JN0-650 Enterprise Routing and Switching - Professional (JNCIP-ENT) Question and Answers

The exhibit shows an OSPF network where Area 1 is configured as a Not-So-Stubby Area (NSSA). R5 is an Autonomous System Boundary Router (ASBR) injecting an External Route (203.0.113.0/24) into this area.

NSSA ASBR Behavior (Option D): Within an OSPF NSSA, external routes cannot be advertised as standard Type 5 LSAs because stubby areas do not support them. Instead, the ASBR (R5) advertises the external prefix using a Type 7 LSA (NSSA External LSA). This LSA is flooded throughout Area 1.

ABR Translation Behavior (Option C): When the Type 7 LSA reaches the Area Border Router (R1), the ABR is responsible for translating it into a Type 5 LSA (AS External LSA). This allows the external route to be propagated into the backbone (Area 0) and subsequently to the rest of the OSPF domain.

Incorrect Statements (A & B): Option A is incorrect because Type 7 LSAs are local to the NSSA and are never advertised into Area 0. Option B is incorrect because Type 5 LSAs are strictly prohibited within an NSSA.

When 802.1X server fail fallback is enabled with the vlan-name feature, the switch provides a specific survival mechanism for both existing and new sessions when the RADIUS server becomes unreachable.

Existing Clients (Statement B): Clients that have already successfully authenticated are unaffected by the server's unavailability in the short term. They maintain their current network access until their specific re-authentication timer expires. Only then will the switch attempt to contact the server again and trigger the fallback action if the server remains down.

New Clients (Statement D): For any new device attempting to connect while the RADIUS server is down, the switch cannot perform a standard authentication. Under the vlan-name fallback configuration, these new clients are automatically placed into the specified fallback VLAN and granted access based on the local policy defined for that VLAN.

Why others are incorrect: Statement A is incorrect because disconnecting active users would cause unnecessary service disruption. Statement C is incorrect because new clients cannot "request" a VLAN during the 802.1X handshake; the switch assigns it based on the fallback configuration.

The exhibit shows a BGP Route Reflector (RR) configuration where an export policy named NHS (Next-Hop Self) is applied to the internal BGP group int-group. The policy NHS sets the next-hop self attribute for BGP routes.

The Problem (Traffic Tromboning):In a standard BGP Route Reflector design, the RR should reflect routes without modifying the BGP next-hop attribute. By applying a next-hop self policy on the export to clients, the RR tells all its clients thatitis the exit point for those routes. Consequently, all data plane traffic is sent to the RR first before being forwarded to the actual destination, rather than following the optimal direct path between clients. This is known as "traffic tromboning" or suboptimal routing.

The Solution (Option C):The most direct way to fix this is todelete the export policythat is forcing the next-hop to be the RR. By deleting protocols bgp group int-group export NHS, the RR will resume standard behavior and reflect the original next-hop received from the route source, allowing clients to route traffic directly to the correct destination.

The Refined Solution (Option D):If you must keep the NHS policy (perhaps for routes learned from external peers), you should ensure it only applies to those specific routes. By adding from route-type internal to the policy term and then potentially changing the logic (or simply narrowing the scope), you can prevent the RR from incorrectly applying next-hop self to internal routes that it is merely reflecting. In the context of this specific problem,Option Dcombined with a change in the policy's action or scope helps ensure reflected internal routes maintain their original, optimal next-hops.

Option Ais incorrect because setting next-hop self for external routes is common practice, but it doesn't solve the problem of internal reflected routes being diverted to the RR.

Option Bis incorrect because applying this as an import policy would change how the RR itself sees the routes, but it wouldn't fix the attributes being sent out to the clients in the reflection process.

In External BGP (EBGP), there is a default safety mechanism that requires the peer's next hop to be on a directly connected network.

TTL Constraint: By default, EBGP packets are sent with a Time-to-Live (TTL) value of 1. If the next hop is not directly connected (e.g., when peering via loopback interfaces or across a multi-hop path), the packet will expire before reaching the destination, causing the route to be discarded or the session to fail.

The Multihop Solution (Option B): To override this behavior, you must configure the multihop statement under the BGP neighbor or group hierarchy. This allows the BGP session to establish by increasing the TTL (typically to 64 or a user-defined value) and bypasses the "directly connected" check.

Incorrect Options: Option A (accept-remote-nexthop) is used in internal BGP or specific routing-instance scenarios to resolve next hops that aren't in the local routing table, but it doesn't solve the EBGP TTL/direct-connection requirement. Option C (advertise-inactive) allows BGP to advertise routes that are not the best path in the routing table, which is irrelevant to next-hop reachability. Option D (multipath) is used for load-sharing across multiple paths.

The exhibit illustrates a PIM multicast environment where routerR2has received a multicast packet fromSource 1 (192.168.100.10)on itsge-0/0/4.0interface. To prevent loops, PIM-SM uses a mechanism calledReverse Path Forwarding (RPF).

RPF Check Process (Option A):When a multicast packet arrives, the router performs an RPF check by looking up the source's IP address in itsunicast routing table(typically inet.0).

The exhibit's command output, show multicast rpf 192.168.100.10, explicitly shows that for the source network $192.168.100.0/24$, theRPF interfaceisge-0/0/1.0.

Because the packet actually arrived onge-0/0/4.0instead of the expected ge-0/0/1.0 interface, the RPF check fails.

Packet Discard (Option C):According to standard PIM-SM operation in Junos OS 24.4, if a multicast packet fails the RPF check—meaning it arrived on an interface that the router does not use to reach the source via unicast—the packet isdiscarded. This is a fundamental loop-prevention mechanism that ensures multicast traffic is only accepted from the shortest path toward the source.

Option B is incorrectbecause the router will not add any interfaces to the Outgoing Interface List (OIL) for a packet that fails the initial RPF check.

Option D is incorrectbecause the exhibit clearly shows the interface in the RPF table (ge-0/0/1.0) is different from the interface where the packet was received (ge-0/0/4.0).

In Junos OS Class of Service (CoS) processing, there is a specific order of operation for packet classification.

Precedence of Multifield (MF) Classifiers:When both a Behavior Aggregate (BA) classifier and a Multifield (MF) classifier are applied to an interface, theMF classifier takes precedence.

Processing Order:

The BA classifier (e.g., DSCP or 802.1p) inspects the packet header and assigns an initial forwarding class and loss priority.

The MF classifier (which looks at multiple fields like source/destination IP and port) is processed later in the pipeline.

The "Final Word":Because the MF classifier is evaluated later, its resultsoverwriteany previous assignments made by the BA classifier. Therefore, if a packet matches both, the MF classifier determines the final forwarding class assignment.

The exhibit illustrates anEVPN-VXLANfabric using multi-homing. Server1 is dual-homed to Leaf1 and Leaf2 using anEthernet Segment Identifier (ESI)in an active-active or active-standby configuration. Server2 is single-homed to Leaf3.

In EVPN environments, specific mechanisms are used to prevent loops and duplicate traffic when dealing with Broadcast, Unknown Unicast, and Multicast (BUM) traffic:

Broadcast Propagation (Option A):When Server2 (connected to Leaf3) generates a broadcast frame, Leaf3 encapsulates this traffic into a VXLAN tunnel and forwards it to all other VTEPs (Virtual Tunnel End Points) that participate in that specific Virtual Network Instance (VNI). Therefore, both Leaf1 and Leaf2 will receive the broadcast frame from the core fabric.

Designated Forwarder (DF) Election (Option C):To prevent a multi-homed device (like Server1) from receiving duplicate copies of the same broadcast frame from multiple leaf switches, EVPN utilizes aDesignated Forwarder (DF). For a given ESI, only one leaf switch is elected as the DF.

The exhibit explicitly states thatLeaf2 is the Designated Forwarder.

According to the Junos EVPN implementation, only the DF is responsible for decapsulating BUM traffic received from the core and forwarding it to the local access segment.

While Leaf1 receives the frame (Option A), it will see that it is not the DF for that segment and will drop the frame rather than forwarding it to Server1. This ensures Server1 receives exactly one copy of the broadcast, delivered by Leaf2.

Option B is incorrectbecause in a standard ingress replication or multicast-based underlay, all VTEPs in the VNI receive the broadcast.

Option D is incorrectbecause Leaf1 is the non-designated forwarder (non-DF) for this segment and is prohibited from forwarding BUM traffic to the ESI.

OSPF stub areas are used to reduce the size of the Link-State Database (LSDB) in routers with limited resources by restricting the flooding of external routes.

Virtual Links (Option C):According to OSPF standards (both v2 and v3),virtual links cannot pass through stub areas. A virtual link must transit a "transit area," which must be a standard (non-stub) area with a full routing table.

Totally Stubby Areas (Option D):A stub area (which blocks Type 5 External LSAs) can be further restricted into atotally stubby area. In Junos OS, this is done by adding the no-summaries statement to the stub configuration. This blocks both Type 5 and Type 3 (Inter-area) LSAs, replacing them with a single default route.

Incorrect Statements:Option Ais incorrect because standard stub areas cannot contain an ASBR; only Not-So-Stubby Areas (NSSA) allow for an ASBR.Option Bis incorrect because an area is either a Stub or an NSSA; they are mutually exclusive configurations for the same area.

To provide IP phones with geographic location details (such as civic addresses or coordinates) automatically, Juniper EX Series switches utilize theLLDP-MED (Link Layer Discovery Protocol - Media Endpoint Discovery)protocol.

VoIP Specifics:While standard LLDP (C) is for general device discovery,LLDP-MEDis an enhancement specifically designed for network-to-endpoint communication for VoIP devices.

Location Identification:LLDP-MED supportsLocation Identification TLVs(Type-Length-Values). These allow a switch to push geographic or civic location data to an IP phone, which is critical for E911 services and asset tracking.

Junos Implementation:On EX Series switches, this is typically configured under protocols lldp-med to ensure the switch advertises the necessary location information to connected endpoints.

Junos OS uses specific routing tables for handling multicast traffic to ensure loop prevention through Reverse Path Forwarding (RPF) checks:

Multicast RPF (Option C):Theinet.0table is the default unicast routing table. In most standard multicast deployments, Protocol Independent Multicast (PIM) performs itsRPF checksagainst this table to determine the upstream interface toward the multicast source.

Topology Differences (Option A):Theinet.2table is specifically designed for multicast RPF lookups when themulticast forwarding topology differsfrom the unicast forwarding topology. This is common in environments using Multiprotocol BGP (MBGP) where you might want multicast traffic to follow a different path than standard data traffic.

inet.1 Role (Option B):Theinet.1table is themulticast forwarding cache. It stores (S,G) and (*,G) entries for actual packet forwarding. Routing protocols like MBGP or IS-IS do not place routesdirectlyinto inet.1; instead, PIM uses information from inet.0 or inet.2 to populate inet.1.

IS-IS and OSPFv3 (Option D):These protocols place their IPv4/IPv6 unicast routes into inet.0 or inet6.0. They do not place routes into inet.2 "directly" unless specific RIB-group configurations or address families are enabled to share those routes for multicast RPF purposes.

In a standard Layer 2 switch environment without specific multicast optimizations, multicast traffic is treated similarly to broadcast traffic and isflooded out of all portswithin a VLAN (except the port where it was received). This is inefficient as it consumes unnecessary bandwidth on ports where no receivers are present.

To optimize this,IGMP Snoopingis the standard solution.

How it works:The switch "snoops" or monitors IGMP (Internet Group Management Protocol) messages between hosts and routers.

Result:When a receiver sends an IGMP Membership Report (Join) for a specific multicast group, the switch records which port that request came from. It then builds a Layer 2 multicast forwarding table so that traffic for that group isonly forwardedto the specific ports that have active listeners.

Junos OS 24.4 Configuration:On modern Juniper switches, you enable this globally or per VLAN using the set protocols igmp-snooping vlan command.

Option A (Promiscuous mode)is used for monitoring or specific security configurations (like Private VLANs) and would not limit multicast flooding.Option B (Spanning Tree)manages loop prevention and does not differentiate between traffic types for forwarding optimization.Option D (IRB interface)is used for Layer 3 routing between VLANs but does not inherently provide Layer 2 multicast optimization within a single VLAN.

In Junos OS 24.4, theno-loss forwarding classis used for traffic that requires lossless delivery, such as iSCSI or FCoE, typically in a Data Center Bridging (DCB) environment.

Priority-Based Flow Control (Option C):To guarantee "no-loss" behavior, the switch must support and usePriority-based Flow Control (PFC). PFC allows the switch to send "pause" frames for a specific priority (forwarding class) to prevent buffer overflow and packet drops without affecting other traffic on the same link.

Forwarding Class Sets (Option B):In enhanced Layer 2 software (ELS) versions used by modern QFX and EX series switches, lossless traffic must be managed withinforwarding class sets(also known as priority groups). This grouping is necessary to apply specific DCB properties, such as PFC and specific bandwidth guarantees, to the lossless traffic class.

Why A and D are incorrect:Default scheduler maps and default drop profiles do not provide the specialized buffer management or lossless signaling required for this class. Lossless traffic specifically requires thesuppression of tail dropsrather than standard drop profiles.

When a peer incorrectly floods your router with an excessive number of routes, it can exhaust system resources and crash the routing engine.

Prefix-Limit (Option B):The prefix-limit (or accepted-prefix-limit) parameter is the primary defense against such "route leaks".

You can set amaximum thresholdfor the number of prefixes allowed from a specific BGP neighbor or group.

When the limit is reached, Junos can be configured to either just log a warning ortear down the BGP sessionentirely (using the teardown keyword) to protect the router.

This prevents the "hundreds of thousand routes" from ever being fully processed or installed into the main routing table.

Damping (Option A):Damping is used to suppress unstable, "flapping" routes, but it does not limit the total volume of stable routes received.

In Junos OS, particularly in BGP-based environments like EVPN-VXLAN or MPLS, the router often needs to perform arecursive lookupto resolve the BGP next-hop of a route.

Next-Hop Resolution (Option C):When an EVPN route (found in default-switch.evpn.0) is received, the protocol next-hop is typically the loopback IP of the remote VTEP. To actually forward traffic, the switch must know how to reach that loopback IP.

Theinet.3table is the default table in Junos used to store egress interface information for BGP next-hops.

While inet.0 handles standard unicast routing, inet.3 is specifically consulted for resolving the path toward BGP peers. In an EVPN context, this ensures that the VXLAN tunnel endpoint is reachable and properly resolved through the underlay.

Other Tables:*inet.2 (Option A)is used for Multicast RPF checks.

default-switch.evpn.0 (Option B)stores the EVPN routes themselves (MAC/IP), but it is thesourceof the lookup, not the table where the recursive resolution occurs.

vxlan.inet (Option D)is an internal table used to track active VXLAN tunnels but is not the primary table for recursive BGP next-hop validation.

The exhibit shows the MSTP configuration for two switches,switch1andswitch2. MSTP allows you to group multiple VLANs into a single Multiple Spanning Tree Instance (MSTI), enabling different root bridges and topologies for different sets of VLANs.

Root Bridge Election (Option B):For any Spanning Tree instance, the switch with thelowest bridge priorityis elected as the root bridge.

Formsti 2, switch1 has a priority of4k(4096), while switch2 has a priority of8k(8192).

Since 4096 < 8192,switch1 is elected the root bridge for msti 2.

Failover Behavior (Option D):Spanning Tree is designed for redundancy. If a primary root bridge fails, the remaining switches in the network re-elect a new root based on the next lowest priority.

Ifswitch2goes down, switch1 becomes the only switch in the region.

Regardless of its original priority (4k or 8k), switch1 will take over as theroot bridge for both msti 1 and msti 2because there are no other contenders with a better (lower) priority.

Incorrect Statements:Option Ais incorrect because for msti 1, switch2 has the lower priority (4k vs. 8k), making switch2 the root bridge.Option Cis incorrect because it contradicts the fundamental high-availability nature of Spanning Tree.

To simplify VLAN management and automate the creation and pruning of VLANs across a network, Juniper utilizes theMultiple VLAN Registration Protocol (MVRP).

MVRP on Trunk Interfaces (Option C):MVRP is the IEEE 802.1ak standard that replaces the older, proprietary GVRP. It is designed to run ontrunk interfacesbetween switches.

Dynamic Creation:When a VLAN is added to one switch, MVRP advertises its existence to neighboring switches. If those switches need to reach that VLAN, they can dynamically create it in their database.

Pruning:If a switch no longer has any active ports or downstream neighbors interested in a specific VLAN, it stops advertising that VLAN on its trunks. This "prunes" the VLAN traffic from those links, saving bandwidth.

Incorrect Options:Option A and Bare incorrect because GVRP is legacy and no longer the recommended protocol for modern Junos deployments.Option Dis incorrect because MVRP is meant for inter-switch trunk links to manage the fabric, not for edge access ports where VLAN membership is usually static.