Instead of manually checking for unsupported or service-impacting configurations, a commit script can be used to automatically identify unwanted configurations and prevent their commit.

This article introduces a Python script, which implements a customized and specific commit check that gets triggered upon configuration commit or commit check.

To demonstrate this script, the article uses the example of a syslog/log under a firewall filter that is expected to cause issues on the production unit and that must, therefore, be prevented from being committed.

The example script identifies which of the firewall filters has syslog/log configured and gives a commit warning for "syslog" and commit error for "log" as demonstrated below.

1. Write the Python script that gets executed when a commit or commit check is issued.

RE0 > start shell user root
% cd /var/db/scripts/commit/
% vi no_firewall_syslog.py   <--you can name anyname. Make sure its ended with .py.

Insert the following lines:

from junos import Junos_Context
from junos import Junos_Configuration
from jnpr.junos import Device
import jcs
def main():
    root = Junos_Configuration
    for element in root.xpath("./firewall/family/inet/filter"):
        filter_name = element.find('name').text
        if element.find("term/then/syslog") != None :
           jcs.emit_warning("Please remove syslog under firewall filters......:{}".format(filter_name))
        if element.find("term/then/log") != None :
           jcs.emit_error("Please remove log under firewall filters.....{}".format(filter_name))  
if __name__ == '__main__':
    main()
:wq! <saves>

%cli

2. Configure Python and enable the script. Commit the configuration.

# ​set system scripts language python
#​ set system scripts commit file no_firewall_syslog.py  

Example configuration

show firewall 
family inet {
    filter LOG_ALL {
        term 1 {
            then {
                log;
                accept;
            }
        }
    }
    filter SYSLOG_ALL {
        term 1 {
            then {
                syslog;
                accept;
            }
        }
    }

The following warning/error will be displayed when you try to commit the above configuration.

error: Please remove log under firewall filters.....LOG_ALL
warning: Please remove syslog under firewall filters......:SYSLOG_ALL
error: 1 error reported by commit scripts
error: commit script failure