Juniper JN0-351 Enterprise Routing and Switching Specialist (JNCIS-ENT) Exam Practice Test

BGP has a simple loop prevention mechanism for eBGP that checks the AS path for its own AS number. However, this mechanism does not work for iBGP, since all routers in the same AS have the same AS number. Therefore, iBGP has two additional rules to prevent routing loops within an autonomous system:

A router does not advertise a route learned from an iBGP neighbor to another iBGP neighbor. This rule ensures that a route does not loop back to the original iBGP router through another iBGP path.

A router does not accept a route learned from an iBGP neighbor if the next hop is not reachable via an IGP. This rule ensures that a router does not forward packets to an unreachable next hop.

These two rules imply that iBGP sessions must be configured as a logical full mesh, meaning that every iBGP router must have a direct iBGP session with every other iBGP router in the same AS. This way, every iBGP router can learn the best route from the eBGP routers and use the IGP to reach the next hop. A logical full mesh does not require a physical full mesh, meaning that iBGP routers do not have to be directly connected. They can use intermediate routers to establish iBGP sessions, as long as the IGP can reach the next hop.

A logical full mesh can be challenging to scale and maintain, especially for large ASes with many iBGP routers. Therefore, some alternatives to the full mesh requirement have been developed, such as route reflectors and confederations. These alternatives relax the iBGP rules and introduce additional attributes and mechanisms to prevent routing loops, such as originator ID and cluster list. References:

BGP Fundamentals

BGP - eBGP loop prevention mechanism same AS number

Loop Prevention in BGP Routing

B  is correct because the loops do not exist is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid.  A loop in BGP means that a route has been advertised by the same AS more than once, which can cause routing instability and inefficiency 1 .  To prevent loops, BGP uses the AS-path attribute, which lists the AS numbers that a route has traversed from the origin to the destination 2 .  The receiving router checks the AS-path attribute of the received route and discards it if it finds its own AS number in the list 2 . This way, BGP avoids accepting routes that contain loops.

C  is correct because the next hop is reachable is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid.  The next hop is the IP address of the next router that is used to forward packets to the destination network 3 .  The receiving router checks the next hop attribute of the received route and verifies that it has a valid route to reach it 3 .  If the next hop is not reachable, the received route is not usable and is rejected by the receiving router 3 . This way, BGP ensures that only feasible routes are accepted.

According to the OSPF protocol, the designated router (DR) is the router that acts as the focal point for exchanging routing information on a multi-access network segment, such as a LAN 1 .  The DR election process is based on the following criteria, in order of precedence 1 :

The router with the highest OSPF priority becomes the DR. The default priority is 1, and a priority of 0 means the router will not participate in the election.

If there is a tie in priority, the router with the highest router ID becomes the DR. The router ID is a 32-bit number that uniquely identifies a router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address of a loopback interface or a physical interface.

If there is a tie in router ID, the router that was first to become an OSPF neighbor becomes the DR.

In your scenario, two routers share the same highest priority and start time. This means that they have equal chances of becoming the DR based on the first and third criteria. Therefore, the second criterion will be used to break the tie, which is the router ID.  The router with the highest router ID will become the DR, and the other router will become the backup designated router (BDR), which is ready to take over the role of DR if it fails 1 .

 A firewall filter is a Junos security solution to filter or control traffic at the data plane as they enter or exit an interface 1 .  A firewall filter consists of one or more terms, each with a set of conditions and actions 2 .  The device evaluates every packet against the firewall filter terms in the order they are defined, and performs the actions specified in the first term that matches the packet 3 .  If no term matches the packet, the device discards the packet by default 3 .

In the exhibit, the firewall filter  mac-address  is applied to the  family ethernet-switching  and involves filtering MAC addresses. There are two terms,  term one  and  term two , each with different conditions and actions. The  from  statement specifies the match conditions, and the  then  statement specifies the actions.  If the  from  statement is omitted, all packets are considered to match and the actions in the  then  statement are taken 2 .  If the  then  statement is omitted, the packets that match the conditions in the  from  statement are accepted by default 2 .

Term one  logs traffic from a specific source MAC address  88:05:00:29:3c:de/48 .  The  log  action is a nonterminating action, which means that the device continues to evaluate the packet against the remaining terms in the filter 2 . Therefore, traffic that matches the  from  statement in term one is not discarded, and option A is incorrect.

Term two  accepts all other traffic not specified in term one.  The  then accept  action is a terminating action, which means that the device stops evaluating the packet against the filter and forwards the packet 2 . Therefore, all traffic not matching the  from  statement in term one is accepted by term two, and option D is correct.

Term two  does not have a  from  statement, which means that all packets are considered to match this term. Therefore, traffic matching the  from  statement in term two is not logged, and option B is incorrect.

Term one  does not have a  then  statement other than the  log  action, which means that the packets that match the  from  statement are accepted by default. Therefore, traffic that matches the  from  statement in term one is accepted, and option C is correct.

Junos devices support various types of tunnels for different purposes 1 2 .

Option B is correct.  Generic Routing Encapsulation (GRE) is a tunneling protocol that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network 1 .  Junos devices support GRE tunnels 1 .

Option D is correct.  IPsec (Internet Protocol Security) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session 1 .  Junos devices support IPsec tunnels 1 .

Option A is incorrect. Spanning Tree Protocol (STP) is not a type of tunnel.  It’s a network protocol designed to prevent loops in a bridged Ethernet local area network 2 .

Option C is incorrect.  While Junos devices do support IP-IP (also known as IP tunneling), it’s not supported on all Junos devices 1 .

The two reasons for the failure to form an adjacency in a network running IS-IS could be:

B. There is no configured ISO address on any IS-IS interface. IS-IS requires each router interface to have an ISO address configured.  Without this address, the routers cannot form an adjacency 1 .

D. The family iso configuration is missing from the adjacency interface. The ‘family iso’ configuration is essential for IS-IS to function correctly.  If this configuration is missing from the adjacency interface, it could prevent the formation of an adjacency 1 .

These explanations are based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 2 3 .

The static route to the 0.0.0.0/0 network has a next hop of xe-0/0/0.0, which is a local interface. BGP does not accept static routes with a local interface as the next hop, because it cannot advertise them to other BGP peers. BGP requires a valid IP address as the next hop for static routes that are redistributed into BGP. To fix this issue, the static route should have a next hop of an IP address that is reachable via the xe-0/0/0.0 interface, such as the IP address of the eBGP neighbor. Alternatively, the next hop can be modified by using a route map when redistributing the static route into BGP12.

The other options are not correct because:

The as-path parameter is not required for redistributing static routes into BGP. The as-path attribute is automatically set by BGP when advertising routes to other BGP peers3.

A community string is not required for redistributing static routes into BGP. A community is an optional attribute that can be used to group routes and apply policies to them4.

The no-readvertise feature is not specified in the configuration. The no-readvertise feature is used to prevent routes learned from one iBGP peer from being advertised to another iBGP peer5.

B  is correct because duplex and speed settings are required to match on both participating devices.  According to the Juniper Networks documentation 1 , all the interfaces in a LAG must have the same speed and be in full-duplex mode. This ensures that the LAG can operate as a single logical link without any performance or compatibility issues.

C  is correct because member links are not required to be contiguous ports.  According to the Juniper Networks documentation 2 , you can group any Ethernet interfaces on a switch into a LAG, regardless of their physical location or slot number. This provides flexibility and scalability for configuring LAGs on switches.

Option A is correct. Creating multiple areas in OSPF can help to reduce the convergence time . This is because changes in one area do not affect other areas, so fewer routers need to run the SPF algorithm in response to a change.

Option D is correct. Creating multiple areas in OSPF can help to reduce Link State Advertisement (LSA) flooding across the network. This is because LSAs are not flooded out of their area of origin.

A  is correct because you can deploy only stateless firewall filters on an EX Series switch.  A stateless firewall filter is a filter that evaluates each packet individually based on the header information, such as source and destination addresses, protocol, and port numbers 1 .  A stateless firewall filter does not keep track of the state or context of a packet flow, such as the sequence number, flags, or session information 1 .  EX Series switches support only stateless firewall filters, which are also called access control lists (ACLs) or packet filters 2 .

C  is correct because you can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch.  Layer 2 traffic is traffic that is switched within a VLAN or a bridge domain, while Layer 3 traffic is traffic that is routed between VLANs or networks 3 .  EX Series switches support three types of firewall filters: port (Layer 2) firewall filters, VLAN firewall filters, and router (Layer 3) firewall filters 4 . You can apply these filters to different interfaces and directions to control the traffic entering or exiting the switch.

Default BGP keepalive timer in Junos is 30 seconds

The default keepalive time for BGP is 30 seconds, which means that BGP peers send keepalive messages to each other every 30 seconds to verify the liveness of the BGP session. If no keepalive message is received from a peer within the hold time, which is 90 seconds by default, the peer is considered to be unavailable and the BGP session is closed. The keepalive time and the hold time can be configured manually for each BGP peer or peer group, but they must match on both ends of the BGP session. The keepalive time should be one third of the hold time for optimal performance. Therefore, option C is correct and the other options are incorrect. References:  BGP keepalive messages and hold time - Juniper Networks

The exhibit shows the output of the command  show ospf neighbor , which displays information about the OSPF neighbors on a router 1 .

The output shows that the OSPF neighbor with the address 172.26.1.1 and the interface ge-0/0/3.0 is in the Exstart state 1 .

The Exstart state is the fourth state in the OSPF neighbor formation process, after Down, Init, and 2-Way states 2 .  In this state, the OSPF neighbors establish a master-slave relationship and exchange database description (DBD) packets, which contain summaries of their link-state databases 2 .

The most common reason for OSPF neighbors to be stuck in the Exstart state is an MTU mismatch between the interfaces 3 .  MTU stands for maximum transmission unit, which is the largest size of a packet that can be transmitted on a network segment 4 .  If the MTU values of two OSPF neighbors are different, they may not be able to exchange DBD packets successfully, as some packets may be dropped or fragmented due to their size exceeding the MTU limit 3 .

To solve this problem, you need to ensure that the MTU values of both OSPF neighbors are the same or compatible.  You can use the command  show interfaces  to display the MTU value of an interface 5 . You can also use the command  ping  with the  do-not-fragment  option to test the MTU size between two routers.  You can change the MTU value of an interface by using the command  set interfaces interface-name mtu mtu-value  in configuration mode 5 .

A. The routes displayed have traversed one or more autonomous systems. True. The AS path attribute shows AS numbers (e.g., 65401 65520.), indicating the route ' s traversal through various autonomous systems. D. The routes displayed are being learned from an IBGP peer. True. The absence of the ' * > i ' marker before the prefixes indicates they are being learned from an IBGP peer. Therefore, the correct statements are A. The routes displayed have traversed one or more autonomous systems. and D. The routes displayed are being learned from an IBGP peer.

The feature that enables an interface on an EX Series switch to receive both untagged traffic (from the computer) and tagged traffic (from the IP phone) is the  voice VLAN 1 2 .

The voice VLAN feature in EX-series switches enables access ports to accept both data (untagged) and voice (tagged) traffic and separate that traffic into different VLANs 1 2 .  This allows the switch to differentiate between voice and data traffic, ensuring that voice traffic can be treated with a higher priority 1 2 . Therefore, option D is correct.

In a trunk port configuration with multiple VLANs, the native VLAN carries untagged traffic. This means frames sent or received on the port without a VLAN tag are automatically assigned to the native VLAN.

Here ' s why the other options are incorrect:

A. The native VLAN must be the default VLAN on the port.  This is not necessarily true. The native VLAN and the default VLAN can be different. The default VLAN is the VLAN assigned to untagged traffic on access ports, while the native VLAN applies to trunk ports.

B. The native VLAN is automatically configured through DHCP.  This is incorrect. The native VLAN needs to be manually configured on the switch port. DHCP is used for assigning IP addresses, not VLAN IDs.

D. The native VLAN is the highest tagged VLAN ID on the port.  This is also incorrect. The native VLAN and tagged VLANs are independent. The native VLAN is not related to the highest or lowest tagged VLAN ID.

Therefore, the only true statement is that the native VLAN is an untagged VLAN ID on the port.

Option B is correct.  Filter-based forwarding (FBF), also known as Policy Based Routing (PBR), uses the forwarding routing instance type 1 2 .

Option C is correct.  Routing Information Base (RIB) groups are used to copy routes from one routing table to another 3 4 .  In the context of FBF, RIB groups can be used to copy routes from the inet.0 routing table 3 4 .

Option A is incorrect.  FBF does not use the no-forwarding routing instance type 1 5 .

Option D is incorrect.  RIB groups are not used to hide routes in the inet.0 routing table 3 4 .  They are used to share or copy routes between different routing tables 3 4 .

According to the Juniper documentation 1 , the output of the show vlans command displays the forwarding options for the VLAN, including the DHCP security features. In the exhibit, the output shows that DHCP security is enabled, and that ARP inspection and IP source guard are also enabled. These features work together to protect the switch from IP spoofing and ARP spoofing attacks. DHCP snooping builds a database of IP/MAC bindings by snooping DHCP messages. ARP inspection validates ARP packets against the DHCP snooping database and drops invalid packets.  IP source guard checks the IP and MAC source addresses of packets against the DHCP snooping database and drops spoofed packets 2 3 . Therefore, the correct answer is A, B, and C.

The other options are not correct because:

D. The DHCP snooping database is not protected by default.  To protect the database from corruption or loss, you need to configure a file name and a location for storing the database, and enable periodic write operations to the file 4 . The exhibit does not show any such configuration.

E. DHCP snooping is not enabled for IPv6 traffic by default.  To enable DHCPv6 snooping, you need to configure a DHCPv6 relay agent and specify the trusted interfaces for DHCPv6 messages 5 . The exhibit does not show any such configuration.

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

The exhibit shows the configuration of RSTP on EX-4, which has the command  force-version stp .  This command forces the switch to use the legacy STP protocol instead of RSTP, even though the switch supports RSTP 1 .  This means that EX-4 will not be able to take advantage of the faster convergence and enhanced features of RSTP, such as edge ports, link type, and proposal/agreement sequence 2 .

The other switches in the network are likely to be running RSTP, as it is the default protocol for EX Series switches 3 . Therefore, there will be a compatibility issue between EX-4 and the other switches, which will result in longer convergence times and suboptimal performance.  The switch will also generate a warning message that says “Warning: STP version mismatch with neighbor” when it receives a BPDU from a RSTP neighbor 1 .

To solve this problem, the force-version command must be removed from EX-4, so that it can run RSTP natively and interoperate with the other switches in the network. This will enable faster convergence and better stability for the network topology.  To remove the command, you can use the  delete protocols rstp force-version  command in configuration mode 1 .

When the MAC address limit feature with the shutdown action is implemented on a switch, if a violation occurs, the interface is disabled and a system log entry is generated 1 .  If the switch has been configured with the port-error-disable statement, the disabled interface recovers automatically upon expiration of the specified disable timeout 1 .  However, if the switch has not been configured for auto-recovery from port error disabled conditions, you must manually clear the violation by running the clear ethernet-switching port-error command for the interface to send and receive traffic again 1 .  This explanation is based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 1 .

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

The maximum allowable MTU size for a default GRE tunnel without IPv4 traffic fragmentation is 1476 bytes 1 .  This is because GRE packets are formed by the addition of the original packets and the required GRE headers 1 .  These headers are 24-bytes in length and since these headers are added to the original frame, depending on the original size of the packet we may run into IP MTU problems 1 .  The most common IP MTU is 1500-bytes in length (Ethernet) 1 .  When the tunnel is created, it deducts the 24-bytes it needs to encapsulate the passenger protocols and that is the IP MTU it will use 1 .  For example, if we are forming a tunnel over FastEthernet (IP MTU 1500) the IOS calculates the IP MTU on the tunnel as: 1500-bytes from Ethernet - 24-bytes for the GRE encapsulation = 1476-Bytes 1 .

A broadcast storm is a network condition where a large number of broadcast packets are sent and received by multiple devices, causing congestion and performance degradation 1 .  A broadcast storm can occur when there are loops in the network topology, meaning that there are multiple paths between two devices 2 .

A spanning tree protocol is a network protocol that prevents loops from being formed when switches or bridges are interconnected via multiple paths.  It does this by creating a logical tree structure that spans all the devices in the network, and disabling or blocking the links that are not part of the tree, leaving a single active path between any two devices 3 .

By eliminating loops, a spanning tree protocol also eliminates broadcast storms, as broadcast packets will not be forwarded endlessly along the looped paths.  Instead, broadcast packets will be sent only along the tree structure, reaching each device once and avoiding congestion 3 .

Option A is correct. For traffic to be sent through a GRE tunnel, there must be a route that directs the traffic into the tunnel. This is typically accomplished through the use of a static route or a dynamic routing protocol.

Option B is correct. All intermediary devices must have a route to the tunnel endpoints34. In real-world scenarios, the tunnel endpoints for a tunnel going over the Internet must have globally reachable internet addresses. Otherwise, intermediate routers in the Internet cannot forward the tunneled packets.

According to the Juniper documentation 1 , the source and destination addresses of a GRE tunnel interface must be in different subnets. If they are in the same subnet, the router will not be able to route the GRE packets correctly. In the exhibit, the source and destination addresses are both in the 192.168.197.0/24 subnet, which is invalid for GRE tunneling. Therefore, the correct answer is D. References:  Configuring GRE Tunnel Interfaces | Junos OS