Juniper Networks Enterprise Routing and Switching, Professional (JNCIP-ENT, JN0-650) (JNCIP-ENT) (JNCIP-ENT) — Questions 1–75

An RP only knows about a source after the source's first-hop router sends a PIM Register to it. Once the RP has (S,G) state, it generates Source-Active messages toward its MSDP peers. If no Register arrives, the RP has no source to advertise, so the peer RP in the other domain receives nothing and cannot build interdomain state for the receiver.

The NSSA is the OSPF area type whose ABR translates Type-7 LSAs into Type-5 LSAs, and it is the only standard area type that generates Type-7 LSAs internally. This satisfies the question's requirement for an area permitting Type-7 LSA generation.

SSM groups do not use a rendezvous point or a shared tree; receivers join the (S,G) channel directly, typically via IGMPv3, and PIM builds only the shortest-path tree. Because no RP is consulted, the flapping unicast route to the RP no longer affects delivery for this group, which is exactly what the scenario requires.

In a private VLAN, isolated ports can communicate only with promiscuous ports, not with each other. Assigning customer ports to the isolated VLAN enforces host isolation while still allowing traffic through the shared promiscuous gateway.

Without a valid instance-type, the routing instance cannot assume the EVPN role, so it never builds the EVPN route table or import policies that process Type-2 MAC/IP routes. The instance-type statement defines the protocol family and import behaviour, making its absence or misconfiguration a direct cause of import failure.

Type 2 routes are specifically designed to advertise MAC addresses and optionally IP addresses along with the associated VXLAN VNI and next-hop. When Host A's MAC is learned locally, the leaf generates a Type 2 route that is distributed via BGP EVPN to all other leaf devices. Remote leaf devices install this route, enabling them to forward unicast traffic directly to the correct leaf without flooding.

The network-control forwarding class carries control plane traffic, including routing protocol messages and management access, and is mapped to a queue with strict-high priority by default. This matches the stem's requirement for the standard class reserved for routing and management traffic.

AS_PATH is a well-known mandatory attribute, so every BGP implementation must recognise it and it must appear in every UPDATE message. It records the sequence of autonomous systems a route traverses, satisfying the stem's requirement for attributes recognised by all implementations and present in all updates.

Junos applies behaviour aggregate classifiers first, then multi-field classifiers, which can override the BA result. This ordering satisfies the stem's scenario of both classifier types on one ingress interface, letting MF classification take precedence for finer-grained matching.

Relaxing strict AS path or IGP cost checks allows multipath load balancing across paths with different metrics.

If ESIs match but BGP session stability or Type-4 route advertisements fluctuate, the DF election re-runs continuously, causing churn.

`show route protocol bgp extensive` satisfies the requirement to display active BGP routes with their communities. The `extensive` modifier expands each route's detail, including the Communities attribute, whereas the default `show route protocol bgp` output omits community values entirely. This makes it the precise command for viewing both routes and their associated communities together.

`show ospf neighbour` displays adjacency states and the router IDs of peers, exposing stuck ExStart or Exchange states that indicate MTU mismatches or mismatched authentication. This directly satisfies the stem's requirement for an OSPF troubleshooting command, since neighbour formation failures are the most common cause of missing routes.

When the RADIUS server is unreachable, the switch places newly authenticating supplicants into a designated critical VLAN or applies a critical profile, preserving network access rather than denying it. This satisfies the stem's fallback requirement, since critical authentication specifically handles server-unreachable conditions on EX Series switches.

A behavior aggregate (BA) classifier maps a single field, such as the DSCP value in the IP header, directly to a forwarding class and loss priority. Because the uplink traffic already carries DSCP markings from the core and you must classify solely on those bits, a BA classifier applied to the interface is exactly the right tool for this scenario.

ARP suppression works by having the local VTEP maintain a cache of IP-MAC bindings from EVPN Type-2 routes. When an ARP request is received for an IP in the cache, the VTEP responds on behalf of the target, suppressing the need to flood the ARP request across the VXLAN fabric. This reduces broadcast traffic and is a key feature of EVPN.

`show msdp summary` lists each MSDP peer with its state and session counts, directly satisfying the requirement to verify peer state. Unlike `show msdp statistics`, which reports message counters, or `show msdp source-active`, which displays cached source information, this command exposes the operational peer relationship itself.

OSPFv3 removed IPv6 addresses from Router and Network LSAs, so prefix information is carried separately by the Intra-Area-Prefix LSA, Type 9. It associates prefixes with a referenced Router, Network or Link LSA within the same area, satisfying the requirement for intra-area IPv6 prefix propagation.

IEEE 802.1X port-based authentication with dynamic VLAN assignment verifies device identity against a RADIUS server before granting network access, then assigns the voice VLAN only after successful authentication. This prevents rogue devices from spoofing LLDP-MED TLVs to obtain voice VLAN membership, satisfying the requirement to block unauthorised masquerading as IP phones.

`show ospf database` dumps the OSPFv2 link-state database, listing router LSAs and network LSAs with their link-state IDs, advertising routers, sequence numbers and ages. It directly satisfies the stem's requirement to display LSAs, unlike neighbour or interface commands that show adjacency state or timer values instead.

The BSR gathers Candidate-RP advertisements and floods the resulting RP-set to every PIM router in the domain, enabling group-to-RP mapping without static configuration. This satisfies the dynamic RP discovery requirement, since routers learn which RPs serve which multicast groups.

MACsec uses the MACsec Key Agreement (MKA) protocol to negotiate secure associations and keys between the switch and an authenticated supplicant. Once MACsec is enabled on the port, only devices possessing the correct connectivity association key can encrypt and decrypt frames, so an unauthorized laptop cannot pass traffic even if it spoofs a MAC address.

In single supplicant mode, the port permits only the first authenticated device; any second MAC address is denied access, remaining unauthenticated. This satisfies the stem's constraint by enforcing one-to-one authentication, unlike multiple mode which allows several hosts behind one port.

LLDP-MED's extended power-via-MDI TLV lets the endpoint advertise its precise power requirement, so the switch allocates exact wattage instead of reserving the full IEEE 802.3af class maximum. This granular negotiation avoids over-reserving power budget on EX Series switches.

The RR preserves the Originator ID and adds its local cluster ID to the front of the Cluster List.

Junos configures the local router as a Candidate-RP under the [edit protocols pim candidate-rp] hierarchy level, where the RP address, priority and group ranges are defined for BSR advertisement. The BSR mechanism then propagates this candidacy to other PIM routers.

The exp classifier matches the MPLS experimental bits, the three-bit field in the label stack header used for QoS marking. Specifying exp lets the classifier inspect those bits directly, satisfying the requirement to classify traffic by MPLS EXP value rather than by IP DSCP or 802.1p.

PIM sparse-mode handles multicast routing between routers, but it does not process host IGMP membership reports. To learn about receivers on directly attached subnets, the router interface must have IGMP enabled for the appropriate version. Without IGMP on that interface, the router never builds the local membership state needed to trigger a PIM join toward the RP.

A forwarding class is an internal queue abstraction that groups packets sharing the same CoS treatment. Classifiers map traffic into forwarding classes, and schedulers then apply bandwidth and drop behaviour per class, controlling how each group is processed.

Junos permits one rewrite rule per type per logical interface, so a DSCP rule and an ieee-802.1 rule coexist without conflict. Remarking errors therefore stem from elsewhere, since these two rule types operate on different header fields simultaneously.

Junos separates routing information by protocol, so the protocol qualifier filters the routing table to only OSPF-learned prefixes. This directly satisfies the requirement to examine OSPF entries specifically, rather than the full inet.0 table containing connected, static and other protocol routes.

Sparse-mode builds distribution trees on demand: receivers send explicit PIM Join messages, either (*,G) towards the RP or (S,G) towards the source, and traffic only flows where joins exist. This pull-model join behaviour is fundamental to sparse-mode operation.

MACsec uses the Connectivity Association Key to authenticate peers and derive session keys, and both ends must negotiate the same cipher suite. Mismatched keys or ciphers cause the secure association to fail, so identical CAKs and matching suites are mandatory.

The command applies MD5 authentication directly under the OSPFv2 interface stanza, satisfying the requirement for cryptographic authentication on that specific interface. The key ID (1) and key string follow the `authentication md5` keyword, which Junos requires to generate the MD5 digest for OSPF hello and link-state packets.

The 'restrict' option prevents the summary LSA from being injected into the area.

LLDP-MED provides network policy advertisement, allowing IP phones to discover the voice VLAN.

Storm control is configured under the ethernet-switching family at the unit level, applying thresholds per logical interface. This placement lets the EX4300 rate-limit broadcast, multicast, and unknown unicast flooding on the access port before it overwhelms the link.

A drop-profile defines the drop behaviour applied by a scheduler, specifying drop probabilities at given buffer-occupancy thresholds. It controls when packets are discarded and in what proportion as queue depth rises, delivering weighted random early detection rather than simple tail drop.

Junos resolves an indirect BGP next hop by performing recursive route lookups, walking the routing table until it reaches a directly connected next hop learned via an active IGP or static route, which is the constraint the stem specifies.

The route reflector prepends its cluster ID to the Cluster List and inserts the originating client's router ID into the Originator ID attribute. Receiving peers detect their own cluster or originator in these attributes and discard the route, preventing iBGP loops.

Type 5 carries IP prefix reachability rather than MAC or host information, so it maps cleanly onto L3VPN semantics. Advertising tenant prefixes into an MPLS backbone and between subnets lets EVPN function as the control plane for routed inter-subnet traffic.

If the forwarding address in the external LSA is not reachable, OSPF will not install the route. The forwarding address is used to avoid extra hops, and if it cannot be resolved, the route is considered invalid. This is a common cause for external routes not being installed despite being in the LSDB.

Identical virtual gateway MAC and IP addresses on every leaf IRB interface create a distributed anycast gateway, so hosts retain one default gateway regardless of which VTEP they attach to. This satisfies the inter-subnet forwarding requirement by enabling seamless VM mobility and symmetric routing across leaf VTEPs.

LLDP-MED voice VLAN information travels in the network policy TLV, which is only emitted when a network policy is defined and mapped to the interface or device profile. LLDP frames transmit regardless, matching the observed symptom of no voice VLAN TLV.

A rib-group that imports routes from a VPN routing instance into inet.0 makes them part of the global table. If the BGP export policy then advertises them to the remote PE, they will appear as global Internet routes, causing the leak. This is a common misconfiguration when trying to share routes between instances.

A behavior aggregate classifier maps specific DSCP code points to forwarding classes and loss priorities in a single lookup. Defining entries for AF11, AF21, and AF31 lets the router classify each packet on ingress by its DSCP value alone, which is precisely what the customer requires for assured forwarding with distinct per-class treatment.

Aggregate level shaping caps the combined bandwidth consumed by every queue beneath that scheduler node, rather than policing individual queues. This satisfies the requirement to limit total traffic across all queues associated with the scheduler map on the MX Series interface.

Captive portal authentication is designed for devices that do not support 802.1X. When such a device connects, the switch redirects its HTTP/HTTPS traffic to a web portal where the user can enter credentials. After successful authentication, the device is granted network access. This matches the scenario of a user opening a browser and authenticating.

Displays VSTP status per VLAN.

`show igmp group` lists every multicast group with joined receivers, displaying the interface each membership was learned on. This directly satisfies the requirement to verify which groups have active receivers joined on an interface, since the output includes group address, interface, and membership state per entry.

MSDP is used between Anycast RPs to exchange source-active information so that receivers joined to one RP learn about sources registered to the other RP.

Once resolved, the forwarding plane programs the next hop with specific interface and adjacency details.

The 'show dot1x interface' command displays 802.1X supplicant state and authentication status per interface on EX Series switches. It directly satisfies the requirement to verify active supplicant states on a specific interface, unlike global dot1x commands that omit per-interface detail.

MAC limit features with action drop protect bridge domains from MAC flooding and unauthorized source MACs.

The RP first sends a PIM Join toward the source, building (S,G) state. Once the source tree is established and the RP starts receiving native multicast traffic, it sends a Register-Stop to the first-hop router. This transitions the source from the register encapsulation to native forwarding along the shortest-path tree, which is the correct PIM-SM behavior.

Correct. Dot1x is the default primary method when order is omitted.

`show poe interface` displays per-interface PoE state, allocated class, and measured power draw for every port on the EX2300, satisfying the requirement to check all connected IP phones across all interfaces simultaneously. It reports the exact operational fields the administrator needs without filtering to a single port.

This command correctly generates a Type 7 default LSA into the NSSA area with the specified metric.

VSTP is an enhancement of RSTP that runs per VLAN. It uses RSTP BPDU format but tags them with VLAN information, allowing interoperability with RSTP bridges. When a VSTP switch connects to an RSTP bridge, it can fall back to sending standard RSTP BPDUs for the native VLAN or use VLAN-tagged BPDUs. This compatibility ensures smooth integration in mixed environments, which is the correct behavior.

Consumption mode still reserves power at the class maximum before boot completes, because LLDP-MED or CDP power negotiation has not yet reported actual draw. With the static reservation table full, that initial allocation fails, so the switch denies power.

A single-rate two-color policer uses a token bucket with a committed burst size. Traffic can burst up to the burst size without being dropped, as long as the average rate does not exceed the committed information rate. The short periods of exceeding 100 Mbps are within the burst allowance, so packets are not dropped. This behavior is expected and matches the scenario.

The show multicast route command displays the multicast forwarding table, listing each (S,G) or (*,G) entry with its incoming interface and outgoing interface list. This directly satisfies the requirement to view OIL entries, unlike show route, which covers unicast routing only.

`set protocols igmp interface irb.10 version 3` explicitly sets the IGMP version to 3 on the IRB interface, satisfying the requirement to enable IGMPv3 processing on user-facing VLAN interfaces. Junos defaults to IGMPv2, so the version statement is mandatory to activate v3 source-specific multicast behaviour on irb.10.

A two-color policer classifies each packet against a single rate and burst threshold, marking it either green (within the committed rate, forwarded) or red (exceeding it, discarded or re-marked). No yellow state exists without a three-color policer.

transmit-rate sets the assured bandwidth a scheduler guarantees to its queue, expressed as an absolute rate or percentage. It is a valid scheduler parameter, defining the minimum throughput allocated to traffic mapped to that forwarding class.

Route Type 2 carries the MAC/IP Advertisement, binding a host MAC to its IP address and forwarding context. Type 1 advertises Ethernet Auto-Discovery, Type 3 carries Inclusive Multicast, and Type 4 handles Ethernet Segment routes, so Type 2 uniquely satisfies the MAC-plus-IP requirement.

The MAC Mobility Extended Community carries a sequence number that increments each time a host moves between provider edge routers, letting all PEs order movements and suppress stale or looping advertisements. This delivers the loop-free MAC movement tracking the stem describes.

MSDP relies on TCP connections over port 639, so blocking this port prevents session establishment.

On authentication failure, the port is moved into the configured guest VLAN, giving the supplicant restricted network access rather than dropping the connection entirely. This satisfies the stem's guest VLAN requirement, since the EX Series switch reassigns the interface to that VLAN and re-initiates authentication when the supplicant retries.

In a distributed gateway, all leaf switches that participate in the same subnet use a common virtual MAC address for the anycast gateway. This allows hosts to use the same default gateway IP and MAC regardless of which leaf they are attached to. When a host sends traffic to the gateway, it is handled locally by the attached leaf, providing optimal routing and avoiding tromboning. This is a fundamental characteristic of anycast gateway.

The transmit-rate 10m configuration sets a guaranteed minimum bandwidth of 10 Mbps for the best-effort queue. When other queues are idle, the scheduler allows this queue to use additional bandwidth up to the interface capacity or the shaping rate, satisfying the requirement to allow bursting. This is the correct way to provide a guaranteed rate with excess sharing.

Type 1 routes carry the Ethernet Segment Identifier and can be advertised per-EVI or per-Ethernet Segment, satisfying the stem's requirement for valid EVPN auto-discovery behaviour. Per-ES advertisement supports multihoming split-horizon and designated-forwarder election, while per-EVI advertisement applies to single-homed access, so both granularities are legitimate.

This command displays detailed information about Ethernet segments, including the DF election state, the designated forwarder, and the backup forwarder. It is essential for troubleshooting DF election issues because it shows which PE is elected as DF for each Ethernet segment and the reason for the election result. This directly addresses the scenario's need to verify DF state.

Captive portal interception works by hijacking plaintext HTTP requests and returning a redirect. HTTPS is encrypted end-to-end, so the switch cannot read or rewrite the request; presenting its own certificate triggers a mismatch warning or silent timeout in the browser.

CLUSTER_LIST is the BGP path attribute specifically designed to prevent loops within a route reflection cluster. When a route reflector reflects a route, it prepends its cluster ID. If a route reflector receives a route whose CLUSTER_LIST already contains its own cluster ID, it discards the route, preventing loops and duplicate advertisements among redundant route reflectors in the same cluster.