CLI Basics & System Access

Comprehensive guide to JunOS CLI fundamentals including operational and configuration modes, command structure, navigation, and default system access for professional network management.

JunOS CLI provides a powerful, hierarchical command-line interface with distinct operational and configuration modes, built on a FreeBSD foundation with UNIX shell integration for comprehensive network device management.

The JunOS command-line interface offers enterprise-grade functionality with clear separation between operational commands and configuration changes, providing both safety and flexibility for network administrators.

---

Understanding JunOS Architecture

FreeBSD Foundation

JunOS is built on FreeBSD UNIX, providing:

• Robust kernel - Proven stability and performance

• UNIX utilities - Full shell access with standard commands

• Process separation - Control and forwarding plane isolation

• Memory protection - Process-level fault isolation

• Real-time OS - Deterministic packet processing

# Access UNIX shell from CLI
root> start shell

# Check FreeBSD version and system info
root@% uname -a
FreeBSD hostname 12.1-RELEASE-p10 FreeBSD 12.1-RELEASE-p10 JUNIPER amd64

# View system processes
root@% ps aux | head -10

# Return to JunOS CLI
root@% cli
root>

CLI vs UNIX Shell Integration

JunOS CLI

Primary interface for network management:

• Structured command hierarchy

• Configuration validation and rollback

• Context-sensitive help

• Command completion and abbreviation

• Operational monitoring commands

# CLI characteristics
root> show version | display xml         # Structured output
root> show interface terse | match ge    # Filtered display  
root> configure                          # Enter configuration mode
[edit]
root# set interfaces ge-0/0/0 unit 0 family inet address 10.1.1.1/24

UNIX Shell

---

CLI Modes and Navigation

Operational Mode

The default mode for monitoring and troubleshooting:

# Operational mode prompt
root>

# Common operational commands
root> show version                    # System information
root> show interfaces terse           # Interface status summary
root> show route                      # Routing table
root> show system processes           # Running processes  
root> show log messages               # System logs
root> monitor interface ge-0/0/0      # Real-time monitoring
root> ping 8.8.8.8 count 5            # Network connectivity test

Key operational capabilities:

• Monitoring: Real-time system and network status

• Testing: Connectivity and performance validation

• Troubleshooting: Diagnostic commands and log analysis

• Display: Various output formats (XML, JSON, detailed)

Configuration Mode

Dedicated mode for making system changes:

1

Entering Configuration Mode

# Enter configuration mode
root> configure
[edit]

# Alternative: configure exclusive (locks configuration)
root> configure exclusive
[edit]

# Check if someone else is configuring
root> show system users

2

Configuration Hierarchy

# Navigate configuration hierarchy
[edit]
root# edit interfaces ge-0/0/0
[edit interfaces ge-0/0/0]

# Move up levels
root# up
[edit interfaces]

# Go to top level
root# top
[edit]

# Edit specific path
root# edit protocols bgp group external-peers
[edit protocols bgp group external-peers]

3

Making Changes

# Set configuration values
[edit]
root# set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24
root# set interfaces ge-0/0/0 description "Connection to Core Switch"
root# set protocols ospf area 0.0.0.0 interface ge-0/0/0.0

# Delete configuration
root# delete interfaces ge-0/0/1
root# delete protocols bgp group external-peers neighbor 10.1.1.2

# Show configuration changes
root# show | compare

4

Committing Changes

# Check configuration syntax
root# commit check

# Commit with comment
root# commit comment "Added new OSPF interface"

# Commit and exit configuration mode
root# commit and-quit

# Commit with confirmation (auto-rollback if no confirm)
root# commit confirmed 5
root# commit    # Confirm within 5 minutes

Shell Mode

Access to underlying FreeBSD system:

# Enter shell from CLI
root> start shell
% 

# Common shell operations
root@% pwd                           # Current directory
root@% ls /config/                   # Configuration files
root@% tail -f /var/log/messages     # Follow log files
root@% ps aux | grep rpd             # Check routing process

# Return to CLI
root@% exit
root>

# Run single shell command from CLI
root> start shell command "df -h"

---

Command Structure and Syntax

Command Hierarchy

JunOS uses a logical, hierarchical command structure:

# Command structure: verb noun [options] [modifiers]
root> show interfaces ge-0/0/0 terse
root> show route protocol ospf extensive
root> show system processes extensive
root> clear interface statistics ge-0/0/0

# Configuration structure: action path value
[edit]
root# set interfaces ge-0/0/0 unit 0 family inet address 10.1.1.1/24
root# set protocols ospf area 0.0.0.0 interface ge-0/0/0.0

Context-Sensitive Help

# Get help at any command level
root> show ?                         # Available show commands
root> show interfaces ?              # Interface-specific options
root> show interfaces ge-0/0/0 ?     # Options for specific interface

# In configuration mode
[edit]
root# set interfaces ?               # Available interface types
root# set interfaces ge-0/0/0 ?      # Configuration options

Command Completion and Abbreviation

# Tab completion
root> show int<TAB>                  # Completes to "interfaces"
root> show interfaces ge-<TAB>       # Shows available interfaces

# Command abbreviation (minimum unique characters)
root> sh int terse                   # Same as "show interfaces terse"
root> sh ro pro os                   # Same as "show route protocol ospf"

# Configuration abbreviation
[edit]
root# set int ge-0/0/0 des "Link to core"    # Abbreviated form

---

User Management and Authentication

Default User Account

# Initial root account (no password)
login: root
Password: [Enter]

# Must set password for network access
[edit]
root# set system root-authentication plain-text-password
New password: YourSecurePassword123!
Retype new password: YourSecurePassword123!

Creating Additional Users

User Account Configuration

# Create new user account
[edit]
root# set system login user netadmin class super-user
root# set system login user netadmin authentication plain-text-password
New password: [enter password]

# Set authentication method
root# set system login user netadmin authentication ssh-rsa "ssh-rsa AAAAB3NzaC1yc2E..."

# User with limited privileges
root# set system login user operator class operator
root# set system login user readonly class read-only

User Classes and Permissions

# Built-in user classes
root# show system login class

# super-user: Full administrative access
# operator: Limited operational commands
# read-only: View-only access
# unauthorized: No access (default)

# Custom user class
[edit]
root# set system login class network-admin permissions [ configure view ]
root# set system login class network-admin allow-commands "clear interface statistics.*"
root# set system login class network-admin deny-commands "request system halt"

Authentication Methods

Local Authentication

# Local password authentication
[edit]
root# set system login user admin authentication plain-text-password
root# set system login user admin class super-user

# Encrypted password (from CLI)
root# set system login user admin authentication encrypted-password "$1$salt$hash"

SSH Key Authentication

RADIUS/TACACS+

---

Advanced CLI Features

Output Modifiers and Pipes

# Display modifiers
root> show configuration | display set          # Show as set commands
root> show interfaces | display xml             # XML output format
root> show route | display json                 # JSON output format

# Pipe modifiers  
root> show route | match "10.1"                 # Filter matching lines
root> show log messages | last 50               # Show last 50 lines
root> show interfaces | except "Administratively down"   # Exclude lines
root> show configuration | find "bgp"           # Search for text

# Save output to file
root> show configuration | save /var/tmp/config.txt

Command History and Aliases

# Command history navigation
# Up arrow or Ctrl+P: Previous command
# Down arrow or Ctrl+N: Next command
# Ctrl+R: Search command history

# Set command aliases (in configuration)
[edit]
root# set system login user admin cli alias "sr" "show route"
root# set system login user admin cli alias "si" "show interfaces terse"

# Using aliases
root> sr protocol ospf          # Expands to "show route protocol ospf"
root> si | match ge-            # Expands to "show interfaces terse | match ge-"

Screen and Session Management

GNU Screen

For managing multiple persistent sessions:

# Start screen session
root@% screen -S junos-config

# Detach from screen (Ctrl+A, then D)
# Reattach to screen
root@% screen -r junos-config

# List screen sessions
root@% screen -ls

# Screen with logging
root@% screen -L -S logged-session

tmux Alternative

---

Configuration Management

Configuration Database

JunOS maintains multiple configuration versions:

# View configuration history
root> show system commit

# View specific configuration version
root> show configuration | display set | no-more

# Compare configurations
root> show system rollback 1 compare 0       # Compare with previous
root> show system rollback 5                 # View 5 commits ago

# Load previous configuration
root> configure
[edit]
root# rollback 1                             # Load previous config
root# commit check                           # Verify before committing

Configuration Backup and Restore

1

Manual Backup

# Save configuration to file
root> show configuration | display set | save /var/tmp/backup-config.txt

# Save to remote server
root> file copy /config/juniper.conf.gz scp://user@server:/backups/

# Archive configuration
root> request system snapshot slice alternate

2

Automated Backup

# Configure automatic backup
[edit]
root# set system archival configuration transfer-on-commit
root# set system archival configuration archive-sites "scp://backup@server/configs/"
root# set system archival configuration transfer-interval 60

# Event-based backup
root# set event-options destinations backup-server 192.168.1.100
root# set event-options event-script file config-backup.py

---

Best Practices for Professional Network Management

Session Management

• Use persistent sessions (screen/tmux) for long configurations

• Lock configuration mode when making extensive changes

• Set session timeouts appropriately for security

• Document changes with commit comments

• Test changes in lab environment first

Security Practices

• Change default passwords immediately after installation

• Use SSH keys instead of passwords where possible

• Limit user access with appropriate class assignments

• Enable command logging for audit trails

• Regularly review user accounts and permissions

Operational Workflow

# Professional configuration workflow
root> configure exclusive                     # Lock configuration
[edit]
root# load merge terminal                     # Load prepared config
[Type configuration, end with ^D]

root# show | compare                         # Review changes
root# commit check                           # Validate configuration
root# commit comment "Ticket #12345: Added OSPF area 1 interfaces"
root# exit                                   # Release lock

Monitoring and Troubleshooting

Professional Tips:

• Use monitor traffic for real-time packet analysis

• Leverage show log messages | match error for quick problem identification

• Set up show interfaces diagnostics optics for fiber link monitoring

• Use request support information for comprehensive system diagnostics

• Always maintain rescue configuration for emergency recovery

---

Emergency Procedures

Password Recovery

# Boot to single-user mode (console required)
# Press space bar during boot when prompted
# Select: Boot [S]ingle User

# Mount file systems and start recovery
mount /dev/ad0s1a /
mount /dev/ad0s1e /var
mount /dev/ad0s1f /config

# Start CLI and reset password
cli
> configure  
[edit]
root# delete system root-authentication
root# set system root-authentication plain-text-password
root# commit and-quit

Configuration Recovery

# Load rescue configuration
root> request system configuration rescue save    # Save current as rescue
root> configure
[edit]
root# rollback rescue                            # Load rescue config
root# commit and-quit

# Factory default (emergency only)  
root> request system zeroize
# Warning: This erases all configuration and reboots device

Emergency Access: Always maintain console access capability and rescue configurations. Network-based recovery procedures require existing network connectivity.