Ansible for Juniper: Automating Network Operations with Power and Precision

Netodata

December 13, 2025

Introduction

In today’s fast-paced IT landscape, network engineering managers are under growing pressure to implement faster, more reliable, and secure network operations. Automation is no longer a luxury—it’s a necessity. Among the most powerful tools for network automation is Ansible, and when paired with Juniper network devices, it offers a robust solution to manage infrastructure at scale while reducing human error, increasing deployment speed, and enabling consistent configuration across the network estate.

As networks grow in complexity and scale, manual configuration becomes increasingly impractical. Network automation with Ansible for Juniper devices provides a pathway to operational excellence through programmable infrastructure, allowing teams to shift from repetitive manual tasks to strategic initiatives that drive business value.

What Is Ansible and Why It’s Ideal for Network Automation

Ansible is an open-source automation engine that simplifies the orchestration, configuration, and management of IT infrastructure. Unlike many other automation tools, Ansible uses a declarative approach where you specify the desired state of your systems rather than the steps to achieve that state.

Key features of Ansible that make it particularly valuable for Juniper network automation include:

Agentless architecture: No need to install external software on managed devices, reducing security concerns and simplifying deployment.
Human-readable YAML syntax: Easy to learn, making onboarding for engineers quick and reducing the learning curve.
Extensive vendor support: Native modules for network vendors including Juniper, Cisco, Arista, and more.
Idempotency: Playbooks can be run multiple times without causing unintended side effects, making automation safer.
Extensibility: Custom modules can be created to address specific organizational needs.
Orchestration capabilities: Coordinate complex multi-device deployment sequences.
Inventory management: Group devices logically for targeted operations.

This combination of features makes Ansible an ideal choice for organizations looking to automate their Juniper network infrastructure while maintaining control and visibility.

Juniper Devices and Their Compatibility with Ansible

Juniper Networks is a popular enterprise-grade vendor known for its high-performance networking equipment running the Junos operating system. Juniper’s commitment to programmability and automation makes their devices particularly well-suited for Ansible-based automation.

The Ansible Junos modules, available through Juniper’s official juniper.junos Ansible collection, provide comprehensive capabilities for managing Junos devices:

juniper_junos_config: Load and commit configuration changes
juniper_junos_facts: Gather system information and operational data
juniper_junos_command: Run operational CLI commands and parse the output
juniper_junos_software: Upgrade device software images
juniper_junos_ping: Test network connectivity
juniper_junos_rpc: Execute specific RPCs on devices
juniper_junos_table: Retrieve and parse operational data using PyEZ Tables

All these modules require NETCONF to be enabled on the Junos devices, which is Juniper’s implementation of the standard network configuration protocol. NETCONF provides a programmatic interface for managing configurations using XML encoding, which Ansible leverages for device communication.

Setting Up Your Ansible Environment for Juniper Automation

Before diving into playbooks, you need to set up a proper Ansible environment for Juniper automation:

1. Install Required Components

First, install Python, Ansible, and the necessary libraries:

# Install Python and pip if not already available
sudo apt update
sudo apt install python3 python3-pip

# Install Ansible
pip3 install ansible

# Install PyEZ (Juniper's Python library) and required dependencies
pip3 install junos-eznc jxmlease

# Install the Juniper.junos collection for Ansible
ansible-galaxy collection install juniper.junos

2. Configure Ansible for Network Automation

Create an ansible.cfg file in your project directory with network-specific settings:

[defaults]
inventory = ./inventory
host_key_checking = False
timeout = 30
retry_files_enabled = False
gathering = explicit
stdout_callback = yaml

[persistent_connection]
connect_timeout = 60 command_timeout = 60

3. Create a Network Inventory

Define your Juniper devices in an inventory file:

# inventory.ini
[juniper_routers]
router1 ansible_host=192.168.1.1
router2 ansible_host=192.168.1.2

[juniper_switches]
sw1 ansible_host=192.168.1.10
sw2 ansible_host=192.168.1.11
sw3 ansible_host=192.168.1.12

[juniper:children]
juniper_routers
juniper_switches

[juniper:vars]
ansible_network_os=junos
ansible_connection=netconf
ansible_user=netadmin
ansible_password=secure_password
ansible_python_interpreter=/usr/bin/python3

Note: For production environments, never store passwords in plain text. Use Ansible Vault or environment variables instead.

Step-by-Step: Automating Juniper Devices Using Ansible Playbooks

Now let’s explore practical examples of automating Juniper devices with Ansible:

Example 1: Basic Device Information Gathering

Create a playbook to gather facts from your Juniper devices:

---
# gather_facts.yml
- name: Collect Juniper Device Information
  hosts: juniper
  gather_facts: no
  collections:
    - juniper.junos

  tasks:
    - name: Gather Junos facts
      juniper_junos_facts:
        savedir: "./facts"
      register: junos_facts

    - name: Display device information
      debug:
        msg: "{{ inventory_hostname }} is running Junos {{ junos_facts.ansible_facts.junos.version }} on a {{ junos_facts.ansible_facts.junos.model }}"

Run this playbook:

ansible-playbook gather_facts.yml

Example 2: Configuring VLANs on Juniper Switches

Create a playbook to configure VLANs:

---
# configure_vlans.yml
- name: Configure VLANs on Juniper Switches
  hosts: juniper_switches
  gather_facts: no
  collections:
    - juniper.junos

  tasks:
    - name: Load VLAN configuration
      juniper_junos_config:
        load: merge
        format: set
        lines:
          - set vlans engineering vlan-id 100
          - set vlans engineering description "Engineering Department"
          - set vlans finance vlan-id 200
          - set vlans finance description "Finance Department"
          - set vlans management vlan-id 999
          - set vlans management description "Network Management"
        comment: "Configuring standard VLANs"
        confirm: 2
      register: config_result

    - name: Show configuration results
      debug:
        var: config_result

Run the VLAN configuration playbook:

ansible-playbook configure_vlans.yml

Example 3: Template-Based Configuration Management

For more complex configurations, use Jinja2 templates:

Create a template file templates/interfaces.j2:

interfaces {
{% for interface in interfaces %}
    {{ interface.name }} {
        description "{{ interface.description }}";
        unit 0 {
            family ethernet-switching {
                vlan {
                    members {{ interface.vlan }};
                }
            }
        }
    }
{% endfor %}
}

Create a variable file host_vars/sw1.yml:

interfaces:
  - name: ge-0/0/0
    description: "Server 1 Connection"
    vlan: "engineering"
  - name: ge-0/0/1
    description: "Server 2 Connection"
    vlan: "engineering"
  - name: ge-0/0/2
    description: "Finance Workstation"
    vlan: "finance"

Create a playbook to apply the template:

---
# apply_interface_config.yml
- name: Configure Interfaces from Templates
  hosts: juniper_switches
  gather_facts: no
  collections:
    - juniper.junos

  tasks:
    - name: Create configuration from template
      template:
        src: templates/interfaces.j2
        dest: "{{ inventory_hostname }}_interfaces.conf"
      delegate_to: localhost

    - name: Apply interface configuration
      juniper_junos_config:
        load: merge
        src: "{{ inventory_hostname }}_interfaces.conf"
        format: text
        comment: "Interface configuration via template"
        confirm: 1
        validate: yes
      register: result

    - name: Show configuration diff
      debug:
        var: result.diff_lines

Run the template-based configuration:

ansible-playbook apply_interface_config.yml

Example 4: Executing Operational Commands

Create a playbook to run and capture operational commands:

---
# operational_commands.yml
- name: Run Operational Commands on Juniper Devices
  hosts: juniper
  gather_facts: no
  collections:
    - juniper.junos

  tasks:
    - name: Check interface status
      juniper_junos_command:
        commands:
          - show interfaces terse
          - show system uptime
      register: cli_output

    - name: Save output to file
      copy:
        content: "{{ cli_output.stdout }}"
        dest: "./outputs/{{ inventory_hostname }}_interfaces.txt"
      delegate_to: localhost

    - name: Show interface summary
      debug:
        msg: "{{ cli_output.stdout_lines[0] | join('\n') }}"

Run the operational commands playbook:

ansible-playbook operational_commands.yml

Example 5: Software Upgrade Automation

---
# upgrade_junos.yml
- name: Upgrade Junos OS
  hosts: juniper_routers
  gather_facts: no
  collections:
    - juniper.junos

  tasks:
    - name: Check current OS version
      juniper_junos_facts:
      register: junos_facts

    - name: Display current version
      debug:
        msg: "Current Junos version: {{ junos_facts.ansible_facts.junos.version }}"

    - name: Upgrade Junos OS
      juniper_junos_software:
        local_package: "./software/junos-srx-20.4R3-S1.tgz"
        reboot: yes
        validate: yes
      register: upgrade
      when: junos_facts.ansible_facts.junos.version != "20.4R3-S1"

    - name: Wait for reboot to complete
      wait_for:
        host: "{{ ansible_host }}"
        port: 830
        delay: 60
        timeout: 600
      when: upgrade.changed

    - name: Verify new version
      juniper_junos_command:
        commands:
          - show version
      register: version_output
      when: upgrade.changed

    - name: Display new version
      debug:
        var: version_output
      when: upgrade.changed

Run the upgrade playbook:

ansible-playbook upgrade_junos.yml

Using Ansible for Network Compliance and Audit

Ansible can also be used for network compliance checking and audit:

---
# compliance_check.yml
- name: Check Security Compliance
  hosts: juniper
  gather_facts: no
  collections:
    - juniper.junos

  tasks:
    - name: Get security configuration
      juniper_junos_command:
        commands:
          - show configuration security
      register: security_config

    - name: Check for SSH version 2
      juniper_junos_command:
        commands:
          - show configuration system services ssh | display set
      register: ssh_config

    - name: Verify NTP configuration
      juniper_junos_command:
        commands:
          - show configuration system ntp
      register: ntp_config

    - name: Generate compliance report
      template:
        src: templates/compliance_report.j2
        dest: "./reports/{{ inventory_hostname }}_compliance.md"
      delegate_to: localhost
      vars:
        security_data: "{{ security_config.stdout[0] }}"
        ssh_data: "{{ ssh_config.stdout[0] }}"
        ntp_data: "{{ ntp_config.stdout[0] }}"

Common Challenges and Troubleshooting Tips

When automating Juniper devices with Ansible, you may encounter several challenges:

1. NETCONF Connectivity Issues

Ensure SSH and NETCONF are enabled on your Juniper devices:

# CLI configuration to enable NETCONF
set system services netconf ssh
set system services ssh

Verify NETCONF connectivity with:

ssh -p 830 netadmin@192.168.1.1 -s netconf

2. Authentication Failures

Use secure authentication methods:

# Using Ansible Vault for credentials
ansible-vault create secrets.yml

Add your credentials to the vault file:

ansible_user: netadmin
ansible_password: secure_password

Reference in your playbook:

- name: Secure Configuration
  hosts: juniper
  vars_files:
    - secrets.yml
  tasks:
    # Your tasks here

Run playbooks with vault:

ansible-playbook -i inventory.ini playbook.yml --ask-vault-pass

3. Playbook Syntax and Validation

Always validate your playbooks:

ansible-playbook --syntax-check playbook.yml

Test playbooks in check mode first:

ansible-playbook playbook.yml --check

4. Rollback Strategies

Implement proper rollback mechanisms:

- name: Configuration with rollback safety
  juniper_junos_config:
    load: merge
    src: config.txt
    confirm: 5  # Auto-rollback after 5 minutes if not confirmed
    commit: yes
  register: result

- name: Confirm commit if tests pass
  juniper_junos_config:
    confirm_commit: yes
  when: validation_tests | success

Best Practices for Juniper Network Automation with Ansible

To maximize the benefits of Ansible automation for your Juniper network:

Organize your automation code repository with a clear structure:

   ansible-juniper/
   ├── inventory/
   │   ├── hosts.ini
   │   └── group_vars/
   ├── playbooks/
   ├── roles/
   ├── templates/
   └── ansible.cfg

Use source control like Git to track changes to your automation code
Implement CI/CD pipelines to test and deploy network changes
Develop a testing strategy including syntax checking, validation, and lab testing before production deployment
Document your automation code with clear comments and README files
Build reusable roles for common tasks rather than monolithic playbooks
Implement proper error handling in your playbooks

Conclusion

Ansible for Juniper provides a powerful framework for network automation that can transform how your organization manages its infrastructure. By starting with basic playbooks and gradually incorporating more advanced techniques like templates and roles, you can build a robust automation strategy that scales with your network.

The examples provided in this article serve as a foundation upon which you can build more complex automation solutions tailored to your specific needs. As you gain experience with Ansible and Juniper automation, you’ll discover new ways to improve efficiency, reduce errors, and enable your network team to focus on strategic initiatives rather than repetitive tasks.

By embracing network automation with Ansible for Juniper, you position your organization to better handle the increasing demands of modern network management while maintaining security, compliance, and operational excellence.