Users might often need to run CLI commands on the backup Routing Engine from the primary Routing Engine, especially in some scripts. However, few CLI commands have built in an option to specify where to execute the command (such as the show version invoke-on other-routing-engine ).
show version invoke-on other-routing-engine
This article details how to execute any CLI command on the backup RE from the primary RE by using the SSH tool.
The RE in MX routers runs FreeBSD or Linux OS and Junos OS runs on top of these operating systems. So in many aspects, the same management commands can be used for the RE as for any FreeBSD/Linux host. In this article, the SSH tool will be used to run commands from one RE on the other RE.
To run any command from one RE (RE0 - primary, in this example) on another RE (RE1 - backup, in this example), the following approach can be used:
{MASTER} user@router-re0> start shell % ssh -JU __juniper_private1__ 10.0.0.5 "show interfaces terse" Password: Interface Admin Link Proto Local Remote lc-0/0/0 up up lc-0/0/0.32769 up up vpls pfe-0/0/0 up up pfe-0/0/0.16383 up up inet inet6
Here RE0 can access RE1 because the EM0 interface on RE0 is connected via an internal Ethernet switch on the Control Board 0 (CB0) to the EM1 interface on RE1. EM0 on RE0 has the IP address 10.0.0.4/8 and EM1 on RE1 has the IP address 10.0.0.5/8. These interfaces are in the __juniper_private1__ routing instance, so the option "-JU __juniper_private1__" is used.
The command (here show interfaces terse ) is executed in the default shell of the user ("user" in this example). Note that the default shell for the user root is the Unix shell (csh for example), whereas for other users, the default shell is Junos OS CLI. So to run Junos OS CLI commands (such as show interface terse ), use non-root users. At the same time, the root account can be used to run UNIX shell commands, for example:
show interfaces terse
root
show interface terse
ssh -JU __juniper_private1__ [email protected] "ifconfig"
If you need to run Junos OS CLI commands from the root account, use the following syntax:
ssh -JU __juniper_private1__ [email protected] "cli -c 'show interfaces terse'"
Other common options can be used with SSH to run commands on the adjacent RE. For example, if you want several commands to be executed, the commands should be delimited with a semicolon:
% ssh -JU __juniper_private1__ [email protected] "show interfaces terse; show route"
Further the procedure can be improved upon by configuring public/private key authentication for SSH to avoid password requests as follows:
Generate public/private keys on RE0. Use an empty password to protect the private key and avoid any password prompt during authentication:
% ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/var/home/labroot/.ssh/id_rsa): Created directory '/var/home/labroot/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /var/home/labroot/.ssh/id_rsa. Your public key has been saved in /var/home/labroot/.ssh/id_rsa.pub. The key fingerprint is: SHA256:nlmbdMfx9MA7GPgXR8yrf6ucoaQI1nyHV68cRqgpTpc labroot@jtac-mx480-r2013-re0 The key's randomart image is: +---[RSA 2048]----+ | o.| | . . .o| | . . = +| | ..+ X.| | S o.+oB o| | o. ==+o+.. | | o =+Eo+ +.. | | . + = = = =..| | o . . *..o| +----[SHA256]-----+ Generated SSH key file /var/home/labroot/.ssh/id_rsa.pub with fingerprint SHA256:nlmbdMfx9MA7GPgXR8yrf6ucoaQI1nyHV68cRqgpTpc
Use the following command to see the generated public key:
% cat ~/.ssh/id_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCi6SaM1iWFKj7eYzAtiBCNg/Edpxwl841QvGbbs9bNxlNJoEL+KpLp6QYnFrBsRVrPnslNcI02lTIMR/cBNW7yBhu7e+9m5ejJYc4RY6LkAcBf+LtEMNX4zexHiAJUGeTyMJRtryxYQqHeYn3WKaJovS6yIoUUUi3/DlLXBkF+S6rMUDMjKQt2YqLVAn0EAOH862g/LmT2Y3DX0lg+l/mSKSVH1MQU3vi/I+t1GTiAKW/5yj/IpV6gv/LSq0YdxnfnPlgeAWK+0zhghvp1RNoiejw7r3bR3iMF+dQvsUcMv/eOD1K8gSPyxi2eZ0112PdBon cvo+leOQ5dN8vvvqOr user@router
Save the generated public key on RE1:
Log in to RE1 by using the user account for which the public/private keys were generated in Step 2 and start the Unix shell:
{MASTER} user@router-re1> start shell
Make the .ssh directory if it does not exist yet:
.ssh
% mkdir .ssh
Copy the generated public key to the authorized_keys file:
authorized_keys
% vi .ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCi6SaM1iWFKj7eYzAtiBCNg/Edpxwl841QvGbbs9bNxlNJoEL+KpLp6QYnFrBsRVrPnslNcI02lTIMR/cBNW7yBhu7e+9m5ejJYc4RY6LkAcBf+LtEMNX4zexHiAJUGeTyMJRtryxYQqHeYn3WKaJovS6yIoUUUi3/DlLXBkF+S6rMUDMjKQt2YqLVAn0EAOH862g/LmT2Y3DX0lg+l/mSKSVH1MQU3vi/I+t1GTiAKW/5yj/IpV6gv/LSq0YdxnfnPlgeAWK+0zhghvp1RNoiejw7r3bR3iMF+dQvsUcMv/eOD1K8gSPyxi2eZ0112PdBon cvo+leOQ5dN8vvvqOr user@router
After this, SSH will try to use the private key for authentication first, so there will be no password prompt:
% ssh -JU __juniper_private1__ 10.0.0.5 "show interfaces terse" Interface Admin Link Proto Local Remote lc-0/0/0 up up lc-0/0/0.32769 up up vpls pfe-0/0/0 up up pfe-0/0/0.16383 up up inet inet6 pfh-0/0/0 up up pfh-0/0/0.16383 up up inet pfh-0/0/0.16384 up up inet ge-0/2/0 up up ge-0/2/0.16386 up up lc-0/2/0 up up lc-0/2/0.32769 up up vpls pfe-0/2/0 up up pfe-0/2/0.16383 up up inet inet6