Defining and Enforcing Configuration Rules with Commit Scripts

Being able to restrict network configurations in accordance with custom configuration rules can reduce human error and improve network uptime and reliability. Commit scripts allow you to enforce custom configuration rules.

This section contains the following topics:

• Commit Script Overview
• Enabling Commit Scripts
• Disabling Commit Scripts

Commit Script Overview

Commit scripts run each time a new candidate configuration is committed and inspect the configuration. If a candidate configuration does not adhere to your design rules, a commit script can instruct the services router to perform various actions, including the following:

• Generate custom warning messages, system log messages, or error messages.

  If error messages are generated, the commit operation fails and the candidate configuration remains unchanged.

• Change the configuration in accordance with your rules and then proceed with the commit operation.

Consider the following examples of actions you can perform with commit scripts:

• Run a basic sanity test. Ensure that the [edit interfaces] and [edit protocols] hierarchies have not been accidentally deleted.
• Check configuration consistency. Ensure that every T1 interface configured at the [edit interfaces] hierarchy level is also configured at the [edit protocols rip] hierarchy level.
• Enforce network design rules. For example, suppose your network design requires every interface on which the International Organization for Standardization (ISO) family of protocols is enabled to also have Multiprotocol Label Switching (MPLS) enabled. At commit time, a commit script inspects the configuration and issues an error if this requirement is not met. This error causes the commit operation to fail and forces the user to update the configuration to comply.

  Instead of an error, the commit script can issue a warning about the configuration problem and then automatically correct it, by changing the configuration to enable MPLS on all interfaces. A system log message can also be generated indicating that corrective action was taken.

The scripting language you use for writing commit scripts is Extensible Stylesheet Language Transformations (XSLT). XSLT commit scripts are based on Junos XML protocol Extensible Markup Language (XML).

Enabling Commit Scripts

To enable commit scripts:

1. Write a commit script.

   For information about writing commit scripts, see the Junos Configuration and Operations Automation Guide.

2. Copy the script to the /var/db/scripts/commit directory.

   Only users with superuser privileges can access and edit files in the /var/db/scripts/commit directory.

3. Navigate to the top of the configuration hierarchy in either the J-Web or CLI configuration editor.
4. Perform the configuration tasks described in Table 47.
5. If you are finished configuring the network, commit the configuration.

Disabling Commit Scripts

If you do not want a commit script to run, you can disable it by deleting or deactivating it in the configuration. Deleting a commit script permanently removes it from the configuration. To run the script later, you must reenable the script as described in Enabling Commit Scripts. Deactivating a commit script disables the script until you activate it later.

To delete a commit script:

1. From configuration mode in the CLI, enter the following command:
   
   

   user@host# delete system scripts commit filename.xsl
2. Commit the configuration:
   
   

   user@host# commit

   commit complete

To deactivate a commit script:

1. From configuration mode in the CLI, enter the following command:
   
   

   user@host# deactivate system scripts commit filename.xsl
2. Commit the configuration:
   
   

   user@host# commit

   commit complete

   Note: You can later reactivate the commit script using the activate system scripts commit filename.xsl command.