Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Example: Preventing Import of the Full Routing Table

 

In the Junos OS routing policy, if you configure a policy with no match conditions and a terminating action of then accept, and then apply the policy to a routing protocol, the protocol imports the entire routing table. This example shows how to use a commit script to prevent this scenario.

Requirements

This example uses a device running Junos OS.

Overview and Commit Script

This example inspects the import statements configured at the [edit protocols ospf] and [edit protocols isis] hierarchy levels to determine if any of the named policies contain a then accept term with no match conditions. The script protects against importing the full routing table into these interior gateway protocols (IGPs).

The example script is shown in both XSLT and SLAX syntax:

XSLT Syntax

SLAX Syntax

Configuration

Step-by-Step Procedure

To download, enable, and test the script:

  1. Copy the script into a text file, name the file import.xsl or import.slax as appropriate, and copy it to the /var/db/scripts/commit/ directory on the device.
  2. Select the following test configuration stanzas, and press Ctrl+c to copy them to the clipboard.

    If you are using the SLAX version of the script, change the filename at the [edit system scripts commit file] hierarchy level to import.slax.

  3. In configuration mode, issue the load merge terminal command to merge the stanzas into your device configuration.
    1. At the prompt, paste the contents of the clipboard by using the mouse and the paste icon.

    2. Press Enter.

    3. Press Ctrl+d.

  4. Commit the configuration.

Verification

Verifying the Commit Script Execution

Purpose

Verify that the script behaves as expected.

Action

Review the output of the commit command. The sample configuration configures an import statement at the [edit protocols ospf] hierarchy level. Because the policy contains a then accept term with no match conditions, the script generates an error, and the commit operation fails. The following output appears after issuing a commit command: