctrl + C to stop pinging. Use the username and password you previously created to authenticate with JUNOS2.
Solution
Exercise 10 – automatic rollback
From your telnet session on JUNOS2, delete the telnet statement under system services level and commit in a way that if you lose your connection to JUNOS2, the configuration is automatically rolled back after 1 minute. Exit both configuration and operational modes to go back to JUNOS1. Try to telnet again to 192.168.1.2; this should not work. Wait about 2 minutes (take a coffee break) and try again. This time it should work as your previous commit should have been rolled back.
Solution
Exercise 11 – copy & rename
Copy em1 configuration to em2 and rename em2 to em3. Deactivate em3. Go to interfaces level and display the candidate configuration. Note the inactive: em3. Finally commit.
Solution
Change em3 IP address from 10.1.1.1/8 to 10.1.1.3/8 (hint: use the rename command). Maybe you would like to see what commands produced this candidate configuration? Use show and a pipe to find out.
Solution
Exercise 12 – annotate
Add an annotation saying that em3 is inactive. Using only one command, commit with a comment describing what you just did and return to operational mode.
Solution
Compare the active configuration with the previous one using the show configuration command.
Solution
Exercise 13 – rescue
You know your configuration works well (basic connectivity is established for instance). Therefore you want to make it the rescue configuration in case of problem; this will speed up a recovery. Create the rescue configuration and restore it.
Solution
Exercise 14 – preferred IP address
Configure an additional IP address (192.168.1.3/24) for em0 and configure your router so that it uses this IP as the source when sending pings to JUNOS2. Commit, exit to operational mode and check with the show interfaces command that em0 has 2 IP addresses.
Solution
Let’s check that JUNOS1 can actually send packets using source IP address 192.168.1.3. On JUNOS2, in operational mode, use the following command to monitor the traffic to and from the router: monitor traffic interface em0 (Ctrl + C to exit). Then ping from JUNOS1 to 192.168.1.2. You should see that you are receiving packets from 192.168.1.3 (192.168.1.3 > 192.168.1.2)
root@JUNOS1> ping 192.168.1.2
PING 192.168.1.2 (192.168.1.2): 56 data bytes
64 bytes from 192.168.1.2: icmp_seq=0 ttl=64 time=12.510 ms
64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=1.665 ms
root@JUNOS2> monitor traffic interface em0
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on em0, capture size 96 bytes
04:37:18.543830 192.168.1.3 > 192.168.1.2: ICMP echo request, id 40718, seq 12, length 64
04:37:18.544023 192.168.1.2 > 192.168.1.3: ICMP echo reply, id 40718, seq 12, length 64
