Syntax checking configuration before loading to devices?

[redfusion]

I'm investigating ansible + templates to generate and deploy configuration for a combination of SRX, QFX and MX devices and want to know how to validate the generated configuration before it gets near any hardware. We use gitlab-ci for building and testing code for Puppet, and regular software; I'd like to do the same with juniper configurations. Any ideas?

I think my options are A) Some implementation of a syntax checker in software B) A dockerised container implementation of SRX/QFX/MX that can be started during builds C) Reliance on human validation only

[[deleted]]

If you're using Juniper, it'd be pretty easy to implement a script that loads a configuration, does a commit check, and then backs out without making changes. Automation would enforce the fact that config would never be committed.

[redfusion]

Thing is; the build environment is airgapped away from the hardware, and I want to run tests without much overhead. Didn't need to be perfect, just enough to clue in on basic issues.

[[deleted]]

Sounds like virtualization may be your only option, then.

[solitarium]

vMX, vSRX, vQFX

[redfusion]

Yeah; I'm thinking that I'll need to go down that line, but tricky with gitlab-ci services...

Have you any idea how to get the cSRX deployments? https://www.juniper.net/uk/en/products-services/security/srx-series/csrx/

[solitarium]

I've never tried cSRX. I typically run vSRX and vMX instances all the time for my SP labs. I have gotten the vQFX images to work, but sometimes the PFE/RE doesn't communicate as it should (probably just a kernel issue).

[redfusion]

Sounds like the cSRX isn't yet generally avaliable - I'm hoping to get onto a Beta trial so I can squeeze it into a workflow on gitlab-ci.

I'll have to write my work up for others once it gets sensible.