Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Establish an SSH Connection for a NETCONF Session

Understanding NETCONF Sessions over SSH

You can use the SSH protocol to establish connections between a configuration management server (CMS) and a Junos device. You use a configuration management server to manage the Junos device remotely.

You can use the following options to establish an SSH connection between the configuration management server and the Junos device.

  • SSH—The configuration management server initiates an SSH session with the Junos device.

  • Outbound SSH—The Junos device initiates, establishes, and maintains an SSH connection with a predefined set of configuration management servers. Use this option when the configuration management server cannot initiate an SSH connection because of network restrictions (such as a firewall).

Common Prerequisites for NETCONF Sessions over SSH or Outbound SSH

For NETCONF sessions that use either SSH or outbound SSH, you must install SSH software on the configuration management server and enable the NETCONF service on the Junos device. See the following sections for detailed instructions:

Install SSH Software on the Configuration Management Server

For SSH connections, the configuration management server (CMS) handles the SSH connection with the Junos device. For outbound SSH connections, the Junos device establishes the SSH connection to the configuration management server, and then the configuration management server takes control of the SSH session.

To establish an SSH or outbound SSH connection with a device, the configuration management server must have SSH software installed locally. For information about obtaining and installing SSH software, see:

Enable NETCONF Service over SSH

To establish NETCONF sessions on a Junos device, you must enable the NETCONF service. You can configure the NETCONF server to accept NETCONF sessions on the following ports:

  • Default NETCONF port (830) or a user-defined port

  • Default SSH port (22)

We recommend that you use the default NETCONF port because it enables the device to identify and filter NETCONF traffic more effectively. Alternatively, you can configure the device to accept NETCONF sessions on a port number of your choosing instead of the default NETCONF port. The defined port accepts only NETCONF-over-SSH sessions and rejects regular SSH session requests.

If you enable NETCONF and you also enable SSH services on the device, the device accepts NETCONF sessions on both the default SSH port and the configured NETCONF port (default or user-defined port). For added security, you can configure event policies that utilize UI_LOGIN_EVENT information to effectively disable the SSH port from accepting NETCONF sessions or to further restrict NETCONF server access on a port.

To enable NETCONF service over SSH on a Junos device:

  1. Enable the NETCONF service on either the default NETCONF port (830) or a user-defined port:

    • To use the default NETCONF port (830), include the netconf ssh statement at the [edit system services] hierarchy level:

    • To use a specific port, configure the port statement with the port number at the [edit system services netconf ssh] hierarchy level.

      The port-number can range from 1 through 65535. The configured port accepts only NETCONF-over-SSH sessions and rejects regular SSH session requests.

      Note:

      Although you can configure NETCONF on any port from 1 through 65535, you should not configure access on a port that is normally assigned for another service. This practice avoids potential resource conflicts. If you configure a port assigned for another service, such as FTP, and that service is enabled, a commit check does not reveal a resource conflict or issue any warning message.

  2. (Optional) To also enable access to the NETCONF SSH subsystem using the default SSH port (22), include the ssh statement at the [edit system services] hierarchy level.

    This configuration enables SSH access to the device for all users and applications.

    Note:

    In releases where the default behavior is to restrict the root user from using the SSH service, you must configure the root-login allow statement at the [edit system services ssh] hierarchy level to enable the root user to open NETCONF sessions over SSH.

  3. (Optional) Configure the device to disconnect unresponsive NETCONF clients.

    Specify the timeout interval (in seconds) after which, if no data has been received from the client, the sshd process requests a response. Additionally, specify the threshold of missed client-alive responses that triggers a disconnect.

    Note:

    Statements configured at the [edit system services netconf ssh] hierarchy level apply only to NETCONF sessions that connect through the default port (830) or through the user-defined port that is configured at the same hierarchy level.

  4. Commit the configuration:

  5. Repeat the preceding steps on each Junos device where the client application establishes NETCONF sessions.

Prerequisites for Establishing an SSH Connection for NETCONF Sessions

Before the configuration management server can establish an SSH connection with a Junos device, you must satisfy the common requirements discussed in:

You must also satisfy the requirements discussed in the following sections:

Configure a User Account for the Client Application on Junos Devices

The configuration management server must log in to the Junos device to establish a NETCONF session. Thus, the configuration management server needs a user account on each device where it establishes a NETCONF session. The following instructions explain how to create a local user account on Junos devices. Alternatively, you can skip this section and enable authentication through RADIUS or TACACS+.

To create a local user account:

  1. Configure the user statement and specify a username. Include the class statement, and specify a login class that has the permissions required for all actions to be performed by the application.
  2. Optionally, include the full-name and uid statements at the [edit system login user username] hierarchy level.
  3. Commit the configuration to activate the user account on the device.
  4. Repeat the preceding steps on each Junos device where the client application establishes NETCONF sessions.

Configure a Public/Private Keypair or Password for the Junos OS User Account

The configuration management server needs an SSH public/private keypair, a text-based password, or both to authenticate with the NETCONF server. A keypair is sufficient if the account is used only to connect to the NETCONF server through SSH. If the account is also used to access the device in other ways (for login on the console, for example), it must have a text-based password. The password is also used (the SSH server prompts for it) if key-based authentication is configured but fails.

Note:

You can skip this section if you have chosen to enable authentication through RADIUS or TACACS+.

To create a text-based password:

  1. Include either the plain-text-password or encrypted-password statement at the [edit system login user username authentication] hierarchy level.

    To enter a password as text, issue the following command. You are prompted for the password, which the device encrypts before storing.

    To enter a password that you previously created and hashed using MD5 or SHA-1, issue the following command:

  2. Commit the configuration.
  3. Repeat the preceding steps on each device where the client application establishes NETCONF sessions.

To create an SSH public/private keypair, perform the following steps:

  1. On the configuration management server where the client application runs, issue the ssh-keygen command in the standard command shell and provide the appropriate arguments.

    For example:

    For more information about ssh-keygen options, see the man page for the ssh-keygen command.

  2. Associate the public key with the Junos OS login account.

    Junos OS copies the contents of the specified file onto the device. URL is the path to the file that contains one or more public keys. The ssh-keygen command by default stores each public key in a file in the .ssh subdirectory of the user home directory; the filename depends on the encoding and SSH version. For information about specifying URLs, see the CLI User Guide.

    Note:

    Alternatively, you can include the ssh-rsa statement at the [edit system login user account-name authentication] hierarchy level. We recommend using the load-key-file statement, however, because it eliminates the need to type or cut-and-paste the public key on the command line.

  3. Commit the configuration.

  4. Repeat Step 2 and Step 3 on each Junos device where the client application establishes NETCONF sessions.

Access the Keys or Password with the Client Application

The client application must be able to access the configured keypair or password and provide it when the NETCONF server prompts for it.

There are several methods for enabling the application to access the key or password:

  • If public/private keys are used, the ssh-agent program runs on the device where the client application runs, and handles the private key.

  • When a user starts the application, the application prompts the user for the password and stores it temporarily in a secure manner.

  • The password is stored in encrypted form in a secure local-disk location or in a secured database.

Prerequisites for Establishing an Outbound SSH Connection for NETCONF Sessions

To enable a configuration management server to establish an outbound SSH connection to the NETCONF server, you must satisfy the common requirements discussed in:

You must also satisfy the requirements discussed in the following sections:

Configure the Junos Device for Outbound SSH

To configure the Junos device for outbound SSH:

  1. At the [edit system services ssh] hierarchy level, set the SSH protocol-version to v2:
  2. Generate or obtain a public/private keypair for the Junos device. This keypair is used to encrypt the data transferred across the SSH connection.
  3. If you are manually installing the public key on the configuration management server, transfer the public key to the CMS.
  4. At the [edit system services] hierarchy level, include the outbound-ssh configuration hierarchy and any required statements.

    For detailed information about each of the options, see outbound-ssh.

  5. Commit the configuration:

Receive and Manage the Outbound SSH Initiation Sequence on the Client

When you configure a Junos device for outbound SSH, the device attempts to maintain a constant connection with a configuration management server. Whenever an outbound SSH session is not established, the device sends an outbound SSH initiation sequence to a configuration management server listed in the device’s configuration management server list. Before establishing a connection with the device, each configuration management server must be set up to receive this initiation sequence, establish a TCP connection with the device, and transmit the device identity back to the device.

The initiation sequence takes one of two forms, depending on how you chose to handle the Junos OS server's public key.

If the public key is installed manually on the configuration management server, the initiation sequence takes the following form:

If the device forwards the public key to the configuration management server during the initialization sequence, the sequence takes the following form:

Related Documentation

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release
Description
15.1
Starting in Junos OS Release 15.1, Junos OS supports outbound SSH connections with devices that have IPv6 addresses.