JN0-460 JNCIS-MistAI-Wired Question and Answers

According to Juniper Networks' validated designs for campus fabrics, the campus fabric core-distribution with edge-routed bridging (ERB) is the optimal architecture when high volumes of east-west traffic are present and access switches are restricted to Layer 2 operations. In an ERB design, the EVPN-VXLAN fabric extends from the core switches to the distribution switches.1 The critical differentiator is the placement of the default gateways (Integrated Routing and Bridging or IRB interfaces). In the ERB model, these gateways are moved from the core to the distribution layer, which effectively acts as the "edge" of the EVPN fabric.

By placing the Layer 3 gateways at the distribution layer, inter-VLAN (east-west) traffic is routed closer to the endpoints.2 This prevents the "hairpinning" effect found in Centrally-Routed Bridging (CRB) architectures, where traffic must travel all the way to the core layer to be routed between subnets before returning down to the distribution and access layers. This reduction in latency and core-link utilization is essential for modern campus environments with high server-to-server or client-to-client traffic patterns.

Furthermore, this architecture specifically accommodates Layer 2 access switches. In the ERB core-distribution model, the access switches are not part of the EVPN-VXLAN overlay; instead, they connect to the distribution tier using standard Link Aggregation Control Protocol (LACP) or ESI-LAG. This allows organizations to leverage existing legacy or lower-tier access switches that do not support advanced VXLAN capabilities while still benefiting from a robust, scalable EVPN-VXLAN fabric at the distribution and core layers.5 In contrast, while the campus fabric IP Clos also excels at handling east-west traffic, it requires the access switches themselves to perform VXLAN encapsulation/decapsulation (acting as VTEPs), which contradicts the requirement for access switches to operate only at Layer 2.

According to Juniper Mist documentation regarding campus fabric design, the campus fabric IP Clos (also known as a 5-stage Clos) is the architecture that extends the EVPN-VXLAN protocol stack from the core tier down through the distribution tier and finally to the access tier. In this model, every switch in the hierarchy—from the high-capacity core switches to the wiring closet access switches—participates in the EVPN control plane and VXLAN data plane.

By extending EVPN-VXLAN to the access tier, the IP Clos architecture provides a standards-based, scalable framework that allows for seamless Layer 2 connectivity over a Layer 3 underlay across the entire campus333333333. This enables advanced features like Microsegmentation using Group-Based Policies (GBP) and Macrosegmentation via Virtual Routing and Forwarding (VRF) instances directly at the edge of the network.

In contrast, other architectures like "core-distribution" (either CRB or ERB) typically limit the EVPN-VXLAN fabric to the core and distribution layers, leaving the access tier to connect via traditional methods like LAG, Virtual Chassis, or standard Layer 2 trunks5555. The IP Clos architecture is specifically designed for large-scale deployments where high density, vendor interoperability, and end-to-end policy enforcement are critical6. By utilizing a 5-stage IP Clos, organizations can eliminate the complexities of Spanning Tree Protocol (STP) while maintaining a flexible, "any-to-any" communication path throughout the physical infrastructure.

WhenMarvis Actionsdisplay “AI Validated,” it indicates the issue was detected earlier but is nowresolved.

Marvis automatically validates remediation and marks the action closed once the anomaly clears.

Marvis, the AI-driven virtual network assistant in Mist, provides real-time troubleshooting insights for both wired and wireless devices.

When used withWired Assurance, certain actions require Juniper EX or QFX switches for telemetry collection.

Two of these wired-specific actions are:

Bad Cable Detection– triggered when electrical faults or poor cable quality are observed through LLDP or physical diagnostics.

AMarvis Actions Missing VLANnotification indicates that anaccess pointis missing a VLAN configured on other APs within the same site.

Marvis identifies configuration inconsistencies by comparing VLAN assignments across devices.

VXLAN (Virtual Extensible LAN) uses an overlay encapsulation method to carry Layer-2 frames over an IP underlay. This functionality is part of the data plane, which is responsible for packet forwarding and encapsulation/decapsulation.

“In an EVPN-VXLAN fabric, the control plane (via BGP EVPN) learns and advertises MAC and IP information, while the data plane encapsulates and forwards traffic using VXLAN tunnels between VTEPs.”

Option A is incorrect: IP learning happens in the control plane, not the data plane.

Option B is incorrect: MAC advertisement is done in the control plane through EVPN route types.

Option D is incorrect: MAC learning is handled by EVPN control plane, not the VXLAN data plane.

Option C is correct: the VXLAN data plane encapsulates the traffic in UDP tunnels between VTEPs.

ThePost-Install (Installer)role has minimal access—sufficient only toclaim APs or switches, assign or unassign them, and place them on maps.

It cannot unclaim or remove devices and typically expires after installation.

According to Juniper Networks' documentation on campus fabric and EVPN-VXLAN architectures, a Virtual Routing and Forwarding (VRF) instance—conceptually referred to within the Junos OS as a routing instance—is typically used to provide macro-segmentation by logically separating a single physical network into multiple, isolated virtual networks.2 In the context of a modern campus fabric managed by Juniper Mist, VRFs allow network administrators to create distinct routing domains that maintain their own independent routing and forwarding tables.3

This separation is essential for multitenancy and security.4 For example, an organization might use one VRF for "Corporate_IT" and another for "Guest_WiFi" or "IoT_Devices". Because each VRF operates with its own routing table, traffic belonging to one instance is completely isolated from traffic in another by default; packets cannot travel between VRFs unless an administrator explicitly configures "route leaking" or directs the traffic through a stateful firewall for security inspection. This architectural approach also permits the use of overlapping IP address spaces, as the routing decisions for one tenant do not interfere with the address entries of another.5

In a Juniper Mist-driven campus fabric (such as Core-Distribution or IP Clos), the Mist portal streamlines the creation of these VRF instances as part of the fabric workflow.6 Once a VRF is created, specific VLANs (and their corresponding IRB interfaces) are assigned to it, ensuring that Layer 3 gateways are placed in the correct logical domain. While the underlay network (Option D) is responsible for providing the physical reachability (loopback to loopback) between switches using a protocol like eBGP, the overlay network leverages VRFs to deliver the actual isolated user services.

According to Juniper Mist documentation, the term "Adopting a Switch" specifically refers to the process of bringing an existing, already-configured switch—often termed a brownfield device—under the management of the Juniper Mist cloud. This is distinct from the "claiming" process, which is reserved for greenfield environments where new, factory-default switches are added using a QR code or activation code.

In a brownfield scenario, the switch is typically already in production or has a pre-existing local configuration that must be preserved or integrated into the Mist AI-driven dashboard. To adopt such a switch, the administrator must manually interact with the switch's Command Line Interface (CLI). The Mist portal provides a unique adoption command—a string of Junos OS configuration—that includes the specific URL for the Mist cloud and the organization’s unique registration token. Once this command is pasted into the switch's CLI and committed, the switch initiates an outbound connection to the Mist cloud via TCP port 2200 or 443.

Upon successful connection, the switch's status changes from "Unassigned" to "Connected" in the Mist dashboard. This transition allows the Mist AI engine to begin collecting telemetry, monitoring Service Level Expectations (SLEs), and performing automated troubleshooting. While the adoption process allows for "monitoring only" mode to avoid disrupting existing services, it is the fundamental first step for transitioning legacy Juniper infrastructure into a modern, cloud-managed Wired Assurance environment. This workflow is essential for organizations looking to leverage Marvis AI and automated operations without having to factory-reset their entire existing network.

According to Juniper Mist documentation, the Throughput Service Level Expectation (SLE) is the primary metric used to measure the ability of wired clients to pass traffic across the physical network without impedance. This SLE is critical for diagnosing issues with real-time, high-bandwidth applications such as video streams, which are highly sensitive to packet loss and latency. Within the Throughput SLE, the Storm Control classifier is specifically designed to identify "bad user minutes" caused by the suppression of Broadcast, Unknown Unicast, and Multicast (BUM) traffic.

Storm control is a mechanism that enables the switch to monitor traffic levels and drop BUM packets when a specified traffic level—known as the storm control level—is exceeded. This prevents a "traffic storm" from proliferating and degrading the overall performance of the LAN. While this is a vital security feature to prevent network meltdowns, it can inadvertently impact legitimate traffic. For instance, if multicast-based video streams or other heavy BUM traffic exceed the configured bandwidth percentage on a port, the switch will drop those packets to protect the rest of the network.

When troubleshooting video stream issues, network administrators should inspect the Storm Control classifier to see if it is triggering "bad user minutes". If the Mist dashboard indicates failures under this classifier, it signifies that the switch hardware is actively dropping packets because the BUM traffic limit has been reached. This provides immediate root-cause evidence, allowing the administrator to determine if they need to adjust the storm control thresholds within the Port Profile or investigate the source of the excessive broadcast traffic. By correlating these hardware-level events with the end-user experience, Mist AI simplifies the resolution of complex performance problems that traditional "up/down" monitoring would miss.

TheAlerts Configurationsection in the Mist dashboard allows administrators to definenotification rules and recipientsfor various network events, including switch issues, site-level incidents, and SLE threshold violations. Notifications can be sent viaemail, webhook, or third-party integrations.

“Use the Alerts Configuration page to enable alerts for specific device events, assign severity levels, and define e-mail or webhook recipients for switch and site notifications.”

Option A (Marvis conversational interface):Used for querying issues via AI, not for email alerts.

Option B (Wired SLEs):Provides analytics and thresholds but does not manage notifications.

Option D (Marvis Actions):Offers suggested remediation steps, not alert setup.

Option C (Alerts Configuration):Correct— this is where email notifications are configured.

In theCampus Fabric Deployment Wizard, the first step is defining thetopology type(3-stage or 5-stage IP Clos) and mapping thephysical connectionsbetween devices (core, distribution, and access).

“The first step in the campus fabric deployment process is to define the topology and identify physical connections between devices. This ensures correct port mapping between core, distribution, and access tiers.”

Option A:Correct— topology definition and physical connectivity mapping occur in the initial step.

Option B:Incorrect — the underlay network configuration happens after topology definition.

Option C:Incorrect — overlay configuration handles EVPN/VXLAN and routing setup, not physical cabling.

Option D:Incorrect — applying intent finalizes the deployment but does not define connectivity.

ForJuniper cloud-ready EX Series switches(EX2300, EX3400, EX4100, EX4400, etc.) to successfully onboard to theJuniper Mist Cloud, specific connectivity requirements must be met:

“Cloud-managed EX switches require outbound connectivity to the Mist Cloud on TCP ports 2200 or 443. Switches must also have access to DNS services to resolve cloud service URLs during onboarding.”

Option A:Incorrect — minimum version depends on switch model; older models may onboard with earlier releases (e.g., 20.x, 21.x).

Option B:Correct— outbound TCP 2200 or 443 connectivity is required for cloud registration.

Option C:Incorrect — switches connect directly to Mist Cloud, not the Agile Licensing Portal.

Option D:Correct— DNS resolution is mandatory for discovering Mist Cloud endpoints.

According to Juniper Networks' software licensing documentation, Juniper utilizes a tiered subscription model for its Junos OS features on EX and QFX Series switches, specifically designed to align with different network use cases. This model is categorized into three main tiers: Standard, Advanced, and Premium. While basic Layer 2 and Layer 3 functions are included in the base or Standard tiers, advanced fabric technologies are reserved for the highest tier.

The Premium License is explicitly required to enable the full EVPN-VXLAN protocol stack on Juniper switches within a campus or data center fabric. As detailed in the Juniper Licensing User Guide, the Premium license serves as a superset that includes all functionality from the Standard and Advanced tiers, while specifically unlocking the advanced routing and virtualization features necessary for modern fabrics. Specifically, this license entitles the user to configure and run Multiprotocol BGP (MP-BGP) with the EVPN address family—which acts as the control plane—and the VXLAN encapsulation required for the data plane.

In a Juniper Mist Wired Assurance environment, there is a clear distinction between the cloud-based management subscription and the local Junos OS license. While the Wired Assurance subscription provides the AI-driven visibility, SLE monitoring, and automation capabilities through the Mist cloud, the Junos OS Premium license is a prerequisite on the physical hardware to execute the EVPN-VXLAN commands and maintain compliance with Juniper's End User License Agreement (EULA). For instance, on platforms like the EX4650 or QFX5120, attempting to commit a configuration involving EVPN without the appropriate Premium Feature License (PFL) will result in system warnings and protocol limitations, as these features are considered "high-value" software capabilities intended for complex, multitenant campus environments.

According to the provided exhibit, several visual indicators confirm the operational status and compliance of the EX4100-48MP switch within the Juniper Mist dashboard1.

First, the statement that PoE is enabled is verified by multiple sections of the dashboard2. In the Front Panel view, several ports display a green icon representing a wireless access point, and the PoE status indicator in the top right is lit green, indicating the subsystem is active. Furthermore, the Statistics panel shows a "Total Power Draw" of 48.40 W, and the Metrics section displays "100% PoE Compliance," confirming that the switch is successfully delivering Power over Ethernet to connected devices such as the three Mist APs listed in the summary.

Second, the exhibit indicates that the Junos OS version on this switch is not compliant with the other switches in the site5. This is explicitly shown in the Metrics section, where the Version Compliance tile is highlighted in red with a value of 0%6. In the Mist AI-driven interface, a red compliance tile signifies that the current software version running on the device (identified as 23.2R1.13 in the Properties panel) does not match the "Configured Version" or the "Approved Version" set at the Site or Organization level.

The other options are incorrect based on the visual evidence. While Mist APs are connected, the Front Panel shows them connected to 2.5GbE (mGig) ports (ports 0, 2, 8, etc.) and standard 1GbE ports, not specifically just "ge" interfaces in a traditional sense8. Additionally, the 0% Version Compliance score directly contradicts the idea that the switch is compliant with the organization's standards.

In acore-distribution campus fabricmodel, the EVPN-VXLAN overlay is establishedonly between the core and distribution tiers. Theaccess switches are not part of the EVPN fabric; they connect upstream to distribution but do not run VXLAN tunnels.

“In the core-distribution campus fabric, only the core and distribution layers participate in the EVPN-VXLAN topology. The access layer connects to the distribution switches and forwards traffic but does not take part in the EVPN-VXLAN fabric.”

Option A:Correct — EVPN-VXLAN is built between core and distribution tiers.

Option B:Incorrect — both coreand distributionparticipate, not just core.

Option C:Incorrect — access switches are excluded from EVPN-VXLAN participation.

Option D:Correct — the access layer does not participate in EVPN-VXLAN.

According to Juniper Mist documentation, Wired Service Level Expectations (SLEs) are designed to provide operational visibility into the wired experience by monitoring Juniper EX and QFX Series switches. These SLEs leverage pre-connection and post-connection performance metrics to ensure network reliability and performance.

Pre-connection metrics are specifically focused on the initial phase of a client's journey to join the network. These metrics show the total number and the time required for successful connects and authentication. By tracking 802.1X events and DHCP snooping data, Mist can identify if clients are failing to onboard due to RADIUS issues, authentication timeouts, or failures in the DHCP binding process. This allows administrators to proactively address onboarding hurdles before they impact the broader user base.

Post-connection metrics, conversely, measure the network experience once a client is already "on the wire" and attempting to pass data. These metrics primarily measure throughput and focus on detecting various network errors and operational anomalies. Specifically, post-connection monitoring detects issues such as Spanning Tree Protocol (STP) loops, interface errors, and congestion. Additional post-connection insights include identifying cable issues, negotiation failures, and MTU mismatches that might occur during active data transmission.

In summary, Juniper Mist divides its telemetry into these two distinct categories to simplify troubleshooting. Pre-connection metrics ensure that users can get on the network, while post-connection metrics ensure that the network can sustain their traffic requirements without errors. This combined approach enables the Mist AI-driven Predictive Analytics and Correlation Engine (PACE) to provide a holistic view of the end-user experience, moving beyond traditional "up/down" monitoring to a deeper understanding of the quality of the client experience.

In Juniper’scampus fabric architectures, the location of theLayer 3 gateway(IRB) differentiates between CRB and ERB models:

Centrally-Routed Bridging (CRB):L3 gateways are placed at thecore layer.

Edge-Routed Bridging (ERB):L3 gateways are placed at thedistribution layer, closer to the edge.

“In the ERB model, Layer 2 gateways are deployed at the access layer, andLayer 3 gateways are deployed at the distribution layer.”

Option A (CRB):Incorrect — L3 is at the core, not distribution.

Option B (IP Clos):Incorrect — in 3-stage Clos, L3 is pushed to the access layer.

Option D (EVPN multihoming):Incorrect — this is about redundancy, not gateway placement.

Option C (ERB):Correct — L3 gateways sit at thedistribution layerin the ERB architecture.

When deployingJuniper Mist Wired AssuranceinManaged mode, switches are fully integrated with Mist Cloud for configuration, monitoring, and AI-driven operations. Managed mode providescomplete cloud-based management, meaning Mist AI handles configuration, templates, telemetry, and SLE tracking.

“In Managed mode, the switch configuration is fully managed by Mist Cloud. Administrators configure switches, templates, and policies directly through the Mist dashboard. A valid Wired Assurance subscription is required for Managed mode operation.”

Option A:Incorrect — the “Monitor Only” mode is read-only, not Managed.

Option B:Correct— Managed mode requires aWired Assurance subscription.

Option C:Incorrect — subscriptions are mandatory for Mist-managed devices.

Option D:Correct— in Managed mode,all supported EX switches are fully managed by Mist AI, including configuration and telemetry.

According to Juniper documentation, a route distinguisher (RD) is a critical address qualifier used to ensure that network layer reachability information (NLRI) remains unique within a Multiprotocol BGP (MP-BGP) control plane, especially in multitenant environments. In a service provider network, different tenants may use identical, overlapping private IP address spaces (such as 192.168.1.0/24). If these routes were advertised without a qualifier, BGP—which typically only considers the IP prefix—would treat them as the same route and potentially overwrite one with the other based on standard BGP best-path selection.

The route distinguisher solves this by prepending an 8-byte field to the tenant's IP address, effectively transforming a 32-bit IPv4 prefix into a unique 96-bit VPN-IPv4 address. This 8-byte value is typically configured in formats such as as-number:number or ip-address:number. Because the resulting VPN-IPv4 prefix is unique to that specific routing instance, the service provider's BGP infrastructure can carry and distinguish between overlapping routes from multiple customers simultaneously.

It is important to differentiate the RD from a route target (RT). While the RD's sole purpose is to provide uniqueness so that routes are not discarded or overwritten, the route target is an extended community attribute used to control the import and export of these routes into the correct virtual routing and forwarding (VRF) tables on remote PE routers. In Juniper's Junos OS, each routing instance of type vrf or evpn must have a unique RD associated with it; failing to configure a unique RD or attempting to use the same RD across different instances will result in a configuration commit failure. This fundamental separation of "making routes unique" (RD) and "directing routes to the right place" (RT) allows for the scalable, isolated multitenancy required in modern EVPN-VXLAN campus and data center fabrics.

Within Mist Insights,Client Eventsshow state transitions such asreassociationand IP-level issues likeDHCP Denied.

These help correlate connectivity issues across wired or wireless edge connections.

Dynamic Port Configuration (DPC)in Juniper Mist enablesautomatic switch port configurationbased on connected device type (e.g., phones, access points, printers). When setting up DPC, administrators define thematching criteria(such as MAC OUI or LLDP system name) and associate aConfiguration Profilethat determines which settings are applied.

“To configure Dynamic Port Configuration, you must assign the ports where DPC will run and select the configuration profile that defines how the port will be automatically configured when a matching device is detected.”

Option A:Correct— you must select the configuration profile to apply once the device type matches.

Option B:Incorrect — DPC does not use polling; it reacts to real-time LLDP/device discovery.

Option C:Correct— you must assign the ports on which DPC operates.

Option D:Incorrect — DPC is supported across EX models running compatible firmware but does not require manually setting a Junos version in configuration.