close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

outbound-ssh

date_range 16-Jan-25

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
outbound-ssh {
    client client-id {
        address {
            port port-number;
            retry number;
            timeout seconds;
        }
        device-id device-id;
        keep-alive {
            retry number;
            timeout seconds;
        }
        proxy-server {
            dhcp;
            static {
                host hostname;
                port port-number;
                proxy-authorization {
                    password password;
                    user username;
                }
            }
        }
        reconnect-strategy (in-order | sticky);
        routing-instance routing-instance-name;
        secret password;
        services  netconf;
    }
    traceoptions {
        file <filename> <files number> <match regular-expression> <size size> <(world-readable | no-world-readable)>;
        flag flag;
        no-remote-trace;
    }
}
            

Hierarchy Level

content_copy zoom_out_map
[edit system services]

Description

Configure a device running the Junos OS behind a firewall to initiate outbound SSH connections to communicate with client management applications on the other side of the firewall.

Options

client `client-id`	Defines a device-initiated connection. This value serves to uniquely identify the outbound-ssh configuration stanza. Each outbound-ssh stanza represents a single outbound SSH connection. Thus, the administrator is free to assign the client-id any meaningful unique value. This attribute is not sent to the client management application.
`address`	Hostname, IPv4 address, or IPv6 address of the management application server. Note: Starting in Release 15.1, Junos OS supports outbound SSH connections with devices having IPv6 addresses. Syntax: You can list multiple servers by adding each server’s IP address or hostname along with the following connection parameters: port `port-number`—Specifies the port number at which a server listens for outbound SSH connection requests. Default: port 22 retry `number`—Specifies the maximum number of times the device attempts to establish an outbound SSH connection before giving up. Default: 3 attempts timeout `seconds`—Specifies how long the device waits between attempts to reconnect to the specified IP address to establish an outbound SSH connection before giving up. Default: 15 seconds
device `device-id`	(Required) Identifies the device to the management application. Each time the device establishes an outbound SSH connection, it first sends an initiation sequence (device-id) to the management application.
keep-alive	(Optional) When configured, specifies that the device should send SSH protocol keepalive messages to the management application. Syntax: To configure keepalive messages, you must set both the retry and timeout attributes: retry `number`—specifies how many keepalive messages the device sends without receiving a response from the application. When that number is exceeded, the device disconnects from the application, ending the outbound SSH connection. Default: 3 attempts timeout `seconds`—specifies how long the device waits to receive data before sending a request for acknowledgment from the application. Default: 15 seconds
proxy-server (dhcp\|static)	Specify the method used to connect via an HTTP proxy server. Values: Two methods are available: dhcp—Fetch the proxy server information from the DHCP configuration. static—Configure a static proxy server.
reconnect-strategy (in-order\|sticky)	(Optional) Specify the method the device uses to reestablish a disconnected outbound SSH connection. Values: Two methods are available: in-order—Configures the device to reconnect to the first configured server. If this server is unavailable, the device tries to connect to the next configured server. The device keeps trying each server in the configured list until the device can establish a connection. sticky—Specify that the device should first attempt to reconnect to the management server from which it disconnected. If that server is unavailable, the device then attempts to connect to the next configured server. The device keeps trying each server in the configured list until the device can establish a connection.
routing-instance `routing-instance-name`	(SRX Series and MX Series only) Specify the name of the routing instance on which the outbound SSH connection needs to be established. If you do not specify a routing instance, your device will establish the outbound SSH connection using the default routing table.
secret `password`	Configures the device to send the device’s public SSH host key when the device connects to the management server. This is the recommended method of maintaining a current copy of the device’s public key.
services `netconf`	Configures the management application to accept NETCONF as an available service.

The remaining statements are explained separately. Search for a statement in CLI Explorer or click a linked statement in the Syntax section for details.

Required Privilege Level

interface—To view this statement in the configuration.

interface-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 8.4.

Support for IPv6 addresses added in Junos OS Release 12.1X47-D15.

routing-instance option introduced in Junos OS Release 19.3R1 for SRX Series and MX Series devices.

arrow_backward PREVIOUS outbound-route-filter

NEXT arrow_forward outer-tag-protocol-id (RFC 2544 Benchmarking)

Junos CLI Reference

ON THIS PAGE