Creating a rescue configuration for a Juniper SRX Firewall

You can create a rescue configuration to be used in the event you make some change to a Juniper Networks SRX router/firewall, which runs Junos OS, that makes the device inaccessible. With a rescue configuration saved on the device, you can return the router/firewall to a known operational state. The rescue configuration saved on the device can provide a last resort means of quickly restoring the device to operational status. You can use either the web-based graphical user interface (GUI) method to create a saved rescue configuration via a web browser connection to the system or a command line interface (CLI) method.

GUI

To due so via a graphical user interface (GUI) method, log into the web interface, then click on the Maintain tab at the top of the window and select Config Management.

Maintain - Config Management

Then click on the Rescue button. You will then see the following:

Rescue

If you inadvertently commit a configuration that denies management access, the only recourse may be to connect the console. The rescue configuration gives you another alternative. The rescue configuration is a configuration you know will allow management access to the device.

Press and immediately release the Config button on the chassis to cause the device to load and commit the rescue configuration. This will put the device back into a managable state. You must have set the rescue configuration for this feature to function properly.

Set or Delete Rescue Configuration

Set rescue configuration

Delete rescue configuration

Click on the Set rescue configuration link. You will then see the following prompt:

Rescue

Confirm Rescue Configuration Operation

Are you sure that you want to set the rescue configuration to the currently running configuration?

Click on the OK button to save the rescue configuration that will allow you to return to the currently running configuration. You should then see the following information displayed:

Rescue

Set Rescue Configuration Results

The rescue configuration was set successfully.

If you inadvertently commit a configuration that denies management access, the only recourse may be to connect the console. The rescue configuration gives you another alternative. The rescue configuration is a configuration you know will allow management access to the device.

Press and immediately release the Config button on the chassis to cause the device to load and commit the rescue configuration. This will put the device back into a managable state. You must have set the rescue configuration for this feature to function properly.

View Rescue Configuration

The rescue configuration for the device has been set. To view the rescue configuration, click the link below.

View rescue configuration

Set or Delete Rescue Configuration

Set rescue configuration

Delete rescue configuration

If you click on the View rescue configuration link, you will see complete configuration information for the device. You can copy and paste that information to a text file, if you like, or save the web page. If you click on the OK button at the bottom of the page, you will be returned to the Rescue configuration page.

CLI

Log into the router/firewall and issue the cli command then issue the command request system configuration rescue save to save the configuration.

root@Alder% cli
root@Alder> request system configuration rescue save

root@Alder>

If you need to restore the system's configuration to the rescue configuration at any point, if you can log into the device via Secure Shell (SSH), invoke configuration mode.

root@Alder% cli
root@Alder> config

Then issue the command rollback rescue and then activate the rescue configuration with the commit command.

root@Alder# rollback rescue
load complete

[edit]
root@Alder# commit
commit complete

[edit]
root@Alder#

If you want to delete the rescue configuration previously saved, use the command request system configuration rescue delete. You don't need to be in configuration mode to delete the rescue configuration.

root@Alder> request system configuration rescue delete

root@Alder>

If you can't log into the command line interface for the device or access it via the GUI interface, but you have a saved rescue configuration, you can restore that configuration by pressing and immediately releasing the Config button on the chassis to cause the device to load and commit the rescue configuration. This will put the device back into a managable state.