Junos Configuration Groups (apply-groups) Explained with Examples

Configuration groups (also known as apply-groups) are one of Junos's most powerful features, and also one of the least understood. A configuration group lets you define reusable blocks of configuration - interface templates, NTP settings, SNMP parameters, syslog options - and then apply them across the hierarchy with a single apply-groups statement. Instead of pasting the same 20 lines of NTP config into every device, you define it once in a group and reuse it everywhere. This guide explains how groups work, how precedence resolves conflicts, and shows working examples you can adapt immediately.

Basic Structure

groups {
    GLOBAL {
        system {
            ntp {
                server 10.0.0.10;
                server 10.0.0.11;
            }
        }
    }
}
apply-groups GLOBAL;

The group named GLOBAL holds NTP configuration, and the top-level apply-groups GLOBAL; injects it into the system hierarchy. You can apply groups at any level: apply-groups under interfaces, under a specific interface, under protocols, etc.

Interface Templates with Wildcards

The classic use case: apply the same family config to every interface with a wildcard:

groups {
    IF-MGMT {
        interfaces {
            <*> {
                unit 0 {
                    family inet {
                        mtu 1500;
                    }
                }
            }
        }
    }
}
apply-groups IF-MGMT;

The <*> wildcard matches all interface names. Junos also supports $junos-interface-ifd-name to build dynamic address patterns:

groups {
    LOOPBACK {
        interfaces {
            lo0 {
                unit 0 {
                    family inet {
                        address $junos-loopback-0/32;
                    }
                }
            }
        }
    }
}

Precedence: Specific Configuration Wins

When the same parameter appears both in a group and directly in the configuration, the direct configuration wins. Groups applied at a lower level override groups applied at a higher level. The resolution order is:

1. Direct (explicit) configuration in the hierarchy
2. Groups applied at the most specific level
3. Groups applied at higher levels
4. junos-defaults groups

Use apply-groups-except to exclude specific statements:

apply-groups-except [ IF-MGMT GLOBAL ];

Practical Example: Syslog + SNMP on Every Device

groups {
    BASE {
        system {
            syslog {
                file messages {
                    any notice;
                    authorization info;
                }
                host 10.0.0.20 {
                    any any;
                }
            }
        }
        snmp {
            community public {
                authorization read-only;
            }
            trap-group NMS {
                targets {
                    10.0.0.21;
                }
            }
        }
    }
}
apply-groups BASE;

Add this block to every new device in your fleet and logging/monitoring is consistent without re-typing.

Verification and Troubleshooting

show configuration | display inheritance
show configuration interfaces | display inheritance
show configuration groups
show configuration | display set

display inheritance is the key command: it shows the effective configuration with group values inlined, so you can see exactly what a group contributed. If a group does not seem to apply, check:

• Typo in the group name vs the apply-groups statement.
• Group applied at the wrong hierarchy level.
• An explicit configuration overriding the group (direct config wins).

Why Use Groups?

• Consistency: one change in the group updates every interface/device.
• Less config to store and review - especially valuable on EX/QFX fleets.
• Combines with NSO/Ansible templating for full automation.

Related: Juniper EX switch initial setup and multi-vendor automation with Ansible and Jinja2.

原文链接：https://www.juniper.net/documentation/us/en/software/junos/cli/topics/topic-map/configuring-configuration-groups.html