This post will focus on the manual backup of Junos configuration files.
Many networks will use a Network Management System (NMS) or a scripting solution like Ansible or Rancid to perform daily backups of network devices.
You can also use the archival command to have Junos automatically backup the configuration every time a commit is made. Here is an example of using the archival command with SFTP.
However, there are times when you may want to take an additional backup, such as before or after a change.
Why Not Rely On Rollback Files?
Junos already keeps the current configuration file and the previous 49 versions.
So why do we need a backup as well?
Each time we perform a commit action, the rollback files increment by one, with the oldest file being lost. If you make enough commits during a change, it is possible that you won’t have a copy of the config as it was before you started your change.
It can also be a bit clearer. Rather than figuring out which commit you need to rollback to, you can load the backup file.
Depending on the nature of the change, we may also want a copy of the configuration stored off of the device. Although very safe, you may want an off-device backup when doing a software upgrade, in case anything goes wrong.
Configuration File Locations
Junos keeps the current configuration plus 49 previous versions.
The first four are kept in /config. The juniper.conf.gz is the current configuration stored as a compressed gzip (.gz) file.
The remaining files are kept in the /var/db/config directory.
lab@vMX-3-B> file list /config
/config:
db_ext
juniper.conf.1.gz
juniper.conf.2.gz
juniper.conf.3.gz
juniper.conf.gz
juniper.conf.md5
<<output removed for brevity>>
lab@vMX-3-B> file list /var/db/config
/var/db/config:
juniper.conf.4.gz
juniper.conf.5.gz
juniper.conf.6.gz
juniper.conf.7.gz
...
<<output removed for brevity>>
...
lab@vMX-3-B> This post will show you how to compare configuration files.
The Two Configuration Styles
There are two ‘styles’ of configuration output. The regular ‘stanza’ style is what you see with the show configuration command. Or, the ‘set’ style, which you can see with show configuration | display set.
My preference is the stanza style, although I know not everyone likes it. I find all of the white space makes it more readable, others prefer having the full context of the set statements.
When taking a backup, I think the stanza style is better. The set style will lose any annotations that are in the configuration.
Saving Configuration Changes
A quick reminder for those who are used to Cisco-style interfaces. To make your configuration changes active you need to use the commit command in configuration mode.
Once you commit your changes, they will be saved in the configuration file and previous configurations will be available via the rollback command.
There is no equivalent of ‘copy run start’ or ‘wr mem’. It is taken care of via the commit process.
Saving The Configuration As A File
There are several variations to save the current configuration file, but they center on displaying and saving the config.
Using A Terminal Program
With this method, you turn logging on in your terminal program. Then run ‘show configuration | no-more’ or ‘show configuration | display set | no-more’ to show the entire configuration without pagination.
The config should now be in the log file for your terminal.
This is great when you can log in to a device, but have difficulty copying files to or from it.
Operational Mode
From operational mode, you can save the configuration to a local file by piping the output to the save command. If you do not specify a path, the file will be saved to the user’s home directory on the device.
lab@vMX-3-B> show configuration | save backup-test.conf
Wrote 89 lines of output to 'backup-test.conf'
lab@vMX-3-B> file list
/var/home/lab/:
backup-test.conf
lab@vMX-3-B> show configuration | save /var/tmp/backup-test.conf
Wrote 89 lines of output to '/var/tmp/backup-test.conf'
lab@vMX-3-B> file list /var/tmp
/var/tmp:
LOCK_FILE
appidd_cust_app_trace
appidd_trace_debug
backup-test.conf
bcast.bdisp.log
...
<<output removed for brevity>>
...
lab@vMX-3-B>
If you want the backup as set commands, use the following.
lab@vMX-3-B> show configuration | display set | save backup-test-set.conf
Wrote 29 lines of output to 'backup-test-set.conf'
lab@vMX-3-B>Configuration Mode
The configuration can also be saved when in configuration mode.
[edit]
lab@vMX-3-B# save backup-test-2.conf
Wrote 89 lines of configuration to 'backup-test-2.conf'
[edit]
lab@vMX-3-B#To get the set style, you need to display the config as set statements first and pipe that to the save command.
[edit]
lab@vMX-3-B# show | display set | save backup-test-set-2.conf
Wrote 29 lines of output to 'backup-test-set-2.conf'
[edit]
lab@vMX-3-B#Notice that the number of lines written matches what we got when saving the configuration from operational mode.
Something to be careful with when saving from configuration mode is that it only saves from where you are in the hierarchy.
So if I ‘edit’ my way down to interface ge-0/0/1 and then save, I get fewer lines.
[edit]
lab@vMX-3-B# edit interfaces ge-0/0/1
[edit interfaces ge-0/0/1]
lab@vMX-3-B# save backup-test-3.conf
Wrote 11 lines of configuration to 'backup-test-3.conf'
[edit interfaces ge-0/0/1]
lab@vMX-3-B# run file show backup-test-3.conf
## Last changed: 2024-09-28 23:35:27 UTC
interfaces {
replace:
ge-0/0/1 {
unit 0 {
family inet {
address 192.168.2.1/30;
}
}
}
}
[edit interfaces ge-0/0/1]
lab@vMX-3-B# show | display set | save backup-test-set-3.conf
Wrote 1 line of output to 'backup-test-set-3.conf'
[edit interfaces ge-0/0/1]
lab@vMX-3-B# run file show backup-test-set-3.conf
set interfaces ge-0/0/1 unit 0 family inet address 192.168.2.1/30
[edit interfaces ge-0/0/1]
lab@vMX-3-B#Using A One Line SSH Command
Your SSH client can run a specific command, instead of logging you into an interactive shell. We can use this to our advantage.
eve@lab1:~$ ssh [email protected] 'show configuration | no-more' > config-fetched-via-ssh.conf
([email protected]) Password:
eve@lab1:~$ wc -l config-fetched-via-ssh.conf
89 config-fetched-via-ssh.conf
eve@lab1:~$In the above example, the command line is the same as we normally use, but we add the command to run in quote marks. The second part, ‘> config-fetched-via-ssh.conf’ is simply redirecting the output of the ssh command to a local file called config-fetched-via-ssh.conf.
The ‘wc -l’ command counts the number of lines in the file. This is 89 which matches what we expect, as it is the same size as the backups we took earlier.
This method avoids the step of copying the backup file off of the device.
Copying The Configuration File
Once you have a saved copy of the configuration, you can now transfer it off of the device.
This can be done in several ways.
From the device itself, you can use the file command or sftp command to copy it to a server.
lab@vMX-3-B> file copy backup-test.conf scp://[email protected]/home/eve/backup-test.conf
[email protected]'s password:
backup-test.conf 100% 2052 407.3KB/s 00:00
lab@vMX-3-B>
lab@vMX-3-B> sftp [email protected]
[email protected]'s password:
Connected to 10.0.0.1.
sftp> put backup-test.conf
Uploading backup-test.conf to /home/eve/backup-test.conf
backup-test.conf 100% 2052 663.4KB/s 00:00
sftp> quit
lab@vMX-3-B>
From a remote server, or your own device, you can use scp, sftp, or ftp to connect to the Junos device and copy the file off as you would normally. Which method you use depends on what services you have configured on the Junos device.
eve@lab1:~$ scp [email protected]:/var/home/lab/backup-test.conf backup-test.conf
([email protected]) Password:
backup-test.conf 100% 2052 363.7KB/s 00:00
eve@lab1:~$
eve@lab1:~$ sftp [email protected]
([email protected]) Password:
Connected to 10.0.0.104.
sftp> ls *.conf
Junos-Prefix-Limit-r3.conf backup-test-2.conf
backup-test-3.conf backup-test-set-2.conf
backup-test-set-3.conf backup-test-set.conf
backup-test.conf
sftp> get backup-test.conf
Fetching /var/home/lab/backup-test.conf to backup-test.conf
backup-test.conf 100% 2052 153.6KB/s 00:00
sftp> quit
eve@lab1:~$It is possible to copy off the current configuration from /var/config/juniper.conf.gz instead. This is just a compressed version of the text configuration file.
Restoring A Configuration
There are a couple of methods of restoring a configuration file, they both use the load command.
The load command is a way of adding bulk configuration at once. You can either paste it in via the CLI or tell the load command to use a file.
If you are restoring a complete configuration the best approach is to copy the configuration file onto the device using one of the methods above that we used to copy the file off the device.
Although using the load command to paste in config is better than simply pasting in set statements, with large configurations it is better to use a file rather than pasting configuration into your terminal program.
This is due to the buffering of the text as it is sent from the terminal program to the device. When trying to paste hundreds, or thousands, of lines it seems to be common that a character or two will be missed or misplaced. This can cause the rest of the configuration to not paste in cleanly, causing errors.
Many of us work on smaller devices, but large service provider configs can get into the tens, or even hundreds, of thousands of lines.
If you are restoring a device from factory default settings, you will need to configure it enough to get basic connectivity first, copy the full backup file to it, and then load that configuration.
To show you how the general process works, we will delete the protocols and routing-options stanza and commit the change. Then we will load the backup configuration. Here we use the override option which will replace the entire configuration with whatever is in the file you specify. Make sure you use a full configuration.
[edit]
lab@vMX-3-B# show | count
Count: 89 lines
[edit]
lab@vMX-3-B# delete protocols
[edit]
lab@vMX-3-B# delete routing-options
[edit]
lab@vMX-3-B# commit
commit complete
[edit]
lab@vMX-3-B# show | count
Count: 65 lines
[edit]
lab@vMX-3-B# load override backup-test.conf
load complete
[edit]
lab@vMX-3-B# commit
commit complete
[edit]
lab@vMX-3-B# show | count
Count: 89 lines
[edit]
lab@vMX-3-B# show | compare rollback 2
[edit]
lab@vMX-3-B#The number of config lines is the same at the start and the end. When we do a comparison between the current configuration and the one we started with (rollback 2 in this case), there are no differences between the two.
Summary
We have looked at how to save, export, and restore configuration to Junos devices. Ideally, you should try these methods out for yourself, so you know how they work before you need to use them. You may find that one method tends to work best for your particular needs.
I also recommend looking at the load command in more detail, as it is a very useful tool.