JN0-352 Enterprise Routing and Switching, Specialist (JNCIS-ENT) Question and Answers

The factory-default storm control configuration on EX Series switches operates in a purely rate-limiting mode rather than an interface-shutdown mode. When broadcast, multicast, or unknown-unicast traffic on a port exceeds the configured bandwidth-percentage threshold, the default action is simply to police the offending traffic type and silently drop only the packets that exceed that threshold, while all traffic within the allowed rate continues to be forwarded normally and the interface itself remains administratively and operationally up throughout the event. This explains the observed symptom precisely: during the burst of unknown-unicast frames, the switch dropped the excess volume above the configured limit, producing a brief period of packet loss, but as soon as the burst subsided and traffic fell back under the threshold, storm control simply stopped dropping packets and normal forwarding resumed automatically — no administrative shutdown, recovery timer, or manual intervention was ever involved, because the interface was never taken down in the first place. This default drop-only behavior is distinct from the optional interface-shutdown action, which must be explicitly configured if an administrator wants storm control to disable a port outright on violation (as seen in a related scenario requiring the clear ethernet-switching recovery-timeout command). Storm control by default covers broadcast, multicast, and unknown-unicast traffic types together, not multicast alone, and it has no functional relationship to GRES, which governs Routing Engine redundancy rather than Layer 2 traffic policing. Reference topics: Junos Enterprise Switching – Storm Control, Default Drop Behavior Versus Interface Shutdown Action.

Root protection (root guard) must always be applied on the ports of the switches you trust to remain root-bridge-eligible, specifically on the interfaces facing away from the legitimate root and toward parts of the network where an untrusted or rogue device could plausibly appear and begin transmitting superior BPDUs. In this topology, Switch-1 is the intended, permanent root bridge (lowest priority, 4k), and Switch-2 is its aggregation-layer peer; both sit above the access layer, where Switch-3 and Switch-4 connect downstream toward end-user-facing infrastructure and where an accidental or malicious rogue switch is realistically most likely to be introduced. The ge-0/0/6 and ge-0/0/8 interfaces on Switch-1 and Switch-2 are precisely the downlink ports facing that access layer, meaning they are the exact points at which a rogue switch's superior BPDU (one advertising a lower priority than the legitimate root) would first be received if such a device appeared beneath Switch-3 or Switch-4. Applying root protection on those specific interfaces causes Junos to immediately block (move to a root-inconsistent, discarding state) any port that receives a superior BPDU, preventing the rogue device from ever being accepted as root, while normal, non-superior BPDUs continue to be processed without disruption. Applying root guard on Switch-1 and Switch-2's peer link (ge-0/0/12/13) would be inappropriate, since that link legitimately connects two trusted, root-eligible switches. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, Root Protection Placement Strategy.

This detailed adjacency output shows R3 maintaining four separate, fully Up adjacencies, evenly split between the two IS-IS levels. R1 and R2 are both formed at Level 1, confirming that R3 is directly adjacent to exactly two Level 1 neighbors within its local area, which validates that statement. R4 and R5 are both formed at Level 2, and Level 2 adjacencies are, by definition, part of the IS-IS backbone that interconnects areas; a router maintaining any Level 2 adjacency is by that fact participating in and connected to the Level 2 backbone, confirming R3's backbone connectivity as well. Every one of the four listed adjacencies explicitly shows 'Speaks: IP, IPv6' in its detail output, which is Junos's way of indicating that both the IPv4 and IPv6 address families have been successfully negotiated and are active over that circuit; this directly contradicts, rather than supports, the claim that IPv6 is disabled on these neighbors — if IPv6 were disabled, the Speaks field would list only IP. Regarding authentication, the output contains no field, flag, or indication whatsoever referencing authentication configuration or state for the R5 adjacency (or any adjacency); Junos would typically surface authentication-related information separately if it were configured and relevant, and its complete absence here means no basis exists in the exhibit to conclude authentication is required for that specific adjacency. Reference topics: Junos Enterprise Routing – IS-IS, Level 1 and Level 2 Adjacencies and Address Family Negotiation.

The 10.20.0.0/22 aggregate covers the four /24 blocks 10.20.0.0/24 through 10.20.3.0/24, but only the first three of those (10.20.0.0/24, 10.20.1.0/24, and 10.20.2.0/24) are configured and present as active contributing routes; 10.20.3.0/24, the block containing the destination address 10.20.3.100, has no corresponding contributing route in this configuration. Because no more-specific route exists for 10.20.3.100, the longest-match lookup falls through the missing /24 and matches only the broader /22 aggregate itself. By default, when Junos installs an aggregate route, it assigns that route a reject next hop rather than any usable forwarding next hop; this is a deliberate design choice so that traffic destined for gaps within an advertised summary block — gaps where no real, more-specific path actually exists — is not blindly forwarded toward whatever next hop happens to belong to one of the unrelated contributing routes. A reject next hop causes the router to drop the packet and generate and return an ICMP destination-unreachable message to the originating source, explicitly informing it that no path exists, which is functionally and behaviorally distinct from a silent discard next hop that would drop the packet without any such notification. Aggregate routes never adopt or forward through any single contributing route's next hop, which rules out the two forwarding-based answer choices entirely. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Default Reject Next Hop for Aggregate Routes.

Because Server A resides in VLAN 10 and Server B resides in VLAN 20, traffic between them cannot remain a purely Layer 2 switched flow; it must be routed between the two VLANs, which on Switch 1 means the packet traverses the switch's internal routing engine (via an IRB interface) between the ingress and egress switching stages. Junos processes firewall filters along this path in a strict, layered order that mirrors the packet's actual journey through the device. First, any filter applied at the physical ingress port level (Rx-Port) is evaluated as the frame first arrives on ge-0/0/10. Next, any filter applied to the ingress VLAN (Rx-VLAN, i.e., VLAN 10) is evaluated as the frame is classified into its source broadcast domain. Because the destination subnet requires routing, the packet is then handed to the routing engine, where any input/ingress routed filter (Rx-Router) applied to the receiving IRB interface is evaluated next, followed by any output/egress routed filter (Tx-Router) applied as the now-routed packet is handed from the routing engine back out toward VLAN 20. Finally, the packet passes through any egress VLAN filter (Tx-VLAN, for VLAN 20) and then the egress physical port filter (Tx-Port) on ge-0/0/20 immediately before transmission to Server B. This complete six-stage sequence — Rx-Port, Rx-VLAN, Rx-Router, Tx-Router, Tx-VLAN, Tx-Port — reflects every filter-evaluation checkpoint a routed, inter-VLAN packet passes through on an EX Series Layer 3 switch. Reference topics: Junos Enterprise Switching – Layer 2 Switching and Firewall Filter Processing Order for Routed VLAN Traffic.

The intent of this filter is to match and discard traffic from one single, specific host MAC address, which requires the source-mac-address match condition to reference the complete, exact 48-bit address using an explicit /48 mask (or no mask at all, which Junos treats as an implicit full match) so that only that one precise address is matched. As configured, the term instead specifies a /40 mask on 00:12:34:56:00:07, meaning only the first 40 bits (the first five octets, 00:12:34:56:00) are actually significant to the match, while the sixth octet is effectively wildcarded across its full range; this produces an imprecise, overly broad match criterion rather than the single-host match the administrator intended, and is a common configuration mistake that undermines the predictability and correctness of MAC-based filtering. The lesson tested here is that source and destination MAC address match conditions in Junos firewall filters must be specified with the correct, deliberate, and explicit prefix length appropriate to the intended scope — typically /48 for a single exact host — rather than an arbitrary or miscalculated mask value. Firewall filters under family ethernet-switching are fully capable of matching on both source-mac-address and destination-mac-address, which rules out that option entirely. Layer 2 MAC-based filters function correctly on both access and trunk interface modes, so interface type is not a limiting factor here. There is no indication in the exhibit that the filter's application direction (input versus output) is reversed. Reference topics: Junos Enterprise Switching – Layer 2 Security, MAC Address Match Conditions and Prefix Length Precision.

A GRE-encapsulated packet consists of the original passenger packet wrapped inside a GRE header and a new outer IP delivery header, and the combined size of these two additions is what constitutes GRE's per-packet overhead. The base GRE header, as defined in RFC 2784 and used in its minimal, non-keyed, non-checksummed form (the default and most common deployment), is exactly 4 bytes in length, containing the flags/version field and the protocol type field identifying the encapsulated payload's ether type. Layered around that GRE header is a completely new outer IPv4 header, which itself consumes a standard 20 bytes, containing the tunnel source and destination addresses used for delivery across the underlying network. Adding these two components together — 4 bytes for the GRE header plus 20 bytes for the new outer IPv4 header — yields a total of exactly 24 bytes of overhead imposed on every encapsulated packet, which is precisely why Junos automatically sets the default protocol MTU on gr- tunnel interfaces to 1476 bytes (1500 minus 24) to prevent oversized, post-encapsulation packets from requiring fragmentation on a standard 1500-byte Ethernet path. The 20-byte figure alone describes only the new IP header in isolation and omits the GRE header itself, while 12 and 32 bytes do not correspond to any standard, non-keyed GRE encapsulation configuration and are included purely as plausible-looking distractors. Reference topics: Junos Enterprise Routing – Tunneling, GRE Header Overhead and MTU Planning.

GRE is fundamentally a stateless encapsulation protocol: the encapsulating router simply wraps the passenger packet in a GRE header and an outer delivery IP header and forwards it based on ordinary IP routing table lookups toward the configured tunnel destination address. For that forwarding to succeed, the underlying (global or routing-instance) routing table on each endpoint must contain a valid, reachable route to the far-end tunnel address; without such a route, the tunnel interface will not come up or will be unable to deliver traffic, since GRE relies entirely on the existing IP infrastructure rather than any tunnel-specific signaling to establish reachability. Because GRE has no built-in state machine or session negotiation, it does not natively track whether the remote endpoint is alive — that requires an optional add-on such as GRE keepalives or BFD, neither of which is enabled by default; an operator must explicitly configure them if failure detection is required. GRE is also protocol-agnostic rather than IPv4-only: it can encapsulate IPv4, IPv6, MPLS, and other network-layer protocols as the passenger, which is one of its defining advantages over IP-in-IP tunneling. Finally, because GRE keeps no per-session state about the peer, it cannot detect or report tunnel failures on its own, reinforcing why route reachability is the one true prerequisite for tunnel operation. Reference topics: Junos Enterprise Routing – Tunneling, Understanding Generic Routing Encapsulation.

OSPF neighbor state progression, as defined in RFC 2328 and displayed by Junos through show ospf neighbor, moves through a well-defined set of named states: Down, Attempt, Init, 2-Way, ExStart, Exchange, Loading, and Full. Down is the initial state, indicating no Hello packets have been recently received from a potential neighbor on that interface; it is a genuine, valid OSPF state and is correctly included here. Init indicates that a Hello packet has been received from the neighbor, but that neighbor has not yet listed the local router's own router ID within its Hello packet, so bidirectional communication has not yet been confirmed; this too is a standard, valid state. Loading occurs after the Exchange state, during which Database Description packets have been fully exchanged and the router is now actively requesting the specific, more-detailed LSAs it identified as missing or outdated from its neighbor via Link State Request packets; it is likewise a standard, valid OSPF neighbor state. 'Established' is not an OSPF state at all — that terminology belongs to BGP's finite state machine, where Established represents the fully operational session state; the OSPF equivalent concept is instead called Full. 'Reject' is not a recognized OSPF neighbor state under any circumstance and does not appear anywhere in the RFC 2328 state machine, making it an invalid distractor as well. Reference topics: Junos Enterprise Routing – OSPF, The OSPF Neighbor State Machine.

Nonstop active routing's defining architectural feature is that the backup Routing Engine runs a fully live, active instance of the routing protocol daemon (rpd) in parallel with the primary Routing Engine's rpd instance, continuously, from the moment NSR and its prerequisite GRES are established — not merely at the instant a switchover begins. As protocol adjacencies form, routes are learned, and the RIB is updated on the primary Routing Engine, that same protocol and RIB state is mirrored in real time to the backup Routing Engine's rpd process through an internal synchronization mechanism, so the backup's protocol state remains a live, up-to-date replica of the primary's at essentially every moment during normal operation. When a switchover occurs, the backup Routing Engine simply assumes the primary role with protocol adjacencies, routing tables, and forwarding state already fully populated and current, allowing it to continue operating without re-establishing neighbor relationships or re-learning the network topology, which is what makes the switchover genuinely nonstop and invisible to neighboring routers. This is fundamentally different from graceful restart, where the restarting router must rebuild its state by requesting help from cooperating neighbors after the fact. The Packet Forwarding Engine plays no role in synchronizing protocol-layer information such as LSAs or BGP updates; that is strictly an rpd-to-rpd function coordinated through the Routing Engine synchronization infrastructure. Reference topics: Junos Enterprise Routing – High Availability, Nonstop Active Routing Architecture and rpd Synchronization.

Once the two candidate routes have equal route preference and equal local preference (both defaulting to 100 unless modified by policy), the Junos BGP algorithm proceeds to its third decision step, which compares the length of each candidate's AS path attribute and selects whichever path carries the shortest AS path, since a shorter path is interpreted as traversing fewer autonomous system hops to reach the origin. This step occurs well before the algorithm ever reaches the specific EBGP-over-IBGP preference rule, which is only evaluated later, after local preference, AS path length, origin type, and MED have all already been compared and found equal between the candidates; because an IBGP-learned copy of a route typically retains the identical AS path that was originally received from the external AS (IBGP does not prepend the local AS number the way crossing an AS boundary does), it is entirely possible, and often the deciding scenario, for AS path length to differ between competing paths well before the algorithm would ever need to fall back on the IBGP-versus-EBGP tiebreak. Selecting a route purely because it was 'learned through IBGP' is not a rule that exists anywhere in the algorithm and would in fact typically be the opposite of Junos's later EBGP-preference tiebreak. Neither next-hop IP address value nor router ID value is compared with a 'highest wins' rule at any point in the standard path selection sequence — where router ID is used at all, Junos prefers the lowest value, not the highest, making both of those distractors doubly incorrect. Reference topics: Junos Enterprise Routing – BGP, Path Selection Order: AS Path Length Precedes EBGP/IBGP Preference.

In this configuration, R1's physical interface address (10.10.10.1) is different from the VRRP virtual IP address (10.100.100.1), meaning R1 is operating as a non-owner VRRP master — it did not originate the virtual address as one of its own real interface addresses. By default, Junos VRRP masters that do not own the virtual address will forward transit traffic destined through that address but will not process or respond to traffic addressed directly to the VIP itself, such as ICMP echo requests, Telnet, or SSH sessions aimed at 10.100.100.1. This is deliberate default behavior intended to prevent ambiguity about which physical device is answering on behalf of a shared virtual identity. To allow the master to accept and respond to packets whose destination is the virtual address itself, the accept-data statement must be explicitly configured under the vrrp-group hierarchy. Once enabled, the elected master will process locally destined traffic sent to the VIP, resolving exactly the symptom described. The track option is used for interface or route-based priority adjustment to influence mastership, advertise-interval tunes the frequency of VRRP hello advertisements, and no-preempt prevents a higher-priority router from reclaiming mastership once a lower-priority router has taken over — none of these affect whether the master processes traffic destined to the VIP. Reference topics: Junos Enterprise Routing – High Availability, VRRP accept-data Behavior.

An integrated routing and bridging interface, configured as irb.x on an EX Series switch, is the mechanism that bridges the Layer 2 and Layer 3 forwarding planes for a given bridge domain or VLAN. By assigning an irb logical unit to a VLAN and configuring an IP address on that unit, the switch gains a routable Layer 3 gateway address that hosts within that VLAN can use as their default gateway, enabling traffic destined for other subnets to be routed off the local broadcast domain. Internally, when a frame destined for the gateway's MAC address arrives on any port belonging to that VLAN, the switch's integrated circuitry hands the packet from the Layer 2 bridging domain to the Layer 3 routing engine associated with the corresponding irb interface, and vice versa for the return path — hence the name 'integrated routing and bridging.' IRB does not eliminate the need for routing instances, which remain a separate mechanism for isolating routing tables; it does not itself perform inter-VLAN switching, since switching still happens strictly within a VLAN's own broadcast domain; and it has no relationship to trunk ports, which remain necessary for carrying multiple tagged VLANs between switches. IRB is the standard method for enabling inter-VLAN routing on a single EX Series switch without an external router. Reference topics: Junos Enterprise Switching – Routing VLANs, Configuring Integrated Routing and Bridging.

The described symptom — excessive packet drops specifically attributed to exceeding the MTU on a GRE tunnel carrying full-size video streaming traffic across default-MTU gigabit Ethernet interfaces — is a direct consequence of the 24 bytes of GRE encapsulation overhead pushing packets that were already at or near the standard 1500-byte Ethernet MTU past the physical interface's transmission limit once the outer GRE and IP headers are added. The most durable fix is to proactively increase the physical member interfaces' MTU beyond the 1500-byte default — to 1524 bytes or higher — which provides sufficient headroom to absorb the full GRE encapsulation overhead without ever causing the fully encapsulated packet to exceed the interface's transmission capability, allowing full-size 1500-byte payloads to pass through the tunnel intact and without fragmentation or drops. As a complementary measure, configuring the clear-dont-fragment-bit option on the tunnel or member interfaces instructs Junos to clear the DF (don't fragment) bit on oversized packets rather than dropping them outright when they do exceed the available MTU, allowing the Packet Forwarding Engine to fragment and later reassemble the traffic instead of silently discarding it, which directly addresses the reported packet loss even under transient conditions. Simply raising the MTU only to 1500 bytes fails to account for the 24-byte GRE overhead and would not resolve the underlying oversize condition. Routing the tunnel over a higher-bandwidth link addresses potential congestion but does nothing to correct an MTU-based packet-size violation, which is the root cause explicitly identified in this scenario. Reference topics: Junos Enterprise Routing – Tunneling, GRE MTU Sizing and Fragmentation Handling for High-Throughput Applications.

Each of the 24 end-device-facing interfaces in this scenario needs to carry traffic for exactly one VLAN, and the end devices themselves are ordinary hosts that neither expect nor generate 802.1Q-tagged frames. This is precisely the definition of an access port in Junos: family ethernet-switching interface-mode is set to access, and a single vlan members statement assigns the port to VLAN 70. Access mode ensures frames egressing toward the host are untagged and any frames received are implicitly treated as belonging to the configured VLAN, which is both simpler to manage and more efficient than trunking, since access ports do not carry the 802.1Q tag overhead nor process VLAN pruning logic relevant only to multi-VLAN links. Trunk mode, by contrast, is reserved for switch-to-switch or switch-to-router links that must simultaneously carry frames for multiple VLANs, such as the uplink toward the distribution switch that transports VLANs 30, 50, and 70 together — configuring the 24 host-facing ports as trunks (with or without a native VLAN) would be functionally incorrect and operationally wasteful, since end devices have no need to interpret VLAN tags. There is also no such behavior in Junos where VLAN-ID numeric value dictates default port behavior, making the 'no configuration needed' option a distractor with no basis in EX Series switching architecture. Reference topics: Junos Enterprise Switching – VLANs, Configuring Access and Trunk Port Modes.

The Complete Sequence Number PDU (CSNP) is the IS-IS mechanism used to summarize the entire contents of a router's link-state database, listing the LSP ID, sequence number, checksum, and remaining lifetime for every LSP the sending router currently believes should exist in the database for that level. On broadcast (LAN) circuits, the elected Designated Intermediate System periodically transmits CSNPs to all routers on the segment as a database-synchronization mechanism; any receiving router compares the summarized list against its own local database, and any discrepancy — an LSP it is missing entirely, or one for which it holds an older sequence number — triggers a targeted request for the specific, updated LSP content. On point-to-point circuits, a single CSNP is exchanged once when the adjacency first comes up, serving the identical synchronization purpose without needing periodic repetition. The Partial Sequence Number PDU (PSNP), by contrast, is used to acknowledge receipt of specific LSPs or to explicitly request specific LSPs identified as missing or outdated after a CSNP comparison, making it a partial, targeted PDU rather than a complete database listing. The LSP itself is the PDU that actually carries the detailed topology and reachability information being advertised, rather than a database summary. The IS-IS Hello PDU (IIH) is used purely for neighbor discovery and adjacency maintenance and carries no link-state database summary information whatsoever. Reference topics: Junos Enterprise Routing – IS-IS, CSNP and Link-State Database Synchronization.