Best practices
The habits that keep a change from becoming an outage. None of these are enforced by the software — they are the operational discipline the transaction model exists to support.
Use commit confirmed for risky changes
Any edit that could cut off your own management path — routing, the default gateway, enabling the firewall or uRPF — should be applied with commit confirmed. If you lose access the box auto-reverts when the timer expires; if the change is good, confirm makes it permanent. The cost of the habit is one extra command; the cost of not having it is a site visit.
Commit at the editing boundary, save at the box boundary
commit is what applies your candidate to running; save is what makes running survive a reboot. Commit when you finish editing a change, and save once you have verified it behaves. A committed-but-unsaved change is live but will be lost on reboot — which is a genuinely confusing failure to debug weeks later, because the box was working right up until it restarted.
Verify before you save
After commit, confirm the change with the relevant show command before running save. Each area has its own: show sessions for access, show nat statistics for translation, show qos bindings for policy, show ip route for routing.
commit
show qos bindings # did it resolve as intended?
save
Mind apply timing
Changes that apply on restart will not affect live traffic on commit alone: firewall filter rules, mss-clamp, the RADIUS coa-port listener (other RADIUS knobs apply live on commit), nat pool, reshape or removal of an in-use pool or ipv6 pool, and the system CPU-plan knobs. Schedule the restart deliberately rather than discovering the gap later. Remember too that a nat policy rule cannot reference a nat pool until that pool is live, which means a brand-new pool needs its restart before the rule that uses it will work.
Commit referenced objects first
QoS and other references resolve against the running configuration, not the candidate. Commit a queue profile before a subscriber profile that names it, and a subscriber profile before an assignment that binds it. Doing it in one go looks tidier and fails validation.
Commit applies QoS tuning live
For in-place queue-profile changes — qsize, AQM, discipline tuning — commit applies them live, then save persists. New sessions bind immediately and existing sessions migrate gradually with no forwarding interruption. Reserve restarts for structural QoS changes: adding, removing or reordering profiles, or changing the port rate.
commit ; save show qos generations
Roll back cleanly
If a candidate is wrong before you commit, rollback discards it entirely. There is no need to hand-undo staged edits one at a time, and trying to is how a half-reverted candidate gets committed by accident.
Establish a diagnostic baseline
Before chasing an intermittent problem — a one-way UDP freeze, unexplained loss — clear the relevant counters, let traffic run, then read them. A moving counter after a known start point is far easier to interpret than a lifetime total that has been accumulating since the last restart.
clear counters nat
clear counters firewall
# ... let it run ...
show nat statistics detail
show firewall drops
Keep uRPF scoped correctly
IPv4 urpf strict is safe once subscriber routes are in the RIB. IPv6 urpf6 defaults off and should stay off until subscriber v6 reverse-routes are installed, or it will drop legitimate static v6 hosts on subscriber circuits. That the two are separate toggles is deliberate, not an oversight.