# Junos OS CLI Fundamentals

> Chapter 2 of the Courseiva JUNIPER-JNCIA-JUNOS curriculum — https://courseiva.com/learn/juniper-jncia-junos/junos-os-cli-fundamentals

**Official objective:** 1.2 — Navigate the Junos CLI, including operational and configuration modes.

## Introduction

How do you tell a Juniper router to do something without accidentally breaking the network? 

The Junos CLI (Command-Line Interface) is the keyboard-based control panel for Juniper devices, and it is split into two distinct modes: operational mode (for looking and troubleshooting) and configuration mode (for making changes). Mastering this split is the single most important foundation skill for the JNCIA-JUNOS exam because it keeps you from crashing a live network while you are just trying to check its pulse.

## The Restaurant Menu and Kitchen Analogy

Have you ever walked into a new restaurant and felt overwhelmed by the menu, not knowing whether you should talk to the host, the waiter, or just grab a seat yourself? 

That is exactly how it feels when you first sit down at a Junos device. The Junos operating system gives you two very distinct menus, just like a restaurant has a menu for customers (what you can eat) and a separate menu for the kitchen staff (how the food is prepared). 

In operational mode, you are the customer. You can ask questions like "What's the soup of the day?"—in Junos terms, that's "show interfaces terse". You can see what is happening, check the temperature of the kitchen, and verify orders are going out correctly. You cannot change the recipe; you can only observe and run diagnostics. 

In configuration mode, you are the head chef in the kitchen. You walk into the back, put on your apron, and start changing the recipe card. You type "configure" and suddenly you can edit the actual settings—like changing the IP address of an interface, which is like swapping out the type of pasta in a dish. When you are done, you commit your changes, which is like sending the new menu to the printer. Until you commit, nobody sees your experimental recipe. 

This two-mode design prevents a junior cook from accidentally deleting the signature dessert while they were just trying to check the stock. Junos forces you to be in the right room for the job, making it nearly impossible to break a running network by accident while you are only supposed to be looking at it.

## Core explanation

When you first connect to a Juniper device—via a direct cable connection or over the network using SSH (Secure Shell, an encrypted way to log into a remote computer)—you land in operational mode. You know you are there because the prompt ends with a angle bracket, like this: "user@router>". In this mode, you can run commands that show you information, like "show interfaces" to see all network ports, "show configuration" to view the current settings, or "ping" to test if another device is reachable. You cannot change any settings here. Think of it as a library where you can read all the books but cannot write in the margins.

If you want to change any setting on the router—like assigning an IP address to an interface, setting up routing protocols, or enabling security features—you must enter configuration mode. You type the command "configure" (or the shortcut "conf") and the prompt changes to end with a hash symbol: "user@router#". The hash is your visual signal that you are now holding a red pen. Every change you make is held in a temporary workspace called the candidate configuration. The device is not running your changes yet; they are just a draft sitting on your desk. This is critical because it means you can edit without any risk to the live network.

Once you have made all your changes in configuration mode, you must type "commit" to activate them. The commit command takes your candidate configuration and applies it to the live, running configuration of the device. Until you commit, the device continues to run with its old settings. If you make a mistake you can type "rollback 0" to revert the candidate configuration back to the last committed version, effectively deleting your draft and starting over.

Why does Junos have two modes? Older networking operating systems from other vendors let you make changes directly while you were looking at the system, which meant a single mistyped command could bring down a network immediately. Junos separates the action of viewing from the action of editing, which is a huge safety net. It also allows multiple people to be in configuration mode at the same time—each person has their own candidate configuration, and they can merge their changes when they commit, though on the exam you will mostly focus on a single user scenario.

Here are the common commands you will use to navigate between and within these modes:

- "show" commands: Always run from operational mode. Examples include "show interfaces terse", "show route", "show log messages". These display information but never change anything.

- "set" commands: Run inside configuration mode. For example, "set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24" assigns an IP address. You type the exact value you want to add or change.

- "edit" command: In configuration mode, "edit interfaces" moves you into the "interfaces" hierarchy, changing your prompt to "user@router# edit interfaces". This is like opening a specific drawer in a filing cabinet so you do not have to type the full path every time.

- "top" command: In configuration mode, "top" jumps you back to the root of the configuration hierarchy, no matter how deep you have drilled down.

- "run" command: You can temporarily run an operational mode command from within configuration mode by typing "run show interfaces". This is useful when you are editing a configuration and need to check the current state without leaving configuration mode.

- "exit" command: In configuration mode, "exit" moves you up one level in the hierarchy. Type it enough times and you will return to operational mode.

- "commit and-quit": This special command commits your changes and automatically exits configuration mode back to operational mode in one step.

To leave configuration mode without saving changes, you can type "exit" until you are back to operational mode, or type "rollback 0" to discard all uncommitted changes, then "exit". The system will not let you accidentally leave with uncommitted changes—it will ask if you want to discard them.

In summary, the two-mode system is a deliberate design choice by Juniper to make networks more stable. You look in operational mode, you edit in configuration mode, and you activate your edits with the commit command. This pattern is repeated in every Junos device you will encounter, from small branch routers to massive core switches.

## Real-world context

Imagine you are the sole IT person at a medium-sized company, and the network goes down at 2 PM on a Tuesday. You are remote, working from home, and you need to log into the main router to find out what is wrong. You open a terminal emulator (like PuTTY or the built-in terminal on macOS/Linux) and SSH into the router's management IP address. You land in operational mode, prompt showing "admin@router>".

You immediately run "show interfaces terse" to see which ports are up and which are down. One of the WAN interfaces shows "down". You run "show log messages" to see recent system events, and you spot an error about a fibre link being unplugged. Now you know the problem—someone likely pulled the cable in the server room—but you cannot fix it from your keyboard. You call the office and ask someone to plug the cable back in. When they do, you run "show interfaces terse" again from operational mode and see the interface come back up. Crisis averted, and you never entered configuration mode because you did not need to change any settings.

Now, consider a different scenario. Your company is expanding to a new floor and needs a new subnet for the guest Wi-Fi. You schedule a maintenance window for midnight on Sunday. At 11:55 PM, you SSH into the router. You first check the current configuration by typing "show configuration | display set" (the pipe to "display set" shows the configuration in set command format, which is easier to read for changes). You see the existing VLAN and interface settings. 

You then type "configure" and the prompt changes to "admin@router#". You enter the following commands:

- "set interfaces ge-0/0/5 unit 0 family inet address 172.16.100.1/24"
- "set security zones security-zone guest-vlan interfaces ge-0/0/5.0"
- "set system services dhcp-server pool guest-wifi network 172.16.100.0/24"

Before committing, you decide to double-check your work. You type "show | compare" which highlights the differences between the candidate configuration and the active configuration. You see that you have added exactly the three lines you intended. Satisfied, you type "commit check"—this validates the syntax of your changes without applying them. It returns no errors. You then type "commit and-quit" to apply the changes and exit configuration mode. 

You run "show interfaces terse" again from operational mode and see the new interface is up. You run "show dhcp server binding" to see that the DHCP server is active. You have successfully changed the live network without unplugging any cables or interrupting other users, because your changes were carefully prepared in the candidate configuration and only applied after validation.

## Exam focus

The JNCIA-JUNOS exam tests your understanding of the two-mode architecture in several specific ways. You will not be asked to configure an entire router; instead, you will see multiple-choice questions that require you to recognise the correct command for a given scenario.

First, the exam loves to ask which mode you are in based on the prompt character. If you see ">", you are in operational mode. If you see "#", you are in configuration mode. A common trap is showing you a prompt like "user@router>" and then asking "Which command do you use to change the hostname?" The correct answer must start with entering configuration mode, so the answer might be "configure" followed by "set system host-name NewName". The wrong answer options often include a "set" command without "configure" first, which would fail because you cannot run set commands from operational mode.

Second, they will test the difference between "show configuration" and "show". From operational mode, "show configuration" displays the entire active configuration as text. From configuration mode, just typing "show" (without any arguments) also displays the candidate configuration. They may ask: "While in configuration mode, which command displays the current candidate configuration?" The answer is "show".

Third, the commit process is a frequent topic. You need to know that "commit" applies the candidate configuration, "commit check" validates syntax without applying, and "rollback 0" discards uncommitted changes. A typical question: "You have made several changes to the configuration but have not committed. How do you discard all your changes and return to the last committed configuration?" Answer: "rollback 0" (or "rollback 0" followed by "exit").

Fourth, the exam tests the hierarchical navigation commands. They may ask: "While in configuration mode at the "edit interfaces" level, what command returns you to the top of the configuration hierarchy?" Answer: "top". Another trap: they might list "exit" as an option, but exit only moves up one level, not to the top.

Fifth, they test the "run" command. A typical scenario: you are in configuration mode and need to check the current uptime of the router. You do not want to leave configuration mode. Which command do you use? Answer: "run show system uptime".

Sixth, be prepared for questions about the candidate configuration model. They may ask: "How many users can simultaneously edit the configuration?" The answer is multiple users, each with their own candidate configuration. They may also ask what happens if you try to commit while another user has uncommitted changes—the answer is that a warning appears, but you can still commit (you just might overwrite their changes).

Finally, the exam will test your knowledge of the "configure exclusive" command. This command enters configuration mode but locks the configuration database so no other user can make changes at the same time. This is useful during critical maintenance windows. A question might ask: "You need to ensure no other administrator can change the configuration while you are working. Which command should you use?" Answer: "configure exclusive".

Remember that the exam is about recognition, not rote memorisation of every command. Understand the logic: operational is for looking, configuration is for changing, commit makes it live.

## Step by step

1. **Connect to the Junos device** — Use an SSH client (like PuTTY on Windows or the terminal on Mac/Linux) to connect to the device's IP address. You will be prompted for a username and password. Once logged in, you land automatically in operational mode, indicated by the '>' at the end of the prompt.
2. **Explore the current state with show commands** — Before changing anything, run 'show interfaces terse' to see all network ports, 'show configuration' to view the current settings, and 'show log messages' to see recent events. This is your reconnaissance phase.
3. **Enter configuration mode** — Type 'configure' (or 'conf') and press Enter. The prompt changes from '>' to '#'. You are now in a sandbox where you can edit settings without affecting the live network.
4. **Make changes using set, edit, and delete commands** — Use 'set' to add or modify a setting (e.g., 'set system host-name Router1'), 'delete' to remove a setting, and 'edit' to navigate into a specific hierarchy (e.g., 'edit interfaces'). Changes are stored in the candidate configuration.
5. **Validate your changes before committing** — Type 'show | compare' to see a diff of what you changed, and 'commit check' to validate the syntax. If there are errors, fix them now. If everything looks good, you are ready to apply.
6. **Commit the changes to make them live** — Type 'commit' to apply the candidate configuration to the active configuration. The device immediately begins using the new settings. Alternatively, use 'commit and-quit' to commit and exit configuration mode in one command.
7. **Return to operational mode and verify** — After committing, type 'exit' if you are still in configuration mode. You should see the '>' prompt again. Run 'show interfaces terse' or other show commands to confirm your changes are active and working correctly.

## Comparisons

### Operational Mode vs Configuration Mode

**Operational Mode:**
- Prompt ends with '>' character
- Used for viewing state and diagnostics
- Cannot change any device settings

**Configuration Mode:**
- Prompt ends with '#' character
- Used for editing router settings
- Changes are held in candidate config until committed

### Commit vs Commit Check

**Commit:**
- Applies candidate config to active config
- Permanently saves changes
- Can cause network disruption if errors exist

**Commit Check:**
- Validates syntax only, does not apply
- No risk to live network
- Useful for catching typos before committing

### Exit (from config mode) vs Rollback 0

**Exit (from config mode):**
- Moves you up one hierarchy level
- Does not automatically discard changes
- May prompt you to discard but leaves choice

**Rollback 0:**
- Discards all uncommitted changes immediately
- Does not change hierarchy level
- Reverts candidate config to last committed version

### Set Command vs Edit Command

**Set Command:**
- Used to add or modify a specific parameter
- Does not change your current hierarchy location
- Example: 'set system host-name R1' adds hostname

**Edit Command:**
- Navigates you into a specific hierarchy branch
- Changes your prompt to show current location
- Example: 'edit interfaces' moves you into interfaces context

## Diagram

_Flowchart showing the navigation between operational mode and configuration mode in Junos CLI._

```mermaid
flowchart TD
    A[User logs into Junos device] --> B[Operational Mode]
    B --> C[Prompt ends with '>']
    B --> D[Run show commands]
    B --> E[Type 'configure']
    E --> F[Configuration Mode]
    F --> G[Prompt ends with '#']
    F --> H[Edit candidate config using set, delete]
    H --> I[Validate with commit check]
    I --> J{Errors?}
    J -- yes --> H
    J -- no --> K[Type 'commit']
    K --> L[Active config updated]
    L --> M[Exit to operational mode]
    M --> B
```

## Common misconceptions

- **Misconception:** You can type any command in any mode and Junos will figure out what you meant. **Reality:** Junos strictly enforces mode separation. You cannot run a 'set' command from operational mode, and you cannot run a 'show interfaces' command from configuration mode without the 'run' prefix. (Beginners are used to other operating systems where you can type commands anywhere. Junos's strict mode separation feels counterintuitive at first.)
- **Misconception:** Pressing Enter after 'configure' immediately puts your changes into effect. **Reality:** 'Configure' only opens the candidate configuration workspace. Your changes are not active until you type 'commit'. (The word 'configure' sounds final, but in Junos it is the beginning of the editing process, not the end.)
- **Misconception:** If you type 'exit' from configuration mode, your uncommitted changes are automatically discarded. **Reality:** When you type 'exit' from configuration mode, the system prompts you to discard uncommitted changes. You must confirm, or you can use 'rollback 0' first to discard them cleanly. (People assume 'exit' means 'close without saving' because that is how most applications work. Junos requires an explicit discard step.)
- **Misconception:** The 'show configuration' command only works from configuration mode. **Reality:** 'Show configuration' can be run from operational mode to view the active (committed) configuration. From configuration mode, you just type 'show' to see the candidate. (The word 'configuration' in the command name makes beginners think it belongs in configuration mode, but it is actually a show command that works in operational mode.)
- **Misconception:** Operational mode is only for troubleshooting, never for configuration changes, so you cannot view configurations there. **Reality:** You can view the entire active configuration from operational mode using 'show configuration'. You just cannot change it. (Beginners assume that because you cannot write, you also cannot read the configuration. Junos separates the ability to read from the ability to write.)

## Key takeaways

- The prompt character tells you your mode: '>' means operational mode (view only), '#' means configuration mode (editing allowed).
- You must type 'configure' to switch from operational mode into configuration mode before making any changes.
- Changes made in configuration mode are stored in a candidate configuration and do not affect the live network until you type 'commit'.
- The 'commit check' command validates your candidate configuration syntax without applying it, preventing accidental syntax errors.
- Use 'rollback 0' from configuration mode to discard all uncommitted changes and revert to the last committed configuration.
- The 'run' command lets you execute operational mode commands (like 'show interfaces') while you are still inside configuration mode.

## FAQ

**What's the difference between 'configure' and 'configure exclusive'?**

'Configure' allows multiple administrators to edit the configuration simultaneously (each with their own candidate). 'Configure exclusive' locks the configuration database so only you can edit it, preventing conflicts during critical changes.

**Can I lose my changes if the power goes out before I commit?**

Yes, uncommitted changes are stored in temporary memory (RAM) and are lost if the device reboots or loses power. Always commit your changes to save them to permanent storage.

**How do I discard changes without committing?**

In configuration mode, type 'rollback 0'. This reverts the candidate configuration to exactly match the last committed configuration, discarding all uncommitted edits.

**What does the 'show | compare' command do?**

It shows the difference between the candidate configuration (your unsaved changes) and the active (committed) configuration. Lines prefixed with '+' are additions, lines with '-' are deletions.

**Can I run operational mode commands from inside configuration mode?**

Yes, use the 'run' command prefix. For example, from configuration mode, type 'run show interfaces terse' to see interface status without exiting configuration mode.

**What happens if I type a wrong command in configuration mode?**

Junos will display a syntax error and remain in configuration mode. Your candidate configuration is unchanged. You can correct the command and continue. The commit will fail until all syntax errors are fixed.

**Do I need to restart the router after committing changes?**

No, Junos applies configuration changes dynamically without requiring a reboot, except for very specific settings like kernel parameters. In most cases, the change takes effect immediately after commit.

## Check your understanding

1. **You are logged into a Junos device and see the prompt 'user@router>'. Are you in operational mode or configuration mode?**

   Answer: You are in operational mode, indicated by the '>' character at the end of the prompt.

2. **What command do you type to enter configuration mode from operational mode?**

   Answer: Type 'configure' (or 'conf' for short) and press Enter.

3. **You have made several changes in configuration mode but have not committed. How do you discard all your changes?**

   Answer: Type 'rollback 0' to revert the candidate configuration to the last committed version.

4. **What is the purpose of the 'commit check' command?**

   Answer: It validates the syntax of the candidate configuration without applying it to the live network, allowing you to catch errors safely.

5. **How do you run an operational mode command (like 'show interfaces') while you are in configuration mode?**

   Answer: Use the 'run' prefix: type 'run show interfaces' while in configuration mode.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/juniper-jncia-junos/junos-os-cli-fundamentals