JNCIS-ENT Tunnels — 20 Questions

Question 1

Which interface naming convention is used for an IP-IP tunnel interface in Junos?

Accepted Answer

ip-0/0/0. In Junos, IP-IP tunnel interfaces are named with the prefix 'ip-' followed by the slot, PIC, and port numbers, such as ip-0/0/0. This naming convention distinguishes them from other tunnel types like GRE (gr-), IPsec (st-), and logical tunnel (lt-).

Answer

st-0/0/0

Answer

gr-0/0/0

Answer

lt-0/0/0

Question 2

You are troubleshooting an IP-IP tunnel between two Junos devices where packets larger than 1476 bytes are being dropped without generating ICMP fragmentation needed messages. Which configuration command will resolve this issue by ensuring proper MTU adjustment?

Accepted Answer

Configure path-mtu-discovery or reduce the tunnel interface MTU to account for the IP-IP encapsulation header size.. The issue is that IP-IP encapsulation adds 20 bytes of overhead (outer IP header), reducing the effective MTU on the tunnel to 1480 bytes (1500 - 20). Packets larger than 1476 bytes are dropped because the tunnel interface MTU is not adjusted, and ICMP fragmentation-needed messages are not generated. The solution is to either enable path-MTU discovery or reduce the tunnel interface MTU to account for the encapsulation overhead.

Answer

set security flow tcp-mss mss-adjust 1360

Answer

set interfaces ip-0/0/0 unit 0 family inet mtu 1500

Answer

set routing-options encapsulation-limit 0

Question 3

You want to run OSPF inside a GRE tunnel on Junos. After configuring the gr- interface, OSPF neighbor adjacencies fail to form. What is a common cause specific to tunnel interfaces in Junos?

Accepted Answer

OSPF network type mismatch, requiring explicit point-to-point setting on the tunnel interface.. On Junos, GRE tunnel interfaces (gr-) default to OSPF network type NBMA or non-broadcast, which prevents OSPF from forming adjacencies without explicit neighbor configuration. Setting the tunnel interface's OSPF network type to point-to-point allows hellos to be sent as multicast and adjacencies to form. This is a common cause of OSPF over GRE failures specific to Junos.

Answer

OSPF authentication must be disabled globally before running over GRE.

Answer

GRE tunnels do not support OSPF routing protocol traffic.

Answer

The tunnel interface must be added to a security zone even on routing devices.

Question 4

An IP-IP tunnel is established between Router A and Router B. Traceroute packets traversing the tunnel show that all hops inside the tunnel are hidden. How does IP-IP encapsulation handle TTL by default on Junos?

Accepted Answer

TTL propagation is disabled by default, hiding inner router hops from traceroute.. By default on Junos, IP-IP tunnels have TTL propagation disabled, meaning the TTL of the inner packet is not copied to the outer header. Instead, the outer header uses a fixed TTL (typically 64) and the inner TTL is not decremented by intermediate routers. This hides the inner hops from traceroute, as the traceroute only sees the tunnel endpoints.

Answer

The outer header drops packets with TTL less than 10.

Answer

IP-IP forces a fixed TTL of 255 on all encapsulated packets.

Answer

IP-IP tunnels do not decrement TTL.

Question 5

You need to monitor the operational status and packet counters of a specific GRE tunnel interface named gr-0/0/0. Which operational mode command should you use?

Accepted Answer

show interfaces gr-0/0/0 extensive. The command 'show interfaces gr-0/0/0 extensive' displays detailed operational status, packet counters, error statistics, and other extensive information for the specified interface. It is the standard Junos operational command to monitor a specific interface's health and traffic.

Answer

show route forwarding-table interface gr-0/0/0

Answer

show gre statistics

Answer

show chassis tencent status

Question 6

An administrator configures a GRE tunnel on a Juniper SRX Series device and notices traffic destined across the tunnel is being dropped. The security zones for the tunnel interface and physical interface are both configured correctly. What could be missing?

Accepted Answer

The tunnel mode must be explicitly set to layer2-transport.. In Junos, traffic entering or leaving a tunnel interface requires security policies permitting traffic between the zones assigned to the tunnel interfaces and the respective ingress/egress zones, or security policies assigned to the tunnel interface zone itself.

Answer

GRE requires RSVP-TE signalling enabled on the physical egress interface.

Answer

The gr-0/0/0 interface is missing an IP address.

Question 7

You need to establish a point-to-point GRE tunnel between two Juniper MX Series routers. Which tunnel services type must be defined under the chassis configuration when using aggregated interface inline services?

Accepted Answer

set chassis fpc 0 pic 0 tunnel-services. On Juniper MX Series routers, GRE tunnel services using aggregated interface inline services require the tunnel-services configuration under the chassis hierarchy, specifically 'set chassis fpc 0 pic 0 tunnel-services'. This enables the PIC to provide tunnel encapsulation/decapsulation for GRE, IPIP, and other tunnel types. Without this chassis-level configuration, the gr- interface cannot be created or function, even if the interface itself is configured.

Answer

set routing-options interface-routes

Answer

set system services gre

Answer

set interfaces gr-0/0/0 unit 0 family inet

Question 8

Which Junos command displays the status of all configured tunnel interfaces on the device?

Accepted Answer

show interfaces gr*. The command 'show interfaces gr*' displays the status of all GRE tunnel interfaces on a Junos device, because GRE tunnels are named 'gr-' followed by a unit number (e.g., gr-0/0/0). The wildcard 'gr*' matches all such interfaces and shows their operational state, encapsulation, and counters. This is the standard way to enumerate tunnel interfaces in Junos.

Answer

show tunnel summary

Answer

show routing-options tunnels

Answer

show chassis tunnels

Question 9

You are configuring a GRE tunnel on a Junos device and need to ensure that keepalives are sent to detect when the remote tunnel endpoint becomes unreachable. Which configuration parameter accomplishes this?

Accepted Answer

set interfaces gr-0/0/0 unit 0 tunnel keepalives. Junos GRE interfaces support keepalive configuration under the tunnel options to monitor peer reachability.

Answer

set protocols gre keepalive-interval 10

Answer

set routing-options gre monitor

Question 10

You need to configure a GRE tunnel that requires routing multiple distinct customer VRFs over a single GRE transport link. Which feature should you combine with the GRE tunnel interface?

Accepted Answer

Multiprotocol BGP (MP-BGP) running over the GRE interface with VPN inet-vpn unicast family.. To route multiple customer VRFs over a single GRE tunnel, you need a control plane that carries VPN routing information. MP-BGP with the inet-vpn unicast family (VPN-IPv4) running over the GRE interface allows the exchange of MPLS-style VPN routes (route distinguishers and route targets) between PE routers, effectively creating a Layer 3 VPN over the tunnel without MPLS in the core.

Answer

Static routes pointing directly to each customer default gateway.

Answer

Enabling native VLAN tagging on the gr-0/0/0 unit 0 interface.

Answer

Layer 2 bridging configuration under the gr- interface.

Question 11

You are troubleshooting a GRE tunnel where traceroute shows packets looping between the tunnel endpoints. Which mechanism prevents routing loops in GRE tunnels on Junos?

Accepted Answer

Proper IP routing protocol metric design and TTL decrementing through the encapsulated IP headers.. GRE tunnels do not have their own loop-prevention mechanism; they rely on the underlying IP routing protocol's metric design and the TTL field in the encapsulated IP header. When a packet enters a GRE tunnel, the outer IP header's TTL is decremented at each hop, and the inner packet's TTL is also decremented when it is decapsulated and re-routed. If a routing loop exists due to poor metric design, packets will loop until the TTL expires, preventing infinite loops. Thus, proper routing protocol metric design and TTL decrementing are the mechanisms that prevent loops.

Answer

The GRE header hop-count field dropping packets exceeding 32 hops.

Answer

Junos automatically shuts down interfaces when a routing loop is detected.

Answer

An automatic split-horizon check built into the GRE driver.

Question 12

Which command displays the configuration of a specific GRE tunnel interface in candidate configuration mode on Junos?

Accepted Answer

show interfaces gr-0/0/0. In Junos, the `show interfaces gr-0/0/0` command displays the operational and configuration details of a specific GRE tunnel interface. When issued in candidate configuration mode, it still provides the active configuration and status of the interface, because `show` commands are operational and can be run from any CLI mode. The `gr-0/0/0` naming convention identifies a GRE tunnel interface, and `show interfaces` is the standard Junos command to view interface information.

Answer

display interface gr-0/0/0

Answer

view gr-0/0/0 configuration

Answer

get interface gr-0/0/0

Question 13

You are designing a network where MTU issues across a GRE tunnel must be mitigated automatically without relying on manual interface MTU adjustments. Which feature can be enabled on Junos routers to dynamically adjust TCP Maximum Segment Size?

Accepted Answer

TCP MSS clamping or adjustment via security options or firewall policers.. TCP MSS clamping (also called MSS adjustment) is the standard mechanism to mitigate MTU/MSS black-hole issues across tunnels like GRE, IPsec, or VXLAN. On Junos, this is configured via firewall filter policers or security flow options that rewrite the TCP MSS field in SYN packets so endpoints negotiate a segment size that fits within the tunnel's reduced MTU. This avoids fragmentation and the classic 'ping works but TCP hangs' symptom caused by PMTUD being blocked.

Answer

Automatic GRE header compression.

Answer

Enabling IPv6 extension header rewriting.

Answer

Setting the ip-ip encapsulation flag to auto-fragment.

Question 14

An administrator wants to verify that packets are successfully traversing a GRE tunnel interface. Which operational command displays packet counters specifically incrementing for the GRE encapsulation and decapsulation processes?

Accepted Answer

show interfaces gr-0/0/0. The 'show interfaces gr-0/0/0' command displays detailed interface statistics for the GRE tunnel interface, including packet counters for encapsulation and decapsulation (e.g., 'Input packets', 'Output packets', and protocol-specific counters). This is the standard operational command to verify GRE tunnel traffic.

Answer

Placeholder note for JSON formatting compliance

Answer

show security flow session interface gr-0/0/0

Answer

show chassis traffic-counters

Answer

show gre traffic

Question 15

Which TWO conditions can cause a Junos GRE tunnel interface to transition to an operational 'Down' state? (Choose two)

Accepted Answer

Failure of GRE keepalives when keepalive monitoring is enabled and the peer stops responding.. Lack of reachability to the tunnel destination or explicit keepalive failure when configured can cause a GRE interface to go down.

Answer

A mismatch in the routing protocol metric configured inside the tunnel.

Answer

An invalid BGP Autonomous System number configuration.

Question 16

Which TWO Junos configuration hierarchies are involved when setting up a functional GRE tunnel with an IP address? (Choose two)

Accepted Answer

edit chassis. Option A (edit chassis) is correct because on Junos platforms that use a tunnel PIC or tunnel interface, you must configure the tunnel physical interface properties under the [edit chassis] hierarchy, such as fpc/pic slot assignments for the tunnel services, before the gr- interface can function. Option C (edit interfaces gr-0/0/0 unit 0) is correct because the logical unit of the GRE tunnel interface is where you assign the tunnel's IP address (family inet address) and configure the tunnel source and destination, which are required for a functional GRE tunnel with an IP address. Option B (edit system services tftp) is not involved because TFTP is a file-transfer service unrelated to GRE tunnel setup. Option D (edit firewall) is not required for basic GRE tunnel functionality, as firewall filters are optional policy constructs. Option E (edit protocols bgp) is not needed because BGP is a routing protocol that may run over the tunnel but is not part of establishing the GRE tunnel itself.

Answer

edit system services tftp

Answer

edit firewall

Answer

edit protocols bgp

Question 17

When configuring OSPF over a GRE tunnel on Junos, which TWO configurations ensure stable neighbor adjacencies and correct route propagation? (Choose two)

Accepted Answer

Ensure that the tunnel interface has a valid IP address matching the subnet of the remote tunnel end.. Option B is correct because a GRE tunnel interface must have an IP address in the same subnet as the remote tunnel endpoint so that OSPF can form an adjacency over the tunnel; without matching subnet addressing, the OSPF hello packets cannot be sourced and received correctly across the tunnel. Option E is correct because GRE tunnels are inherently point-to-point links, and configuring the OSPF interface type as point-to-point (set protocols ospf area 0 interface gr-0/0/0 interface-type p2p) avoids DR/BDR election and ensures correct adjacency formation and route propagation over the tunnel. Option A is wrong because IP-IP encapsulation is not an OSPF routing option to disable, and GRE itself relies on IP encapsulation; disabling it would break the tunnel. Option C is wrong because BGP graceful restart is irrelevant to OSPF neighbor stability and does not apply to a tunnel interface. Option D is wrong because setting the OSPF dead interval to 1 second globally is far too aggressive, would cause frequent adjacency flaps, and is not a recommended practice for stable adjacencies.

Answer

Disable IP-IP encapsulation on the OSPF routing options.

Answer

Enable BGP graceful restart on the tunnel interface.

Answer

Set the OSPF dead interval to 1 second globally.

Question 18

Which THREE parameters are part of a standard Junos GRE tunnel interface configuration block? (Choose three)

Accepted Answer

family inet address . Option C is correct because a GRE tunnel interface in Junos is a logical unit that must be assigned an IP address under the inet family (family inet address ) to carry the inner passenger traffic. Option D is correct because tunnel destination defines the remote tunnel endpoint that the GRE-encapsulated packets are sent to. Option E is correct because tunnel source specifies the local source address used as the outer IP header source for the GRE tunnel. Option A is not part of a standard Junos GRE tunnel configuration block, as gre-key is not a valid Junos tunnel interface parameter. Option B is incorrect because encapsulation-type ipsec is not used for GRE; GRE tunnels use the gre encapsulation, and ipsec is configured separately under security associations.

Answer

gre-key <number>

Answer

encapsulation-type ipsec

Question 19

You are troubleshooting a GRE tunnel on a Junos device and notice that traffic passing through the tunnel is being dropped due to packet size exceeding the path MTU. Which command can you use directly on the tunnel interface to prevent fragmentation issues by adjusting the MSS?

Accepted Answer

set interfaces gr-0/0/0 unit 0 family inet mtu 1400. Setting the MTU on the tunnel interface with 'set interfaces gr-0/0/0 unit 0 family inet mtu 1400' directly adjusts the maximum transmission unit, which helps prevent fragmentation by ensuring packets fit within the tunnel's path MTU. This is the correct command to adjust MSS indirectly by lowering MTU.

Answer

set interfaces gr-0/0/0 unit 0 tunnel destination 192.168.1.2

Answer

set protocols gre path-discovery enable

Answer

set routing-options ip-options drop

Question 20

Which THREE parameters can be optionally configured on a Junos GRE tunnel interface (gr-) to enhance functionality or security? (Choose three.)

Accepted Answer

Tunnel key. Option C (Tunnel key) is correct because a Junos GRE tunnel interface supports the 'tunnel key' statement, which inserts a GRE key value into the GRE header to identify and demultiplex specific tunnel traffic, enhancing functionality in multi-tunnel scenarios. Option D (Tunnel checksum) is correct because GRE interfaces on Junos can be configured with 'tunnel checksum', which enables checksum verification of the inner packet to detect corruption across the tunnel. Option E (IP TOS inheritance/copying) is correct because Junos GRE interfaces support 'copy-tos' (or TOS inheritance), allowing the outer GRE/IP header to copy the inner packet's TOS value so QoS markings are preserved end-to-end. Option A (BGP AS override) is not a GRE tunnel interface parameter; it is a BGP neighbor-level setting used for loop prevention in certain AS-path scenarios, so it does not belong here. Option B (IPsec encryption profile) is not configured directly on the gr- interface; IPsec is applied via a separate services/st0 or ES PIC/interface configuration, not as a GRE tunnel interface option.

Answer

BGP AS override

Answer

IPsec encryption profile