Showing posts with label Juniper Network. Show all posts
Showing posts with label Juniper Network. Show all posts

Monday, January 10, 2011

juniper router configuration command(Network)


           Description                                                                Commands

Show running configuration                                              sh configuration

Show version                                                                  sh ver

displays the status of interfaces configured for IP              show interface terse 

displays the interface configuration, status and statistics.    show interfaces [intfc] detail

displays information about a physical port device              show interfaces intfc extensive

displays the interface configuration, status and statistics     show interfaces description


displays summary information about entries in the
routing table                                                                    show route
displays the status of all Border Gateway Protocol

(BGP) connections                                                          show bgp summary

will show you how that route is being advertised,
look for the first line                                                         show route protocol bgp prefix

will show you how that route is being advertised,
look for the first line                                                         show route range prefix

displays routes matching the autonomous system (AS)
path regular expression                                                    show route aspath-regexp "AS-regexp"

Shows whether a neighbor supports the route refresh
capability   show route receive-protocol bgp neigh           show route source-gateway neigh protocol bgp

                                                                                       

Shows whether a neighbor supports the route refresh
capabilty                                                                         show route advertising-protocol bgp neigh 


displays both ES and IS neighbors                                   show isis adjacency


shows specific information about each interface                show isis interface

displays the current state of the the routing table               show isis routes

displays a list of all connected routers in all areas              show isis spf

 shows neighbor ID, Priority, IP, & State if the
neighbor router, dead time.                                              show ospf neighbor

shows neighbor id, pri, state, dead time, address              
and interface                                                                   show ospf interface

display the current state of the routing table                      show ospf route

display list of information related to the OSPF
database for a specific communication server                   show ospf database

display the system hardware config., software version,
and name and source of configuration files and boot
images                                                                            show version, show system uptime

displays power-on diagnostics status                               show chasis hardware

displays utilization statistics   show system process
displays the current software image, configuration,
controllers, counters, stacks, interfaces, memory
and buffers  -                                                                 request support info


display the state of logging to the syslog                          show log messages

displayall route-maps configured or only the one
specified                                                                        show policy name

display information about a prefix list or prefix                
list entries                                                                       show policy name

display routes that are permitted by BGP                       
community list                                                                configure,show policy-options 
                                                                                     community name

displays temperature and voltage information
on the console                                                               show chassis  environment

to check to see if a destination is alive                            ping dest rapid (for cisco like output)
                                                                                    ping dest (for unix like output)

to check to see if a destination is alive                            ping dest bypass-routing

Change console terminal settings                                    monitor start messages 

Change console terminal settings                                    monitor stop 

sets the length for displaying command output                set cli screen-length 0















Saturday, November 20, 2010

Netscreen - NSRP

HA Setups
There are 3 main types of HA setup, they are,
  • Active / Passive - All traffic passes the active node. In the event of failure the backup firewall is activated, and traffic flow is resumed.
  • Active / Active - Both Firewalls share the network load. In the event of failure all traffic is passed through the working node.
  • Active / Active Full Mesh - This setup eliminates any single point of failure. Every link to each node, switch, and router is cabled twice to allow for complete redundancy.
HA Feature Sets

SOHO
This allows for you to configure a secondary untrust interface. Of which in the event of failure the secondary link will become active, in order to restore connectivity. You can use either the available serial port or ethernet port for your secondary link, allowing you to connect ADSL Modems or Routers.
By default you must manually initiate a failover from the CLI.

The various commands are below,

ns5gt-> exec failover force <- failover manual
ns5gt-> exec failover revert <- revert ack
ns5gt-> exec failover auto <- enable automatic failover
To allow the link to stabilize there is a default hold down timer of 30secs. If required you can modify this by using the command,

ns5gt-> set failover hold-down [number of seconds]
SOHO only monitors the link between the Netscreen and the modem or the router. So if there is a problem with the ISP service the Netscreen will not failover.
To allow you to configure this setup (dual untrust) you will need to be using a port mode of "dual-untrust" or "combined".
To confirm which mode you are running use the command `get system`. You can change the mode by using `exec port-mode dual-untrust` command, but be warned this will cause all the configuration to be erased.
NSRP-Lite
This allows for Active/Passive setup with configuration syncronisation. But does not provide Run-Time Oject syncronisation (discussed later) or an Active/Active setup.

NSRP
NSRP is the protocol that allows clustered Netscreens to communicate with each other and allows them to exchange state information. Which in turn allows them to make the required decisions to ensure traffic is still passed in the event of failure.
When NSRP is enabled a VSD (Virtual Security Device) is created, along with the configuration of the physical interfaces being applied to VSI`s Virtual Security Interfaces. Each VSD belongs to a VSD group. In each VSD group, one VSD is nominated as a master VSD. Each VSD will sit on each firewall. Only the master VSD (Active firewall) will pass the traffic. Along with this the IP addresses assigned to a VSI follow the master VSD. With regards to the management IP`s these stay static to each firewall.


NSRP States
At any one time each VSD can be in one of 6 states.
  1. Master
  2. Primary Backup
  3. Backup
  4. Initial
  5. Ineligible
  6. Inoperable
Initial - Occurs when a VSD is first created due to reboot or configuration change. While in this state the VSD learns other devices in the VSD group, syncs the state with other VSD`s, and elections for which VSD should be master.
Master or Backup - Each VSD then either goes into a master or backup state.
Primary backup - If the backup node finds there is no primary backup VSD it sets itself to the Primary Backup for the VSD group. When in this state the VSD can either be prompted to master due to the old VSD disappearing or goes into an inoperable state.
Inoperable - The VSD will go into this state if it detects a failure that stops it from passing traffic, when in this state the VSD isnt included in elections.
Ineligible - This is an administratively down state of a VSD, of which is done manually. `set nsrp vsd-group id [number] mode ineligable`.The Master VSD is determined,
  • if there is no other VSD then the devices wins and becomes active
  • if there are 2 VSDs the device with the lowest priority wins ( `set nsrp vsd-group id X priority N` )
  • if both devices have same priority or its not set then the VSD with the lowest MAC address wins. 
A fail over can be caused by any of the following,
  • Software crashes
  • Hardware or power failure
  • Link failure on monitored interfaces or zones
  • Unavailability of one or more Tracked IP`s

Cluster Traffic
2 types of packets are exchanged over HA Links. These are control messages and data packets.
  • Control messages : Consists of Heartbeats, Link probes, VSD stat information and session synchronizations.
  • Data packets       : This is normal user traffic which is passed from one firewall to another. This happens in an Active/Active HA setup.
To check if both devices are in sync run the command,

ns5gt-> clear db
ns5gt-> exec nsrp sync global-config check-sum
ns5gt-> get db str

NSRP Track IP
Interface Track IP and VPN monitoring are not included with NSRP. NSRP Tracking allows you to fail across your cluster in the event of IP`s becoming unreachable. Such as a router IP. This allows for failovers in the event of a Netscreen interface or switch port failing.
If in the event of failure you required your traffic to take an alternative route, a configuration option would be to,

  1. Disable the default VSD group
  2. Create a new VSD group but leave out your interfaces that you require as being local.
  3. Set Track IP to poll an IP address (such as your Router)
In the event of failover this would prevent the failed interface from moving to the other VSD.
RTO Mirroring
Real-Time Object mirroring allows dynamic based information to be synchronized between the cluster nodes, such as DHCP leases, VPN sessions etc.
To enable RTO use the following commands,
ns5gt-> set nsrp cluster id1
ns5gt-> set nsrp rto-mirror sync
With some insecure protocols you may wish to disable sessions created by a certain policy from being mirrored when dealing with DoS attacks. To change this,
  1. Go into the policy
  2. Select "Advanced"
  3. Deselect "HA Session Backup" and click return.
  4. Click OK

Split Brain
Split Brain is a situation where the HA link fails and in turn both devices believe the other device has failed and then promotes itself to master.
There are 3 methods in which you can prevent this situation from arising,
  1. Dual HA links.
  2. Connect the Ha links directly using cross over cables.
  3. Add a secondary path for the HA link. This will use an existing traffic interfaces and is enabled via the commands.

ns5gt-> adding a secondary path
ns5gt-> set nsrp secondary-path eth1

"No Brain" Situation
In this situation both switches/switch ports fail. Both firewalls may be plugged into the same switch or different switches which may fail due to power failure etc. This causes both firewalls to place themselves into an inoperable state and then backup. Causing both firewalls to be in a backup state.
To ensure that one device is always master you can use the command,
ns5gt-> set nsrp vsd-group master-always-exists
The main issue with this occurs in a situation where both switches/switch ports fail for one network (i.e trust) and then a switch/switch port fails on the active node. In this case the cluster will not fail across to the secondary node even though it is the best candiate for master.

Wednesday, November 3, 2010

Configure the Router with the CLI

To configure the router, including the routing protocols, router interfaces, network management, and user access, you must enter a separate mode called configuration mode. Do this by issuing the configure operational mode command.

In configuration mode, the command-line interface (CLI) provides commands to configure the router, load a text (ASCII) file that contains the router configuration, activate a configuration, and save the configuration to a text file.
This chapter discusses the following topics:

Tuesday, November 2, 2010

Additional Details about Specifying Statements and Identifiers

This section provides more detailed information about specifying statements and identifiers in configuration mode:

How to Specify Statements

This section provides more detailed information about CLI container and leaf statements so that you can better understand how the CLI displays them in a configuration and how you must specify them when creating ASCII configuration files.
Statements are shown one of two ways, either with braces or without:
  • Statement name and identifier, with one or more lower-level statements enclosed in braces:
< statement-name > < identifier > {
    statement; 
    additional-statements; 
}

  • Statement name, identifier, and a single identifier:
< statement-name > < identifier > identifier; 

The statement-name is the name of the statement. In the configuration example shown in the previous section, ospf and area are statement names.
The identifier is a name or other string that uniquely identifies an instance of a statement. The identifier is used when a statement can be specified more than once in a configuration. In the configuration example shown in the previous section, the identifier for the area statement is 0 and the identifier for the interface statement is so-0/0/0.
When specifying a statement, you must specify either a statement name or an identifier, or both, depending on the statement hierarchy.
You specify identifiers in one of the following ways:
  • identifier—The identifier is a flag, which is a single keyword.
  • identifier value—The identifier is a keyword, and the value is a required option variable.
  • identifier [value1 value 2 value3 ...]—The identifier is a set that accepts multiple values. The brackets are required when you specify a set of identifiers; however, they are optional when you specify only one identifier.
The following examples illustrate how statements and identifiers are specified in the configuration:
protocol {                                            # Top-level statement (statement-name).
    ospf {                                        # Statement under "protocol" (statement-name).
        area 0.0.0.0 {                                    # OSPF area "0.0.0.0" (statement-name identifier),
            interface so-0/0/0 {                                # which contains an interface named "so-0/0/0."
                hello-interval 25;                            # Identifier and value (identifier-name value). 
                priority 2;                            # Identifier and value (identifier-name value).
                disable;                            # Flag identifier (identifier-name).
            }
            interface so-0/0/1;                                # Another instance of "interface," named so-0/0/1,
        }                                    # this instance contains no data, so no braces
    }                                        # are displayed.
}
policy-options {                                            # Top-level statement (statement-name).
    term term1 {                                        # Statement under "policy-options" 
                                            # (statement-name value).
        from {                                    # Statement under "term" (statement-name).
            route-filter 10.0.0.0/8 orlonger reject;                                                                # One identifier ("route-filter") with
            route-filter 127.0.0.0/8 orlonger reject;                                                                # multiple values.
            route-filter 128.0.0.0/16 orlonger reject;
            route-filter 149.20.64.0/24 orlonger reject;
            route-filter 172.16.0.0/12 orlonger reject;
            route-filter 191.255.0.0/16 orlonger reject;
        }
        then {                            # Statement under "term" (statement-name).
            next term;                        # Identifier (identifier-name).
        }
    }
}

When you create an ASCII configuration file, you can specify statements and identifiers in one of the following ways. However, each statement has a preferred style, and the CLI uses that style when displaying the configuration in response to a configuration mode show command.
  • Statement followed by identifiers:
statement-name identifier-name [...] identifier-name value [...];

  • Statement followed by identifiers enclosed in braces:
statement-name { 
    identifier-name; 
    [...] 
    identifier-name value;
    [...]
}

  • For some repeating identifiers, you can use one set of braces for all the statements:
statement-name {
    identifier-name value1; 
    identifier-name value2; 
}

Monday, November 1, 2010

Using the CLI to Configure the Router

This section walks through an example of creating a simple configuration, illustrating how to use the CLI to create, display, and modify the software configuration for your system. The example used in this section creates the following configuration:
protocols {
    ospf {
        area 0.0.0.0 {
            interface so-0/0/0 {
                hello-interval 5;
                dead-interval 20;
            }
            interface so-0/0/1 {
                hello-interval 5;
                dead-interval 20;
            }
        }
    }
}

Shortcut

You can create this entire configuration with two commands:
[edit]
user@host# set protocols ospf area 0.0.0.0 interface so-0/0/0 hello-interval 5 dead-interval 20
[edit]
user@host# set protocols ospf area 0.0.0.0 interface so-0/0/1 hello-interval 5 dead-interval 20

Longer Configuration Example

The remainder of this section provides a longer example of creating the OSPF configuration. In the process, it illustrates how to use the different features of the CLI.
First, you enter configuration mode by issuing the configure top-level command:
user@host> configure 
entering configuration mode
[edit]
user@host# 

The prompt in braces shows that you are in configuration edit mode, at the top of the hierarchy. If you want to create the above configuration, you start by editing the protocols ospf statements:
[edit]
user@host# edit protocols ospf
[edit protocols ospf]
user@host# 

Now, add the OSPF area:
[edit protocols ospf]
user@host# edit area 0.0.0.0
[edit protocols ospf area 0.0.0.0]
user@host# 


Next, add the first interface:
[edit protocols ospf area 0.0.0.0]
user@host# edit interface so0
[edit protocols ospf area 0.0.0.0 interface so-0/0/0]
user@host# 

You now have four nested statements. Next, set the hello and dead intervals. Note that command completion (enter a tab or space) and context-sensitive help (type a question mark) are always available.
[edit protocols ospf area 0.0.0.0 interface so-0/0/0]
user@host# set ?
Possible completions:
+ apply-groups                                    Groups from which to inherit configuration data
> authentication-key                                    Authentication key
  dead-interval                                    Dead interval (seconds)
  disable                                    Disable OSPF on this interface
  hello-interval                                    Hello interval (seconds)
  interface-type                                    Type of interface
  metric                                    Interface metric (1..65535)
> neighbor                                    NBMA neighbor
  passive                                    Do not run OSPF, but advertise it
  poll-interval                                    Poll interval for NBMA interfaces
  priority                                    Designated router priority
  retransmit-interval                                    Retransmission interval (seconds)
  transit-delay                                    Transit delay (seconds)
  transmit-interval                                     OSPF packet transmit interval (milliseconds)
[edit protocols ospf area 0.0.0.0 interface so-0/0/0]
user@host# set hello-interval 5
[edit protocols ospf area 0.0.0.0 interface so-0/0/0]
user@host# set dead-interval 20
[edit protocols ospf area 0.0.0.0 interface so-0/0/0]
user@host# 

You can see what is configured at the current level with the show command:
[edit protocols ospf area 0.0.0.0 interface so-o]
user@host# show 
hello-interval 5;
dead-interval 20;
[edit protocols ospf area 0.0.0.0 interface so-0/0/0]
user@host# 

You are finished at this level, so back up a level and take a look at what you have so far:
[edit protocols ospf area 0.0.0.0 interface so-0/0/0]
user@host# up 
[edit protocols ospf area 0.0.0.0]
user@host# show 
interface so-0/0/0 {
    hello-interval 5;
    dead-interval 20;
}
[edit protocols ospf area 0.0.0.0]
user@host# 

The interface statement appears because you have moved to the area statement.
Now, add the second interface:
[edit protocols ospf area 0.0.0.0]
user@host# edit interface so-0/0/1
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# set hello-interval 5
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# set dead-interval 20
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# up 
[edit protocols ospf area 0.0.0.0]
user@host# show 
interface so-0/0/0 {
    hello-interval 5;
    dead-interval 20;
}
interface so-0/0/1 {
    hello-interval 5;
    dead-interval 20;
}
[edit protocols ospf area 0.0.0.0]
user@host# 

Now, back up to the top level and see what you have:
[edit protocols ospf area 0.0.0.0]
user@host# top
[edit]
user@host# show 
protocols {
    ospf {
        area 0.0.0.0 {
            interface so-0/0/0 {
                hello-interval 5;
                dead-interval 20;
            }
            interface so-0/0/1 {
                hello-interval 5;
                dead-interval 20;
            }
        }
    }
}
[edit]
user@host# 

This configuration now contains the statements you want. Before committing it, which activates the configuration, verify that the configuration is correct:
[edit]
user@host# commit check
configuration check succeeds
[edit]
user@host#

Now you can commit the configuration to activate it on the router:
[edit]
user@host# commit
commit complete
[edit]
user@host#

Suppose you decide to use different dead and hello intervals on interface so-0/0/1. You can make changes to the configuration. You can go directly to the appropriate hierarchy level by typing the full hierarchy path to the statement you want to edit.
[edit]
user@host# edit protocols ospf area 0.0.0.0 interface so-0/0/1
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# show 
hello-interval 5;
dead-interval 20;
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# set hello-interval 7
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# set dead-interval 28
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# top
[edit]
user@host# show 
protocols {
    ospf {
        area 0.0.0.0 {
            interface so-0/0/0 {
                hello-interval 5;
                dead-interval 20;
            }
            interface so-0/0/1 {
                hello-interval 7;
                dead-interval 28;
            }
        }
    }
}
[edit]
user@host# 

If you change your mind and decide not to run OSPF on the first interface, you can delete the statement:
[edit]
user@host# edit protocols ospf area 0.0.0.0
[edit protocols ospf area 0.0.0.0]
user@host# delete interface so-0/0/0
[edit protocols ospf area 0.0.0.0]
user@host# top
[edit]
user@host# show 
protocols {
    ospf {
        area 0.0.0.0 {
            interface so-0/0/1 {
                hello-interval 7;
                dead-interval 28;
            }
        }
    }
}
[edit]
user@host# 

Note that everything inside of the statement you deleted was deleted with it. You could eliminate the entire OSPF configuration by simply entering delete protocols ospf while at the top level.
Suppose you decide to use the default values for the hello and dead intervals on your remaining interface, but you want OSPF to run on that interface:
[edit]
user@host# edit protocols ospf area 0.0.0.0 interface so-0/0/1
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# delete hello-interval
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# delete dead-interval
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# top
[edit]
user@host# show 
protocols {
    ospf {
        area 0.0.0.0 {
            interface so-0/0/1;
        }
    }
}
[edit]
user@host# 

You can set multiple statements at the same time as long as they are all part of the same hierarchy (the path of statements from the top inward, as well as one or more statements at the bottom of the hierarchy). Doing this can reduce considerably the number of commands you must enter. For example, if you want to go back to the original hello and dead interval timers on interface so-0/0/1, you can enter:
[edit]
user@host# edit protocols ospf area 0.0.0.0 interface so-0/0/1
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# set hello-interval 5 dead-interval 20
[edit protocols ospf area 0.0.0.0 interface so-0/0/1]
user@host# exit
[edit]
user@host# show
protocols {
    ospf {
        area 0.0.0.0 {
            interface so-0/0/1 {
                hello-interval 5;
                dead-interval 20;
            }
        }
    }
}
[edit]
user@host#

You also can re-create the other interface, as you had it before, with only a single entry:
[edit]
user@host# set protocols ospf area 0.0.0.0 interface so-0/0/1 hello-interval 5 dead-interval 20
[edit]
user@host# show
protocols {
    ospf {
        area 0.0.0.0 {
            interface so-0/0/0 {
                hello-interval 5;
                dead-interval 20;
            }
            interface so-0/0/1 {
                hello-interval 5;
                dead-interval 20;
            }
        }
    }
} 

Sunday, October 31, 2010

Have Multiple Users Configure the Software

Up to 32 users can be in configuration mode simultaneously, and they all can be making changes to the configuration. All changes made by all users are visible to everyone editing the configuration—the changes become visible as soon as the user presses the Enter key at the end of a command that changes the configuration, such as set, edit, or delete.
When any of the users editing the configuration issues a commit command, all changes made by all users are checked and activated.

Saturday, October 30, 2010

Add Comments in a Configuration

You can include comments in a configuration to describe any statement in the configuration. You can add commands interactively in the CLI and by editing the ASCII configuration file.
When you add comments in configuration mode, they are associated with a statement at the current level. Each statement can have one single-line comment associated with it. Before you can associate a comment with a statement, the statement must exist. The comment is placed on the line preceding the statement.
To add comments to a configuration, use the annotate configuration mode command:
annotate statement "comment-string" 

statement is the configuration statement to which you are attaching the comment; it must be at the current hierarchy level. If a comment for the specified statement already exists, it is deleted and replaced with the new comment.
comment-string is the text of the comment. The comment text can be any length, and you must type it on a single line. If the comment contains spaces, you must enclose it in quotation marks. In the comment string, you can include the comment delimiters /* */ or #. If you do not specify any, the comment string is enclosed with the /* */ comment delimiters.
To delete an existing comment, specify an empty comment string:
annotate statement "" 

When you edit the ASCII configuration file and add comments, they can be one or more lines and must precede the statement they are associated with. If you place the comments in other places in the file, such as on the same line following a statement or on a separate line following a statement, they are removed when you use the load command to open the configuration into the CLI.
When you include comments in the configuration file directly, you can format comments in the following ways:
  • Start the comment with a /* and end it with a */. The comment text can be on a single line or can span multiple lines.
  • Start the comment with a # and end it with a new line (carriage return).
If you add comments with the annotate command, you can view the comments within the configuration by entering the show configuration mode command or the show configuration operational mode command.
When configuring interfaces, you can add comments about the interface by including the description statement at the [edit interfaces interface-name] hierarchy level. Any comments you include appear in the output of the show interfaces commands. For more information about the description statement, see the JUNOS Internet Software Configuration Guide: Interfaces and Class of Service.

Examples: Include Comments in Configurations

Add comments to a configuration:
[edit]
user@host# show
protocols {
    ospf {
        area 0.0.0.0 {
            interface so-0/0/0 {
                hello-interval 5;
            }
        }
    }
}
[edit]
user@host# edit protocols ospf 
[edit protocols ospf]
user@host# set area 0.0.0.0 
user@host# annotate area 0.0.0.0 "Backbone area configuration added June 15, 1998" 
[edit protocols ospf]
user@host# edit area 0.0.0.0
[edit protocols ospf area 0.0.0.0]
user@host# annotate interface so0 "Interface from router sj1 to router sj2"
[edit protocols ospf area 0.0.0.0]
user@host# top
[edit]
user@host# show 
protocols {
    ospf {
        /* Backbone area configuration added June 15, 1998 */
        area 0.0.0.0 {
            /* Interface from router sj1 to router sj2 */
            interface so-0/0/0 {
                hello-interval 5;
            }
        }
    }
}
[edit]
user@host# 

The following excerpt from a configuration example illustrates how to enter comments in a configuration file:
/* This comment goes with routing-options */
routing-options {
    /* This comment goes with routing-options traceoptions */
    traceoptions {
        /* This comment goes with routing-options traceoptions tracefile */
        tracefile rpd size 1m files 10;
        /* This comment goes with routing-options traceoptions traceflag task */
        traceflag task;
        /* This comment goes with routing-options traceoptions traceflag general */
        traceflag general;
        }
    autonomous-system 10458;    /* This comment is dropped */ 
}
routing-options {
    rib-groups {
        ifrg {
            import-rib [ inet.0 inet.2 ];
            /* A comment here is dropped */
        }
        dvmrp-rib {
            import-rib inet.2;
            export-rib inet.2;
            /* A comment here is dropped */
        }
    /* A comment here is dropped */
    }
/* A comment here is dropped */
} 

Friday, October 29, 2010

Deactivate and Reactivate Statements and Identifiers in a Configuration

In a configuration, you can deactivate statements and identifiers so that they do not take effect when you issue the commit command. Any deactivated statements and identifiers are marked with the inactive: tag. They remain in the configuration, but are not activated when you issue a commit command.
To deactivate a statement or identifier, use the deactivate configuration mode command:
deactivate (statement | identifier) 

To reactivate a statement or identifier, use the activate configuration mode command:
activate (statement | identifier) 

In both commands, the statement or identifier you specify must be at the current hierarchy level.
In some portions of the configuration hierarchy, you can include a disable statement to disable functionality. One example is disabling an interface by including the disable statement at the [edit interface interface-name] hierarchy level. When you deactivate a statement, that specific object or property is completely ignored and is not applied at all when you issue a commit command. When you disable a functionality, it is activated when you issue a commit command but is treated as though it is down or administratively disabled.

Examples: Deactivate and Reactivate Statements and
Identifiers in a Configuration

Deactivate an interface in the configuration:
[edit interfaces]
user@host# show 
at-5/2/0 {
    traceoptions {
        traceflag all;
    }
    atm-options {
        vpi 0 maximum-vcs 256;
    }
    unit 0 {
...
[edit interfaces]
user@host# deactivate at-5/2/0
[edit interfaces]
user@host# show
inactive: at-5/2/0 {
    traceoptions {
        traceflag all;
    }
...

Reactivate the interface:
[edit interfaces]
user@host# activate at-5/2/0
[edit interfaces]
user@host# show
at-5/2/0 {
    traceoptions {
        traceflag all;
    }
...