Junos Automation Stack Overview
Junos offers a rich automation ecosystem: PyEZ (Python library for NETCONF), JSNAPy (snapshot testing), Ansible modules, OpenConfig data models, and on-box scripts (op, event, commit). All mechanisms build on NETCONF/YANG for programmability - you can write the same config via CLI, REST API, NETCONF RPC, or PyEZ helper.
NETCONF / YANG
SSH-based RPC protocol, XML payloads, structured data models. Port 830.
OpenConfig
Vendor-neutral YANG models for interfaces, BGP, system. Supported on Junos 17+.
gRPC / gNMI
Streaming telemetry and config via gRPC Network Management Interface.
# Enable NETCONF over SSH
set system services netconf ssh port 830
set system services ssh
# Enable gRPC telemetry
set system services extension-service request-response grpc clear-text port 9339
PyEZ - Python for Junos Automation
Juniper PyEZ (jnpr.junos) is the official Python library for managing Junos devices over NETCONF. It abstracts low-level RPCs into Pythonic objects - Device, Table, View, and Config - making it ideal for scripts, test harnesses, and CI/CD pipelines. Install via pip install junos-eznc.
from jnpr.junos import Device
from jnpr.junos.utils.config import Config
from jnpr.junos.exception import CommitError, LockError
# Connect and audit a policy
with Device(host='srx1.example.com', user='admin', passwd='Juniper123') as dev:
facts = dev.facts
print(f"Model: {facts['model']}, Version: {facts['version']}")
# Retrieve running config
cfg = dev.rpc.get_config(filter_xml='')
# Operational RPC - count IPsec tunnels
ipsec = dev.rpc.get_ipsec_security_associations_information()
tunnels = ipsec.findall('ipsec-security-associations-block')
print(f"Active IPsec SAs: {len(tunnels)}")
# Push a config change (atomic load-merge + commit)
config_snippet = '''
security {
policies {
from-zone trust to-zone untrust {
policy ALLOW-NEW {
match {
source-address any;
destination-address any;
application junos-https;
}
then { permit; log { session-close; } }
}
}
}
}
'''
with Device(host='srx1.example.com', user='admin', passwd='Juniper123') as dev:
with Config(dev, mode='exclusive') as cu:
cu.load(config_snippet, format='text', merge=True)
cu.commit_check()
cu.commit(comment='Add HTTPS allow via PyEZ')
JSNAPy - Pre/Post Change Validation
JSNAPy (Junos SNAPshot administrator in Python) captures operational state snapshots before and after a change and diffs them. Use it to assert that OSPF neighbors are still up, tunnel counts are unchanged, interface errors have not increased - turning manual verification into automated test suites.
# JSNAPy test file: check_ospf.yml
tests_include:
- test_ospf_neighbors
test_ospf_neighbors:
- command: show ospf neighbor
- iterate:
xpath: '//ospf-neighbor'
tests:
- is-equal: ospf-neighbor-state, Full
err: "OSPF neighbor {{post['neighbor-address']}} is {{post['ospf-neighbor-state']}}"
info: "OSPF neighbor {{post['neighbor-address']}} is Full"
# Run pre-snap, make change, run post-snap + diff
jsnapy --snap pre -f config.yml
jsnapy --snap post -f config.yml
jsnapy --check pre post -f config.yml
On-Box Scripts: Op, Event, Commit
Junos runs SLAX, XSLT, or Python scripts directly on the device. Op scripts are invoked manually to simplify operations. Event scripts trigger on syslog patterns (e.g., interface down). Commit scripts validate or transform candidate configs before commit - blocking non-compliant changes.
# Enable Python scripts
set system scripts language python3
set system scripts op file show_tunnels.py
set system scripts commit file enforce_logging.py
# Event script on OSPF adjacency loss
set event-options policy OSPF-DOWN events ospf_neighbor_down
set event-options policy OSPF-DOWN then event-script ospf_recover.py
# Commit script example (Python) - enforce session-close logging on all policies
from junos import Junos_Context
import jcs
def main():
conf = jcs.get_config()
for policy in conf.xpath('//security/policies/policy'):
if not policy.xpath('.//log/session-close'):
jcs.emit_error(f"Policy {policy.find('name').text} missing session-close log")
if __name__ == '__main__':
main()
Ansible & Junos Space Workflows
The juniper.device Ansible collection provides modules (config, facts, rpc, software) for Junos automation. Combined with Junos Space Security Director REST APIs, entire policy change workflows - from ticket ingestion to multi-device push to rollback - can be automated.
# Ansible playbook snippet - push policy to all SRX
- name: Deploy security policy
hosts: srx_fleet
connection: local
gather_facts: no
collections:
- juniper.device
tasks:
- name: Load config
juniper.device.config:
config_mode: exclusive
load: merge
src: "policies/{{ inventory_hostname }}.conf"
comment: "Automated push via Ansible"
commit: true
check: true
# Junos Space REST API - publish policy
curl -k -X POST \
-H "Content-Type: application/vnd.juniper.sd.fwpolicy-management.firewall-policy+json;version=1" \
-u super:juniper123 \
-d @policy.json \
https://space.example.com/api/juniper/sd/fwpolicy-management/firewall/policies
Monitoring & Telemetry
SRX supports multiple monitoring methods: classic SNMPv2/v3, syslog, sFlow (for flow visibility), and modern streaming telemetry via gRPC/gNMI with Junos Telemetry Interface (JTI). JTI pushes counters, session metrics, and BGP state at sub-second intervals to time-series databases like Prometheus or Kafka.
# SNMP v3
set snmp v3 usm local-engine user monitoruser authentication-sha authentication-password "Monitor!123"
set snmp v3 usm local-engine user monitoruser privacy-aes128 privacy-password "Privacy!123"
# Streaming telemetry (JTI via gRPC)
set services analytics streaming-server NMS remote-address 10.1.1.50 remote-port 50051
set services analytics export-profile PROF reporting-rate 60
set services analytics sensor INTF-STATS server-name NMS export-name PROF resource /junos/system/linecard/interface/
# sFlow for flow export
set protocols sflow collector 10.1.1.60 udp-port 6343
set protocols sflow interfaces ge-0/0/0
set protocols sflow sample-rate 1000
show services analytics streaming-server
show snmp v3
Troubleshooting Quick Reference
| Scenario | Command |
|---|
| Check session for a flow | show security flow session source-prefix 10.1.1.10 |
| Policy hit counts | show security policies hit-count |
| Live flow debug | set security flow traceoptions flag all |
| IPsec SA state | show security ipsec security-associations detail |
| IKE phase 1 debug | show security ike security-associations |
| CPU and memory | show chassis routing-engine |
| Data plane sessions/CPU | show security monitoring fpc 0 |
| ATP Cloud status | show services advanced-anti-malware status |
| Commit history | show system commit |