This article explains how to backup a configuration from a Juniper device to an archive site within the defined interval.
There are two methods to transfer a configuration backup from a Juniper device to an archive site.
Before proceeding with either of the above methods, establish an SSH trust between the Junos device and the archive site. This way, the Junos device can perform SSH login to the archive site without a password. This procedure is known as SSH public key authentication or SSH password-less authentication .
To backup the configuration to a remote server while executing a commit, refer to KB15399 - Back up/archive a configuration file to a remote server while executing commit [juniper.net]
To backup the configuration to a remote server using time-interval without any authentication, refer to KB27993 - Archiving configuration using "transfer-interval" statement [juniper.net]
(Take SRX for example.)
Here, Linux Server is our Archive site. Create a user in the Linux Server. E.g., admin
Create a Directory in the Linux Server. Make the “admin” as the owner of the directory and give relevant file permissions to receive the configuration backup from the Junos device.
In Junos device, generate the SSH key under the shell mode using the below command.(Must be root user.)
root@host# ssh-keygen
Note: By using the above command, the SSH key will be generated with RSA algorithm with a key length of 2048. You can also generate the key with a stronger key-length or using a different algorithm.
Locate the generated SSH key in the Junos device (/root/.ssh/id_rsa.pub) and transfer it to the Linux Server in the following location: /<USERNAME PATH>/.ssh/authorized_keys.
Example: root@host# scp /root/.ssh/id_rsa.pub [email protected]:/var/home/admin/.ssh/authorized_keys
Try to SSH your Linux Server from Junos device. You should be able to login without prompting for a password. Once this procedure is completed, use either transfer-on-commit or event-options to backup your configuration periodically to your archive site without login.
This method uses transfer-interval of 15 minutes. For example, for every 15 minutes, the configuration will be transferred to the archive site. If you intend to transfer the configuration upon every commit, then use the statement " set system archival configuration transfer-on-commit ".
set system archival configuration transfer-interval 15 set system archival configuration archive-sites "scp://[email protected]:/var/tmp/config-archival"
If the archival is successful, the log below will be in the messages file with the device's hostname appended to it.
Apr 4 09:05:10 HOSTNAME logger: transfer-file: Transferred /var/transfer/config/SRX_20210404_090448_juniper.conf.gz
The maximum transfer-interval using the above system archival configuration method is 2880 minutes, which is 48 hours. If the customer has a requirement where he/she would like to backup the configuration every week, then it is not possible to do so with the above method. For this purpose, we are using event-options with the time-interval of 604800 seconds which is 1 week.
set event-options generate-event CONFIG-ARCHIVAL time-interval 604800 set event-options policy CONFIG-ARCHIVAL-POLICY events CONFIG-ARCHIVAL set event-options policy CONFIG-ARCHIVAL-POLICY then upload filename /config/juniper.conf.gz destination MY-DESTINATION set event-options destinations MY-DESTINATION archive-sites "scp://[email protected]:/var/tmp/config-archival/"
If the archival is successful via event-options, the log below will be in the messages file:
Apr 4 09:14:06 HOSTNAME root: transfer-file: Transferred /config/juniper.conf.gz
Note: With both methods, the " set security ssh-known-hosts host <x.x.x.x> . . . " line will be added automatically once the SCP archive-site is configured.