Juniper Networks Enterprise Routing and Switching, Professional (JNCIP-ENT, JN0-650) (JNCIP-ENT) (JNCIP-ENT) — Questions 151–225

MSTP breaks an identical bridge-priority tie by comparing the bridge MAC address, and the numerically lowest value wins the regional root election. This satisfies the stem's constraint: two switches share equal priorities, so the deterministic lowest-MAC comparison elects one regional root and prevents a loop.

Type 3 routes advertise the VTEP IP address and are used for BUM traffic replication. They include the originating VTEP's IP address and the VNI, allowing remote VTEPs to build a multicast or ingress replication list. This enables VXLAN tunnels to be established for BUM traffic, which is essential in an EVPN-VXLAN fabric.

Bridge assurance ensures that switches actively send BPDUs on all point-to-point operational ports, preventing loops caused by unidirectional link failures.

The server-timeout value sets the interval the switch waits for a RADIUS reply before declaring that server unresponsive and moving to the next configured server. This satisfies the failover requirement: a slow or dead RADIUS server cannot stall authentication indefinitely, because the switch retries the next server once the timeout expires.

On Junos EX switches, PoE ports default to low priority when no explicit priority is set. Under constrained power budgets, allocation follows port index order, so ge-0/0/0 would need an explicit high priority to be prioritised for the emergency IP phone.

The 'family evpn signaling' configuration under the BGP neighbor enables the EVPN address family, allowing the routers to exchange EVPN routes. This is the correct and required configuration for EVPN-VXLAN fabrics. Without it, BGP will not negotiate the EVPN capability, and no EVPN routes will be exchanged, breaking the control plane for MAC and IP reachability.

For traffic to be forwarded to a remote VTEP, a VXLAN tunnel must be established. This requires receiving the remote VTEP's Type-3 route. If the Type-3 route is missing, the local VTEP will not have a tunnel to the remote VTEP, and traffic will be dropped even if the MAC address is known via Type-2. This is the most likely cause.

Junos displays each OSPF neighbour's router ID, interface and state (Init, 2-Way, ExStart, Exchange, Loading, Full) via this operational command, directly satisfying the stem's requirement to verify adjacency progress and confirm whether routers reached the Full state.

Junos configures MSDP TCP MD5 authentication under the peer hierarchy using authentication-key, which applies the key to the TCP session with that specific peer. This satisfies the requirement to secure the MSDP peer relationship's TCP session.

For captive portal to function, the captive portal profile must be applied to the interface using the 'captive-portal' statement under the interface configuration. Without this, the switch does not intercept HTTP requests or redirect users, allowing them to bypass authentication.

The 'show pim join' command displays PIM join state and confirms the upstream RPF neighbor toward the source or RP.

Assigning high PoE priority to critical IP phone ports ensures the switch sheds lower-priority powered devices first when demand exceeds the EX4300's power budget, keeping phones online during the deficit. This directly mitigates the shortfall by controlling which ports lose power, rather than reducing total consumption.

Type 2 EVPN routes distribute MAC addresses through the control plane, so the ingress PE already knows the destination MAC and forwards as known unicast. This control-plane learning removes the need to flood unknown unicast across the core for multi-homed hosts.

During ExStart, OSPF routers negotiate the master/slave relationship and exchange database description packets. If the interface MTU values differ, the routers cannot agree on the initial sequence number and the adjacency stalls in ExStart. This is a common cause and is resolved by matching the MTU on both interfaces or using the 'ignore-mtu' configuration.

IGMPv2 introduces a querier election process, where routers on the same subnet exchange queries and the lowest IP address wins, becoming the sole querier. IGMPv1 has no such election, relying instead on the multicast routing protocol (PIM) to designate the querier, so this feature directly satisfies the comparison the stem requests.

MBGP carries separate unicast and multicast Network Layer Reachability Information, letting RPF checks follow a distinct multicast topology rather than mirroring the unicast path. This satisfies the stem's requirement that multicast routing diverge from unicast routing, which plain BGP cannot achieve since it advertises only one reachability set.

Type 2 routes populate the control plane, but forwarding requires a valid VNI-to-tunnel mapping and resolvable next hop. If that mapping or resolution is incomplete, the route appears in bgp.evpn.0 yet traffic cannot be encapsulated, explaining the data-plane drop despite control-plane presence.

The guest VLAN feature assigns unauthenticated or failed supplicants to a designated VLAN, providing limited network access. It is the mechanism that places failed clients into a restricted segment where they can reach remediation resources. Without configuring a guest VLAN, failed authentication typically results in the port being held or blocked without VLAN reassignment.

The EXP field is the three-bit MPLS header field that Junos rewrite rules can mark, satisfying the requirement for valid CoS rewrite targets. Rewrite rules map forwarding classes to EXP bits on egress label-switched interfaces, so exp qualifies alongside inet-precedence and dscp as a supported header marker.

DHCP snooping designates trusted ports and filters rogue DHCP server replies, blocking an attacker from handing out a malicious default gateway. This directly prevents DHCP spoofing on Layer 2 access ports, satisfying the scenario's first requirement.

The `show class-of-service scheduler-map` command lists every configured scheduler map alongside its forwarding-class associations, satisfying the requirement to display both mappings together. Unlike `show class-of-service scheduler-map <name>`, which requires a specific map name, this form enumerates all maps, directly answering the stem's request for configured scheduler maps and their forwarding-class associations.

Route targets are extended communities attached to EVPN routes, determining which VRFs import or export them. Configuring matching import and export targets on each PE establishes the routing-instance-level reachability required for EVPN route exchange across the peer session.

The 'show route resolution' command displays how the routing table resolves next hops, including unresolved BGP next hops and their underlying IGP or static routes. This directly satisfies the need to troubleshoot why the BGP next hop is not being resolved.

Prepending repeats the local AS number in the AS path, lengthening it so remote BGP speakers applying shortest-path selection deprioritise this route. This satisfies the stated objective of making the path less preferred for inbound traffic from the external provider.

The 'Disabled' status in the PoE output indicates that PoE is administratively disabled on that interface. This can be set with 'set poe interface ge-0/0/10 disable'. Even if the interface is up and LLDP works, PoE will not be supplied until it is enabled. This is a common oversight when PoE is disabled per port for security or power-saving reasons.

The vlan-map is applied at the logical interface unit level, where input and output maps rewrite or push VLAN tags. Configuring it there lets customer tag 100 be encapsulated with the outer service provider tag 3000, achieving Q-in-Q tunnelling on the MX Series.

External peers receive routes with only the confederation's top-level AS number in the AS path; sub-AS numbers are stripped when advertisements cross the confederation boundary. This satisfies the stem's constraint that outside peers remain unaware of internal sub-AS structure, preserving standard eBGP behaviour without requiring reconfiguration on external routers.

`show msdp source-active` directly queries the MSDP SA cache, listing active sources and their originating PIM domains. This satisfies the requirement to verify which sources are currently active across domains, since the SA cache is precisely the repository MSDP populates from SA messages. Other MSDP commands display peer or statistics data, not cached source entries.

The show class-of-service interface command displays the CoS configuration applied to a specific interface, including the classifier, rewrite rule, scheduler map, and the forwarding class to queue mapping. This directly provides the information the administrator needs to verify how forwarding classes map to queues on the interface in question.

EVPN Route Type 3 carries the Inclusive Multicast Ethernet Tag route, advertising each PE's participation in a broadcast domain. Receiving PEs build the ingress replication list from these advertisements, enabling BUM traffic delivery without multicast underlay support.

Junos uses the three-part format for defining large communities.

Under a Junos access profile, radius-server-group binds the profile to a named RADIUS server group, satisfying the requirement for a configurable authentication parameter. The access profile references this group so 802.1X supplicants are authenticated against the specified RADIUS servers, making it a valid configurable option.

The well-known no-export community prevents a route from being advertised beyond the local autonomous system, including to confederation peers. It is transitive, so it propagates between internal BGP speakers while still blocking external advertisement, matching the stem's constraint.

Junos sets the OSPF reference bandwidth under the [edit protocols ospf] hierarchy, so the global command is set protocols ospf reference-bandwidth 10g. This raises the baseline used for cost calculation, giving accurate metrics for high-speed interfaces.

Shaping delays packets rather than dropping them, so it must be applied where the device controls transmission scheduling. Egress interfaces allow the router to queue and meter outbound traffic, whereas ingress shaping is impractical because the upstream sender controls the rate.

L2PT encapsulates customer Layer 2 protocol frames, including BPDUs, and forwards them transparently across the provider core, so provider VSTP/MSTP instances never process them. This satisfies the requirement that customer BPDUs traverse the Q-in-Q tunnel untouched.

MSDP peering requires loopback addresses to match on both peers and a TCP session on port 639, with MBGP carrying the multicast routes that resolve the RPF check. That combination enables inter-AS source discovery across autonomous systems running BGP.

The 'priority' statement under the OSPF interface sets the DR election priority. A higher priority increases the likelihood of becoming the DR. Setting it to 100 (the maximum is 255) makes this router more likely to be elected DR than routers with lower priorities. This is the correct way to influence the DR election on a Junos device.

Junos hashes selected packet header fields, such as source and destination addresses, to produce an index into the set of resolved BGP next hops. This satisfies the equal-cost forwarding requirement by distributing traffic across the multiple paths rather than pinning one interface.

VLAN action rules define whether the provider edge pushes, pops or swaps tags as frames traverse the tunnel. Aligning these operations on both sides preserves the customer's inner VLAN while adding the service tag, which is the core mechanism of Q-in-Q forwarding.

L2PT encapsulates customer Layer 2 protocol frames, such as STP BPDUs, and forwards them across the provider core as data, preventing provider bridges from processing or blocking them. This preserves the customer's control-plane topology transparently through the QinQ tunnel.

`show class-of-service interface` displays per-interface forwarding-class-to-queue mappings, scheduler associations and queue counters, directly satisfying the stem's requirement to verify operational state on a specific interface. Unlike CoS configuration output, it reports live queue assignment and statistics, confirming that classification and scheduling behave as intended.

Within a confederation, routes crossing member AS boundaries carry AS_CONFED_SEQUENCE segments rather than ordinary AS_SEQUENCE entries. Member numbers 65001 and 65002 are recorded there and are not counted as external AS hops, so loop detection and path length treat the confederation as one AS.

Session-Timeout (Attribute 27) carries the maximum session duration in seconds, which the EX Series switch enforces by terminating the 802.1X client session once the value elapses. This directly satisfies the stem's requirement to assign a specific session timeout per authenticated client, rather than relying on switch-local defaults.

In PIM sparse-mode, the first-hop router (FHR) adjacent to the source must have PIM enabled on the source-facing interface and a unicast route toward the RP so it can send PIM Register messages encapsulating the source traffic. If the migrated subnet touches a router without PIM on that interface, the source never registers and receivers on the shared tree receive nothing.

server-fail keep is designed to maintain previously authenticated sessions on the port when the RADIUS server becomes unreachable. New supplicants are denied access because no authentication decision can be made. This exactly matches the security team's requirement of preserving existing access while blocking new endpoints during a RADIUS outage.

A rewrite rule is used to mark CoS bits on outgoing packets. To mark expedited-forwarding packets with DSCP EF (46), you configure a DSCP rewrite rule that maps the expedited-forwarding forwarding class to code point 46, and then apply that rewrite rule to the egress interface. This is the correct configuration.

The LLDP-MED network policy TLV carries the VLAN ID, identifying the voice VLAN that the endpoint must tag its traffic with. This satisfies the voice application policy requirement by directing the phone to the correct Layer 2 segment.

Port priority (low, high, critical) is configurable per interface under PoE settings, letting administrators rank power allocation when the switch's budget is exhausted. Critical interfaces receive power first, then high, then low, satisfying the stem's requirement for explicitly manageable per-interface PoE parameters on EX Series switches.

A policer's discard action drops excess traffic immediately at the interface, enforcing the committed rate without buffering. This satisfies the stem's requirement for actions triggered when traffic exceeds the specified rate, since discarding is one of the three standard policer outcomes alongside rate-limiting and marking.

VLAN swap replaces the incoming inner VLAN tag with a different tag before the frame is forwarded into the provider core, preserving the outer tag. This matches the stem's description of substituting the inner tag, distinguishing it from push, pop, or translate operations on the MX Series.

Network policy TLVs include Layer 2 priority (802.1p) and DSCP values, enabling the phone to mark voice traffic appropriately for QoS. This ensures that voice packets are prioritized across the network. These parameters are essential for maintaining voice quality in congested networks.

The DF is responsible for sending BUM traffic down to the attached customer site.

ORIGINATOR_ID is set by the first route reflector to the router ID of the iBGP speaker that injected the route into the AS. When the route is reflected back to that originating client, the client sees its own router ID in the ORIGINATOR_ID attribute and rejects the route, preventing a loop. This is the standard BGP route reflection loop-prevention mechanism defined in RFC 4456.

To exchange EVPN routes, BGP must be configured with the evpn signaling address family. This enables the PE routers to negotiate and exchange EVPN NLRIs. Without this configuration, BGP will not carry EVPN routes, and the fabric cannot learn remote MAC or IP addresses. This is a fundamental requirement for EVPN signaling in Junos.

Junos BGP multipath requires equal IGP metrics to each BGP next hop; differing interior costs make paths ineligible as candidates. This condition ensures traffic is distributed across next hops reachable at equivalent cost, satisfying the stem's multipath requirement.

Junos applies export policy after the route selection process has installed the best path in the routing table, so as-path prepend and community matching only affect what is advertised to the peer, never the local decision.

Configuring priority high on the voice forwarding class places it in a strict-priority queue, which is serviced before all other queues until empty. This satisfies the stem's requirement that delay-sensitive voice traffic be serviced ahead of every other queue.

A captive portal profile is mandatory because it defines the redirect URL, authentication parameters and session behaviour applied to unauthenticated clients. Without it, the switch has no policy to intercept HTTP requests and present the login page.

LLDP-MED network policy TLVs let the switch push VLAN ID, 802.1p priority and DSCP values to attached endpoints, so voice, video and guest traffic land in the correct VLAN automatically. This is the policy automation behaviour Junos EX Series implements for media endpoints.

A policer with a discard action discards non-conforming packets at ingress, which matches the observed immediate loss. To remark excess traffic and let the egress drop profile handle selective discarding, the policer must use loss-priority high or a similar remark action. Checking the policer action is therefore the correct first step in diagnosing this behaviour.

The interface-level 'cost' statement under the OSPF area hierarchy sets the metric advertised for that interface, directly influencing shortest-path calculation. This satisfies the requirement to adjust OSPF cost on a specific interface to manipulate path selection.

Discard or reject resolving routes invalidate BGP next-hop resolution.

MSDP peers establish a TCP session on port 639, so the peer addresses must be reachable through the unicast routing table rather than the Anycast RP address itself. This satisfies the stem's core requirement: each router needs a unique, routable loopback for the MSDP session, distinct from the shared Anycast address.

Standard iBGP full-mesh rules apply between non-client peers; a route reflector reflects routes from clients to all clients and non-clients, and from non-clients to clients only.

EVPN routing instances are declared under the routing-instances hierarchy, where the instance-type statement set to evpn activates EVPN address families and enables the corresponding BGP and VXLAN signalling. This is the exact hierarchy Junos requires for an EVPN instance.

OSPFv3 runs as a separate routing process, so Junos uses the `protocols ospf3` hierarchy rather than `protocols ospf` with an address family. Assigning the interface under `area 0.0.0.0` enables OSPFv3 on that interface, satisfying the stem's requirement for the OSPFv3 address-family hierarchy.

show route table bgp.evpn.0 displays the BGP EVPN routing table, including route types and next hops, confirming which EVPN routes were received and installed. This satisfies the stem's requirement for essential diagnostic information about EVPN routing tables in Junos OS.

A BA classifier maps a single CoS field such as DSCP, IP precedence, or MPLS EXP into a forwarding class and loss priority without examining other packet fields. Because the requirement is to classify solely on the DSCP bits in the IP header with no firewall filter, the BA classifier applied to the ingress interface is exactly the right tool.

In class-based mode, the switch reserves power for each device according to the PoE class it reports during detection and classification, using the class maximum rather than actual consumption. That makes the budget predictable, but it can leave unused headroom, because many phones in Class 3 draw much less than 15.4 W. 'show poe controller' shows the mode, total budget and power in use.

RADIUS Filter-Id attributes reference filter names, but Junos applies only filters already configured and committed locally. The VLAN name resolved because it existed; the missing filters were never defined on the switch, so nothing could be attached.

In All-Active multihoming, the DF election per Ethernet segment ensures that only one PE (the DF) forwards BUM traffic to the multihomed device, preventing duplicate packets. However, known unicast traffic can be forwarded by any PE that has the MAC address in its EVPN table, allowing load balancing. This is the correct behavior for EVPN All-Active multihoming on Junos.

Route Type 5 carries IP prefix routes, allowing the data centre gateway to translate between EVPN and the IP-VRF MPLS L3VPN backbone. Types 2 and 3 advertise MAC or MAC/IP bindings and inclusive multicast, which cannot convey prefix reachability across the two domains.

MSDP peer relationships are configured under the [edit protocols msdp] hierarchy, where you define each peer with its address and optional parameters such as local address and authentication. This satisfies the stem's requirement to share active source information between the two autonomous system border routers.

With distributed gateway IRB, every leaf terminates inter-subnet traffic locally using a shared virtual MAC and IP address as the default gateway. This symmetric, anycast-style design avoids tromboning traffic to a centralised gateway, reducing latency and improving forwarding efficiency across the EVPN-VXLAN fabric.