Connect to Junos Devices Using Junos PyEZ

The Junos PyEZ Device class supports using SSH to connect to a Junos device. You can establish a NETCONF session over SSH with the device’s management interface or you can establish an SSH connection with a console server that is directly connected to the device’s CONSOLE port. The SSH server must be able to authenticate the user using standard SSH authentication mechanisms, as described in Authenticate Junos PyEZ Users. To establish a NETCONF session over SSH, you must also satisfy the requirements outlined in Set Up Junos PyEZ Managed Nodes.

Junos PyEZ automatically queries the default SSH configuration file at ~/.ssh/config, if one exists. When using SSH to connect to a Junos device or to a console server connected to the device, Junos PyEZ first attempts SSH public key-based authentication and then tries password-based authentication. When password-based authentication is used, the supplied password is used as the device password. When SSH keys are in use, the supplied password is used as the passphrase for unlocking the private key. If the SSH private key has an empty passphrase, then a password is not required. However, SSH private keys with empty passphrases are not recommended.

To establish a NETCONF session over SSH with a Junos device and print the device facts in a Junos PyEZ application using Python 3:

You can configure a Junos device to initiate a TCP/IP connection with a client management application that would be blocked if the client attempted to initiate the connection (for example, if the device is behind a firewall). The outbound-ssh configuration instructs the device to create a TCP/IP connection with the client management application and to forward the identity of the device. Once the connection is established, the management application acts as the client and initiates the SSH sequence, and the Junos device acts as the server and authenticates the client.

To configure the Junos device for outbound SSH connections, include the outbound-ssh statement at the [edit system services] hierarchy level. In the following example, the Junos device attempts to initiate a connection with the host at 198.51.100.101 on port 2200:

user@router1> show configuration system services outbound-ssh
  client nms1 {
    device-id router1;
    secret "$9$h1/ceWbs4UDkGD/Cpu1I-Vb"; ## SECRET-DATA
    services netconf;
    198.51.100.101 port 2200;
  }

To establish a connection with the Junos device using outbound SSH, the Junos PyEZ application sets the sock_fd argument in the Device constructor equal to the file descriptor of an existing socket and either omits the host argument or sets it to None.

The following Junos PyEZ example listens on the configured TCP port for incoming SSH sessions from Junos devices. The application accepts an incoming connection and retrieves the socket’s file descriptor for that connection, which is used for the value of the sock_fd argument. The client application establishes the SSH connection with the device, collects and prints the device facts, disconnects from the device, and waits for more connections.

import socket
from jnpr.junos import Device
from jnpr.junos.exception import ConnectError
from getpass import getpass
from pprint import pprint

"""
  Listen on TCP port 2200 for incoming SSH session with a Junos device. 
  Upon connecting, collect and print the devices facts, 
  then disconnect from that device and wait for more connections.
"""

def launch_junos_proxy(client, addr):
    val = {
            'MSG-ID': None,
            'MSG-VER': None,
            'DEVICE-ID': None,
            'HOST-KEY': None,
            'HMAC': None
            }

    msg = ''
    count = 0

    while count < 5:
        c = client.recv(1)
        c = c.decode("utf-8")
        msg += str(c)
        if c == '\n':
            count += 1

    for line in msg.splitlines():
        (key, value) = line.split(': ')
        val[key] = value
        print("{}: {}".format(key, val[key]))

    return client.fileno()


def main():
    
    PORT = 2200

    junos_username = input('Junos OS username: ')
    junos_password = getpass('Junos OS password: ')

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

    s.bind(('', PORT))
    s.listen(5)
    print('\nListening on port %d for incoming sessions ...' % (PORT))

    sock_fd = 0    
    while True:
        client, addr = s.accept()
        print('\nGot a connection from %s:%d' % (addr[0], addr[1]))
        sock_fd = launch_junos_proxy(client, addr)

        print('Logging in ...')
        try:
            with Device(host=None, sock_fd=sock_fd, user=junos_username, passwd=junos_password) as dev:
                pprint(dev.facts)
        except ConnectError as err:
            print ("Cannot connect to device: {0}".format(err))                

if __name__ == "__main__":
    main()

user@nms1:~$ python3 junos-pyez-outbound-ssh.py
Junos OS username: user
Junos OS password:

Listening on port 2200 for incoming sessions ...

Got a connection from 10.10.0.5:57881
MSG-ID : DEVICE-CONN-INFO
MSG-VER : V1
DEVICE-ID : router1
HOST-KEY : ssh-rsa AAAAB...0aF4Mk=
HMAC : 4e61201ec27a8312104f63bfaf77a4478a892c82
Logging in ...
{'2RE': True,
 'HOME': '/var/home/user',
 'RE0': {'last_reboot_reason': 'Router rebooted after a normal shutdown.',
         'mastership_state': 'master',
         'model': 'RE-MX-104',
         'status': 'OK',
         'up_time': '2 days, 6 hours, 22 minutes, 22 seconds'},
 'RE1': {'last_reboot_reason': 'Router rebooted after a normal shutdown.',
         'mastership_state': 'backup',
         'model': 'RE-MX-104',
         'status': 'OK',
         'up_time': '2 days, 6 hours, 22 minutes, 12 seconds'},
 'RE_hw_mi': False,
 'current_re': ['re0', 'master', 'node', 'fwdd', 'member', 'pfem'],
 'domain': 'example.com',
 'fqdn': 'router1.example.com',
 'hostname': 'router1',
...

For detailed information about configuring outbound SSH on Junos devices, see Configure Outbound SSH Service.

The Junos PyEZ Device class supports connecting to a Junos device using telnet, which provides unencrypted access to the network device. You can telnet to the device’s management interface or to a console server that is directly connected to the device’s CONSOLE port. You must configure the Telnet service at the [edit system services] hierarchy level on all devices that require access to the management interface. Accessing the device through a console server enables you to initially configure a new or zeroized device that is not yet configured for remote access.

To use Junos PyEZ to telnet to a Junos device, you must include mode='telnet' in the Device argument list, and optionally include the port parameter to specify a port. When you specify mode='telnet' but omit the port parameter, the value for port defaults to 23. When the application connects through a console server, specify the port through which the console server connects to the Junos device.

To use Junos PyEZ to telnet to a Junos device and print the device facts in a Junos PyEZ application using Python 3:

The Junos PyEZ Device class enables you to connect to a Junos device using a serial console connection, which is useful when you must initially configure a new or zeroized device that is not yet configured for remote access. To use this connection method, you must be physically connected to the device through the CONSOLE port. For detailed instructions about connecting to the CONSOLE port on your device, see the hardware documentation for your specific device.

To use Junos PyEZ to connect to a Junos device through a serial console connection, you must include mode='serial' in the Device argument list, and optionally include the port parameter to specify a port. When you specify mode='serial' but omit the port parameter, the value for port defaults to /dev/ttyUSB0.

To connect to a Junos device using a serial console connection and also load and commit a configuration on the device in a Junos PyEZ application using Python 3: