How do you tell a Juniper router to do something without accidentally breaking the network? The Junos CLI (Command-Line Interface) is the keyboard-based control panel for Juniper devices, and it is split into two distinct modes: operational mode (for looking and troubleshooting) and configuration mode (for making changes). Mastering this split is the single most important foundation skill for the JNCIA-JUNOS exam because it keeps you from crashing a live network while you are just trying to check its pulse.
Jump to a section
A simple way to picture Junos OS CLI Fundamentals
Have you ever walked into a new restaurant and felt overwhelmed by the menu, not knowing whether you should talk to the host, the waiter, or just grab a seat yourself?
That is exactly how it feels when you first sit down at a Junos device. The Junos operating system gives you two very distinct menus, just like a restaurant has a menu for customers (what you can eat) and a separate menu for the kitchen staff (how the food is prepared).
In operational mode, you are the customer. You can ask questions like "What's the soup of the day?"—in Junos terms, that's "show interfaces terse". You can see what is happening, check the temperature of the kitchen, and verify orders are going out correctly. You cannot change the recipe; you can only observe and run diagnostics.
In configuration mode, you are the head chef in the kitchen. You walk into the back, put on your apron, and start changing the recipe card. You type "configure" and suddenly you can edit the actual settings—like changing the IP address of an interface, which is like swapping out the type of pasta in a dish. When you are done, you commit your changes, which is like sending the new menu to the printer. Until you commit, nobody sees your experimental recipe.
This two-mode design prevents a junior cook from accidentally deleting the signature dessert while they were just trying to check the stock. Junos forces you to be in the right room for the job, making it nearly impossible to break a running network by accident while you are only supposed to be looking at it.
When you first connect to a Juniper device—via a direct cable connection or over the network using SSH (Secure Shell, an encrypted way to log into a remote computer)—you land in operational mode. You know you are there because the prompt ends with a angle bracket, like this: "user@router>". In this mode, you can run commands that show you information, like "show interfaces" to see all network ports, "show configuration" to view the current settings, or "ping" to test if another device is reachable. You cannot change any settings here. Think of it as a library where you can read all the books but cannot write in the margins.
If you want to change any setting on the router—like assigning an IP address to an interface, setting up routing protocols, or enabling security features—you must enter configuration mode. You type the command "configure" (or the shortcut "conf") and the prompt changes to end with a hash symbol: "user@router#". The hash is your visual signal that you are now holding a red pen. Every change you make is held in a temporary workspace called the candidate configuration. The device is not running your changes yet; they are just a draft sitting on your desk. This is critical because it means you can edit without any risk to the live network.
Once you have made all your changes in configuration mode, you must type "commit" to activate them. The commit command takes your candidate configuration and applies it to the live, running configuration of the device. Until you commit, the device continues to run with its old settings. If you make a mistake you can type "rollback 0" to revert the candidate configuration back to the last committed version, effectively deleting your draft and starting over.
Why does Junos have two modes? Older networking operating systems from other vendors let you make changes directly while you were looking at the system, which meant a single mistyped command could bring down a network immediately. Junos separates the action of viewing from the action of editing, which is a huge safety net. It also allows multiple people to be in configuration mode at the same time—each person has their own candidate configuration, and they can merge their changes when they commit, though on the exam you will mostly focus on a single user scenario.
Here are the common commands you will use to navigate between and within these modes:
"show" commands: Always run from operational mode. Examples include "show interfaces terse", "show route", "show log messages". These display information but never change anything.
"set" commands: Run inside configuration mode. For example, "set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24" assigns an IP address. You type the exact value you want to add or change.
"edit" command: In configuration mode, "edit interfaces" moves you into the "interfaces" hierarchy, changing your prompt to "user@router# edit interfaces". This is like opening a specific drawer in a filing cabinet so you do not have to type the full path every time.
"top" command: In configuration mode, "top" jumps you back to the root of the configuration hierarchy, no matter how deep you have drilled down.
"run" command: You can temporarily run an operational mode command from within configuration mode by typing "run show interfaces". This is useful when you are editing a configuration and need to check the current state without leaving configuration mode.
"exit" command: In configuration mode, "exit" moves you up one level in the hierarchy. Type it enough times and you will return to operational mode.
"commit and-quit": This special command commits your changes and automatically exits configuration mode back to operational mode in one step.
To leave configuration mode without saving changes, you can type "exit" until you are back to operational mode, or type "rollback 0" to discard all uncommitted changes, then "exit". The system will not let you accidentally leave with uncommitted changes—it will ask if you want to discard them.
In summary, the two-mode system is a deliberate design choice by Juniper to make networks more stable. You look in operational mode, you edit in configuration mode, and you activate your edits with the commit command. This pattern is repeated in every Junos device you will encounter, from small branch routers to massive core switches.
Connect to the Junos device
Use an SSH client (like PuTTY on Windows or the terminal on Mac/Linux) to connect to the device's IP address. You will be prompted for a username and password. Once logged in, you land automatically in operational mode, indicated by the '>' at the end of the prompt.
Explore the current state with show commands
Before changing anything, run 'show interfaces terse' to see all network ports, 'show configuration' to view the current settings, and 'show log messages' to see recent events. This is your reconnaissance phase.
Enter configuration mode
Type 'configure' (or 'conf') and press Enter. The prompt changes from '>' to '#'. You are now in a sandbox where you can edit settings without affecting the live network.
Make changes using set, edit, and delete commands
Use 'set' to add or modify a setting (e.g., 'set system host-name Router1'), 'delete' to remove a setting, and 'edit' to navigate into a specific hierarchy (e.g., 'edit interfaces'). Changes are stored in the candidate configuration.
Validate your changes before committing
Type 'show | compare' to see a diff of what you changed, and 'commit check' to validate the syntax. If there are errors, fix them now. If everything looks good, you are ready to apply.
Commit the changes to make them live
Type 'commit' to apply the candidate configuration to the active configuration. The device immediately begins using the new settings. Alternatively, use 'commit and-quit' to commit and exit configuration mode in one command.
Return to operational mode and verify
After committing, type 'exit' if you are still in configuration mode. You should see the '>' prompt again. Run 'show interfaces terse' or other show commands to confirm your changes are active and working correctly.
Imagine you are the sole IT person at a medium-sized company, and the network goes down at 2 PM on a Tuesday. You are remote, working from home, and you need to log into the main router to find out what is wrong. You open a terminal emulator (like PuTTY or the built-in terminal on macOS/Linux) and SSH into the router's management IP address. You land in operational mode, prompt showing "admin@router>".
You immediately run "show interfaces terse" to see which ports are up and which are down. One of the WAN interfaces shows "down". You run "show log messages" to see recent system events, and you spot an error about a fibre link being unplugged. Now you know the problem—someone likely pulled the cable in the server room—but you cannot fix it from your keyboard. You call the office and ask someone to plug the cable back in. When they do, you run "show interfaces terse" again from operational mode and see the interface come back up. Crisis averted, and you never entered configuration mode because you did not need to change any settings.
Now, consider a different scenario. Your company is expanding to a new floor and needs a new subnet for the guest Wi-Fi. You schedule a maintenance window for midnight on Sunday. At 11:55 PM, you SSH into the router. You first check the current configuration by typing "show configuration | display set" (the pipe to "display set" shows the configuration in set command format, which is easier to read for changes). You see the existing VLAN and interface settings.
You then type "configure" and the prompt changes to "admin@router#". You enter the following commands:
"set interfaces ge-0/0/5 unit 0 family inet address 172.16.100.1/24"
"set security zones security-zone guest-vlan interfaces ge-0/0/5.0"
"set system services dhcp-server pool guest-wifi network 172.16.100.0/24"
Before committing, you decide to double-check your work. You type "show | compare" which highlights the differences between the candidate configuration and the active configuration. You see that you have added exactly the three lines you intended. Satisfied, you type "commit check"—this validates the syntax of your changes without applying them. It returns no errors. You then type "commit and-quit" to apply the changes and exit configuration mode.
You run "show interfaces terse" again from operational mode and see the new interface is up. You run "show dhcp server binding" to see that the DHCP server is active. You have successfully changed the live network without unplugging any cables or interrupting other users, because your changes were carefully prepared in the candidate configuration and only applied after validation.
The JNCIA-JUNOS exam tests your understanding of the two-mode architecture in several specific ways. You will not be asked to configure an entire router; instead, you will see multiple-choice questions that require you to recognise the correct command for a given scenario.
First, the exam loves to ask which mode you are in based on the prompt character. If you see ">", you are in operational mode. If you see "#", you are in configuration mode. A common trap is showing you a prompt like "user@router>" and then asking "Which command do you use to change the hostname?" The correct answer must start with entering configuration mode, so the answer might be "configure" followed by "set system host-name NewName". The wrong answer options often include a "set" command without "configure" first, which would fail because you cannot run set commands from operational mode.
Second, they will test the difference between "show configuration" and "show". From operational mode, "show configuration" displays the entire active configuration as text. From configuration mode, just typing "show" (without any arguments) also displays the candidate configuration. They may ask: "While in configuration mode, which command displays the current candidate configuration?" The answer is "show".
Third, the commit process is a frequent topic. You need to know that "commit" applies the candidate configuration, "commit check" validates syntax without applying, and "rollback 0" discards uncommitted changes. A typical question: "You have made several changes to the configuration but have not committed. How do you discard all your changes and return to the last committed configuration?" Answer: "rollback 0" (or "rollback 0" followed by "exit").
Fourth, the exam tests the hierarchical navigation commands. They may ask: "While in configuration mode at the "edit interfaces" level, what command returns you to the top of the configuration hierarchy?" Answer: "top". Another trap: they might list "exit" as an option, but exit only moves up one level, not to the top.
Fifth, they test the "run" command. A typical scenario: you are in configuration mode and need to check the current uptime of the router. You do not want to leave configuration mode. Which command do you use? Answer: "run show system uptime".
Sixth, be prepared for questions about the candidate configuration model. They may ask: "How many users can simultaneously edit the configuration?" The answer is multiple users, each with their own candidate configuration. They may also ask what happens if you try to commit while another user has uncommitted changes—the answer is that a warning appears, but you can still commit (you just might overwrite their changes).
Finally, the exam will test your knowledge of the "configure exclusive" command. This command enters configuration mode but locks the configuration database so no other user can make changes at the same time. This is useful during critical maintenance windows. A question might ask: "You need to ensure no other administrator can change the configuration while you are working. Which command should you use?" Answer: "configure exclusive".
Remember that the exam is about recognition, not rote memorisation of every command. Understand the logic: operational is for looking, configuration is for changing, commit makes it live.
The prompt character tells you your mode: '>' means operational mode (view only), '#' means configuration mode (editing allowed).
You must type 'configure' to switch from operational mode into configuration mode before making any changes.
Changes made in configuration mode are stored in a candidate configuration and do not affect the live network until you type 'commit'.
The 'commit check' command validates your candidate configuration syntax without applying it, preventing accidental syntax errors.
Use 'rollback 0' from configuration mode to discard all uncommitted changes and revert to the last committed configuration.
The 'run' command lets you execute operational mode commands (like 'show interfaces') while you are still inside configuration mode.
These come up on the exam all the time. Here's how to tell them apart.
Operational Mode
Prompt ends with '>' character
Used for viewing state and diagnostics
Cannot change any device settings
Configuration Mode
Prompt ends with '#' character
Used for editing router settings
Changes are held in candidate config until committed
Commit
Applies candidate config to active config
Permanently saves changes
Can cause network disruption if errors exist
Commit Check
Validates syntax only, does not apply
No risk to live network
Useful for catching typos before committing
Exit (from config mode)
Moves you up one hierarchy level
Does not automatically discard changes
May prompt you to discard but leaves choice
Rollback 0
Discards all uncommitted changes immediately
Does not change hierarchy level
Reverts candidate config to last committed version
Set Command
Used to add or modify a specific parameter
Does not change your current hierarchy location
Example: 'set system host-name R1' adds hostname
Edit Command
Navigates you into a specific hierarchy branch
Changes your prompt to show current location
Example: 'edit interfaces' moves you into interfaces context
Mistake
You can type any command in any mode and Junos will figure out what you meant.
Correct
Junos strictly enforces mode separation. You cannot run a 'set' command from operational mode, and you cannot run a 'show interfaces' command from configuration mode without the 'run' prefix.
Beginners are used to other operating systems where you can type commands anywhere. Junos's strict mode separation feels counterintuitive at first.
Mistake
Pressing Enter after 'configure' immediately puts your changes into effect.
Correct
'Configure' only opens the candidate configuration workspace. Your changes are not active until you type 'commit'.
The word 'configure' sounds final, but in Junos it is the beginning of the editing process, not the end.
Mistake
If you type 'exit' from configuration mode, your uncommitted changes are automatically discarded.
Correct
When you type 'exit' from configuration mode, the system prompts you to discard uncommitted changes. You must confirm, or you can use 'rollback 0' first to discard them cleanly.
People assume 'exit' means 'close without saving' because that is how most applications work. Junos requires an explicit discard step.
Mistake
The 'show configuration' command only works from configuration mode.
Correct
'Show configuration' can be run from operational mode to view the active (committed) configuration. From configuration mode, you just type 'show' to see the candidate.
The word 'configuration' in the command name makes beginners think it belongs in configuration mode, but it is actually a show command that works in operational mode.
Mistake
Operational mode is only for troubleshooting, never for configuration changes, so you cannot view configurations there.
Correct
You can view the entire active configuration from operational mode using 'show configuration'. You just cannot change it.
Beginners assume that because you cannot write, you also cannot read the configuration. Junos separates the ability to read from the ability to write.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
'Configure' allows multiple administrators to edit the configuration simultaneously (each with their own candidate). 'Configure exclusive' locks the configuration database so only you can edit it, preventing conflicts during critical changes.
Yes, uncommitted changes are stored in temporary memory (RAM) and are lost if the device reboots or loses power. Always commit your changes to save them to permanent storage.
In configuration mode, type 'rollback 0'. This reverts the candidate configuration to exactly match the last committed configuration, discarding all uncommitted edits.
It shows the difference between the candidate configuration (your unsaved changes) and the active (committed) configuration. Lines prefixed with '+' are additions, lines with '-' are deletions.
Yes, use the 'run' command prefix. For example, from configuration mode, type 'run show interfaces terse' to see interface status without exiting configuration mode.
Junos will display a syntax error and remain in configuration mode. Your candidate configuration is unchanged. You can correct the command and continue. The commit will fail until all syntax errors are fixed.
No, Junos applies configuration changes dynamically without requiring a reboot, except for very specific settings like kernel parameters. In most cases, the change takes effect immediately after commit.
You've finished Junos OS CLI Fundamentals. Continue through the JNCIA-JUNOS study guide to build a complete picture of the exam.
Done with this chapter?