Use the juniper.device.system Ansible Module to Restore a Junos Device
to its Factory-Default State
Use the juniper.device.system Ansible module to restore a device
running Junos OS or a device running Junos OS Evolved to its factory-default configuration
settings.
Juniper Networks provides Ansible modules that you can use to restore a Junos device to
its factory-default configuration settings. Table 1 outlines the modules. If you are already using a given set of modules from the
juniper.device collection, use the module for that set.
|
Collection |
Module Set |
Module Name |
|---|---|---|
|
|
||
|
|
juniper.device.junos_config
(zeroize option) |
This topic discusses how to use the juniper.device.system module to
reset a Junos device to its factory-default state. For information about using the
juniper.device.junos_config module to reset a device, see Restore a Device to Factory-Default Configuration Settings.
How to Restore the Factory-Default Configuration Settings
To use the juniper.device.system module to restore a device to
its factory-default configuration settings, set the module’s
action argument to 'zeroize'. After you
restore a device to its factory-default state, you must log in through the
console as root in order to access the device.
The action: "zeroize" argument causes the module to execute the
<request-system-zeroize> RPC on the target host. This
command removes all configuration information on the specified Routing Engines,
resets all key values on the device, and then reboots the device and resets it
to the factory-default configuration settings. The zeroize operation removes all
data files, including customized configuration and log files, by unlinking the
files from their directories. It also removes all user-created files from the
system including all plaintext passwords, secrets, and private keys for SSH,
local encryption, local authentication, IPsec, RADIUS, TACACS+, and SNMP.
For more information about the corresponding operational commands, see:
The following Ansible playbook uses the juniper.device.system
module with action: "zeroize". The module resets all Routing
Engines on each host in the inventory group to the factory-default configuration
settings.
---
- name: Restore Junos devices to factory-default state
hosts: dc1
connection: local
gather_facts: no
tasks:
- name: Restore all Routing Engines to factory-default state
juniper.device.system:
action: "zeroize"
By default, the action: "zeroize" operation resets all Routing
Engines in a dual Routing Engine setup to the
factory-default configuration settings. Junos OS Evolved always zeroize both
Routing Engines. However, on devices running Junos OS, you can also instruct the
module to perform the operation on only the Routing Engine to which the
application is connected. In a Virtual Chassis or Virtual Chassis Fabric (VCF)
composed of EX Series switches (except EX8200 Virtual Chassis) or QFX Series
switches, the operation runs only on the connected member switch.
To explicitly indicate that the operation should be performed on all Routing
Engines in a dual Routing Engine setup, include the
all_re: True argument, which is the default.
tasks:
- name: Restore all Routing Engines to factory-default state
juniper.device.system:
action: "zeroize"
all_re: True
On devices running Junos OS, to perform the requested action on only the Routing
Engine to which the application is connected, include the
all_re: False argument.
tasks:
- name: Restore connected Routing Engine to its factory-default state
juniper.device.system:
action: "zeroize"
all_re: False
To instruct the module to also scrub all memory and media, in addition to
removing all configuration and log files, include the media:
True argument. Including the media: True argument
is equivalent to executing the request system zeroize media
operational mode command. The media option scrubs every storage
device that is attached to the system, including disks, flash memory devices,
removable USBs, and so on. The duration of the scrubbing process is dependent on
the size of the media being erased.
tasks:
- name: Restore device to its factory-default state and scrub media
juniper.device.system:
action: "zeroize"
media: True
Example: Use Ansible to Restore the Factory-Default Configuration Settings
This example uses the juniper.device.system module to restore a
Junos device to its factory-default configuration settings. You can execute the
module using any type of connection. However, once you reset the device, you can
only access it again as root through a console server or the
CONSOLE port. This example connects to the device through
a console server.
Requirements
This example uses the following hardware and software components:
-
Configuration management server running Ansible 2.17 or later with the
juniper.devicecollection installed -
Junos device that has access to the console port through a console server and has a user account configured with appropriate permissions
-
Existing Ansible inventory file with required hosts defined
Overview
This example creates an Ansible playbook that uses the
juniper.device.system module to reset each host in the
inventory group to its factory-default configuration settings. The module’s
action argument is set to "zeroize", which
executes the <request-system-zeroize> RPC on each host.
The operation removes all configuration information on the Routing Engines,
resets all key values on the device, and then reboots the device and resets it
to its factory-default state.
The request system zeroize command removes all data files,
including customized configuration and log files, by unlinking the files
from their directories. The command also removes all user-created files from
the system including all plaintext passwords, secrets, and private keys for
SSH, local encryption, local authentication, IPsec, RADIUS, TACACS+, and
SNMP.
When calling the module from a playbook, we recommend that you use an interactive
prompt to confirm that the user does intend to reset the devices. If a user
unintentionally runs the playbook and you do not implement a check, it could
revert the devices and disrupt any networks that require those devices. As a
precaution, this playbook uses an interactive prompt to verify that the user
intends to reset the devices. The playbook requires that the user manually type
'yes' on the command line in order to execute the
module. If the Confirmation check task fails, the Ansible
control node skips the other tasks in the play for that device.
The playbook executes the juniper.device.system module provided
that the confirmation check was successful. The module connects to the Junos
device through the console server on the specified port, which is defined in the
Ansible inventory file for each host. The playbook prompts for the device
password and stores it in a variable. After the reboot, you must log in through
the console as root in order to access the device.
Configuration
Create and Execute the Ansible Playbook
Step-by-Step Procedure
To create a playbook that uses the juniper.device.system
module to restore a Junos device to its factory-default configuration
settings:
Include the boilerplate for the playbook and this play, which executes the modules locally.
--- - name: Restore Junos device to factory-default configuration settings hosts: dc1a_console connection: local gather_facts: no
Create an interactive prompt to prevent the accidental execution of the module.
vars_prompt: - name: reset_confirmation prompt: > This playbook resets hosts to factory-default configurations! Enter 'yes' to continue. default: "no" private: noCreate an interactive prompt for the device password, if you do not pass in the user credentials through some other means.
- name: "device_password" prompt: "Device password" private: yesDefine the connection parameters.
vars: password: "{{ device_password }}" mode: "telnet" port: "{{ ansible_port }}"Create the task that confirms the user's intent.
tasks: - name: Confirmation check fail: msg="Playbook run confirmation failed" when: reset_confirmation != "yes"Create the task to reset all Routing Engines on the device to the factory-default configuration settings.
- name: Restore all Routing Engines to factory-default configuration juniper.device.system: action: "zeroize" timeout: 120 register: result(Optional) Create a task to print the response.
- name: Print response ansible.builtin.debug: var: result
Results
On the Ansible control node, review the completed playbook. If the playbook does not display the intended code, repeat the instructions in this example to correct the playbook.
---
- name: Restore Junos device to factory-default configuration settings
hosts: dc1a_console
connection: local
gather_facts: no
vars_prompt:
- name: reset_confirmation
prompt: >
This playbook resets hosts to factory-default configurations!
Enter 'yes' to continue.
default: "no"
private: no
- name: "device_password"
prompt: "Device password"
private: yes
vars:
password: "{{ device_password }}"
mode: "telnet"
port: "{{ ansible_port }}"
tasks:
- name: Confirmation check
fail: msg="Playbook run confirmation failed"
when: reset_confirmation != "yes"
- name: Restore all Routing Engines to factory-default configuration
juniper.device.system:
action: "zeroize"
timeout: 120
register: result
- name: Print response
ansible.builtin.debug:
var: result
Execute the Playbook
To execute the playbook:
-
Issue the
ansible-playbookcommand on the control node, and provide the playbook path and any required options.root@ansible-cn:~/ansible# ansible-playbook ansible-pb-junos-zeroize.yaml This playbook resets hosts to factory-default configurations! Enter 'yes' to continue. [no]: yes Device password: PLAY [Restore Junos device to factory-default configuration settings] TASK [Confirmation check] ********************************************** skipping: [dc1a-console.example.net] TASK [Restore all Routing Engines to factory-default configuration] **** changed: [dc1a-console.example.net] TASK [Print response] ************************************************** ok: [dc1a-console.example.net] => { "result": { "action": "zeroize", "all_re": true, "changed": true, "failed": false, "media": false, "msg": "zeroize successfully initiated.", "other_re": false, "reboot": false "vmhost": false } } PLAY RECAP ************************************************************ dc1a-console.example.net : ok=2 changed=1 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0
Verification
Verify Playbook Execution
Purpose
Verify that the playbook successfully reset the Junos devices to the factory-default configuration.
Action
Access the device through the console port as root. The device should now be in Amnesiac state.
Amnesiac <ttyd0> login:
Meaning
The Amnesiac prompt is indicative of a device that is
booting from a factory-default configuration and that does not have a
hostname configured.