JNCIS-ENT Tunnels Practice Test 2 — 15 Questions

Question 1

Which TWO Junos configuration hierarchies are involved when setting up a functional GRE tunnel with an IP address? (Choose two)

Accepted Answer

edit chassis. Option A (edit chassis) is correct because on Junos platforms that use a tunnel PIC or tunnel interface, you must configure the tunnel physical interface properties under the [edit chassis] hierarchy, such as fpc/pic slot assignments for the tunnel services, before the gr- interface can function. Option C (edit interfaces gr-0/0/0 unit 0) is correct because the logical unit of the GRE tunnel interface is where you assign the tunnel's IP address (family inet address) and configure the tunnel source and destination, which are required for a functional GRE tunnel with an IP address. Option B (edit system services tftp) is not involved because TFTP is a file-transfer service unrelated to GRE tunnel setup. Option D (edit firewall) is not required for basic GRE tunnel functionality, as firewall filters are optional policy constructs. Option E (edit protocols bgp) is not needed because BGP is a routing protocol that may run over the tunnel but is not part of establishing the GRE tunnel itself.

Answer

edit system services tftp

Answer

edit firewall

Answer

edit protocols bgp

Question 2

When configuring OSPF over a GRE tunnel on Junos, which TWO configurations ensure stable neighbor adjacencies and correct route propagation? (Choose two)

Accepted Answer

Ensure that the tunnel interface has a valid IP address matching the subnet of the remote tunnel end.. Option B is correct because a GRE tunnel interface must have an IP address in the same subnet as the remote tunnel endpoint so that OSPF can form an adjacency over the tunnel; without matching subnet addressing, the OSPF hello packets cannot be sourced and received correctly across the tunnel. Option E is correct because GRE tunnels are inherently point-to-point links, and configuring the OSPF interface type as point-to-point (set protocols ospf area 0 interface gr-0/0/0 interface-type p2p) avoids DR/BDR election and ensures correct adjacency formation and route propagation over the tunnel. Option A is wrong because IP-IP encapsulation is not an OSPF routing option to disable, and GRE itself relies on IP encapsulation; disabling it would break the tunnel. Option C is wrong because BGP graceful restart is irrelevant to OSPF neighbor stability and does not apply to a tunnel interface. Option D is wrong because setting the OSPF dead interval to 1 second globally is far too aggressive, would cause frequent adjacency flaps, and is not a recommended practice for stable adjacencies.

Answer

Disable IP-IP encapsulation on the OSPF routing options.

Answer

Enable BGP graceful restart on the tunnel interface.

Answer

Set the OSPF dead interval to 1 second globally.

Question 3

Which THREE parameters are part of a standard Junos GRE tunnel interface configuration block? (Choose three)

Accepted Answer

family inet address . Option C is correct because a GRE tunnel interface in Junos is a logical unit that must be assigned an IP address under the inet family (family inet address ) to carry the inner passenger traffic. Option D is correct because tunnel destination defines the remote tunnel endpoint that the GRE-encapsulated packets are sent to. Option E is correct because tunnel source specifies the local source address used as the outer IP header source for the GRE tunnel. Option A is not part of a standard Junos GRE tunnel configuration block, as gre-key is not a valid Junos tunnel interface parameter. Option B is incorrect because encapsulation-type ipsec is not used for GRE; GRE tunnels use the gre encapsulation, and ipsec is configured separately under security associations.

Answer

gre-key <number>

Answer

encapsulation-type ipsec

Question 4

You are troubleshooting a GRE tunnel on a Junos device and notice that traffic passing through the tunnel is being dropped due to packet size exceeding the path MTU. Which command can you use directly on the tunnel interface to prevent fragmentation issues by adjusting the MSS?

Accepted Answer

set interfaces gr-0/0/0 unit 0 family inet mtu 1400. Setting the MTU on the tunnel interface with 'set interfaces gr-0/0/0 unit 0 family inet mtu 1400' directly adjusts the maximum transmission unit, which helps prevent fragmentation by ensuring packets fit within the tunnel's path MTU. This is the correct command to adjust MSS indirectly by lowering MTU.

Answer

set interfaces gr-0/0/0 unit 0 tunnel destination 192.168.1.2

Answer

set protocols gre path-discovery enable

Answer

set routing-options ip-options drop

Question 5

Which THREE parameters can be optionally configured on a Junos GRE tunnel interface (gr-) to enhance functionality or security? (Choose three.)

Accepted Answer

Tunnel key. Option C (Tunnel key) is correct because a Junos GRE tunnel interface supports the 'tunnel key' statement, which inserts a GRE key value into the GRE header to identify and demultiplex specific tunnel traffic, enhancing functionality in multi-tunnel scenarios. Option D (Tunnel checksum) is correct because GRE interfaces on Junos can be configured with 'tunnel checksum', which enables checksum verification of the inner packet to detect corruption across the tunnel. Option E (IP TOS inheritance/copying) is correct because Junos GRE interfaces support 'copy-tos' (or TOS inheritance), allowing the outer GRE/IP header to copy the inner packet's TOS value so QoS markings are preserved end-to-end. Option A (BGP AS override) is not a GRE tunnel interface parameter; it is a BGP neighbor-level setting used for loop prevention in certain AS-path scenarios, so it does not belong here. Option B (IPsec encryption profile) is not configured directly on the gr- interface; IPsec is applied via a separate services/st0 or ES PIC/interface configuration, not as a GRE tunnel interface option.

Answer

BGP AS override

Answer

IPsec encryption profile

Question 6

When troubleshooting a non-functional IP-IP or GRE tunnel on a Junos routing device, which TWO diagnostic steps or commands are commonly utilized? (Choose two.)

Accepted Answer

Use show interfaces gr-0/0/0 to verify that the physical and logical link states are up and packet counters are incrementing.. Option C is correct because `show interfaces gr-0/0/0` (or the equivalent `ip-` interface for IP-IP tunnels) is the standard Junos command to verify that the tunnel interface's physical and logical link states are Up and that input/output packet counters are incrementing, which directly confirms whether traffic is actually traversing the tunnel. Option E is correct because GRE/IP-IP tunnels add encapsulation overhead, so using `ping` with the do-not-fragment (DF) bit set and appropriately sized payloads is a common technique to detect path MTU and fragmentation problems that can silently break tunnel traffic. Option A is not appropriate because rebooting the device is a disruptive, last-resort action and does not constitute a targeted diagnostic step for tunnel troubleshooting. Option B is not appropriate because `clear ip-ip statistics` merely resets counters rather than diagnosing the fault, and clearing counters can actually destroy useful evidence. Option D is not appropriate because `show chassis routing-engine` reports overall control plane CPU and memory on the Routing Engine and does not specifically inspect tunnel encapsulation modules or diagnose tunnel forwarding issues.

Answer

Execute request system reboot immediately to restart tunnel daemon processing.

Answer

Use clear ip-ip statistics to reset tunnel counters.

Answer

Run show chassis routing-engine to check control plane memory utilization of tunnel encapsulation modules.

Question 7

You have configured a GRE tunnel between two Juniper routers. The tunnel interface is up, and you can ping the remote tunnel endpoint. However, OSPF adjacencies over the tunnel are not forming. You suspect an MTU issue. Which configuration change should you apply to resolve the problem?

Accepted Answer

Configure the tunnel interface MTU to 1476 and adjust the OSPF interface MTU to match.. GRE encapsulation adds overhead, reducing the effective MTU. OSPF requires matching MTU on both ends of a link to form an adjacency. Setting the tunnel MTU to 1476 and ensuring OSPF uses that MTU resolves the mismatch and allows adjacencies to form.

Answer

Increase the tunnel interface MTU to 1500.

Answer

Set the tunnel interface MTU to 1476 and configure 'ip mtu' on the physical interface.

Answer

Enable fragmentation on the tunnel interface with 'fragment' under the tunnel configuration.

Question 8

You are troubleshooting a GRE tunnel between two Juniper routers. The tunnel interface is up, but traffic is not passing. You suspect a routing issue. Which two actions should you take to verify that routes are being properly advertised over the tunnel? (Choose two.)

Accepted Answer

Verify that the tunnel interface is included in the routing protocol configuration.. To verify that routes are being advertised over the tunnel, you must ensure the routing protocol adjacency is up and that the tunnel interface is included in the protocol configuration. Checking OSPF neighbor state confirms the adjacency, and verifying interface inclusion ensures the protocol is active on the tunnel.

Answer

Check the MTU settings on the tunnel interface.

Answer

Examine the routing table for routes learned over the tunnel.

Answer

Ping the remote tunnel endpoint to test connectivity.

Question 9

You are configuring a GRE tunnel on a Juniper router. Which command would you use to verify the operational status and configuration of the tunnel interface?

Accepted Answer

show interfaces gr-0/0/0 terse. The 'show interfaces gr-0/0/0 terse' command provides a quick summary of the tunnel interface's operational status and basic configuration. It shows whether the interface is up or down, the IP address, and other key details, making it ideal for a fast verification. Other commands either provide too much detail or only show configuration without status.

Answer

show configuration interfaces gr-0/0/0

Answer

show interfaces gr-0/0/0 detail

Answer

show tunnel statistics

Question 10

You have configured a GRE tunnel between two Juniper routers. The tunnel is up, and you can ping the remote tunnel endpoint. However, you notice that large packets are being dropped when traversing the tunnel. Which configuration change would most likely resolve this issue?

Accepted Answer

Reduce the MTU on the tunnel interface to account for GRE overhead.. Large packets are dropped because the GRE encapsulation adds overhead, making the packet exceed the underlying path MTU. Reducing the tunnel interface MTU to 1476 (or lower) ensures that encapsulated packets fit within the physical interface MTU, preventing fragmentation and drops. This is a standard practice when configuring GRE tunnels.

Answer

Increase the MTU on the tunnel interface to allow larger packets.

Answer

Enable fragmentation on the tunnel interface.

Answer

Change the tunnel mode from GRE to IP-IP to reduce overhead.

Question 11

When configuring a GRE tunnel source and destination address on a Junos device, which configuration hierarchy is used?

Accepted Answer

set interfaces gr-0/0/0 unit 0 tunnel source destination . On Junos, GRE tunnel source and destination addresses are configured under the tunnel interface unit hierarchy using 'set interfaces gr-0/0/0 unit 0 tunnel source destination '. This is the standard syntax for GRE tunnels, where the tunnel interface is a gr- interface and parameters are applied at the unit level.

Answer

set routing-options tunnels source destination

Answer

set protocols gre source destination

Answer

set system tunnel source destination

Question 12

What is the official protocol number assigned in the outer IP header for GRE encapsulation?

Accepted Answer

47. The official protocol number assigned to GRE (Generic Routing Encapsulation) in the outer IP header is 47, as defined by IANA. This number is used in the IP protocol field to indicate that the payload is a GRE packet. Therefore, option C is correct.

Answer

50

Answer

4

Answer

89

Question 13

You have configured an IP-IP tunnel, but traffic fails to pass through. You run 'show interfaces ip-0/0/0' and see that the output displays 'Input drops' incrementing rapidly. What is the most likely reason?

Accepted Answer

Packets exceeding the interface MTU with the Don't Fragment (DF) bit set are being dropped.. Input drops incrementing rapidly on an IP-IP tunnel interface typically indicate that packets are being dropped due to MTU issues. When a packet exceeds the tunnel interface MTU and has the Don't Fragment (DF) bit set, the router cannot fragment it and must drop it, often sending an ICMP 'fragmentation needed' message. This is a common cause of input drops on tunnel interfaces.

Answer

The security policies are blocking the return traffic.

Answer

OSPF hello packets are malformed.

Answer

The tunnel destination IP address is unreachable via the routing table.

Question 14

What is the primary function of a Junos tunnel interface when used in conjunction with routing protocols?

Accepted Answer

To provide a virtual point-to-point layer 3 link for routing protocol adjacencies across an untrusted or disjointed transport network.. A Junos tunnel interface provides a virtual point-to-point Layer 3 link that can carry routing protocol adjacencies across a transport network that may not support multicast or is disjointed. This allows routing protocols like OSPF or BGP to form neighbors over the tunnel, treating it as a direct connection.

Answer

To act as a physical layer 2 bridge for VLAN extension without IP addresses.

Answer

To encrypt all transit traffic by default using hardware-based AES-256.

Answer

To replace physical interfaces for standard local area network connections.

Question 15

On an MX Series router, you configure a GRE tunnel that terminates on a routing instance (VRF). Where must the tunnel source and destination addresses be routable?

Accepted Answer

They must be routable within the routing table associated with the underlying transport interface (often the master routing instance or specific VRF).. For a GRE tunnel terminating in a routing instance (VRF), the tunnel source and destination addresses must be routable within the routing table associated with the underlying transport interface. This is typically the master routing instance or a specific VRF that has reachability to the tunnel endpoints. The tunnel itself can be in a different VRF, but the transport must be resolvable.

Answer

They must be part of the same subnet as the tunnel payload addresses.

Answer

They must be resolved via BGP inet-vpn routes only.

Answer

They must be configured as loopback addresses in the destination VRF exclusively.