Juniper QFX (Junos) — Deployment

Stage, diff, commit and roll back fabric changes for Juniper QFX (Junos) data center fabrics (VXLAN/EVPN). Part of the multi-vendor Data Center automation guide.

Repository

Juniper

Junos

QFX

VXLAN / EVPN

Render per-vendor config from the intent model

Stage as a candidate on Juniper, then diff

Commit only the expected diff — roll back on failure

Setup, key commands & run examples

deploy.sh

Stage / diff / commit

The Juniper QFX (Junos) change workflow. Junos is the gold standard for safe change: edit the candidate, show | compare, then commit confirmed so the box auto-reverts if you lose access. NETCONF over SSH is first-class.

deploy.sh

bash

# 1. stage:   configure (candidate config) + load merge
# 2. diff:    show | compare
# 3. commit:  commit confirmed 5 (auto-rollback unless re-confirmed)
# 4. revert:  rollback 1 / commit confirmed timeout

deploy.py

Guarded commit

Render config from intent, stage it on Juniper, preview the diff and only commit when it matches what you expect.

deploy.py

python

dev.load_merge_candidate(config=rendered)   # configure (candidate config) + load merge
diff = dev.compare_config()                 # show | compare
print(diff)
if diff and "vlan 120" in diff:
    dev.commit_config()                     # commit confirmed 5 (auto-rollback unless re-confirmed)
else:
    dev.discard_config()

Best practices

Diff before every commit
Always review show | compare (or gate it in CI) so no Juniper change is applied blind.
Deploy leaf-pairs, not rows
Roll one MLAG/ESI pair at a time and verify before moving on, so redundancy survives a bad change.
Confirmed commits
Use commit confirmed on Juniper so the box auto-reverts if you lose reachability.
Post-change verification
Re-read EVPN/VTEP state after each commit and abort the rollout if anything regressed.

Hands-on exercises

Guided practice tasks — copy the starter snippet, run it against a lab device, and extend it to meet the goal.

Exercise 1

Guarded VLAN rollout

Goal: Add an L2VNI to one Juniper leaf pair: stage, print the diff, commit only if it contains the expected VLAN id.

exercise_1

python

rendered = render_l2vni(vlan=120, vni=10120)
# TODO: stage -> diff -> commit only if "120" in diff, else discard

Exercise 2

Rollback drill

Goal: Apply a bad change, detect the EVPN peer drop, and roll back with: rollback 1 / commit confirmed timeout

exercise_2

bash

# apply change, then on failure:
rollback 1 / commit confirmed timeout

Curated videos & guides

Checklist — pitfalls, gotchas & verification

Common pitfalls

•Committing without reviewing the diff first.
•Deploying both leaves of an MLAG/ESI pair at once and dropping the redundant path.
•Assuming Juniper commit semantics match other vendors — they differ.

Gotchas to watch

•compare_config() returns an empty string (not None) when there is no change — test truthiness.
•Losing your management session mid-commit can lock you out without confirmed-commit.

Verify it works

•After deploy, re-read EVPN neighbors and confirm every peer returned to up.
•Diff running-config against intent post-change to prove zero unexpected drift.