JNCIS-ENT Tunnels Practice Test 4 — 15 Questions

Question 1

Which TWO tools or commands can be used on Junos to verify the operational packet flow through a tunnel interface? (Choose two)

Accepted Answer

show interfaces gr-0/0/0 extensive. Option B, `show interfaces gr-0/0/0 extensive`, is correct because the extensive output for a tunnel interface includes operational and traffic statistics such as input/output packets, bytes, errors, and tunnel-specific counters, which directly confirm whether packets are flowing through the gr-0/0/0 tunnel. Option C, `monitor traffic interface gr-0/0/0`, is correct because it captures live packets traversing the tunnel interface, providing real-time verification of the operational packet flow. Option A, `show chassis alarms`, only reports hardware and system alarm conditions and does not show tunnel packet flow. Option D, `request system snapshot`, creates a backup copy of the file system and has nothing to do with verifying traffic. Option E, `show route summary`, displays routing table prefix counts and protocol summaries, not per-interface packet flow through a tunnel.

Answer

show chassis alarms

Answer

request system snapshot

Answer

show route summary

Question 2

An administrator needs to configure a basic GRE tunnel between two Junos devices across a routed IP network. Which interface family must be enabled on the physical transit interface to allow the GRE encapsulated packets to traverse the network?

Accepted Answer

family inet. GRE encapsulated packets are IP packets with protocol number 47, so the physical transit interface must have 'family inet' enabled to forward them across the routed IP network. Without family inet, the interface cannot process IPv4 packets, and the GRE tunnel will not come up. This is the fundamental requirement for GRE over an IP-routed underlay.

Answer

family mpls

Answer

family iso

Answer

family ccc

Question 3

Which interface naming convention is used by Junos OS to identify a generic routing encapsulation (GRE) tunnel interface?

Accepted Answer

gr-. Junos OS uses the 'gr-' prefix to identify GRE tunnel interfaces, for example gr-0/0/0. This naming convention is fixed and is used consistently in configuration and operational commands for GRE tunnels.

Answer

lt-

Answer

st-

Answer

ip-

Question 4

An administrator has configured a GRE tunnel between two SRX Series devices. Traffic originating from behind the local security zone destined for the tunnel interface is being dropped by default security policies. Which action must be taken to ensure transit traffic can enter the GRE tunnel?

Accepted Answer

Configure a security policy from the internal zone to the zone containing the gr- interface allowing all traffic.. On SRX Series devices in flow mode, all transit traffic — including traffic destined to a tunnel interface — is subject to security policy evaluation. The gr- interface belongs to a security zone, and traffic from the internal zone to that tunnel zone must be explicitly permitted by a security policy. Without this policy, the default deny-all policy drops the traffic before it can be encapsulated and sent through the GRE tunnel.

Answer

Disable flow-based mode globally on the SRX Series device.

Answer

Enable proxy-arp on the physical interface.

Answer

Add the gr- interface to the junos-default security zone.

Question 5

You need to configure an IP-IP tunnel on a Junos device. Which interface prefix is designated for IP-IP tunnels in the Junos CLI?

Accepted Answer

ip-. In Junos, IP-IP tunnels are configured on interfaces with the 'ip-' prefix (e.g., ip-0/0/0). This naming convention distinguishes IP-IP tunnels from other tunnel types like GRE (gr-), multicast tunnels (mt-), and generic routing encapsulations. The 'ip-' interface is specifically designated for IP-in-IP encapsulation as defined in RFC 2003.

Answer

mt-

Answer

gr-

Answer

st-

Question 6

You are configuring an IP-IP tunnel on a Junos routing platform. Which statement correctly identifies how IP-IP encapsulation differs from GRE encapsulation?

Accepted Answer

IP-IP encapsulates an IP packet inside another IP packet with an outer IP header and no extra transport header, whereas GRE includes a GRE header.. IP-IP tunneling (RFC 2003) prepends only an outer IPv4 header to the original packet, with protocol number 4 indicating IP-in-IP. GRE (RFC 2784/2890) inserts a GRE header between the outer IP header and the payload, adding fields like protocol type, checksum, key, and sequence number. This makes GRE more feature-rich but with more overhead (typically 24 bytes vs 20 for IP-IP).

Answer

IP-IP encapsulation includes a 4-byte protocol header while GRE includes routing and key fields.

Answer

IP-IP requires a logical tunnel (lt-) interface to function properly.

Answer

GRE supports only IPv4 payloads while IP-IP supports both IPv4 and IPv6.

Question 7

When configuring a GRE tunnel on Junos, which two parameters are mandatory under the specific gr- interface hierarchy to establish the tunnel endpoint connectivity?

Accepted Answer

tunnel source and tunnel destination. A GRE tunnel requires at least a source address and a destination address to define the tunnel endpoints.

Answer

tunnel key and tunnel checksum

Answer

tunnel metric and tunnel preference

Answer

tunnel bandwidth and tunnel delay

Question 8

An enterprise network uses a GRE tunnel to connect two sites running OSPF. OSPF neighbor adjacencies fail to form over the GRE tunnel even though unicast pings between the tunnel endpoints succeed. Upon inspecting interface configurations, you notice that OSPF hellos are not being received by the peer. What is the most likely cause of this issue?

Accepted Answer

OSPF hello packets are being sent as multicast, and the underlying network or tunnel configuration does not properly forward multicast traffic or protocol 89 is blocked.. OSPF sends hello packets to the multicast address 224.0.0.5 (AllSPFRouters) using IP protocol 89. For OSPF to form an adjacency over a GRE tunnel, the tunnel must properly forward multicast traffic and not filter protocol 89. If the underlying network or tunnel configuration blocks multicast or protocol 89, hellos are not received, and the adjacency fails. Unicast pings succeed because they are unicast IP packets, not multicast, and may use a different protocol (ICMP), so they do not test the multicast forwarding path or protocol 89 filtering. Thus, the most likely cause is that multicast hellos are not being delivered.

Answer

The tunnel source address must match the loopback address exactly on both ends for OSPF to initialize.

Answer

Junos requires explicit enabling of dynamic routing inside gr- interfaces using the command set protocols gre ospf enable.

Answer

GRE tunnels do not support routing protocols such as OSPF under any circumstances.

Question 9

An administrator configures a GRE tunnel with a tunnel key enabled for security segmentation between two sites. The tunnel comes up, but traffic fails to pass. Debugging reveals that packets are dropped because the receiving router rejects the packets. What is the most probable configuration mismatch?

Accepted Answer

The tunnel key value configured on one router does not match the tunnel key value configured on the remote peer router.. GRE tunnel keys are used to multiplex multiple GRE tunnels between the same pair of endpoints, and both ends must be configured with the same key value for the receiver to accept the encapsulated packets. If the keys mismatch, the receiving router drops the packets because it cannot match them to the expected tunnel, even though the tunnel interface itself shows as up. This is the classic cause of 'tunnel up but traffic fails' with GRE keys.

Answer

The tunnel source address is using a loopback interface instead of a physical interface.

Answer

The physical interface MTU is set too high on the ingress router.

Answer

The GRE tunnel interface family inet is missing the primary address.

Question 10

Which Junos operational mode command is used to verify the operational status and packet statistics of configured GRE tunnel interfaces?

Accepted Answer

show interfaces gr-0/0/0. The 'show interfaces' command in Junos operational mode displays detailed status, counters, and statistics for any interface, including GRE tunnel interfaces named gr-0/0/0. It shows operational state (up/down), traffic counters, errors, and protocol family information. This is the standard way to verify GRE tunnel health and packet flow on Junos devices.

Answer

show protocols tunnel status

Answer

show chassis tunnels

Answer

show gre tunnel summary

Question 11

You are configuring a GRE tunnel and want to ensure that integrity checks are performed on the transmitted packets to detect corruption. Which parameter should you add to the tunnel configuration?

Accepted Answer

set interfaces gr-0/0/0 unit 0 tunnel checksum. The tunnel checksum parameter enables GRE header checksumming, which adds a checksum to the GRE header so the receiving endpoint can detect corruption in the encapsulated packet. On Junos, this is configured with 'set interfaces gr-0/0/0 unit 0 tunnel checksum'. It is the only option that maps to a real Junos GRE integrity feature.

Answer

set interfaces gr-0/0/0 unit 0 tunnel verify-integrity

Answer

set protocols gre checksum-validation enable

Answer

set interfaces gr-0/0/0 unit 0 family inet encryption aes256

Question 12

Which TWO actions must be performed when configuring a functional GRE tunnel between two Junos devices over an intermediate IP network? (Choose two.)

Accepted Answer

Configure the tunnel source IP address under the gr- interface hierarchy.. Options B and C are correct because a GRE tunnel interface on Junos requires both a source and a destination address to define the tunnel endpoints: the source is configured with 'set interfaces gr-0/0/0 tunnel source ' and the destination with 'set interfaces gr-0/0/0 tunnel destination ', which are mandatory for the tunnel to encapsulate and forward traffic. Option A is incorrect because family mpls is only needed if MPLS is being run over the tunnel, not for a basic functional GRE tunnel. Option D is incorrect because family iso is used for IS-IS, which is unrelated to establishing a GRE tunnel. Option E is incorrect because a static route to the gr- interface as next-hop for all internet traffic is a routing design choice, not a requirement for the tunnel itself to function.

Answer

Enable family mpls on the gr- interface.

Answer

Enable family iso on the physical transit interface.

Answer

Configure a static route pointing directly to the gr- interface as the next-hop for all internet traffic.

Question 13

Which THREE statements are true regarding IP-IP encapsulation in Junos OS? (Choose three.)

Accepted Answer

IP-IP tunnels encapsulate an IP packet directly inside another IP packet without adding a GRE header.. Option A is correct because IP-IP (IP-in-IP) tunneling, as defined in RFC 2003, simply wraps an original IP packet inside a new outer IP header with protocol number 4, without inserting a GRE header. Option B is correct because GRE adds at least 4 bytes of GRE header (plus optional fields) on top of the outer IP header, whereas IP-IP adds only the outer IP header, resulting in lower overhead. Option E is correct because in Junos OS, IP-IP tunnel interfaces are configured with names beginning with the ip- prefix (for example, ip-0/0/0), distinguishing them from gr- (GRE) and other tunnel interface types. Option C is not correct because IP-IP encapsulation only carries IP payloads; multi-protocol payloads like AppleTalk or IPX require GRE, which supports a protocol type field. Option D is not correct because IP-IP tunnels are software-based logical interfaces and do not require any specialized physical line card with hardware cryptographic engines.

Answer

IP-IP tunnels natively support multi-protocol payloads such as AppleTalk and IPX.

Answer

IP-IP tunnels require a specialized physical line card with built-in hardware cryptographic engines.

Question 14

Which TWO factors must be carefully managed when running OSPF over a GRE tunnel interface on Junos devices? (Choose two.)

Accepted Answer

Interface MTU settings to account for the additional GRE header size and prevent packet drops or fragmentation issues.. Option B is correct because a GRE tunnel adds an outer IP header (typically 24 bytes for GRE + IPv4, or more with additional options), which reduces the effective payload MTU on the gr- interface; if the tunnel interface MTU is not lowered accordingly (e.g., to 1476 or less) or TCP MSS clamping is not applied, OSPF hello packets and other traffic can be dropped or fragmented, breaking adjacency. Option D is correct because OSPF over a GRE tunnel is normally configured with the point-to-point network type, since a point-to-point link does not require DR/BDR election and avoids the multicast/unicast adjacency issues that can arise on a broadcast-type tunnel; this ensures reliable adjacency formation between the two tunnel endpoints. Option A is not required because BGP multipath on the physical transit interface is unrelated to running OSPF over GRE and is not a prerequisite for OSPF adjacency. Option C is incorrect because LDP is an MPLS label distribution protocol and is not configured on a gr- interface to run OSPF. Option E is incorrect because proprietary Junos Layer 2 bridging protocols are not used to run OSPF over GRE.

Answer

Mandatory activation of BGP multipath routing on the physical transit interface.

Answer

Configuring MPLS Label Distribution Protocol (LDP) directly on the gr- interface.

Answer

Enabling proprietary Junos Layer 2 bridging protocols over the gr- interface.

Question 15

You are configuring a GRE tunnel between two Juniper routers. The tunnel interface is gr-0/0/0, and you have configured the tunnel source as ge-0/0/0.0 and the tunnel destination as 192.0.2.2. You notice that the tunnel interface is up, but traffic sent through the tunnel is being dropped. Which action would you take to resolve this issue?

Accepted Answer

Ensure that the tunnel destination is reachable via the tunnel source interface's routing table.. The tunnel interface being up indicates that the tunnel configuration is recognized, but traffic drops often occur when the tunnel destination is not reachable through the tunnel source interface. Ensuring that the route to the destination points out the source interface allows the encapsulated packets to be sent correctly. This is a common oversight when the underlying network has multiple paths or when the source interface is not the preferred route.

Answer

Increase the MTU on the tunnel interface to accommodate the GRE overhead.

Answer

Configure a firewall filter on the tunnel interface to allow GRE traffic.

Answer

Change the tunnel mode from GRE to IP-IP to reduce overhead.