JNCIS-ENT Tunnels — Timed 10 Questions

Question 1

Which interface naming convention is used for an IP-IP tunnel interface in Junos?

Accepted Answer

ip-0/0/0. In Junos, IP-IP tunnel interfaces are named with the prefix 'ip-' followed by the slot, PIC, and port numbers, such as ip-0/0/0. This naming convention distinguishes them from other tunnel types like GRE (gr-), IPsec (st-), and logical tunnel (lt-).

Answer

st-0/0/0

Answer

gr-0/0/0

Answer

lt-0/0/0

Question 2

You are troubleshooting an IP-IP tunnel between two Junos devices where packets larger than 1476 bytes are being dropped without generating ICMP fragmentation needed messages. Which configuration command will resolve this issue by ensuring proper MTU adjustment?

Accepted Answer

Configure path-mtu-discovery or reduce the tunnel interface MTU to account for the IP-IP encapsulation header size.. The issue is that IP-IP encapsulation adds 20 bytes of overhead (outer IP header), reducing the effective MTU on the tunnel to 1480 bytes (1500 - 20). Packets larger than 1476 bytes are dropped because the tunnel interface MTU is not adjusted, and ICMP fragmentation-needed messages are not generated. The solution is to either enable path-MTU discovery or reduce the tunnel interface MTU to account for the encapsulation overhead.

Answer

set security flow tcp-mss mss-adjust 1360

Answer

set interfaces ip-0/0/0 unit 0 family inet mtu 1500

Answer

set routing-options encapsulation-limit 0

Question 3

You want to run OSPF inside a GRE tunnel on Junos. After configuring the gr- interface, OSPF neighbor adjacencies fail to form. What is a common cause specific to tunnel interfaces in Junos?

Accepted Answer

OSPF network type mismatch, requiring explicit point-to-point setting on the tunnel interface.. On Junos, GRE tunnel interfaces (gr-) default to OSPF network type NBMA or non-broadcast, which prevents OSPF from forming adjacencies without explicit neighbor configuration. Setting the tunnel interface's OSPF network type to point-to-point allows hellos to be sent as multicast and adjacencies to form. This is a common cause of OSPF over GRE failures specific to Junos.

Answer

OSPF authentication must be disabled globally before running over GRE.

Answer

GRE tunnels do not support OSPF routing protocol traffic.

Answer

The tunnel interface must be added to a security zone even on routing devices.

Question 4

An IP-IP tunnel is established between Router A and Router B. Traceroute packets traversing the tunnel show that all hops inside the tunnel are hidden. How does IP-IP encapsulation handle TTL by default on Junos?

Accepted Answer

TTL propagation is disabled by default, hiding inner router hops from traceroute.. By default on Junos, IP-IP tunnels have TTL propagation disabled, meaning the TTL of the inner packet is not copied to the outer header. Instead, the outer header uses a fixed TTL (typically 64) and the inner TTL is not decremented by intermediate routers. This hides the inner hops from traceroute, as the traceroute only sees the tunnel endpoints.

Answer

The outer header drops packets with TTL less than 10.

Answer

IP-IP forces a fixed TTL of 255 on all encapsulated packets.

Answer

IP-IP tunnels do not decrement TTL.

Question 5

You need to monitor the operational status and packet counters of a specific GRE tunnel interface named gr-0/0/0. Which operational mode command should you use?

Accepted Answer

show interfaces gr-0/0/0 extensive. The command 'show interfaces gr-0/0/0 extensive' displays detailed operational status, packet counters, error statistics, and other extensive information for the specified interface. It is the standard Junos operational command to monitor a specific interface's health and traffic.

Answer

show route forwarding-table interface gr-0/0/0

Answer

show gre statistics

Answer

show chassis tencent status

Question 6

An administrator configures a GRE tunnel on a Juniper SRX Series device and notices traffic destined across the tunnel is being dropped. The security zones for the tunnel interface and physical interface are both configured correctly. What could be missing?

Accepted Answer

The tunnel mode must be explicitly set to layer2-transport.. In Junos, traffic entering or leaving a tunnel interface requires security policies permitting traffic between the zones assigned to the tunnel interfaces and the respective ingress/egress zones, or security policies assigned to the tunnel interface zone itself.

Answer

GRE requires RSVP-TE signalling enabled on the physical egress interface.

Answer

The gr-0/0/0 interface is missing an IP address.

Question 7

You need to establish a point-to-point GRE tunnel between two Juniper MX Series routers. Which tunnel services type must be defined under the chassis configuration when using aggregated interface inline services?

Accepted Answer

set chassis fpc 0 pic 0 tunnel-services. On Juniper MX Series routers, GRE tunnel services using aggregated interface inline services require the tunnel-services configuration under the chassis hierarchy, specifically 'set chassis fpc 0 pic 0 tunnel-services'. This enables the PIC to provide tunnel encapsulation/decapsulation for GRE, IPIP, and other tunnel types. Without this chassis-level configuration, the gr- interface cannot be created or function, even if the interface itself is configured.

Answer

set routing-options interface-routes

Answer

set system services gre

Answer

set interfaces gr-0/0/0 unit 0 family inet

Question 8

Which Junos command displays the status of all configured tunnel interfaces on the device?

Accepted Answer

show interfaces gr*. The command 'show interfaces gr*' displays the status of all GRE tunnel interfaces on a Junos device, because GRE tunnels are named 'gr-' followed by a unit number (e.g., gr-0/0/0). The wildcard 'gr*' matches all such interfaces and shows their operational state, encapsulation, and counters. This is the standard way to enumerate tunnel interfaces in Junos.

Answer

show tunnel summary

Answer

show routing-options tunnels

Answer

show chassis tunnels

Question 9

You are configuring a GRE tunnel on a Junos device and need to ensure that keepalives are sent to detect when the remote tunnel endpoint becomes unreachable. Which configuration parameter accomplishes this?

Accepted Answer

set interfaces gr-0/0/0 unit 0 tunnel keepalives. Junos GRE interfaces support keepalive configuration under the tunnel options to monitor peer reachability.

Answer

set protocols gre keepalive-interval 10

Answer

set routing-options gre monitor

Question 10

You need to configure a GRE tunnel that requires routing multiple distinct customer VRFs over a single GRE transport link. Which feature should you combine with the GRE tunnel interface?

Accepted Answer

Multiprotocol BGP (MP-BGP) running over the GRE interface with VPN inet-vpn unicast family.. To route multiple customer VRFs over a single GRE tunnel, you need a control plane that carries VPN routing information. MP-BGP with the inet-vpn unicast family (VPN-IPv4) running over the GRE interface allows the exchange of MPLS-style VPN routes (route distinguishers and route targets) between PE routers, effectively creating a Layer 3 VPN over the tunnel without MPLS in the core.

Answer

Static routes pointing directly to each customer default gateway.

Answer

Enabling native VLAN tagging on the gr-0/0/0 unit 0 interface.

Answer

Layer 2 bridging configuration under the gr- interface.