Getting started with Junos can be a bit disorienting. While many other Network Operating Systems have similarities with Cisco’s IOS, Junos is different in many ways.
In part one, we’ll look at:
- Shutting Junos down gracefully
- Logging in to Junos
- Setting or changing the root password
- Creating a new user account
- Enabling remote access
- Setting the Hostname
- Looking at the hardware and interfaces.
Gracefully Shutting Down Junos
Although shutting down Junos isn’t the first thing you will need to do, it is important to understand that it needs to be shut down gracefully, whether it is a large chassis-based router or a small switch. Failing to properly shut down a Junos device can corrupt the operating system, much like any regular computer or server.
This is in direct contrast to many Cisco devices, where it is safe to just turn them off.
Junos devices tend to be more resilient these days. Switches and branch firewalls tend to have two boot partitions so that if one gets corrupted the other is available for use. Still, it is always best to shut them down properly before powering them off.
To shut down Junos gracefully, we can use variations of the following commands.
request system haltor
request system power-offThe halt command will shut down the operating system, but leave the device powered on. From the console, you can press press any key to restart the operating system.
The power-off command will shut down the operation system and power the device off if that is supported. This is usually available on virtual devices and smaller devices like switches and branch firewalls.
Logging In To Junos
To log in to a Junos device for the first time, you will normally connect via the serial console port. For a physical device, this will typically need a console cable and a terminal program.
How you connect to the console for a virtual machine will depend on your virtualization platform. Normally, you will either open a console window or telnet to a specific port on the server.
Although most Junos devices have an ethernet management port, it will need configuration before you can use it.
The rest of this section assumes you have connected to the device console.
First Time Logging In
When connected to the console, hit enter once or twice, and you should see output similar to this:
FreeBSD/amd64 (Amnesiac) (ttyu0)
login: The (Amnesiac) text appears when no hostname is set. If you see anything other than Amnesiac, it suggests the device has at least some configuration, and that the root password is unlikely to be the default.
For almost all Junos devices, the default login is ‘root’ with no password. Whenever you log in as root, you will be dropped into the shell rather than the Junos CLI. You need to enter ‘cli’ to get to Junos. All other users log in directly to the Junos CLI.
Below is an example of logging in as root and entering the ‘cli’ command.
FreeBSD/amd64 (Amnesiac) (ttyu0)
login: root
Last login: Thu Aug 24 14:23:32 on ttyu0
--- JUNOS 23.2R1.15 Kernel 64-bit JNPR-12.1-20230815.735906f_buil
root@:~ #
root@:~ # cli
root> Notice how I was not prompted for the root password at all? Also, notice how the command prompt changed after entering the ‘cli’ command.
I have only encountered one situation where the default root password was not blank. That was on one vQFX image. I can’t remember what the password was, but it may have been ‘Juniper’.
Once you are in the Junos CLI, you may see some messages logged to the console screen. It depends on what type of device you are logged into.
Since I am using a Junos vRouter for this example, with the factory-default configuration I see the following messages.
root>
Auto Image Upgrade: No DHCP Client in bound state, reset all DHCP clients
Auto Image Upgrade: DHCP INET6 Client State Reset : fxp0.0
Auto Image Upgrade: DHCP INET6 Client State Reset : fxp0.0
Auto Image Upgrade: DHCP INET Client Bound interfaces :
Auto Image Upgrade: DHCP INET Client Unbound interfaces : fxp0.0
Auto Image Upgrade: DHCP INET6 Client Bound interfaces :
Auto Image Upgrade: DHCP INET6 Client Unbound interfaces : fxp0.0
Auto Image Upgrade: To stop, on CLI apply
"delete chassis auto-image-upgrade" and commit
Auto Image Upgrade: No DHCP Client in bound state, reset all DHCP clients
Auto Image Upgrade: DHCP INET Client State Reset : fxp0.0
Auto Image Upgrade: DHCP INET6 Client State Reset : fxp0.0 For now, I’ll be ignoring these messages, we’ll come back to these a bit later.
Junos Configuration Mode
When we entered the Junos CLI, we were put in the ‘operational’ mode. We can tell this by the ‘>’ of the command prompt.
Like other equipment, operational mode allows us to view information about and operate the device. We need to enter configuration mode to configure it.
Unlike other vendors, Junos has a commit system. When you enter configuration mode, you are not modifying the live configuration. Instead, you are modifying a ‘candidate’ configuration. Any changes you make here only become active when you ‘commit’ the configuration.
Junos has several configuration modes, which I’ll cover in another post. For now, the main thing to understand is that changes don’t take effect until they are committed.
To enter configuration mode you can use either the ‘configure’ or ‘edit’ commands. To leave configuration mode use ‘exit’.
In configuration mode, you can use ‘show’ to see the configuration settings. You can also see this from the operational mode by using the ‘show configuration’ command.
The ‘set’ command is used to add or change the configuration. To remove configuration items, you can ‘delete’ the relevant line.
To show what changes have been made before you commit them, the ‘show | compare’ command can be used. See this post for information on comparing Junos configurations.
It is also useful to know how to save, export, and restore the configuration.
This will become a bit clearer as we work through the rest of the examples below.
Setting Or Changing The Root Password
One of the first things we need to do is to set the root password. The commands shown below can be used to set or change the root password.
set system root-authentication plain-text-password
After you enter the above command, you’ll be prompted to enter a password. The ‘plain-text-authentication’ only means that the password will be entered in plain text, not that it will be stored that way. All passwords in Junos are stored as the encrypted hash.
Once you’ve set the password, you need to commit the change.
Below is an example of setting the root password.
root> edit
Entering configuration mode
[edit]
root# set system root-authentication plain-text-password
New password:
Retype new password:
[edit]
root# commit
commit complete
[edit]
root# exit
Exiting configuration mode
root> Again, a few things to note. See how the command prompt changed when entering configuration mode.
Also, we now have the [edit] entry just above the command line. This tells us where we are in the configuration hierarchy.
After changing the root password, we used the ‘commit’ statement to apply the change.
If I log out of the console session and log back in again, you’ll see I’m now prompted for a password for the root account.
FreeBSD/amd64 (Amnesiac) (ttyu0)
login: root
Password:
Last login: Sun Feb 2 01:52:46 on ttyu0
--- JUNOS 23.2R1.15 Kernel 64-bit JNPR-12.1-20230815.735906f_buil
root@:~ # cli
root>The root password is a mandatory configuration item. You must have a root password set to commit the configuration. If it isn’t, you will see an error about missing mandatory configuration.
Creating A New Junos User Account
We don’t always want to log in as root. To create a new user account, we can use the following command.
set system login user <<username>> class <<user-class>> authentication plain-text-passwordThis creates a new local user account. The login classes are like groups and determine what access a given user account has. A complete example is shown below, creating a user called lab and assigning them the ‘super-user’ class, which is the same as the root account.
set system login user lab class super-user authentication plain-text-passwordLet’s look at a full example. I’ve used ‘edit’ to enter configuration mode, but you could also use ‘configure’.
There is no configuration under the ‘system login’ hierarchy before we start.
root> edit
Entering configuration mode
[edit]
root# show system login
[edit]
root# set system login user lab class super-user authentication plain-text-password
New password:
Retype new password:
[edit]
root# show system login
user lab {
class super-user;
authentication {
encrypted-password "$6$xEAwOksD$c.oNV8PFOEDBHXpGJlAUu4gl3OSmpGWu5SVRJCrLn/IFkDuLFK19NDpqw.a4KOQnNsRmoHA2b56xdsBOYEOOZ1"; ## SECRET-DATA
}
}
[edit]
root# show | compare
[edit system]
+ login {
+ user lab {
+ uid 2001;
+ class super-user;
+ authentication {
+ encrypted-password "$6$xEAwOksD$c.oNV8PFOEDBHXpGJlAUu4gl3OSmpGWu5SVRJCrLn/IFkDuLFK19NDpqw.a4KOQnNsRmoHA2b56xdsBOYEOOZ1"; ## SECRET-DATA
+ }
+ }
+ }
[edit]
root# commit
commit complete
[edit]
root# exit
Exiting configuration mode
root>As you can see, the ‘show | compare’ indicates what configuration has been added or removed.
We can now log in via the console as the newly created ‘lab’ user.
root> exit
root@:~ # exit
logout
FreeBSD/amd64 (Amnesiac) (ttyu0)
login: lab
Password:
--- JUNOS 23.2R1.15 Kernel 64-bit JNPR-12.1-20230815.735906f_buil
lab> Since we are still logged in as root, we need to ‘exit’ twice. Once to exit the Junos CLI and a second time to exit the shell.
We then log in as our new user, ‘lab’, and we are given the Junos CLI prompt.
In this example, we use a local user account to log in to Junos. This is sometimes called password authentication.
In Junos, we can also authenticate with the following:
- RADIUS Accounts
- TACACS+ accounts
- SSH Keys
When using RADIUS or TACACS+ accounts we will need to change the authentication order setting.
Removing auto-chassis-upgrade
During all of the above, I’ve been getting the following messages on the console.
Auto Image Upgrade: To stop, on CLI apply
"delete chassis auto-image-upgrade" and commit
Auto Image Upgrade: No DHCP Client in bound state, reset all DHCP clients
Auto Image Upgrade: DHCP INET Client State Reset : fxp0.0
Auto Image Upgrade: DHCP INET6 Client State Reset : fxp0.0 This won’t be present on all Junos systems. It depends on what type of device you are working with. To get rid of this we will delete the auto-image-update configuration, which we don’t need.
lab> configure
Entering configuration mode
[edit]
lab# show chassis
auto-image-upgrade;
[edit]
lab# delete chassis auto-image-upgrade
[edit]
lab# show | compare
[edit]
- chassis {
- auto-image-upgrade;
- }
[edit]
lab#
Auto Image Upgrade: No DHCP Client in bound state, reset all DHCP clients
Auto Image Upgrade: DHCP INET6 Client State Reset : fxp0.0
Auto Image Upgrade: DHCP INET6 Client State Reset : fxp0.0
[edit]
lab# commit and-quit
commit complete
Exiting configuration mode
lab> In the above, we use the ‘show’ command to look at a specific part of the configuration and the ‘delete’ command to remove the auto-image-upgrade setting.
Adding the ‘and-quit’ to the commit command causes Junos to exit out of configuration mode after the commit has completed.
Configuring The Management Interface
So far we have logged in, set the root password, and created a new user account.
We’ve done all of this via the console, but how do we manage the device remotely?
Although not strictly necessary for remote management, it is common to connect devices to a management network via the ethernet management interface.
On most Junos devices, the management interface is called fxp0. On the switching devices, it may be called me0, vme (virtual management, used when stacking switches), or em0.
In Junos, there are three parts to an interface configuration. There is the physical interface, the logical interface (unit), and the address families configured under the logical interface.
Some interfaces support multiple logical ‘units’, and others only one. When only one logical unit is supported, it will be called unit 0.
As management interfaces only support a single unit, we will configure interface fxp0 with a single unit, called unit 0, and use a family inet (IPv4) address.
Because we don’t want any of the default fxp0 settings, we will delete the fxp0 configuration first, and then apply our new settings.
The example below shows us deleting the fxp0 interface and adding our configuration. Notice how the ‘show | compare’ shows what entries are being removed, and which are being added.
lab> configure
Entering configuration mode
[edit]
lab# show interfaces fxp0
unit 0 {
family inet {
dhcp {
vendor-id Juniper-vmx-VM679EC97D68;
}
}
family inet6 {
dhcpv6-client {
client-type stateful;
client-ia-type ia-na;
client-identifier duid-type duid-ll;
vendor-id Juniper:vmx:VM679EC97D68;
}
}
}
[edit]
lab# delete interfaces fxp0
[edit]
lab# show interfaces fxp0
[edit]
lab# set interfaces fxp0 unit 0 family inet address 10.0.0.50/24
[edit]
lab# show interfaces fxp0
unit 0 {
family inet {
address 10.0.0.50/24;
}
}
[edit]
lab# show | compare
[edit interfaces fxp0 unit 0 family inet]
- dhcp {
- vendor-id Juniper-vmx-VM679EC97D68;
- }
[edit interfaces fxp0 unit 0 family inet]
+ address 10.0.0.50/24;
[edit interfaces fxp0 unit 0]
- family inet6 {
- dhcpv6-client {
- client-type stateful;
- client-ia-type ia-na;
- client-identifier duid-type duid-ll;
- vendor-id Juniper:vmx:VM679EC97D68;
- }
- }
[edit]
lab# commit and-quit
commit complete
Exiting configuration mode
lab>From operation mode, we can check the fxp0 interface.
lab> show interfaces fxp0 terse
Interface Admin Link Proto Local Remote
fxp0 up up
fxp0.0 up up inet 10.0.0.50/24
lab>I can now ping the router from a management host connected to the same network as the fxp0 interface.
eve@linux-mgmt:~$ ping 10.0.0.50
PING 10.0.0.50 (10.0.0.50) 56(84) bytes of data.
64 bytes from 10.0.0.50: icmp_seq=1 ttl=64 time=6.26 ms
64 bytes from 10.0.0.50: icmp_seq=2 ttl=64 time=2.13 ms
64 bytes from 10.0.0.50: icmp_seq=3 ttl=64 time=2.49 ms
64 bytes from 10.0.0.50: icmp_seq=4 ttl=64 time=1.67 ms
^C
--- 10.0.0.50 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 1.668/3.134/6.256/1.825 ms
eve@linux-mgmt:~$Enabling Remote Access
WARNING: Think BEFORE you enable this. Once enabled, services are available on any available interface. If you enable SSH, or telnet, it is enabled for all interfaces. You need to use a firewall filter applied to the loopback interface to limit access.
Typically, Junos devices do not have remote access enabled by default. There may be a few device-dependent variations. Some of the smaller SRX’s may enable the web interface by default. That is a topic for another day.
Each remote access method needs to be set under the ‘system services’ hierarchy.
Enabling SSH Access
To enable SSH, we need to configure it under system services. The most basic configuration is this:
lab> configure
Entering configuration mode
[edit]
lab# show system services
[edit]
lab# set system services ssh
[edit]
lab# show | compare
[edit system]
+ services {
+ ssh;
+ }
[edit]
lab# commit and-quit
commit complete
Exiting configuration mode
lab>We can now SSH to the router from our management host.
eve@linux-mgmt:~$ ssh [email protected]
([email protected]) Password:
Last login: Sun Feb 2 03:30:02 2025
--- JUNOS 23.2R1.15 Kernel 64-bit JNPR-12.1-20230815.735906f_buil
lab> exit
Connection to 10.0.0.50 closed.
eve@linux-mgmt:~$Ideally, you may want to add some additional configuration for your SSH sessions.
lab> edit
Entering configuration mode
[edit]
lab# set system services ssh protocol-version v2
[edit]
lab# set system services ssh rate-limit 5
[edit]
lab# set system services ssh connection-limit 5
[edit]
lab# set system services ssh root-login deny
[edit]
lab# show system services
ssh {
root-login deny;
protocol-version v2;
connection-limit 5;
rate-limit 5;
}
[edit]
lab# commit and-quit
commit complete
Exiting configuration mode
lab>The above limits the number of SSH connections, and rate-limits the number of incoming connections per minute. Root login is disabled by default, adding it here makes this behavior more explicit.
Check If SSH Is Enabled By Default
While writing this, I came across something interesting. Let’s see if you can spot it in the output below.
lab> show configuration system services
lab> eve@linux-mgmt:~$ ssh [email protected]
([email protected]) Password:
Last login: Sun Feb 2 03:31:50 2025 from 10.0.0.1
--- JUNOS 23.2R1.15 Kernel 64-bit JNPR-12.1-20230815.735906f_buil
lab>There is no SSH configuration on the router itself, but we can still SSH to it from the management host. To be honest, this is unexpected. I would normally expect this not to work. It’s possible there has been a change in default behavior or just a quirk of the specific test device I am using.
In this case, it is a vJunos router running 23.2R1.15.
Something to keep in mind.
Enabling SFTP Server
For a long time, although Junos allowed you to SSH into it, you were not able to SFTP into it. This has changed in later versions of Junos.
With SSH configured as it was under the Enabling SSH example above, we can’t SFTP into the router.
eve@linux-mgmt:~$ sftp [email protected]
([email protected]) Password:
subsystem request failed on channel 0
Connection closed.
Connection closed
eve@linux-mgmt:~$We can enable the SFTP server on the router as follows.
lab> configure
Entering configuration mode
[edit]
lab# set system services ssh sftp-server
[edit]
lab# show | compare
[edit system services ssh]
+ sftp-server;
[edit]
lab# commit and-quit
commit complete
Exiting configuration mode
lab> As you can see below, we can now SFTP into the router from the management host.
eve@linux-mgmt:~$ sftp [email protected]
([email protected]) Password:
Connected to 10.0.0.50.
sftp> pwd
Remote working directory: /var/home/lab
sftp> ls
sftp> quit
eve@linux-mgmt:~$
Enabling Telnet Or FTP Access
I do not recommend enabling telnet or ftp on your device. It is far better to use encrypted protocols such as SSH, SFTP, or SCP.
But, in case you do want to enable them, here is an example.
Testing from the management host first, we can see that telnet and FTP do not work.
eve@linux-mgmt:~$ telnet 10.0.0.50
Trying 10.0.0.50...
telnet: Unable to connect to remote host: Connection refused
eve@linux-mgmt:~$ ftp 10.0.0.50
ftp: Can't connect to `10.0.0.50:21': Connection refused
ftp: Can't connect to `10.0.0.50:ftp'
ftp> quit
eve@linux-mgmt:~$Both these protocols need to be configured under ‘system services’ to be enabled.
lab> configure
Entering configuration mode
[edit]
lab# set system services telnet
[edit]
lab# set system services ftp
[edit]
lab# show | compare
[edit system services]
+ ftp;
+ telnet;
[edit]
lab# show system services
ssh {
root-login deny;
protocol-version v2;
sftp-server;
connection-limit 5;
rate-limit 5;
}
ftp;
telnet;
[edit]
lab# commit and-quit
commit complete
Exiting configuration mode
lab>The router is now accessible using telnet and FTP, as shown below from the management host.
eve@linux-mgmt:~$ telnet 10.0.0.50
Trying 10.0.0.50...
Connected to 10.0.0.50.
Escape character is '^]'.
login: lab
Password:
Last login: Sun Feb 2 03:36:59 from 10.0.0.1
--- JUNOS 23.2R1.15 Kernel 64-bit JNPR-12.1-20230815.735906f_buil
lab>
lab> quit
Connection closed by foreign host.
eve@linux-mgmt:~$
eve@linux-mgmt:~$ ftp 10.0.0.50
Connected to 10.0.0.50.
220 FTP server (Version 6.00LS) ready.
Name (10.0.0.50:eve): lab
331 Password required for lab.
Password:
230 User lab logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
Remote directory: /var/home/lab
ftp> ls
229 Entering Extended Passive Mode (|||55566|)
150 Opening ASCII mode data connection for '/bin/ls'.
total 0
226 Transfer complete.
ftp> quit
221 Goodbye.
eve@linux-mgmt:~$Setting The Hostname
To set the hostname for the router, we use the following command.
set system host-name <<hostname>>Here is an example.
lab> configure
Entering configuration mode
[edit]
lab# set system host-name MyRouter
[edit]
lab# commit and-quit
commit complete
Exiting configuration mode
lab@MyRouter>
lab@MyRouter>Notice how the command prompt has changed, it now has user@hostname, instead of just the username.
Checking Interfaces And Hardware
You can use the ‘show chassis hardware’ command to check what type of device you are on, what hardware is installed, and what the serial numbers are.
lab@MyRouter> show chassis hardware
Hardware inventory:
Item Version Part number Serial number Description
Chassis <<Removed>> VMX
Midplane
Routing Engine 0 RE-VMX
CB 0 VMX SCB
FPC 0 BUILTIN BUILTIN Virtual FPC
CPU Rev. 1.0 RIOT-LITE BUILTIN
MIC 0 Virtual
PIC 0 BUILTIN BUILTIN Virtual
lab@MyRouter>You can see we are working with a virtual MX (vMX) and that it has a virtual FPC, MIC, and PIC installed.
To see what interfaces are available, you can use the ‘show interfaces terse’ command. The ‘terse’ reduces the output, instead of showing the detail for the interfaces.
lab@MyRouter> show interfaces terse
Interface Admin Link Proto Local Remote
ge-0/0/0 up up
ge-0/0/0.0 up up inet 192.168.100.1/24
multiservice
lc-0/0/0 up up
lc-0/0/0.32769 up up vpls
pfe-0/0/0 up up
pfe-0/0/0.16383 up up inet
inet6
pfh-0/0/0 up up
pfh-0/0/0.16383 up up inet
pfh-0/0/0.16384 up up inet
ge-0/0/1 up up
ge-0/0/1.16386 up up
ge-0/0/2 up up
ge-0/0/2.16386 up up
ge-0/0/3 up up
ge-0/0/3.16386 up up
ge-0/0/4 up up
ge-0/0/4.16386 up up
ge-0/0/5 up up
ge-0/0/5.16386 up up
ge-0/0/6 up up
ge-0/0/6.16386 up up
ge-0/0/7 up up
ge-0/0/7.16386 up up
ge-0/0/8 up up
ge-0/0/8.16386 up up
ge-0/0/9 up up
ge-0/0/9.16386 up up
cbp0 up up
demux0 up up
dsc up up
em1 up up
em1.0 up up inet 10.0.0.4/8
128.0.0.1/2
128.0.0.4/2
inet6 fe80::5254:ff:fe12:bdfe/64
fec0::a:0:0:4/64
tnp 0x4
esi up up
...
<<outpur removed for brevity>>
...
fxp0 up up
fxp0.0 up up inet 10.0.0.50/24
gre up up
ipip up up
irb up up
jsrv up up
jsrv.1 up up inet 128.0.0.127/2
lo0 up up
lo0.16384 up up inet 127.0.0.1 --> 0/0
lo0.16385 up up inet
lsi up up
mif up up
mtun up up
pimd up up
pime up up
pip0 up up
pp0 up up
rbeb up up
tap up up
vtep up up
lab@MyRouter> We’ll cover interfaces in more detail in part two.