JNCIS-ENT Tunnels — 20 Questions

Question 1

An administrator configures a GRE tunnel on a Juniper SRX Series device and notices traffic destined across the tunnel is being dropped. The security zones for the tunnel interface and physical interface are both configured correctly. What could be missing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The tunnel mode must be explicitly set to layer2-transport.. In Junos, traffic entering or leaving a tunnel interface requires security policies permitting traffic between the zones assigned to the tunnel interfaces and the respective ingress/egress zones, or security policies assigned to the tunnel interface zone itself.

Answer

GRE requires RSVP-TE signalling enabled on the physical egress interface.

Answer

The gr-0/0/0 interface is missing an IP address.

Question 2

You are configuring a GRE tunnel on a Junos device and need to ensure that keepalives are sent to detect when the remote tunnel endpoint becomes unreachable. Which configuration parameter accomplishes this?

Accepted Answer

set interfaces gr-0/0/0 unit 0 tunnel keepalives. Junos GRE interfaces support keepalive configuration under the tunnel options to monitor peer reachability.

Answer

set protocols gre keepalive-interval 10

Answer

set routing-options gre monitor

Question 3

Which TWO conditions can cause a Junos GRE tunnel interface to transition to an operational 'Down' state? (Choose two)

Accepted Answer

Failure of GRE keepalives when keepalive monitoring is enabled and the peer stops responding.. Lack of reachability to the tunnel destination or explicit keepalive failure when configured can cause a GRE interface to go down.

Answer

A mismatch in the routing protocol metric configured inside the tunnel.

Answer

An invalid BGP Autonomous System number configuration.

Question 4

When configuring a GRE tunnel on Junos, which two parameters are mandatory under the specific gr- interface hierarchy to establish the tunnel endpoint connectivity?

Accepted Answer

tunnel source and tunnel destination. A GRE tunnel requires at least a source address and a destination address to define the tunnel endpoints.

Answer

tunnel key and tunnel checksum

Answer

tunnel metric and tunnel preference

Answer

tunnel bandwidth and tunnel delay

Question 5

Which interface naming convention is used for an IP-IP tunnel interface in Junos?

Accepted Answer

ip-0/0/0. IP-IP tunnels use the 'ip-' prefix for their interface names in Junos.

Answer

st-0/0/0

Answer

gr-0/0/0

Answer

lt-0/0/0

Question 6

You are troubleshooting an IP-IP tunnel between two Junos devices where packets larger than 1476 bytes are being dropped without generating ICMP fragmentation needed messages. Which configuration command will resolve this issue by ensuring proper MTU adjustment?

Accepted Answer

Configure path-mtu-discovery or reduce the tunnel interface MTU to account for the IP-IP encapsulation header size.. Enabling ip-mtu or adjusting the interface MTU, or utilizing tcp-mss parameters on the routing-options or interfaces hierarchy helps prevent fragmentation issues when encapsulating traffic.

Answer

set security flow tcp-mss mss-adjust 1360

Answer

set interfaces ip-0/0/0 unit 0 family inet mtu 1500

Answer

set routing-options encapsulation-limit 0

Question 7

You want to run OSPF inside a GRE tunnel on Junos. After configuring the gr- interface, OSPF neighbor adjacencies fail to form. What is a common cause specific to tunnel interfaces in Junos?

Accepted Answer

OSPF network type mismatch, requiring explicit point-to-point setting on the tunnel interface.. OSPF defaults to broadcast network type for multi-access interfaces. GRE tunnels on Junos default to a point-to-point or point-to-multipoint behavior depending on configuration, but often require explicit OSPF network-type point-to-point configuration if mismatched with the remote end.

Answer

OSPF authentication must be disabled globally before running over GRE.

Answer

GRE tunnels do not support OSPF routing protocol traffic.

Answer

The tunnel interface must be added to a security zone even on routing devices.

Question 8

An IP-IP tunnel is established between Router A and Router B. Traceroute packets traversing the tunnel show that all hops inside the tunnel are hidden. How does IP-IP encapsulation handle TTL by default on Junos?

Accepted Answer

TTL propagation is disabled by default, hiding inner router hops from traceroute.. By default, standard IP-IP encapsulation copies the TTL from the inner IP header to the outer IP header, or decrements it, but standard IP-IP behavior can mask inner routing hops depending on whether TTL propagation is enabled or disabled.

Answer

The outer header drops packets with TTL less than 10.

Answer

IP-IP forces a fixed TTL of 255 on all encapsulated packets.

Answer

IP-IP tunnels do not decrement TTL.

Question 9

You need to monitor the operational status and packet counters of a specific GRE tunnel interface named gr-0/0/0. Which operational mode command should you use?

Accepted Answer

show interfaces gr-0/0/0 extensive. The command 'show interfaces gr-0/0/0' provides detailed operational status, traffic counters, and encapsulation details for the GRE interface.

Answer

show route forwarding-table interface gr-0/0/0

Answer

show gre statistics

Answer

show chassis tencent status

Question 10

When configuring a GRE tunnel source and destination address on a Junos device, which configuration hierarchy is used?

Accepted Answer

set interfaces gr-0/0/0 unit 0 tunnel source destination . GRE tunnel source and destination addresses are defined under the specific logical tunnel interface configuration hierarchy.

Answer

set routing-options tunnels source destination

Answer

set protocols gre source destination

Answer

set system tunnel source destination

Question 11

You need to establish a point-to-point GRE tunnel between two Juniper MX Series routers. Which tunnel services type must be defined under the chassis configuration when using aggregated interface inline services?

Accepted Answer

set chassis fpc 0 pic 0 tunnel-services. To configure GRE tunnels on MX Series routers using inline services, you must configure the tunnel-services under the chassis FPC settings to enable the physical or virtual services pic capabilities.

Answer

set routing-options interface-routes

Answer

set system services gre

Answer

set interfaces gr-0/0/0 unit 0 family inet

Question 12

What is the official protocol number assigned in the outer IP header for GRE encapsulation?

Accepted Answer

47. GRE is designated as IP protocol number 47.

Answer

50

Answer

4

Answer

89

Question 13

You have configured an IP-IP tunnel, but traffic fails to pass through. You run 'show interfaces ip-0/0/0' and see that the output displays 'Input drops' incrementing rapidly. What is the most likely reason?

Accepted Answer

Packets exceeding the interface MTU with the Don't Fragment (DF) bit set are being dropped.. Input drops on tunnel interfaces frequently occur due to MTU mismatches where incoming encapsulated packets exceed the tunnel interface or physical interface capability and cannot be fragmented because the DF bit is set.

Answer

The security policies are blocking the return traffic.

Answer

OSPF hello packets are malformed.

Answer

The tunnel destination IP address is unreachable via the routing table.

Question 14

What is the primary function of a Junos tunnel interface when used in conjunction with routing protocols?

Accepted Answer

To provide a virtual point-to-point layer 3 link for routing protocol adjacencies across an untrusted or disjointed transport network.. Tunnel interfaces provide a virtual point-to-point link over which routing protocols can establish adjacencies and exchange routing information across an intermediate network.

Answer

To act as a physical layer 2 bridge for VLAN extension without IP addresses.

Answer

To encrypt all transit traffic by default using hardware-based AES-256.

Answer

To replace physical interfaces for standard local area network connections.

Question 15

On an MX Series router, you configure a GRE tunnel that terminates on a routing instance (VRF). Where must the tunnel source and destination addresses be routable?

Accepted Answer

They must be routable within the routing table associated with the underlying transport interface (often the master routing instance or specific VRF).. For a tunnel to establish successfully, its source and destination IP addresses must be resolvable in the routing table of the routing instance that owns or routes the transport path, or the global routing table depending on where the tunnel interface is bound.

Answer

They must be part of the same subnet as the tunnel payload addresses.

Answer

They must be resolved via BGP inet-vpn routes only.

Answer

They must be configured as loopback addresses in the destination VRF exclusively.

Question 16

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

Accepted Answer

family inet6. Even when carrying IPv6 payload traffic, the core tunnel interface family depends on whether the payload is inet6, while the tunnel source/destination addresses handle the IPv4 transport.

Answer

family inet

Answer

family iso

Answer

family mpls

Question 17

Which Junos command displays the status of all configured tunnel interfaces on the device?

Accepted Answer

show interfaces gr*. The concise or standard interface display command filters or shows tunnel interfaces when specified, such as 'show interfaces gr*'.

Answer

show tunnel summary

Answer

show routing-options tunnels

Answer

show chassis tunnels

Question 18

When configuring an IP-IP tunnel on a Junos device, what happens to the source and destination IP addresses of the original packet when it is encapsulated?

Accepted Answer

The original packet is placed inside a new outer IP header, leaving the inner IP header and its source/destination unchanged.. IP-IP encapsulation takes the original IP packet and prepends a new (outer) IP header, leaving the inner IP header completely intact.

Answer

The original packet has its source address replaced by the tunnel interface address and destination kept intact.

Answer

The original source and destination IP addresses are overwritten by the tunnel endpoint addresses.

Answer

The original packet header is stripped and replaced entirely by a GRE header.

Question 19

Which protocol number is used in the outer IP header for an IP-IP tunnel?

Accepted Answer

4. IP-IP encapsulation (Protocol 4) encapsulates IPv4 packets inside IPv4 packets.

Answer

47

Answer

6

Answer

17

Question 20

You need to configure a GRE tunnel that requires routing multiple distinct customer VRFs over a single GRE transport link. Which feature should you combine with the GRE tunnel interface?

Accepted Answer

Multiprotocol BGP (MP-BGP) running over the GRE interface with VPN inet-vpn unicast family.. To transport multiple VRFs across a single tunnel interface, BGP or another routing protocol running over the tunnel must exchange VPN-IPv4/VPN-IPv6 routes, or Logical Systems / Multiprotocol BGP can be utilized.

Answer

Static routes pointing directly to each customer default gateway.

Answer

Enabling native VLAN tagging on the gr-0/0/0 unit 0 interface.

Answer

Layer 2 bridging configuration under the gr- interface.