Prepare The Account
Use a dedicated account with permission to inspect routes, not a super-user account. Confirm it can run show route 1.1.1.1 and cannot enter configuration mode. Restrict SSH reachability to the RouteGlass VM.
Prepare The Key
Generate a dedicated SSH key pair in a protected directory and install only its public key on the router. Protect the private key with mode 0600. During installation provide the private-key path, not the .pub file.
Installer Inputs
Enable BGP Lookup and choose Juniper Junos. Enter the router address, SSH port (default 22), read-only username and private-key path. The installer copies the key to /etc/routeglass/ssh/juniper_routeglass and pins the router key in /etc/routeglass/ssh/juniper_known_hosts. Independently verify the router host-key fingerprint.
Validate Lookup
curl -sS 'http://127.0.0.1:8080/api/diagnostics?type=bgp&target=1.1.1.1'If the router host key changes, verify the replacement independently before deliberately updating the pinned key. Do not turn off strict host-key checking.