Juniper Networks Enterprise Routing and Switching, Professional (JNCIP-ENT, JN0-650) (JNCIP-ENT) (JNCIP-ENT) — Questions 76–150

A strict-high queue is serviced first, but its effective rate can still be constrained by an interface-level shaper or by other strict-high queues competing for the same bandwidth. If the interface shaper or another strict-high queue consumes the available bandwidth, voice packets can be delayed even though the queue is marked strict-high.

A DSCP rewrite rule contains a table keyed by forwarding class and loss priority. Packets whose forwarding class and loss priority do not appear in that table are not rewritten and retain their original DSCP, which explains why some packets still leave with their original values on the WAN interface.

In multi-supplicant mode, 802.1X authenticates each supplicant independently, and the RADIUS Access-Accept can return a VLAN attribute per client. The switch then assigns each authenticated client to its own dynamic VLAN on the same port.

Junos defaults redistributed routes entering OSPF to external metric-type 2 with a cost of 1, so the route is advertised without accumulating internal OSPF link costs. Type 1 would add internal costs, which is not the default behaviour.

This command correctly configures an interface as an RSTP edge port. Edge ports are connected to end devices and do not receive BPDUs. They transition directly to forwarding state, bypassing the listening and learning states, which speeds up convergence when a device is connected.

In a Virtual Chassis, two members are elected as Master and Backup Routing Engines, running the control and management planes, while the remaining eight switches operate as line cards forwarding traffic. This centralised RE model provides the failover resilience required.

Type-7 LSAs are specifically designed for NSSAs to originate external routes without accepting Type-5 LSAs from the backbone.

The protocols bgp group hierarchy defines a named peer group, letting common BGP parameters and policies be applied once to many neighbours. This satisfies the stem's requirement to simplify neighbour configuration through a single reusable group definition.

Reducing `supp-timeout` and `max-retries` shortens the 802.1X EAPOL retransmission window before fallback triggers. The delay stems from the switch waiting through the full supplicant timeout multiplied by retry count; lowering both parameters accelerates the transition to MAC RADIUS authentication for non-802.1X clients.

The graph maps drop probability versus fill level percentage.

This statement enables OSPFv3 on the specified interface and associates it with area 0. OSPFv3 is configured under the [edit protocols ospf3] hierarchy in Junos OS. Without this interface-level configuration, OSPFv3 will not run on the interface, even if IPv6 is enabled. This is the correct and required step to activate OSPFv3 on an interface.

A source-specific join must follow the unicast route to the source, which points out a different interface than the RP path. PIM must be enabled on that outgoing interface for the router to send the (S,G) join and receive the source traffic. Without PIM on that interface, the source tree cannot be built, so enabling it resolves the delivery failure.

The voice-vlan statement on an access port makes Junos treat the port as untagged for data in the native VLAN while recognising 802.1Q-tagged frames for the voice VLAN ID, delivering simultaneous segregation without trunk configuration.

Route reflection follows client and non-client roles: a route learned from a non-client IBGP peer is reflected only to client peers, never to other non-clients. This prevents the non-client-to-non-client advertisement that full-mesh IBGP would otherwise require.

`show pim rps` displays the RP set that PIM has learned, including entries sourced via BSR, with their group ranges, priority and holdtime. It directly satisfies the stem's requirement to verify the currently learned BSR RP on the Junos device, unlike commands showing interface or neighbour state.

The 'show evpn database' command on MX Series displays MAC addresses learned through both the EVPN control plane (Type 2 routes) and the data plane, across every bridge domain, satisfying the requirement to view local and remote entries together.

The shaping-rate statement on a scheduler enforces a maximum transmission rate for a queue, effectively capping how much bandwidth it can consume. Applying shaping-rate to the strict-high voice queue limits its usage so it cannot starve other queues, which directly addresses the requirement to cap the voice queue while preserving its priority treatment.

The EXP classifier maps MPLS Experimental bits to forwarding classes and packet-loss priorities, satisfying the stem's requirement for natively supported Junos CoS classifiers. Junos supports exp, inet-precedence, and dscp classifiers; exp specifically handles MPLS label headers, unlike dscp or inet-precedence, which read IP header fields.

Policers enforce a rate limit and mark or drop excess traffic. Binding a firewall filter containing a policer to the loopback interface as an input filter applies the rate limit to traffic destined to the Routing Engine, which is exactly the control-plane protection described. This is the standard Junos approach for protecting the RE.

The Ethernet Segment Identifier uniquely identifies the attachment circuit to the Ethernet segment, and all PE routers multi-homing that segment must share the same ESI value. This satisfies the requirement for a unique identifier in all-active EVPN multi-homing.

Exceeding the MAC limit triggers the configured action, typically dropping new source MACs and logging.

Junos OS sets the OSPF reference bandwidth to 100 Mbps by default, so any interface at or above that speed receives a cost of 1. Administrators must raise this value on faster links to preserve meaningful cost differentiation.

The LLDP-MED Capabilities TLV is mandatory for LLDP-MED operation and advertises supported media features, letting the switch classify a device as a media endpoint rather than an infrastructure node. It satisfies the requirement to distinguish endpoints from standard switches and routers.

Setting a high bridge priority (61440) ensures the access switch will not become the root bridge for any VLAN. Configuring the uplink port with a lower path cost makes it the preferred path for forwarding traffic toward the distribution switch. This combination achieves both goals: preventing the access switch from becoming root and ensuring the uplink is used for forwarding.

OSPFv3 is configured under protocols ospf3.

IGMP must be enabled on the interface facing the receivers so the router can send general queries and process membership reports. The version must match the receivers, since IGMPv2 and IGMPv3 report formats differ and mismatch causes memberships to be ignored. This directly satisfies the requirement to query and track memberships on VLAN 200.

Virtual Chassis collapses multiple switches into one logical device with a single control plane, so inter-member links are treated as internal fabric rather than bridged segments. Loop-free forwarding is achieved without Spanning Tree blocking any port.

Snooping builds a per-VLAN group membership table from IGMP reports, so multicast is forwarded only to interested ports rather than every port. That filtering of unwanted streams conserves bandwidth on switch links, satisfying the stated benefit.

The 'show interfaces vtep' command displays the status of the virtual tunnel endpoint interface, including its operational state, encapsulation, and associated VXLAN network identifiers. It helps verify that the VTEP is up and properly configured. If the VTEP is down, VXLAN tunnels cannot be established, preventing traffic forwarding even if EVPN routes are present. This command is essential for diagnosing data plane issues in EVPN-VXLAN.

OSPF designated router election is decided first by interface priority, then router ID. Setting priority 200 on the interface raises it above the default 128, ensuring this router wins the DR election within area 0.0.0.0.

Link Layer Discovery Protocol – Media Endpoint Discovery extends IEEE 802.1AB LLDP with TIA-1057 TLVs, enabling automatic VLAN assignment, PoE negotiation and E911 location data for IP phones. This satisfies the stem's IP telephony context, where media endpoint discovery beyond standard LLDP is required.

232.0.0.0/8 is the IPv4 block RFC 4607 reserves for Source-Specific Multicast, satisfying the stem's requirement for the standard SSM range. SSM delivers traffic only from explicitly requested sources, so receivers use IGMPv3 or MLDv2 to specify both group and source, unlike ASM's shared 224.0.0.0/4 space.

A stub area blocks Type-5 external LSAs at its boundary, so internal routers hold smaller link-state databases. The ABR instead injects a default route, giving stub routers reachability to external destinations without carrying external prefixes.

MSTP region membership requires identical region name, revision number and VLAN-to-instance mapping on every switch. If any of these three parameters differs, the switch belongs to a separate region, so matching all three preserves the strict region boundaries the administrator needs.

Defining the community under policy-options with the members statement creates a named community object holding the value 65000:100, which policy terms can then match or apply to BGP routes. This satisfies the stem's requirement for a correctly named community using the Junos policy framework.

Route Type 5 carries IP prefix routes, enabling inter-subnet forwarding between IP-VRFs across the EVPN fabric. Unlike Types 2 and 3, which advertise MAC/IP and inclusive multicast respectively, Type 5 satisfies the stem's requirement for IP prefix reachability in an IP-VRF-to-EVPN integration.

The 'translator-role never' command disables the NSSA ABR from performing Type-7 to Type-5 translation.

In anycast RP, MSDP peering between the RP instances synchronizes active source information. After Router B reloads, the source's first-hop router re-registers with B, which rebuilds (S,G) state and sends Source-Active messages to its MSDP peer Router A. Router A can then join toward the source, restoring delivery to receivers attached to it.

For switches to be in the same MSTP region, they must have the same region name, revision level, and VLAN-to-MSTI mapping. If the region name differs, the switches will consider themselves in different regions and will not form a single MSTP region, potentially causing loops or suboptimal paths. Therefore, ensuring identical region names is critical for proper MSTP operation.

This operational command displays the 802.1X authenticator state for the interface, including EAPOL counters, the current role, and whether the port is in authenticated or held state. It helps determine whether the switch is sending EAPOL frames and waiting for supplicant responses, which matches the symptom of EAPOL starting but no RADIUS request being generated.

LLDP-MED conveys the voice VLAN through a network policy TLV, so an LLDP-MED network policy defining VLAN 50 must exist and be applied to the interface. Without it, no policy is advertised and the phone cannot discover the voice VLAN, satisfying the stem's discovery requirement.

For the switch to apply a filter based on the RADIUS Filter-Id attribute, the filter must exist in the Junos configuration and be associated with the 802.1X authentication process. The authenticator interface configuration or access profile must reference the filter, allowing the switch to map the returned Filter-Id to the locally defined filter and apply it to the supplicant's traffic.

Tunnel-Medium-Type (Attribute 65) defines the link-layer transport of the tunnel, using values such as 802 for Ethernet, and must accompany Tunnel-Type and Tunnel-Private-Group-ID for dynamic VLAN assignment. On EX Series switches, this triple lets the RADIUS server direct the supplicant into the correct VLAN after 802.1X succeeds.

Confederation member ASNs are encapsulated in AS_CONFED segments and stripped at the outer boundary.

The MSTP configuration digest is a hash of the region's configuration attributes, and the MST configuration name is one of the three hashed parameters. Switches must share identical values for these parameters to belong to the same MST region.

BGP routing policies can set or modify local preference on incoming IBGP routes, influencing outbound path selection within the local autonomous system. This satisfies the stated action, since local preference is a well-known BGP attribute adjustable via policy.

OSPF requires that the hello and dead intervals match on both routers for an adjacency to form. In this scenario, R1 has hello 10 and dead 40, while R2 has hello 30 and dead 120. Changing R1 to match R2's timers will allow the routers to establish the adjacency. This is a common configuration requirement in OSPF.

BPDU protection (also known as BPDU guard) is designed for edge ports that should not receive BPDUs. When enabled, if a BPDU is received on that port, the port is immediately disabled (err-disabled) to prevent loops. This is the correct feature for the scenario because it directly addresses unauthorized BPDUs on access ports and takes protective action.

Local Preference is a well-known discretionary attribute propagated only across IBGP sessions within an autonomous system; it is not advertised to EBGP peers. This satisfies the stem by confirming that IBGP peers alone evaluate and exchange the attribute.

BGP multipath requires that the paths have equal MED values. By using a routing policy to set the MED to the same value on both paths, and enabling multipath under BGP, the router can install both paths for load balancing. This is the correct approach.

Drop discards frames from additional MAC addresses once the configured limit is exceeded, while permitting existing learned addresses to continue forwarding. Juniper offers this as the less disruptive action compared with shutting the interface down.

In all-active multi-homing, the DF election determines which PE forwards BUM traffic to the multi-homed device. Type 4 routes carry the Ethernet Segment Identifier (ESI) and are used in the DF election process. The elected DF is responsible for forwarding BUM traffic, while all PEs can forward known unicast traffic based on locally learned MAC addresses or Type 2 routes.

Type 4 ASBR Summary LSAs advertise the route to an ASBR and are flooded by the ABR into normal stub areas. Totally stubby areas block them, alongside Type 3 and Type 5, leaving only intra-area routes and a default.

A Junos drop profile is a table of queue fill-level percentages mapped to drop probabilities. As the average queue depth crosses each configured fill level, the associated probability determines the likelihood that an arriving packet is discarded. This is the core mechanism that makes WRED gradual rather than a hard tail drop, and it is exactly what must be verified when tuning congestion behaviour.

A behaviour aggregate classifier inspects only the CoS marking already present in the packet header — DSCP for IP or EXP for MPLS — and maps it to a forwarding class and loss priority, without any multifield inspection of source, destination or port.

BSR operation is enabled under the [edit protocols pim bsr] hierarchy, where the local router is configured as candidate BSR with priority and as candidate rendezvous point. This satisfies the requirement for PIM sparse-mode bootstrap election.

Junos policers support actions beyond discard: they can set the packet's loss priority (for example, to high) on traffic exceeding the configured rate. This satisfies the statement's claim, letting downstream congestion controls drop marked packets preferentially.

The phone acts as a Layer 2 pass-through for the attached PC. PC frames remain untagged and are forwarded into the port's native VLAN, while the phone's own voice frames carry an 802.1Q tag, keeping data and voice traffic logically separated.

Sham-links use /32 source and destination addresses inside the VPN routing instance.

The `drop-profile-map` statement inside a scheduler maps each loss priority (low, medium-low, high) to a specific drop profile, satisfying the requirement to assign three distinct profiles within one forwarding class. Junos uses this hierarchy under the scheduler's `drop-profile-map` to bind PLP values to profiles.

VSTP (VLAN Spanning Tree Protocol) is a Juniper feature that runs a separate RSTP instance for each VLAN. This provides per-VLAN spanning-tree topologies, allowing independent convergence and load balancing. It is the correct choice because it combines the rapid convergence of RSTP with per-VLAN instances, exactly matching the requirement.

The supplicant timeout timer governs the interval the authenticator waits for an EAP-Response/Identity from the supplicant before retransmitting the EAP-Request/Identity. This satisfies the stem's constraint on default 802.1X timer behaviour, since the switch acts as authenticator and retransmits to the supplicant when no reply arrives.

VSTP maps each VLAN to a separate spanning-tree instance using IEEE 802.1Q BPDUs, and Juniper implements compatibility with Cisco's PVST+ so the two can share a topology. This interoperability lets EX Series switches participate in mixed-vendor Layer 2 networks.

A transmit-rate guarantees the critical queue its minimum share during congestion, while a shaping-rate caps the guest queue's maximum throughput at 200 Mbps regardless of idle capacity. Together they satisfy both the guaranteed-minimum and maximum-limit requirements on the congested uplink interface.

Custom forwarding classes are defined under the [edit class-of-service forwarding-classes] hierarchy, where each class is mapped to a queue number. This stanza lets you name and assign up to eight classes, satisfying the requirement to define them explicitly rather than rely on default best-effort, expedited, assured and network-control classes.

Because stacked tags add overhead (an extra 4 bytes per tag), core link MTU must be increased to prevent frame fragmentation or drops.

Assigning a guaranteed transmit-rate ensures the network control class always has bandwidth reserved, while high priority causes it to be serviced ahead of lower-priority data queues. Together they protect routing protocol updates during congestion without the starvation risk of strict-high priority. This is the recommended approach for the network control forwarding class.

The export policy's metric action assigns the OSPF external metric carried in the AS-external LSA when redistributing routes into OSPF. This satisfies the stem's requirement, letting the filter control the advertised cost of redistributed routes rather than relying on defaults.

Voice VLAN allows the switch to automatically place voice traffic into a specified VLAN and apply a priority. Configuring the voice VLAN as 100 with priority 5 and data VLAN as 200 on the access port meets the requirement, as the phone will tag voice packets with the appropriate VLAN and priority.

232.0.0.0/8 is the IANA-designated SSM range, letting receivers specify both source and group in IGMPv3 or MLDv2 joins. This satisfies the stem's requirement for the standard SSM block, unlike the ASM ranges 224.0.0.0/4 or the administratively scoped 239.0.0.0/8.

AS_CONFED_SEQUENCE is a BGP attribute used within a confederation to record the sub-AS numbers that a route has traversed. It functions similarly to AS_PATH but is only used within the confederation. When a route leaves the confederation, the AS_CONFED_SEQUENCE is removed and replaced with the confederation identifier in the AS_PATH. This attribute prevents loops within the confederation by allowing routers to detect if a route has already passed through their sub-AS.

A walled garden or bypass list lets unauthenticated clients reach specified IP addresses before captive portal authentication completes, satisfying the requirement for pre-authentication access to permitted resources. Traffic to all other destinations remains intercepted and redirected to the portal, so granular exceptions are enforced without granting full network access prematurely.

Cryptographic authentication prevents unauthorized routers from forming adjacencies.

This command displays bootstrap messages received, elected BSR address, and candidate RP information.

In 'consumption' mode, the switch allocates power based on the actual power consumption of the device, measured in real time. This allows more efficient use of the power budget, as devices that draw less than their class maximum free up power for other ports. It is ideal for PoE+ phones with varying power needs.