JN0-351 Enterprise Routing and Switching Specialist (JNCIS-ENT) Questions and Answers

A broadcast storm is a network condition where a large number of broadcast packets are sent and received by multiple devices, causing congestion and performance degradation 1 .  A broadcast storm can occur when there are loops in the network topology, meaning that there are multiple paths between two devices 2 .

A spanning tree protocol is a network protocol that prevents loops from being formed when switches or bridges are interconnected via multiple paths.  It does this by creating a logical tree structure that spans all the devices in the network, and disabling or blocking the links that are not part of the tree, leaving a single active path between any two devices 3 .

By eliminating loops, a spanning tree protocol also eliminates broadcast storms, as broadcast packets will not be forwarded endlessly along the looped paths.  Instead, broadcast packets will be sent only along the tree structure, reaching each device once and avoiding congestion 3 .

In OSPF, the Designated Router (DR) and Backup Designated Router (BDR) are elected based on the priority of the routers 1 .  The router with the highest priority becomes the DR, and the router with the second highest priority becomes the BDR 1 .  If there is a tie in priority, then the router with the highest Router ID is chosen 1 .

In this scenario, R2 has a higher priority (64) than R1 (32), so R2 will become the DR 1 .  Since R1 has the second highest priority, it will become the BDR 1 . Therefore, option D is correct.

According to the Juniper documentation 1 , the output of the show vlans command displays the forwarding options for the VLAN, including the DHCP security features. In the exhibit, the output shows that DHCP security is enabled, and that ARP inspection and IP source guard are also enabled. These features work together to protect the switch from IP spoofing and ARP spoofing attacks. DHCP snooping builds a database of IP/MAC bindings by snooping DHCP messages. ARP inspection validates ARP packets against the DHCP snooping database and drops invalid packets.  IP source guard checks the IP and MAC source addresses of packets against the DHCP snooping database and drops spoofed packets 2 3 . Therefore, the correct answer is A, B, and C.

The other options are not correct because:

D. The DHCP snooping database is not protected by default.  To protect the database from corruption or loss, you need to configure a file name and a location for storing the database, and enable periodic write operations to the file 4 . The exhibit does not show any such configuration.

E. DHCP snooping is not enabled for IPv6 traffic by default.  To enable DHCPv6 snooping, you need to configure a DHCPv6 relay agent and specify the trusted interfaces for DHCPv6 messages 5 . The exhibit does not show any such configuration.

A keepalive OAM probe is a mechanism that can be used to monitor the state of a GRE tunnel and detect any failures in the tunnel path. A keepalive OAM probe consists of sending periodic packets from one end of the tunnel to the other and expecting a reply.  If no reply is received within a specified time, the tunnel is considered down and the line protocol of the tunnel interface is changed to down 1 .

To configure a keepalive OAM probe for a GRE tunnel, you need to specify two parameters: the keepalive-time and the hold-time. The keepalive-time is the interval between each keepalive packet sent by the local router.  The hold-time is the maximum time that the local router waits for a reply from the remote router before declaring the tunnel down 2 .

According to the Juniper Networks documentation, the hold-time value must be two times the keepalive-time value for a GRE tunnel 2 . This is because the hold-time value must account for both the round-trip time of the keepalive packet and the processing time of the remote router. If the hold-time value is too small, it may cause false positives and unnecessary tunnel flaps.

In the exhibit, the configuration shows that the keepalive-time is set to 10 seconds and the hold-time is set to 15 seconds for the gr-1/1/10.1 interface. This means that the local router will send a keepalive packet every 10 seconds and will wait for 15 seconds for a reply from the remote router. However, this hold-time value is not two times the keepalive-time value, which violates the recommended configuration. This may cause traffic drops if the remote router takes longer than 15 seconds to reply.

Therefore, option D is correct, because the hold-time value must be two times the keepalive-time value for a GRE tunnel.  Option A is incorrect, because BFD is not required for GRE tunnels; BFD is another protocol that can be used to monitor tunnels, but it is not compatible with GRE keepalives 3 .  Option B is incorrect, because the “event link-adjacency-loss” option is not related to GRE tunnels; it is an option that can be used to trigger an action when a link goes down 4 .  Option C is incorrect, because LLDP does not need to be removed from the gr-1/1/10.1 interface; LLDP is a protocol that can be used to discover neighboring devices and their capabilities, but it does not interfere with GRE tunnels 5 .

The solution that should be implemented in this scenario is to create a default generate route that includes an import policy to match BGP routes from ISP1 and assign a preference value of four or less. This way, the default route will be advertised to the internal OSPF neighbors only when there is a BGP route from ISP1 in the routing table, and it will have a higher preference than any other default route from ISP2 or ISP3. If ISP1 is not available, the default generate route will be withdrawn and the traffic will use the next available default route from ISP2 or ISP3.

Option A is incorrect because creating a default static route with ISP1’s address as the next hop while specifying the addresses for ISP2 and ISP3 as qualified next hops with a preference value of six or higher will not ensure that the default route is advertised to the internal OSPF neighbors only when ISP1 is available. The default static route will always be in the routing table regardless of the availability of ISP1, and it will have a lower preference than any other default route from ISP2 or ISP3.

Option C is incorrect because creating a default static route with each neighbor address as the next hop will not ensure that all traffic uses ISP1 as the primary connection and only uses ISP2 and ISP3 when ISP1 is not available. The default static route will always be in the routing table regardless of the availability of ISP1, and it will load balance the traffic among the three ISPs.

Option D is incorrect because creating a default aggregated route will not ensure that the default route is advertised to the internal OSPF neighbors only when ISP1 is available. The default aggregated route will always be in the routing table regardless of the availability of ISP1, and it will not have any preference value associated with it. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

A. On R1, enable Level 1 on the ge-0/0/1 interface.  In IS-IS, both levels (Level 1 and Level 2) are enabled by default when you enable IS-IS on an interface 1 .  Level 1 systems route within an area 2 .  If the destination is outside an area, Level 1 systems route toward a Level 2 system 2 . Therefore, enabling Level 1 on the ge-0/0/1 interface on R1 would allow packets to reach from R1 to R3.

D. On R3 enable Level 1 on the ge-0/0/4 interface Similarly, enabling Level 1 on the ge-0/0/4 interface on R3 would allow packets to reach from R1 to R3.

These explanations are based on the IS-IS configuration documents and learning resources available at Juniper Networks 1  and Cisco 3 4 .

The output of the show bgp neighbor command shows the following information:

The local AS number of R1 is 65400, as indicated by the line “Local: 10.32.1.1+179 AS 65400”.

The peer AS number of 10.32.1.2 is 63645, as indicated by the line “Peer: 10.32.1.2+179 AS 63645”.

The BGP session is established, as indicated by the line “State: Established”.

The routers are exchanging IPv4 routes, as indicated by the line “Type: External State: Established Flags: < Sync > ” and the table showing the number of prefixes received and sent for inet.0 routing table. References:  Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks , [show bgp neighbor - Technical Documentation - Support - Juniper Networks]

To create a LAG interface, you need to perform two actions: enable LAG on the chassis and on each member interface. The first action is to configure the chassis stanza with the aggregated-devices statement and specify the number of LAG interfaces and the link-speed for each interface. The second action is to configure each member interface with the family ethernet-switching statement and the aggregated-ether-options statement with the lacp option. The name of the first LAG interface is not relevant, as long as it matches the name of the aggregated interface under the interfaces stanza. The name can be ae0, ae1, or any other valid name. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/lsa-refresh-interval-edit-protocols-ospf.html

According to the Juniper documentation1, when a switch receives a unicast frame destined to a MAC address that is not registered in the bridging table, it floods the frame out all ports that are part of the same VLAN, except the receiving port. This is the default behavior of a switch when it does not know the destination MAC address. The switch does not perform an ARP request, send an error message, or flood the frame to all VLANs. References: Understanding Unicast Flooding | Junos OS | Juniper Networks

The maximum allowable MTU size for a default GRE tunnel without IPv4 traffic fragmentation is 1476 bytes 1 .  This is because GRE packets are formed by the addition of the original packets and the required GRE headers 1 .  These headers are 24-bytes in length and since these headers are added to the original frame, depending on the original size of the packet we may run into IP MTU problems 1 .  The most common IP MTU is 1500-bytes in length (Ethernet) 1 .  When the tunnel is created, it deducts the 24-bytes it needs to encapsulate the passenger protocols and that is the IP MTU it will use 1 .  For example, if we are forming a tunnel over FastEthernet (IP MTU 1500) the IOS calculates the IP MTU on the tunnel as: 1500-bytes from Ethernet - 24-bytes for the GRE encapsulation = 1476-Bytes 1 .

C  is correct because Layer 2 control traffic is permitted on the secondary link of a redundant trunk group (RTG) on EX Series switches.  Layer 2 control traffic includes protocols such as LLDP, LACP, and STP, which are used to exchange information and coordinate actions between switches 1 .  According to the Juniper Networks documentation 2 , Layer 2 control traffic is allowed to pass through both the active and the secondary links of an RTG, but data traffic is only forwarded through the active link. This allows the switches to maintain their Layer 2 adjacencies and monitor the link status on both links.

D  is correct because if the active link fails, then the secondary link automatically takes over in an RTG on EX Series switches.  An RTG consists of two trunk links: an active or primary link, and a secondary or backup link 2 . The active link is used to forward data traffic, while the secondary link is in standby mode.  If the active link fails or becomes unavailable, the secondary link immediately transitions to a forwarding state and takes over the data traffic without waiting for normal STP convergence 2 . This provides fast recovery and redundancy for the network.

Aggregate routes are used for advertising summarized network prefixes 1 2 .  They help minimize the number of routing tables in an IP network by consolidating selected multiple routes into a single route advertisement 1 .  This approach is in contrast to non-aggregation routing, in which every routing table contains a unique entry for each route 1 .

Therefore, option D is correct. Options A, B, and C are not correct because:

Aggregate routes can be used with both static routing and dynamic routing protocols 1 .

Aggregate routes are not automatically generated for all of the subnets in a routing table.  They need to be manually configured 1 .

Aggregate routes are not always preferred over more specific routes.  The route selection process in Junos OS considers several factors, including route preference and metric, before determining the active route 1 .

The default hello interval on an OSPF interface depends on the network type of the interface. For point-to-point and broadcast network types, the default hello interval is 10 seconds. For non-broadcast and point-to-multipoint network types, the default hello interval is 30 seconds. The hello interval is the time between sending hello packets to establish and maintain neighbor adjacencies. The hello interval can be configured manually on each interface using the  ip ospf hello-interval  command. References:

OSPF Hello and Dead Interval - NetworkLessons.com

OSPF Hello and Dead Interval: Operation and Configuration

Adjusting OSPF Timers - Cisco IOS Cookbook, 2nd Edition

ospf timer hello - WLAN AC V200R010C00 Command Reference - Huawei

OSPF Timers – Hello and Dead Intervals - Packet Lab

Link-state update packets are used to flood link-state advertisements (LSAs) among OSPF routers. The destination IP address of these packets depends on the network type and the state of the interface. On broadcast and point-to-point networks, OSPF uses two IP multicast addresses: 224.0.0.5 for all OSPF routers and 224.0.0.6 for all designated routers (DRs) and backup designated routers (BDRs)12. If the interface state is DR or BDR, the link-state update packets are sent to 224.0.0.5. Otherwise, they are sent to 224.0.0.63. On non-broadcast networks, such as Frame Relay or ATM, link-state update packets are sent as unicasts to each adjacent neighbor3. Therefore, the correct answer is A and D. References: Understanding OSPF Areas | Junos OS, How OSPF Works - IP Routing [Book] - O’Reilly Media, Link state packet - Wikipedia

The exhibit shows the configuration of BFD liveness detection for BGP at the global level, which applies to all BGP neighbors by default 1 .  However, this configuration does not specify the session mode, which determines whether BFD uses single-hop or multihop mode to communicate with a neighbor 2 .

For single-hop BGP neighbors, which are directly connected on the same subnet, the session mode can be either automatic or single-hop.  For multihop BGP neighbors, which are not directly connected and require multiple hops to reach, the session mode must be multihop 2 .

Since your BGP neighbors are in different countries, they are likely to be multihop neighbors.  Therefore, you need to configure the session mode as multihop for each neighbor individually at the [edit protocols bgp group group-name neighbor address bfd-liveness-detection] hierarchy level 2 . For example:

protocols { bgp { group usa { neighbor 192.0.2.1 { bfd-liveness-detection { session-mode multihop; } } } group france { neighbor 198.51.100.1 { bfd-liveness-detection { session-mode multihop; } } } } }

If you do not configure the session mode for multihop neighbors, BFD will use the default mode of automatic, which will try to use single-hop mode and fail to establish a BFD session with the remote neighbor 2 . This will prevent BGP from using BFD to detect liveliness and failover.

Therefore, the answer  B  is correct, as you need to configure the BFD liveness detection on the BGP neighbor level with the appropriate session mode for multihop neighbors.

IP-IP tunnels encapsulate IP packets within other IP packets, allowing them to traverse networks that wouldn ' t normally support the original IP packets. This encapsulation involves the TTL (Time-to-Live) of the inner packet being decremented as it traverses through the tunnel towards its endpoint.

The two reasons for the failure to form an adjacency in a network running IS-IS could be:

B. There is no configured ISO address on any IS-IS interface. IS-IS requires each router interface to have an ISO address configured.  Without this address, the routers cannot form an adjacency 1 .

D. The family iso configuration is missing from the adjacency interface. The ‘family iso’ configuration is essential for IS-IS to function correctly.  If this configuration is missing from the adjacency interface, it could prevent the formation of an adjacency 1 .

These explanations are based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 2 3 .