Skip to main content

Devices / Vendors / Juniper

Create a read-only account on Juniper Junos

Create a Junos login class and account that let ITVA collect data from a Juniper device without permission to change it.

A read-only account lets ITVA collect data from a Juniper device without the permission to change it. In this guide, you create a login class and an account for ITVA, then connect the device to ITVA.

Before you begin

  • SSH is on, and the probe host can reach the device on the SSH port.
  • You can sign in to the device and commit configuration changes.

What ITVA needs

ITVA signs in with SSH and stays in operational mode. It runs show commands, including show configuration | display set. It also sets CLI options for the session, such as set cli screen-length 0.

The built-in read-only class has only the view permission, which cannot show the configuration. So you create a class that adds view-configuration. This permission shows the configuration with secrets hidden.

Create a login class

  1. Enter configuration mode.
configure
  1. Create the class.
set system login class itva-read-only permissions [ view view-configuration ]

Create the account

  1. Create the account. Replace <USERNAME> with the name of the account. Junos asks you for the password two times.
set system login user <USERNAME> class itva-read-only authentication plain-text-password
  1. Commit the change.
commit and-quit

Set up the device in ITVA

  1. In the portal, open the device and select Edit.
  2. In Credentials, add a credential with the Username and Password of the new account.
  3. Set Admin to No for this credential, because the account cannot change the device.
  4. Make sure Management Port is 22, or the SSH port that you set on the device.
  5. Select Save.

Check that it worked

  1. On the device page, open the actions menu and select Test Connection.
  2. Select Sync Data, then select Sync.
  3. Make sure the log shows sync succeeded lines and no sync failed lines.

Limits

This account supports syncing data only. ITVA tools that change the device need an account with more permissions. For example, OS upgrade validation and IS-IS interface changes do not work with this account.