CCNA Ethernet Switching And Spanning Tree Questions

In a private VLAN, isolated ports can communicate only with promiscuous ports, not with each other. Assigning customer ports to the isolated VLAN enforces host isolation while still allowing traffic through the shared promiscuous gateway.

MACsec uses the Connectivity Association Key to authenticate peers and derive session keys, and both ends must negotiate the same cipher suite. Mismatched keys or ciphers cause the secure association to fail, so identical CAKs and matching suites are mandatory.

LLDP-MED provides network policy advertisement, allowing IP phones to discover the voice VLAN.

Storm control is configured under the ethernet-switching family at the unit level, applying thresholds per logical interface. This placement lets the EX4300 rate-limit broadcast, multicast, and unknown unicast flooding on the access port before it overwhelms the link.

Displays VSTP status per VLAN.

VSTP is an enhancement of RSTP that runs per VLAN. It uses RSTP BPDU format but tags them with VLAN information, allowing interoperability with RSTP bridges. When a VSTP switch connects to an RSTP bridge, it can fall back to sending standard RSTP BPDUs for the native VLAN or use VLAN-tagged BPDUs. This compatibility ensures smooth integration in mixed environments, which is the correct behavior.

This command correctly configures an interface as an RSTP edge port. Edge ports are connected to end devices and do not receive BPDUs. They transition directly to forwarding state, bypassing the listening and learning states, which speeds up convergence when a device is connected.

In a Virtual Chassis, two members are elected as Master and Backup Routing Engines, running the control and management planes, while the remaining eight switches operate as line cards forwarding traffic. This centralised RE model provides the failover resilience required.

Exceeding the MAC limit triggers the configured action, typically dropping new source MACs and logging.

Setting a high bridge priority (61440) ensures the access switch will not become the root bridge for any VLAN. Configuring the uplink port with a lower path cost makes it the preferred path for forwarding traffic toward the distribution switch. This combination achieves both goals: preventing the access switch from becoming root and ensuring the uplink is used for forwarding.

Virtual Chassis collapses multiple switches into one logical device with a single control plane, so inter-member links are treated as internal fabric rather than bridged segments. Loop-free forwarding is achieved without Spanning Tree blocking any port.

MSTP region membership requires identical region name, revision number and VLAN-to-instance mapping on every switch. If any of these three parameters differs, the switch belongs to a separate region, so matching all three preserves the strict region boundaries the administrator needs.

For switches to be in the same MSTP region, they must have the same region name, revision level, and VLAN-to-MSTI mapping. If the region name differs, the switches will consider themselves in different regions and will not form a single MSTP region, potentially causing loops or suboptimal paths. Therefore, ensuring identical region names is critical for proper MSTP operation.

The MSTP configuration digest is a hash of the region's configuration attributes, and the MST configuration name is one of the three hashed parameters. Switches must share identical values for these parameters to belong to the same MST region.

BPDU protection (also known as BPDU guard) is designed for edge ports that should not receive BPDUs. When enabled, if a BPDU is received on that port, the port is immediately disabled (err-disabled) to prevent loops. This is the correct feature for the scenario because it directly addresses unauthorized BPDUs on access ports and takes protective action.

Drop discards frames from additional MAC addresses once the configured limit is exceeded, while permitting existing learned addresses to continue forwarding. Juniper offers this as the less disruptive action compared with shutting the interface down.

VSTP (VLAN Spanning Tree Protocol) is a Juniper feature that runs a separate RSTP instance for each VLAN. This provides per-VLAN spanning-tree topologies, allowing independent convergence and load balancing. It is the correct choice because it combines the rapid convergence of RSTP with per-VLAN instances, exactly matching the requirement.

VSTP maps each VLAN to a separate spanning-tree instance using IEEE 802.1Q BPDUs, and Juniper implements compatibility with Cisco's PVST+ so the two can share a topology. This interoperability lets EX Series switches participate in mixed-vendor Layer 2 networks.

Because stacked tags add overhead (an extra 4 bytes per tag), core link MTU must be increased to prevent frame fragmentation or drops.

Voice VLAN allows the switch to automatically place voice traffic into a specified VLAN and apply a priority. Configuring the voice VLAN as 100 with priority 5 and data VLAN as 200 on the access port meets the requirement, as the phone will tag voice packets with the appropriate VLAN and priority.

MSTP breaks an identical bridge-priority tie by comparing the bridge MAC address, and the numerically lowest value wins the regional root election. This satisfies the stem's constraint: two switches share equal priorities, so the deterministic lowest-MAC comparison elects one regional root and prevents a loop.

Bridge assurance ensures that switches actively send BPDUs on all point-to-point operational ports, preventing loops caused by unidirectional link failures.

DHCP snooping designates trusted ports and filters rogue DHCP server replies, blocking an attacker from handing out a malicious default gateway. This directly prevents DHCP spoofing on Layer 2 access ports, satisfying the scenario's first requirement.

The vlan-map is applied at the logical interface unit level, where input and output maps rewrite or push VLAN tags. Configuring it there lets customer tag 100 be encapsulated with the outer service provider tag 3000, achieving Q-in-Q tunnelling on the MX Series.

L2PT encapsulates customer Layer 2 protocol frames, including BPDUs, and forwards them transparently across the provider core, so provider VSTP/MSTP instances never process them. This satisfies the requirement that customer BPDUs traverse the Q-in-Q tunnel untouched.

VLAN action rules define whether the provider edge pushes, pops or swaps tags as frames traverse the tunnel. Aligning these operations on both sides preserves the customer's inner VLAN while adding the service tag, which is the core mechanism of Q-in-Q forwarding.

L2PT encapsulates customer Layer 2 protocol frames, such as STP BPDUs, and forwards them across the provider core as data, preventing provider bridges from processing or blocking them. This preserves the customer's control-plane topology transparently through the QinQ tunnel.

VLAN swap replaces the incoming inner VLAN tag with a different tag before the frame is forwarded into the provider core, preserving the outer tag. This matches the stem's description of substituting the inner tag, distinguishing it from push, pop, or translate operations on the MX Series.

MSTP boundary ports receive RSTP BPDUs and fall back to RSTP compatibility on that port only, allowing interworking with legacy RSTP switches on shared segments while preserving MSTP operation internally. Compatibility is per-port, not region-wide.

Switches are in the same MST region only when their MST configuration identifier matches exactly: the region name, the revision number, and a digest of the full VLAN-to-instance mapping table, which is carried in BPDUs. One VLAN mapped differently, even an unused one, puts a switch in another region. On Junos, compare 'show spanning-tree mstp configuration' across switches, checking the name, revision and digest.

MC-LAG with ICCP lets two Juniper devices present one logical LAG to the access layer, giving Active-Active multihoming with no blocked links. ICCP synchronises state between peers, so the core needs no Spanning Tree Protocol to prevent loops.

This is correct. BPDU guard, when enabled on an edge port, disables the port upon receiving a BPDU, placing it in err-disabled state. Junos OS supports automatic recovery from err-disabled state via the 'errdisable recovery' configuration, which can re-enable the port after a timeout.