# Junos OS Initial Setup: Candidate Configurations, Commit Rules, and Interface Provisioning

Engineers transitioning from Cisco IOS to Juniper Networks Junos OS often encounter immediate workflow friction. Where Cisco immediately applies interface and routing changes directly to the running configuration, Junos uses a transactional database model.

Understanding this candidate configuration architecture, mandatory root authentication constraints, and rollback mechanisms is essential before deploying any Juniper SRX, MX, or vSRX hardware.

---

### 1\. Operational Mode vs. Configuration Mode

When logging into Junos via an out-of-band console cable (configured to 9600-8-N-1 serial parameters), the system presents the operational prompt indicated by an angle bracket:

`root@core-router>`

Operational mode is strictly for monitoring, inspecting routing tables (`show route`), and running diagnostic tests (`ping`, `traceroute`). To make any system adjustments, you must transition to the configuration hierarchy by entering:

`root@core-router> configure`\
`root@core-router#`

The prompt transforms to a hash mark (`#`), indicating that you are now editing a private **Candidate Configuration buffer**.

---

### 2\. The Candidate vs. Active Configuration Paradigm

Any command executed inside configuration mode (such as defining hostnames, DNS resolvers, or IP addressing) alters only the candidate buffer in memory. The active running kernel continues to process traffic uninterrupted.

This design eliminates the risk of dropping an active SSH session while half-reconfiguring an interface subnet.

Before applying candidate changes to live silicon, Junos allows engineers to inspect the exact differential:

`show | compare`

Lines prefixed with a minus (`-`) represent deleted commands; lines with a plus (`+`) indicate new configurations to be merged.

---

### 3\. The Mandatory Root Authentication Rule

Junos OS enforces strict administrative security out of the box. A newly unboxed or factory-reset router (`load factory-default`) will unconditionally reject any `commit` command until root credentials are encrypted:

```junos
[edit]
root@core-router# commit
error: Missing mandatory statement: 'root-authentication'
error: commit failed: 1 error reported
```

To satisfy this kernel requirement, configure a plaintext password, which Junos automatically hashes using SHA-512 or UNIX-Crypt:

```junos
set system root-authentication plain-text-password
# Enter new password twice when prompted
```

---

### 4\. Safe Pre-Flight Checks and Rollback Safeguards

One of the strongest architectural advantages of Junos is automated syntax verification before execution:

- **Pre-Flight Validation:** Run `commit check` to test syntax, IP overlap, and routing logic without applying the changes.
- **Timed Commit (Failsafe for Remote Admins):** When configuring remote WAN interfaces, execute `commit confirmed 5`. If the new IP breaks your management link and you fail to enter a confirming `commit` within 5 minutes, the router automatically rolls back to the previous working state.
- **Rollback History:** The router stores up to 50 previous successful commits locally. Recovering from an administrative mistake requires running `rollback 1` followed by `commit`.

For a complete hardware setup walkthrough covering console roll-over pinouts, root password recovery from the bootloader prompt, and secondary interface cascading, consult the [initial Junos CLI configuration and interface setup guide](https://routeripguide.com/howto/juniper-router-setup-junos-cli).

---

*Maintained by Router IP Guide — Independent Hardware Networking & Gateway Diagnostic Suite.*