JNCIS-ENT Tunnels Practice Test 2 — 15 Questions

Question 1

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

Accepted Answer

family inet6. Even when carrying IPv6 payload traffic, the core tunnel interface family depends on whether the payload is inet6, while the tunnel source/destination addresses handle the IPv4 transport.

Answer

family inet

Answer

family iso

Answer

family mpls

Question 2

Which Junos command displays the status of all configured tunnel interfaces on the device?

Accepted Answer

show interfaces gr*. The concise or standard interface display command filters or shows tunnel interfaces when specified, such as 'show interfaces gr*'.

Answer

show tunnel summary

Answer

show routing-options tunnels

Answer

show chassis tunnels

Question 3

When configuring an IP-IP tunnel on a Junos device, what happens to the source and destination IP addresses of the original packet when it is encapsulated?

Accepted Answer

The original packet is placed inside a new outer IP header, leaving the inner IP header and its source/destination unchanged.. IP-IP encapsulation takes the original IP packet and prepends a new (outer) IP header, leaving the inner IP header completely intact.

Answer

The original packet has its source address replaced by the tunnel interface address and destination kept intact.

Answer

The original source and destination IP addresses are overwritten by the tunnel endpoint addresses.

Answer

The original packet header is stripped and replaced entirely by a GRE header.

Question 4

Which protocol number is used in the outer IP header for an IP-IP tunnel?

Accepted Answer

4. IP-IP encapsulation (Protocol 4) encapsulates IPv4 packets inside IPv4 packets.

Answer

47

Answer

6

Answer

17

Question 5

You need to configure a GRE tunnel that requires routing multiple distinct customer VRFs over a single GRE transport link. Which feature should you combine with the GRE tunnel interface?

Accepted Answer

Multiprotocol BGP (MP-BGP) running over the GRE interface with VPN inet-vpn unicast family.. To transport multiple VRFs across a single tunnel interface, BGP or another routing protocol running over the tunnel must exchange VPN-IPv4/VPN-IPv6 routes, or Logical Systems / Multiprotocol BGP can be utilized.

Answer

Static routes pointing directly to each customer default gateway.

Answer

Enabling native VLAN tagging on the gr-0/0/0 unit 0 interface.

Answer

Layer 2 bridging configuration under the gr- interface.

Question 6

An administrator notices that CPU utilization on the Routing Engine spikes when a high volume of transit traffic is directed through a locally terminated GRE tunnel on an MX router without inline services configured. What is the cause?

Accepted Answer

Tunnel encapsulation/decapsulation is falling back to Routing Engine CPU processing due to missing inline services PIC configuration.. Without inline services or appropriate PIC support configured for tunnel services, packet processing for encapsulation and decapsulation may fallback to software processing on the Routing Engine or non-optimized paths.

Answer

GRE keepalives are transmitting every 1 millisecond.

Answer

IP-IP tunnels require software processing, whereas GRE is always hardware-switched.

Answer

The firewall filter logging feature is active on all tunnel interfaces.

Question 7

You are configuring a GRE tunnel over an IPv4 network, but you want to secure the GRE traffic using IPsec (GRE over IPsec). In Junos, how is this typically structured on SRX or MX devices?

Accepted Answer

Traffic is encapsulated in GRE, and the resulting GRE packets are subsequently protected by IPsec VPN policies.. GRE over IPsec involves encapsulating traffic in GRE first, and then applying IPsec protection to the GRE packets by referencing the tunnel or transport zones/policies.

Answer

GRE and IPsec operate simultaneously as a single unified protocol without nested headers.

Answer

IPsec encapsulates the traffic first, and GRE wraps the encrypted payload.

Answer

IPsec replaces the GRE header entirely while maintaining GRE interface numbers.

Question 8

You are troubleshooting a GRE tunnel where traceroute shows packets looping between the tunnel endpoints. Which mechanism prevents routing loops in GRE tunnels on Junos?

Accepted Answer

Proper IP routing protocol metric design and TTL decrementing through the encapsulated IP headers.. GRE does not have an inherent TTL field in the GRE header itself, but Junos copies or handles the inner IP header TTL, and enabling keepalives or proper routing protocol design prevents loops. However, MTU and TTL settings are critical. Wait, what about tunnel loop prevention features? Tunnel interfaces rely on proper routing configuration, but let's look at options.

Answer

The GRE header hop-count field dropping packets exceeding 32 hops.

Answer

Junos automatically shuts down interfaces when a routing loop is detected.

Answer

An automatic split-horizon check built into the GRE driver.

Question 9

You configure a GRE tunnel between two routers. Router A can ping Router B's tunnel IP address successfully, but devices behind Router A cannot ping devices behind Router B across the tunnel. What is the most likely cause?

Accepted Answer

Missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface.. If local tunnel endpoints can reach each other, the tunnel itself is up. Failure of transit traffic behind the routers typically points to missing static or dynamic routing entries pointing to the remote subnet across the tunnel.

Answer

The GRE tunnel source IP address is configured incorrectly.

Answer

The physical interface MTU is set too high.

Answer

The gr- interface family inet address is missing.

Question 10

Which command displays the configuration of a specific GRE tunnel interface in candidate configuration mode on Junos?

Accepted Answer

show interfaces gr-0/0/0. To view the active or candidate configuration for a specific interface, the 'show interfaces gr-0/0/0' command is used in operational mode, or 'show interfaces gr-0/0/0' within configuration mode.

Answer

display interface gr-0/0/0

Answer

view gr-0/0/0 configuration

Answer

get interface gr-0/0/0

Question 11

When configuring an IP-IP tunnel on Junos, can you run multicast routing protocols like PIM over the IP-IP tunnel?

Accepted Answer

No, because IP-IP does not support multicast or broadcast packet encapsulation, whereas GRE does.. Unlike GRE, standard IP-IP encapsulation does not support broadcast or multicast traffic natively because IP-IP is strictly point-to-point unicast encapsulation without multicast destination mapping capabilities.

Answer

Yes, by enabling PIM sparse-mode directly on the ip-0/0/0 interface.

Answer

No, because Junos prohibits all routing protocols over IP-IP interfaces.

Answer

Yes, but only if IGMP version 3 is explicitly configured.

Question 12

You have configured a GRE tunnel, and you want to verify that the tunnel source and destination parameters match what is expected. Which command shows the configured tunnel source and destination addresses?

Accepted Answer

show interfaces gr-0/0/0 extensive. The 'show interfaces gr-0/0/0 extensive' command displays detailed properties including tunnel source and destination addresses.

Answer

show route protocol gre

Answer

show system tunnel-info

Answer

show chassis hardware

Question 13

You are designing a network where MTU issues across a GRE tunnel must be mitigated automatically without relying on manual interface MTU adjustments. Which feature can be enabled on Junos routers to dynamically adjust TCP Maximum Segment Size?

Accepted Answer

TCP MSS clamping or adjustment via security options or firewall policers.. Junos allows configuring TCP MSS adjustment under security flow or firewall options to ensure TCP segments fit within the tunnel MTU.

Answer

Automatic GRE header compression.

Answer

Enabling IPv6 extension header rewriting.

Answer

Setting the ip-ip encapsulation flag to auto-fragment.

Question 14

Which TWO statements are true regarding Junos tunnel interface naming conventions? (Choose two)

Accepted Answer

GRE tunnel interfaces begin with the prefix 'gr-'.. GRE tunnels use 'gr-' and IP-IP tunnels use 'ip-' prefixes.

Answer

Secure tunnel interfaces (IPsec) begin with the prefix 'gr-'.

Answer

Logical tunnel interfaces begin with the prefix 'ip-'.

Answer

All tunnel interfaces must start with the prefix 'xe-'.

Question 15

Which Junos configuration statement defines the destination address of a GRE tunnel?

Accepted Answer

destination <ip-address>. The destination address is defined using the 'destination' keyword under the tunnel configuration of the gr- interface.

Answer

remote-endpoint <ip-address>

Answer

peer-address <ip-address>

Answer

tunnel-destination <ip-address>