> For the complete documentation index, see [llms.txt](https://jncia-workbook.gitbook.io/workbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jncia-workbook.gitbook.io/workbook/junos-basics/24-locking-configuration.md).

# 24) Locking Configuration

### Pre-Work

If you made any changes, you can quickly revert the lab using the **load\_config\_on\_nodes.py** script.

```
python3 load_config_on_nodes.py --lab_dir three-routers --config_filename basic.addressing.cfg
```

### Lab

Connect to R1, and lock the configuration of `ge-0/0/0`. We do not want anyone editing the configuration for `ge-0/0/0`. Also add a comment to the interface in the configuration that says `"Please do not change ge-0/0/0 config without notifying engineering."`

### Answer

<details>

<summary>Expand to reveal</summary>

```
edit interfaces
annotate ge-0/0/0 "Please do not change ge-0/0/0 config without notifying engineering." 
protect ge-0/0/0 
```

\
Note that if you lock `ge-0/0/0` first, then you won't be able to add the comment. Also note that the lock takes place immediately after issuing the `protect` command, even before committing.

</details>

### Explanation

<details>

<summary>Expand to reveal</summary>

Locking prevents other users from making changes. This can be useful when you want to ensure that a section of the configuration should not change. You lock the hierarchy by using `protect <hierarchy>`.

\
You will see the `protect:` statement appended to the hierarchy that you have protected:

```
admin@R1> show configuration interfaces 
protect: ge-0/0/0 {
    unit 0 {
        family inet {
            address 10.1.2.1/24;
        }
        family inet6 {
            address 2001:db8:1:2::1/64;
        }
    }
}
```

\
If someone tries to change anything under this hierarchy, they'll get the following error:

```
admin@R1# set interfaces ge-0/0/0.0 family inet address 100.1.2.1/24 
warning: [interfaces ge-0/0/0] is protected, 'interfaces ge-0/0/0 unit 0 family inet address 100.1.2.1/24' cannot be created
```

\
To solve this lab, you must annotate first, as the lock takes place immediately, even before committing. It seems that using the `protect` command does not technically require a commit. However, to see the protect statement in the config, we do need to commit.

\
To remove the lock, you would use `unprotect interfaces ge-0/0/0`.

\
To add comments to the configuration, we use the `annotate` command. The annotation syntax is `annotate <statement> <comment>` - so you have to edit the configuration hierarchy one level above for this to work. In other words, you cannot be at the top and try to use `annotate interfaces ge-0/0/0 "Some comment"`.

```
[edit]
admin@R1# annotate interfaces ge-0/0/0 "Some comment"
                                       ^
syntax error, expecting ';', [Enter], or '|'.

[edit]
admin@R1# 

```

\
The annotation looks like this in the config:

```
admin@R1# run show configuration interfaces             
/* Please do not change ge-0/0/0 config without notifying engineering. */
protect: ge-0/0/0 {
    unit 0 {
        family inet {
            address 10.1.2.1/24;
        }
        family inet6 {
            address 2001:db8:1:2::1/64;
        }
    }
}
```

\
To remove a comment, you change the comment to an empty string:

```
edit interfaces
annotate ge-0/0/0 ""
```

</details>

### Further Reading

<https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/annotate.html>

<https://www.juniper.net/documentation/us/en/software/junos/cli/topics/example/junos-cli-configuration-protecting.html>