Juniper Junos

---
name: juniper-junos
description: "Expert coverage of Juniper Junos OS across all versions: commit model, configuration hierarchy, MX/QFX/EX/SRX platforms, MPLS/L3VPN, EVPN-VXLAN, IS-IS/OSPF/BGP, Apstra fabric automation, Mist wired assurance, NETCONF/PyEZ, and Junos Evolved. Use for \"Junos\", \"Juniper\", \"MX series\", \"QFX\", \"EX switch\", \"SRX\", \"Apstra\", \"commit confirmed\", \"NETCONF Junos\", \"PyEZ\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `routing-switching` skill."
license: MIT
---

# Juniper Junos

This skill covers Juniper Junos OS across all supported versions (24.2R LTS, 24.4R feature). Areas of expertise include:

- FreeBSD-based Junos OS and Linux-based Junos Evolved (microservices architecture)
- Commit model: candidate vs active configuration, rollback history, commit confirmed
- Configuration hierarchy with set/delete/edit navigation
- MX series (service provider/enterprise routing), QFX series (data center switching), EX series (campus), SRX series (security)
- BGP (eBGP/iBGP, route reflectors, additional-paths), OSPF, IS-IS
- MPLS (LDP, RSVP-TE, Segment Routing SR-MPLS/SRv6), L2VPN (VPLS, EVPN-VPWS), L3VPN (RFC 4364)
- EVPN-VXLAN data center fabrics (ERB, CRB, VLAN-aware mode)
- Apstra 6.0 intent-based fabric automation (blueprints, probes, multi-vendor)
- Mist wired assurance for EX series (ZTP, SLE, Marvis AI, dynamic port profiles)
- NETCONF (RFC 6241), PyEZ automation library, gNMI telemetry
- Routing Engine / Packet Forwarding Engine separation, dual-RE redundancy

This skill's guidance spans Junos holistically. When a question is version-specific, consult the matching `references/versions/` file.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for show commands, commit history, log analysis
   - **Design / Architecture** -- Load `references/architecture.md` for platform selection, MPLS, EVPN-VXLAN, Apstra
   - **Best practices** -- Load `references/best-practices.md` for config hierarchy, commit safety, Apstra design, Mist
   - **Configuration** -- Apply Junos expertise directly using set commands and hierarchy
   - **Automation** -- Focus on NETCONF, PyEZ, gNMI, Apstra API

2. **Identify version** -- Determine Junos version (24.2R LTS vs 24.4R feature). Classic Junos vs Junos Evolved matters for platform selection and feature support.

3. **Identify platform** -- MX vs QFX vs EX vs SRX determines available features, ASIC capabilities, and forwarding scale. QFX5220/5240 run Junos EVO; MX/EX/SRX run classic Junos.

4. **Load context** -- Read the relevant reference file for deep knowledge.

5. **Recommend** -- Provide actionable, platform-specific guidance with Junos set commands and configuration hierarchy.

6. **Verify** -- Suggest validation steps with specific show commands.

## Core Architecture

### Junos OS Foundation

**Junos OS (Classic)**: Built on hardened FreeBSD. Monolithic kernel with Juniper extensions. Strict separation between Routing Engine (control plane) and Packet Forwarding Engine (data plane). RE runs routing processes (rpd, mgd, chassisd); PFE runs line-rate forwarding via ASICs.

**Junos OS Evolved**: Built on Linux (Ubuntu-based). Microservices architecture where routing protocols, management, and daemons run as independent processes. Process crashes are isolated. Available on QFX5220, QFX5240, PTX10000, ACX7000. Same CLI surface and commit model as classic Junos.

### RE/PFE Separation

- RE failure does not interrupt forwarding (Nonstop Forwarding / Graceful Restart)
- Dual RE platforms provide automatic failover with commit synchronize
- RE holds routing tables (inet.0, inet6.0, mpls.0); PFE holds forwarding tables pushed from RE

### Commit Model

The commit model is Junos's fundamental differentiator:

- **Candidate configuration**: working copy you edit; not active until committed
- **Active configuration**: running config stored in `/config/juniper.conf`
- `commit` activates the candidate; previous active becomes rollback 1
- Up to 50 rollback configurations stored
- `commit confirmed <minutes>`: auto-rollback if not re-confirmed -- prevents lockout
- `commit check`: validate syntax without activating
- `show | compare`: diff candidate vs active before committing

```
commit                          # activate candidate config
commit confirmed 5              # auto-rollback in 5 minutes if not confirmed
commit check                    # syntax validation only
rollback 1                      # load previous active into candidate
show | compare rollback 1       # diff candidate vs rollback 1
```

## Platform Families

### MX Series (Service Provider / Enterprise Routing)

MX204 (1U fixed, 400 GbE), MX480/960/10003 (modular chassis), MX2008/2010/2020 (carrier-class). Full Internet routing tables, MPLS/LDP/RSVP, L2/L3 VPN, Segment Routing, BFD, PTP/IEEE 1588.

### QFX Series (Data Center Switching)

QFX5110/5120 (ToR leaf 10/25/100 GbE), QFX5220/5240 (100/400 GbE, Junos EVO), QFX10002/10008/10016 (spine/core). Full EVPN-VXLAN, Apstra-qualified.

### EX Series (Campus)

EX2300 (entry-level PoE), EX3400 (stackable Virtual Chassis), EX4300/4400 (mid-range), EX4650 (25/100 GbE aggregation). Mist wired assurance integration.

### SRX Series (Security)

SRX300/380 (branch), SRX1500/4200/4600 (mid-range), SRX5000 (carrier-grade). Stateful firewall, IPS, AppID, UTM, IPsec/SSL VPN.

## Routing Protocols

### BGP

```
set protocols bgp group EXTERNAL type external
set protocols bgp group EXTERNAL peer-as 65002
set protocols bgp group EXTERNAL neighbor 192.168.1.2
set protocols bgp group EXTERNAL export SEND-ROUTES

# Route Reflector
set protocols bgp group INTERNAL type internal
set protocols bgp group INTERNAL local-address 10.0.0.1
set protocols bgp group INTERNAL cluster 10.0.0.1
set protocols bgp group INTERNAL neighbor 10.0.0.2
```

### IS-IS (Preferred for DC Fabrics)

```
set protocols isis interface ge-0/0/0.0 level 2 metric 10
set protocols isis interface lo0.0 passive
set protocols isis level 2 wide-metrics-only
```

### OSPF

```
set protocols ospf area 0.0.0.0 interface ge-0/0/0.0
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf export REDISTRIBUTE-DIRECT
```

## MPLS / L3VPN

```
# MPLS + LDP
set protocols mpls interface ge-0/0/0.0
set protocols ldp interface ge-0/0/0.0

# L3VPN instance
set routing-instances CUST-A instance-type vrf
set routing-instances CUST-A interface ge-0/1/0.0
set routing-instances CUST-A route-distinguisher 65001:100
set routing-instances CUST-A vrf-target target:65001:100
set routing-instances CUST-A protocols bgp group CE type external
set routing-instances CUST-A protocols bgp group CE neighbor 10.100.1.2 peer-as 65100
```

Junos supports LDP, RSVP-TE, Segment Routing (SR-MPLS, SRv6), L2VPN (VPLS, EVPN-VPWS), L3VPN (RFC 4364).

## EVPN-VXLAN

```
# Underlay BGP
set protocols bgp group UNDERLAY type external
set protocols bgp group UNDERLAY family inet unicast

# EVPN overlay
set protocols bgp group OVERLAY type internal
set protocols bgp group OVERLAY family evpn signaling

# VXLAN VNI
set vlans VLAN10 vlan-id 10
set vlans VLAN10 vxlan vni 10010

# EVPN instance
set routing-instances EVPN instance-type evpn
set routing-instances EVPN vlan-list VLAN10
set routing-instances EVPN vtep-source-interface lo0.0
```

**ERB (Edge-Routed Bridging)**: Distributed L3 gateways at each leaf; routes locally; preferred by Apstra.
**CRB (Centrally Routed Bridging)**: Routing at spine; simpler but creates a bottleneck.

## Policy Framework

Junos uses policy-statements for all route filtering, redistribution, and manipulation. Routes are NOT advertised or redistributed without explicit policy.

### Policy-Statement Structure

```
set policy-options policy-statement SEND-ROUTES term DIRECT from protocol direct
set policy-options policy-statement SEND-ROUTES term DIRECT then accept
set policy-options policy-statement SEND-ROUTES term DEFAULT then reject
```

### Common Policy Patterns

```
# Prefix list filtering
set policy-options prefix-list CUSTOMER-ROUTES 10.100.0.0/16
set policy-options policy-statement FILTER-CUSTOMER term 1 from prefix-list CUSTOMER-ROUTES
set policy-options policy-statement FILTER-CUSTOMER term 1 then accept
set policy-options policy-statement FILTER-CUSTOMER term DEFAULT then reject

# Community-based routing
set policy-options community BLACKHOLE members 65001:666
set policy-options policy-statement BLACKHOLE-FILTER term 1 from community BLACKHOLE
set policy-options policy-statement BLACKHOLE-FILTER term 1 then reject

# AS-path filtering
set policy-options as-path CUSTOMER-AS "65100+"
set policy-options policy-statement AS-FILTER term 1 from as-path CUSTOMER-AS
set policy-options policy-statement AS-FILTER term 1 then accept

# Route redistribution between protocols
set policy-options policy-statement OSPF-TO-BGP term 1 from protocol ospf
set policy-options policy-statement OSPF-TO-BGP term 1 from route-filter 10.0.0.0/8 orlonger
set policy-options policy-statement OSPF-TO-BGP term 1 then accept
set protocols bgp group EXTERNAL export OSPF-TO-BGP
```

### Import/Export Application

```
# BGP import policy (filter received routes)
set protocols bgp group TRANSIT import TRANSIT-IMPORT

# BGP export policy (filter advertised routes)
set protocols bgp group TRANSIT export TRANSIT-EXPORT

# OSPF export policy (redistribute into OSPF)
set protocols ospf export REDISTRIBUTE-STATIC
```

## Firewall Filters

Junos firewall filters provide packet filtering, rate limiting, and policing:

### Interface Filter

```
set firewall family inet filter INTERFACE-FILTER term ALLOW-ICMP from protocol icmp
set firewall family inet filter INTERFACE-FILTER term ALLOW-ICMP then accept
set firewall family inet filter INTERFACE-FILTER term ALLOW-BGP from protocol tcp
set firewall family inet filter INTERFACE-FILTER term ALLOW-BGP from destination-port bgp
set firewall family inet filter INTERFACE-FILTER term ALLOW-BGP then accept
set firewall family inet filter INTERFACE-FILTER term COUNT-ALL then count ALL-TRAFFIC
set firewall family inet filter INTERFACE-FILTER term COUNT-ALL then accept

set interfaces ge-0/0/0 unit 0 family inet filter input INTERFACE-FILTER
```

### Policer (Rate Limiting)

```
set firewall policer RATE-1G if-exceeding bandwidth-limit 1g burst-size-limit 100m
set firewall policer RATE-1G then discard

set firewall family inet filter POLICE-TRAFFIC term 1 then policer RATE-1G
set firewall family inet filter POLICE-TRAFFIC term 1 then accept
```

### Loopback Filter (RE Protection)

```
set firewall family inet filter PROTECT-RE term SSH from source-prefix-list MGMT-NETS
set firewall family inet filter PROTECT-RE term SSH from protocol tcp
set firewall family inet filter PROTECT-RE term SSH from destination-port ssh
set firewall family inet filter PROTECT-RE term SSH then accept
set firewall family inet filter PROTECT-RE term DENY then log
set firewall family inet filter PROTECT-RE term DENY then discard

set interfaces lo0 unit 0 family inet filter input PROTECT-RE
```

## Class of Service (QoS)

### Scheduler Configuration

```
set class-of-service schedulers BEST-EFFORT transmit-rate percent 30
set class-of-service schedulers BUSINESS transmit-rate percent 40
set class-of-service schedulers VOICE transmit-rate percent 20
set class-of-service schedulers NETWORK-CONTROL transmit-rate percent 10

set class-of-service scheduler-maps MY-MAP forwarding-class best-effort scheduler BEST-EFFORT
set class-of-service scheduler-maps MY-MAP forwarding-class business scheduler BUSINESS
set class-of-service scheduler-maps MY-MAP forwarding-class voice scheduler VOICE
set class-of-service scheduler-maps MY-MAP forwarding-class network-control scheduler NETWORK-CONTROL

set class-of-service interfaces ge-0/0/0 scheduler-map MY-MAP
```

## Automation

### NETCONF (RFC 6241)
```python
from ncclient import manager
with manager.connect(host='192.168.1.1', username='admin', password='pass') as m:
    config = m.get_config(source='running')
```

### PyEZ
```python
from jnpr.junos import Device
from jnpr.junos.utils.config import Config
dev = Device(host='192.168.1.1', user='admin', passwd='pass')
dev.open()
cu = Config(dev)
cu.load('set interfaces ge-0/0/0 description "Uplink"', format='set')
cu.pdiff()
cu.commit()
dev.close()
```

### Jinja2 Templates with PyEZ

```python
from jnpr.junos import Device
from jnpr.junos.utils.config import Config

template_vars = {
    'hostname': 'leaf-01',
    'loopback_ip': '10.0.0.1/32',
    'bgp_asn': '65001',
    'bgp_peers': [
        {'ip': '10.1.1.1', 'asn': '65000'},
        {'ip': '10.1.2.1', 'asn': '65000'}
    ]
}

dev = Device(host='192.168.1.1', user='admin', passwd='pass')
dev.open()
cu = Config(dev)
cu.load(template_path='templates/leaf.j2', template_vars=template_vars, format='set')
cu.pdiff()
cu.commit_check()
cu.commit(comment='Automated provisioning via PyEZ')
dev.close()
```

### gNMI Telemetry

gNMI streaming telemetry on Junos EVO platforms:
- **Get**: retrieve operational/config state
- **Set**: modify configuration
- **Subscribe**: streaming telemetry (SAMPLE, ON_CHANGE, ONCE)
- **Capabilities**: discover supported models and encodings

Supported on QFX5220/5240 and PTX10000 series (Junos EVO). OpenConfig YANG paths used for multi-vendor consistency.

## Security Hardening

### Management Access

```
set system services ssh protocol-version v2
set system services ssh root-login deny
set system services ssh rate-limit 5
delete system services telnet
set system login retry-options tries-before-disconnect 3
set system login retry-options backoff-threshold 1
set system login retry-options backoff-factor 10
```

### SNMP v3

```
set snmp v3 usm local-engine user MONITOR authentication-sha authentication-key <key>
set snmp v3 usm local-engine user MONITOR privacy-aes128 privacy-key <key>
set snmp v3 vacm access group MONITOR default-context-prefix security-model usm security-level privacy read-view ALL
```

### AAA with TACACS+

```
set system authentication-order [tacplus password]
set system tacplus-server 10.0.0.50 secret <secret>
set system tacplus-server 10.0.0.50 timeout 5
set system login user LOCAL-ADMIN class super-user authentication encrypted-password "<hash>"
```

### NTP

```
set system ntp server 10.0.0.100 prefer
set system ntp server 10.0.0.101
set system ntp authentication-key 1 type md5 value <key>
set system ntp trusted-key 1
set system ntp server 10.0.0.100 key 1
```

## Common Pitfalls

1. **Commit without `commit confirmed`** -- On remote devices, a misconfiguration can lock you out permanently. Always use `commit confirmed` with a short timer when making access-affecting changes.
2. **Forgetting `commit synchronize`** -- On dual-RE platforms, configurations can drift between REs if commit synchronize is not used. Enable with `set system commit synchronize`.
3. **ERB vs CRB mismatch in Apstra** -- Mixing ERB and CRB designs in the same fabric creates asymmetric routing. Choose one and apply consistently.
4. **IS-IS wide metrics** -- Classic IS-IS metrics are limited to 63. Always enable `wide-metrics-only` for modern deployments.
5. **Policy-statement required for route export** -- Junos does not redistribute routes by default. Every protocol redistribution requires an explicit export policy-statement.
6. **Junos EVO platform confusion** -- Not all QFX switches run Junos EVO. QFX5100/5110/5120 run classic Junos; QFX5220/5240 run EVO. Verify before applying EVO-specific guidance.

## Version-Specific Guidance

| Version | Reference | What's version-specific |
|---|---|---|
| 24.4 | `references/versions/24.4.md` | Current feature release; SRv6 uSID, EVPN Type-5 scale, BGP Flowspec, Apstra 6.0 qualification |

## Reference Files

Load these when you need deep knowledge for a specific area:

- `references/architecture.md` -- Commit model, Junos vs EVO, platform families, MPLS, EVPN-VXLAN, Apstra 6.0, Mist integration
- `references/diagnostics.md` -- Show commands, commit history, traceroute/ping, log messages, NETCONF debug
- `references/best-practices.md` -- Config hierarchy, commit confirmed, Apstra fabric design, Mist integration