JNCIS-ENT Tunnels Practice Test 1 — 15 Questions

Question 1

Which interface naming convention is used for an IP-IP tunnel interface in Junos?

Accepted Answer

ip-0/0/0. In Junos, IP-IP tunnel interfaces are named with the prefix 'ip-' followed by the slot, PIC, and port numbers, such as ip-0/0/0. This naming convention distinguishes them from other tunnel types like GRE (gr-), IPsec (st-), and logical tunnel (lt-).

Answer

st-0/0/0

Answer

gr-0/0/0

Answer

lt-0/0/0

Question 2

You are troubleshooting an IP-IP tunnel between two Junos devices where packets larger than 1476 bytes are being dropped without generating ICMP fragmentation needed messages. Which configuration command will resolve this issue by ensuring proper MTU adjustment?

Accepted Answer

Configure path-mtu-discovery or reduce the tunnel interface MTU to account for the IP-IP encapsulation header size.. The issue is that IP-IP encapsulation adds 20 bytes of overhead (outer IP header), reducing the effective MTU on the tunnel to 1480 bytes (1500 - 20). Packets larger than 1476 bytes are dropped because the tunnel interface MTU is not adjusted, and ICMP fragmentation-needed messages are not generated. The solution is to either enable path-MTU discovery or reduce the tunnel interface MTU to account for the encapsulation overhead.

Answer

set security flow tcp-mss mss-adjust 1360

Answer

set interfaces ip-0/0/0 unit 0 family inet mtu 1500

Answer

set routing-options encapsulation-limit 0

Question 3

You want to run OSPF inside a GRE tunnel on Junos. After configuring the gr- interface, OSPF neighbor adjacencies fail to form. What is a common cause specific to tunnel interfaces in Junos?

Accepted Answer

OSPF network type mismatch, requiring explicit point-to-point setting on the tunnel interface.. On Junos, GRE tunnel interfaces (gr-) default to OSPF network type NBMA or non-broadcast, which prevents OSPF from forming adjacencies without explicit neighbor configuration. Setting the tunnel interface's OSPF network type to point-to-point allows hellos to be sent as multicast and adjacencies to form. This is a common cause of OSPF over GRE failures specific to Junos.

Answer

OSPF authentication must be disabled globally before running over GRE.

Answer

GRE tunnels do not support OSPF routing protocol traffic.

Answer

The tunnel interface must be added to a security zone even on routing devices.

Question 4

An IP-IP tunnel is established between Router A and Router B. Traceroute packets traversing the tunnel show that all hops inside the tunnel are hidden. How does IP-IP encapsulation handle TTL by default on Junos?

Accepted Answer

TTL propagation is disabled by default, hiding inner router hops from traceroute.. By default on Junos, IP-IP tunnels have TTL propagation disabled, meaning the TTL of the inner packet is not copied to the outer header. Instead, the outer header uses a fixed TTL (typically 64) and the inner TTL is not decremented by intermediate routers. This hides the inner hops from traceroute, as the traceroute only sees the tunnel endpoints.

Answer

The outer header drops packets with TTL less than 10.

Answer

IP-IP forces a fixed TTL of 255 on all encapsulated packets.

Answer

IP-IP tunnels do not decrement TTL.

Question 5

You need to monitor the operational status and packet counters of a specific GRE tunnel interface named gr-0/0/0. Which operational mode command should you use?

Accepted Answer

show interfaces gr-0/0/0 extensive. The command 'show interfaces gr-0/0/0 extensive' displays detailed operational status, packet counters, error statistics, and other extensive information for the specified interface. It is the standard Junos operational command to monitor a specific interface's health and traffic.

Answer

show route forwarding-table interface gr-0/0/0

Answer

show gre statistics

Answer

show chassis tencent status

Question 6

An administrator configures a GRE tunnel on a Juniper SRX Series device and notices traffic destined across the tunnel is being dropped. The security zones for the tunnel interface and physical interface are both configured correctly. What could be missing?

Accepted Answer

The tunnel mode must be explicitly set to layer2-transport.. In Junos, traffic entering or leaving a tunnel interface requires security policies permitting traffic between the zones assigned to the tunnel interfaces and the respective ingress/egress zones, or security policies assigned to the tunnel interface zone itself.

Answer

GRE requires RSVP-TE signalling enabled on the physical egress interface.

Answer

The gr-0/0/0 interface is missing an IP address.

Question 7

You need to establish a point-to-point GRE tunnel between two Juniper MX Series routers. Which tunnel services type must be defined under the chassis configuration when using aggregated interface inline services?

Accepted Answer

set chassis fpc 0 pic 0 tunnel-services. On Juniper MX Series routers, GRE tunnel services using aggregated interface inline services require the tunnel-services configuration under the chassis hierarchy, specifically 'set chassis fpc 0 pic 0 tunnel-services'. This enables the PIC to provide tunnel encapsulation/decapsulation for GRE, IPIP, and other tunnel types. Without this chassis-level configuration, the gr- interface cannot be created or function, even if the interface itself is configured.

Answer

set routing-options interface-routes

Answer

set system services gre

Answer

set interfaces gr-0/0/0 unit 0 family inet

Question 8

Which Junos command displays the status of all configured tunnel interfaces on the device?

Accepted Answer

show interfaces gr*. The command 'show interfaces gr*' displays the status of all GRE tunnel interfaces on a Junos device, because GRE tunnels are named 'gr-' followed by a unit number (e.g., gr-0/0/0). The wildcard 'gr*' matches all such interfaces and shows their operational state, encapsulation, and counters. This is the standard way to enumerate tunnel interfaces in Junos.

Answer

show tunnel summary

Answer

show routing-options tunnels

Answer

show chassis tunnels

Question 9

You are configuring a GRE tunnel on a Junos device and need to ensure that keepalives are sent to detect when the remote tunnel endpoint becomes unreachable. Which configuration parameter accomplishes this?

Accepted Answer

set interfaces gr-0/0/0 unit 0 tunnel keepalives. Junos GRE interfaces support keepalive configuration under the tunnel options to monitor peer reachability.

Answer

set protocols gre keepalive-interval 10

Answer

set routing-options gre monitor

Question 10

You need to configure a GRE tunnel that requires routing multiple distinct customer VRFs over a single GRE transport link. Which feature should you combine with the GRE tunnel interface?

Accepted Answer

Multiprotocol BGP (MP-BGP) running over the GRE interface with VPN inet-vpn unicast family.. To route multiple customer VRFs over a single GRE tunnel, you need a control plane that carries VPN routing information. MP-BGP with the inet-vpn unicast family (VPN-IPv4) running over the GRE interface allows the exchange of MPLS-style VPN routes (route distinguishers and route targets) between PE routers, effectively creating a Layer 3 VPN over the tunnel without MPLS in the core.

Answer

Static routes pointing directly to each customer default gateway.

Answer

Enabling native VLAN tagging on the gr-0/0/0 unit 0 interface.

Answer

Layer 2 bridging configuration under the gr- interface.

Question 11

You are troubleshooting a GRE tunnel where traceroute shows packets looping between the tunnel endpoints. Which mechanism prevents routing loops in GRE tunnels on Junos?

Accepted Answer

Proper IP routing protocol metric design and TTL decrementing through the encapsulated IP headers.. GRE tunnels do not have their own loop-prevention mechanism; they rely on the underlying IP routing protocol's metric design and the TTL field in the encapsulated IP header. When a packet enters a GRE tunnel, the outer IP header's TTL is decremented at each hop, and the inner packet's TTL is also decremented when it is decapsulated and re-routed. If a routing loop exists due to poor metric design, packets will loop until the TTL expires, preventing infinite loops. Thus, proper routing protocol metric design and TTL decrementing are the mechanisms that prevent loops.

Answer

The GRE header hop-count field dropping packets exceeding 32 hops.

Answer

Junos automatically shuts down interfaces when a routing loop is detected.

Answer

An automatic split-horizon check built into the GRE driver.

Question 12

Which command displays the configuration of a specific GRE tunnel interface in candidate configuration mode on Junos?

Accepted Answer

show interfaces gr-0/0/0. In Junos, the `show interfaces gr-0/0/0` command displays the operational and configuration details of a specific GRE tunnel interface. When issued in candidate configuration mode, it still provides the active configuration and status of the interface, because `show` commands are operational and can be run from any CLI mode. The `gr-0/0/0` naming convention identifies a GRE tunnel interface, and `show interfaces` is the standard Junos command to view interface information.

Answer

display interface gr-0/0/0

Answer

view gr-0/0/0 configuration

Answer

get interface gr-0/0/0

Question 13

You are designing a network where MTU issues across a GRE tunnel must be mitigated automatically without relying on manual interface MTU adjustments. Which feature can be enabled on Junos routers to dynamically adjust TCP Maximum Segment Size?

Accepted Answer

TCP MSS clamping or adjustment via security options or firewall policers.. TCP MSS clamping (also called MSS adjustment) is the standard mechanism to mitigate MTU/MSS black-hole issues across tunnels like GRE, IPsec, or VXLAN. On Junos, this is configured via firewall filter policers or security flow options that rewrite the TCP MSS field in SYN packets so endpoints negotiate a segment size that fits within the tunnel's reduced MTU. This avoids fragmentation and the classic 'ping works but TCP hangs' symptom caused by PMTUD being blocked.

Answer

Automatic GRE header compression.

Answer

Enabling IPv6 extension header rewriting.

Answer

Setting the ip-ip encapsulation flag to auto-fragment.

Question 14

An administrator wants to verify that packets are successfully traversing a GRE tunnel interface. Which operational command displays packet counters specifically incrementing for the GRE encapsulation and decapsulation processes?

Accepted Answer

show interfaces gr-0/0/0. The 'show interfaces gr-0/0/0' command displays detailed interface statistics for the GRE tunnel interface, including packet counters for encapsulation and decapsulation (e.g., 'Input packets', 'Output packets', and protocol-specific counters). This is the standard operational command to verify GRE tunnel traffic.

Answer

Placeholder note for JSON formatting compliance

Answer

show security flow session interface gr-0/0/0

Answer

show chassis traffic-counters

Answer

show gre traffic

Question 15

Which TWO conditions can cause a Junos GRE tunnel interface to transition to an operational 'Down' state? (Choose two)

Accepted Answer

Failure of GRE keepalives when keepalive monitoring is enabled and the peer stops responding.. Lack of reachability to the tunnel destination or explicit keepalive failure when configured can cause a GRE interface to go down.

Answer

A mismatch in the routing protocol metric configured inside the tunnel.

Answer

An invalid BGP Autonomous System number configuration.