JN0-351 Enterprise Routing and Switching Specialist (JNCIS-ENT) Question and Answers

Option A suggests that the MTU is not at least 1492 bytes.  This is correct because IS-IS requires a minimum MTU of 1492 bytes to establish adjacencies 1 .  If the MTU is less than this, IS-IS adjacencies will not be established 1 .

Option D suggests that the lo0 interface is not included as an IS-IS interface.  This is also correct because the loopback interface (lo0) is typically used as the router ID in IS-IS 1 .  If the loopback interface is not included in IS-IS, it could prevent IS-IS adjacencies from being established 1 .

Therefore, options A and D are correct.

The static route to the 0.0.0.0/0 network has a next hop of xe-0/0/0.0, which is a local interface. BGP does not accept static routes with a local interface as the next hop, because it cannot advertise them to other BGP peers. BGP requires a valid IP address as the next hop for static routes that are redistributed into BGP. To fix this issue, the static route should have a next hop of an IP address that is reachable via the xe-0/0/0.0 interface, such as the IP address of the eBGP neighbor. Alternatively, the next hop can be modified by using a route map when redistributing the static route into BGP12.

The other options are not correct because:

The as-path parameter is not required for redistributing static routes into BGP. The as-path attribute is automatically set by BGP when advertising routes to other BGP peers3.

A community string is not required for redistributing static routes into BGP. A community is an optional attribute that can be used to group routes and apply policies to them4.

The no-readvertise feature is not specified in the configuration. The no-readvertise feature is used to prevent routes learned from one iBGP peer from being advertised to another iBGP peer5.

Option A is correct. For traffic to be sent through a GRE tunnel, there must be a route that directs the traffic into the tunnel. This is typically accomplished through the use of a static route or a dynamic routing protocol.

Option B is correct. All intermediary devices must have a route to the tunnel endpoints34. In real-world scenarios, the tunnel endpoints for a tunnel going over the Internet must have globally reachable internet addresses. Otherwise, intermediate routers in the Internet cannot forward the tunneled packets.

B  is correct because the loops do not exist is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid.  A loop in BGP means that a route has been advertised by the same AS more than once, which can cause routing instability and inefficiency 1 .  To prevent loops, BGP uses the AS-path attribute, which lists the AS numbers that a route has traversed from the origin to the destination 2 .  The receiving router checks the AS-path attribute of the received route and discards it if it finds its own AS number in the list 2 . This way, BGP avoids accepting routes that contain loops.

C  is correct because the next hop is reachable is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid.  The next hop is the IP address of the next router that is used to forward packets to the destination network 3 .  The receiving router checks the next hop attribute of the received route and verifies that it has a valid route to reach it 3 .  If the next hop is not reachable, the received route is not usable and is rejected by the receiving router 3 . This way, BGP ensures that only feasible routes are accepted.

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

According to the Juniper documentation 1 , the output of the show vlans command displays the forwarding options for the VLAN, including the DHCP security features. In the exhibit, the output shows that DHCP security is enabled, and that ARP inspection and IP source guard are also enabled. These features work together to protect the switch from IP spoofing and ARP spoofing attacks. DHCP snooping builds a database of IP/MAC bindings by snooping DHCP messages. ARP inspection validates ARP packets against the DHCP snooping database and drops invalid packets.  IP source guard checks the IP and MAC source addresses of packets against the DHCP snooping database and drops spoofed packets 2 3 . Therefore, the correct answer is A, B, and C.

The other options are not correct because:

D. The DHCP snooping database is not protected by default.  To protect the database from corruption or loss, you need to configure a file name and a location for storing the database, and enable periodic write operations to the file 4 . The exhibit does not show any such configuration.

E. DHCP snooping is not enabled for IPv6 traffic by default.  To enable DHCPv6 snooping, you need to configure a DHCPv6 relay agent and specify the trusted interfaces for DHCPv6 messages 5 . The exhibit does not show any such configuration.

Redundant Trunk Groups (RTGs) on EX Series switches provide a simple solution for network recovery when a trunk port on a switch goes down 1 .  They are configured on the access switch and contain two links: a primary or active link, and a secondary link 1 .  Therefore, option B is correct because if the active link fails, the secondary link automatically starts forwarding data traffic without waiting for normal spanning-tree protocol convergence 1 .

Option D is also correct.  In a typical enterprise network composed of distribution and access layers, RTGs are used where one Access switch is connected to two different uplink switches 2 .  This implies that RTGs must be connected to the same aggregation switch 2 .

To create a LAG interface, you need to perform two actions: enable LAG on the chassis and on each member interface. The first action is to configure the chassis stanza with the aggregated-devices statement and specify the number of LAG interfaces and the link-speed for each interface. The second action is to configure each member interface with the family ethernet-switching statement and the aggregated-ether-options statement with the lacp option. The name of the first LAG interface is not relevant, as long as it matches the name of the aggregated interface under the interfaces stanza. The name can be ae0, ae1, or any other valid name. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

According to the OSPF protocol, the designated router (DR) is the router that acts as the focal point for exchanging routing information on a multi-access network segment, such as a LAN 1 .  The DR election process is based on the following criteria, in order of precedence 1 :

The router with the highest OSPF priority becomes the DR. The default priority is 1, and a priority of 0 means the router will not participate in the election.

If there is a tie in priority, the router with the highest router ID becomes the DR. The router ID is a 32-bit number that uniquely identifies a router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address of a loopback interface or a physical interface.

If there is a tie in router ID, the router that was first to become an OSPF neighbor becomes the DR.

In your scenario, two routers share the same highest priority and start time. This means that they have equal chances of becoming the DR based on the first and third criteria. Therefore, the second criterion will be used to break the tie, which is the router ID.  The router with the highest router ID will become the DR, and the other router will become the backup designated router (BDR), which is ready to take over the role of DR if it fails 1 .

The feature that enables an interface on an EX Series switch to receive both untagged traffic (from the computer) and tagged traffic (from the IP phone) is the  voice VLAN 1 2 .

The voice VLAN feature in EX-series switches enables access ports to accept both data (untagged) and voice (tagged) traffic and separate that traffic into different VLANs 1 2 .  This allows the switch to differentiate between voice and data traffic, ensuring that voice traffic can be treated with a higher priority 1 2 . Therefore, option D is correct.

Option B is correct.  Flooding is a mechanism used in Layer 2 bridging where the switch sends incoming packets to all its ports except for the port where the packet originated 1 .  This is done when the switch doesn’t know the destination MAC address or when the packet is a broadcast or multicast 1 .

Option C is correct.  Learning is another mechanism used in Layer 2 bridging where the switch learns the source MAC addresses of incoming packets and associates them with the port on which they were received 2 3 .  This information is stored in a MAC address table, also known as a bridge table 2 3 .

Option A is incorrect.  Blocking is a state in Spanning Tree Protocol (STP) used to prevent loops in a network 2 .  It’s not a mechanism used in building and maintaining a Layer 2 bridge table 2 .

Option D is incorrect.  Listening is also a state in Spanning Tree Protocol (STP) where the switch listens for BPDUs to make sure no loops occur in the network before transitioning to the learning state 2 .  It’s not a mechanism used in building and maintaining a Layer 2 bridge table 2 .

In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree 1 .

Option A suggests that the designated port forwards data to the downstream network segment or device.  This is correct because the designated port is the port on a network segment that has the best path to the root bridge 1 .  It’s responsible for forwarding frames towards the root bridge and sending configuration messages into its segment 1 .

Option D suggests that the root port is responsible for forwarding data to the root bridge.  This is also correct because the root port is always the link directly connected to the root bridge, or the shortest path to the root bridge 1 .  It’s used to forward traffic towards the root bridge 1 .

Therefore, options A and D are correct.

In BGP, the path selection process is based on a set of attributes 1 .  The process starts by preferring the path with the highest weight, then the highest local preference, then the locally originated routes, and so on 1 .  If all these attributes are the same, then it prefers the path with the shortest AS path 1 .

Referring to the exhibit, all four ISPs have the same weight, local preference, and origin 1 .  However, ISP 4 has the shortest AS path 1 . Therefore, ISP 4 will be selected as the active path. So, option C is correct.

A route reflector is a BGP router that is allowed to break the iBGP loop avoidance rule and advertise routes received from an iBGP peer to another iBGP peer under specific conditions 1 .  A route reflector can have three types of peerings: EBGP neighbor, IBGP client neighbor, and IBGP non-client neighbor 2 .  A cluster is a group of route reflectors and their clients that are fully meshed 3 .  The cluster ID is a 4-byte value that identifies the route reflector cluster and is carried in the ORIGINATOR_ID attribute of the BGP update message 4 . The cluster ID is used to prevent routing loops among route reflectors and their clients.  If a route reflector receives a route with its own cluster ID, it discards the route 5 . Therefore, the cluster ID is required to prevent routing loops when using route reflectors.

 In a Rapid Spanning Tree Protocol (RSTP) topology, the root bridge is determined by the switch with the lowest bridge priority value 1 2 .  If all switches have the same priority, then the root bridge is assigned to the switch whose MAC address’s hex value is the lowest 2 .  The default bridge priority value is 32768 3 2 . However, without the actual exhibit, it’s difficult to definitively determine which device is the root bridge.  But based on the options provided, if we assume that the local device has a lower bridge priority or a lower MAC address than other devices in the network, then it could be considered as the root bridge for this RSTP topology 4 5 .

IP-IP tunnels encapsulate IP packets within other IP packets, allowing them to traverse networks that wouldn ' t normally support the original IP packets. This encapsulation involves the TTL (Time-to-Live) of the inner packet being decremented as it traverses through the tunnel towards its endpoint.

The output shown in the exhibit is a brief display of the Ethernet switching table, which shows the learned Layer 2 MAC addresses for each VLAN and interface 1 .

The command  show ethernet-switching table  displays the Ethernet switching table with brief information, such as the destination MAC address, the VLAN name, the forwarding state, and the interface name 1 .

The command  show route forwarding-table  displays the routing table information for each protocol family, such as inet, inet6, mpls, iso, and so on 2 . It does not show the Ethernet switching table or the MAC addresses.

The command  show ethernet-switching table extensive  displays the Ethernet switching table with extensive information, such as the destination MAC address, the VLAN name, the forwarding state, the interface name, the VLAN index, and the tag type 1 . It shows more details than the brief output shown in the exhibit.

The command  show route forwarding-table family ethernet-switching  displays the routing table information for the ethernet-switching protocol family, which shows the destination MAC address, the next-hop MAC address, and the interface name 3 . It does not show the VLAN name or the forwarding state.

According to the Juniper documentation1, when a switch receives a unicast frame destined to a MAC address that is not registered in the bridging table, it floods the frame out all ports that are part of the same VLAN, except the receiving port. This is the default behavior of a switch when it does not know the destination MAC address. The switch does not perform an ARP request, send an error message, or flood the frame to all VLANs. References: Understanding Unicast Flooding | Junos OS | Juniper Networks

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

OSPF DR/BDR election is a process that occurs on multi-access data links. It is intended to select two OSPF nodes: one to be acting as the Designated Router (DR), and another to be acting as the Backup Designated Router (BDR). The DR and BDR are responsible for generating network LSAs for the multi-access network and synchronizing the LSDB with other routers on the same network 1 .

The DR/BDR election is based on two criteria: the OSPF priority and the router ID. The OSPF priority is a value between 0 and 255 that can be configured on each interface participating in OSPF. The default priority is 1. A priority of 0 means that the router will not participate in the election and will never become a DR or BDR. The router with the highest priority will become the DR, and the router with the second highest priority will become the BDR. If there is a tie in priority, then the router ID is used as a tie-breaker. The router ID is a 32-bit number that uniquely identifies each router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address on a loopback interface or any active interface 2 .

In this scenario, all routers have the same priority of 1, so the router ID will determine the outcome of the election. The router IDs are shown in the exhibit as RID values. The highest RID belongs to R4 (10.10.10.4), so R4 will become the DR. The second highest RID belongs to R3 (10.10.10.3), so R3 will become the BDR.

A keepalive OAM probe is a mechanism that can be used to monitor the state of a GRE tunnel and detect any failures in the tunnel path. A keepalive OAM probe consists of sending periodic packets from one end of the tunnel to the other and expecting a reply.  If no reply is received within a specified time, the tunnel is considered down and the line protocol of the tunnel interface is changed to down 1 .

To configure a keepalive OAM probe for a GRE tunnel, you need to specify two parameters: the keepalive-time and the hold-time. The keepalive-time is the interval between each keepalive packet sent by the local router.  The hold-time is the maximum time that the local router waits for a reply from the remote router before declaring the tunnel down 2 .

According to the Juniper Networks documentation, the hold-time value must be two times the keepalive-time value for a GRE tunnel 2 . This is because the hold-time value must account for both the round-trip time of the keepalive packet and the processing time of the remote router. If the hold-time value is too small, it may cause false positives and unnecessary tunnel flaps.

In the exhibit, the configuration shows that the keepalive-time is set to 10 seconds and the hold-time is set to 15 seconds for the gr-1/1/10.1 interface. This means that the local router will send a keepalive packet every 10 seconds and will wait for 15 seconds for a reply from the remote router. However, this hold-time value is not two times the keepalive-time value, which violates the recommended configuration. This may cause traffic drops if the remote router takes longer than 15 seconds to reply.

Therefore, option D is correct, because the hold-time value must be two times the keepalive-time value for a GRE tunnel.  Option A is incorrect, because BFD is not required for GRE tunnels; BFD is another protocol that can be used to monitor tunnels, but it is not compatible with GRE keepalives 3 .  Option B is incorrect, because the “event link-adjacency-loss” option is not related to GRE tunnels; it is an option that can be used to trigger an action when a link goes down 4 .  Option C is incorrect, because LLDP does not need to be removed from the gr-1/1/10.1 interface; LLDP is a protocol that can be used to discover neighboring devices and their capabilities, but it does not interfere with GRE tunnels 5 .

Aggregate routes are used for advertising summarized network prefixes 1 2 .  They help minimize the number of routing tables in an IP network by consolidating selected multiple routes into a single route advertisement 1 .  This approach is in contrast to non-aggregation routing, in which every routing table contains a unique entry for each route 1 .

Therefore, option D is correct. Options A, B, and C are not correct because:

Aggregate routes can be used with both static routing and dynamic routing protocols 1 .

Aggregate routes are not automatically generated for all of the subnets in a routing table.  They need to be manually configured 1 .

Aggregate routes are not always preferred over more specific routes.  The route selection process in Junos OS considers several factors, including route preference and metric, before determining the active route 1 .