Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 76–150

IP-IP tunnels add an outer header, reducing effective MTU. Packets with the DF bit set that exceed this reduced MTU cannot be fragmented and are dropped, incrementing input drops. This matches the observed symptom on the tunnel interface.

Link State Update packets carry the actual LSAs during flooding, delivering them to neighbours so their link-state databases converge. The stem's requirement for reliable flooding is satisfied because LSUs transport the advertisements themselves, while reliability comes from the Link State Acknowledgment packets sent in response.

The Open message carries the version, my autonomous system number, hold time and BGP identifier, letting both peers agree on session parameters before any routing data flows. It is the first message exchanged after the TCP three-way handshake, directly satisfying the stem's requirement for negotiating session parameters during establishment.

A virtual-router instance maintains its own independent routing table and protocol instances, giving the department full Layer 3 isolation from the master instance. This satisfies the requirement to separate that department's traffic without the overlapping-address limitations of other instance types.

Type 3 summary LSAs are originated by the ABR to describe inter-area destinations, flooding them into the adjacent area to advertise networks learned from one area into another. This directly satisfies the stem's requirement for the LSA an ABR generates when propagating routes between areas, rather than intra-area Type 1 or Type 2 LSAs.

Static clients lack DHCP-assigned bindings, so the DHCP snooping database holds no IP-to-MAC entry for them. DAI validates ARP packets against that database and drops any ARP lacking a matching binding, blocking the static client's gateway resolution. A static ARP access-list entry is required to permit it.

NSR synchronises OSPF protocol daemon state between Routing Engines, so the standby is already current and neighbours see no adjacency reset during switchover. GRES alone relies on neighbour helper mode, so NSR removes that dependency, satisfying the stem's control plane switchover constraint.

When an LSP's remaining lifetime reaches zero, the router purges it: the LSP is removed from the link-state database rather than retained. This satisfies the stem's scenario of an expired lifetime, distinguishing purge from refresh or re-origination.

IP-IP prepends only an outer IP header, using protocol number 4, with no transport or GRE header between outer and inner packets. GRE inserts its own GRE header, adding fields such as protocol type and optional keys, making it the axis of difference.

SPF runs Dijkstra's algorithm over the link-state database to compute the lowest-cost path from the local router to every reachable node and prefix, producing the loop-free topology used for forwarding. This directly satisfies the question's requirement that shortest-path computation occurs during the IS-IS SPF calculation.

Filter-based forwarding steers matched traffic into a separate routing instance, which by default has no path back to the core. Installing a default route (0.0.0.0/0) inside that instance's table ensures return traffic reaches the core gateway rather than being dropped.

SRX Series devices evaluate transit traffic against security policies between zones. Because the gr- interface sits in its own zone, a policy from the internal zone to that tunnel zone permitting all traffic is required for transit packets to enter.

IP-in-IP encapsulation carries the inner packet as payload of an outer IPv4 header whose Protocol field is set to 4, the assigned value for IPv4 encapsulation. This identifies the tunnel payload to the receiving endpoint.

The `tunnel checksum` parameter enables GRE header and payload checksumming, satisfying the requirement to detect packet corruption in transit. Unlike `tunnel key`, which only provides weak sender identification, checksums verify data integrity end-to-end. This directly addresses the stem's integrity-check constraint for the gr-0/0/0 tunnel interface.

LACP requires member links to share identical speed, duplex and LACP mode settings; mismatched parameters prevent the bundle forming or cause member suspension. This satisfies the stem's requirement for a configuration condition on the EX4300 LAG.

DHCP snooping drops server replies arriving on untrusted ports, so the port facing the legitimate corporate server must be marked trusted to permit its offers through. This satisfies the stem's requirement to allow only that server's replies.

Promiscuous ports are designed to communicate with all ports in the PVLAN, including isolated and community ports. In a DMZ, the router or gateway connects to a promiscuous port so that isolated hosts can reach the gateway while remaining unable to communicate directly with each other. This behavior is fundamental to PVLAN operation and satisfies the requirement of shared gateway access.

The detail keyword expands each neighbour entry beyond the summary view, exposing dead timer countdowns, router IDs, interface addresses and area bindings. This satisfies the requirement for neighbour state plus timer and address information in a single command.

A promiscuous port carries the primary VLAN and communicates with every isolated and community port, plus external networks such as the router or firewall. This satisfies the stem's requirement for one of the two defined PVLAN port types on Juniper EX Series switches, alongside isolated and community ports.

The VLAN-to-instance mapping table must be identical on every switch, since MSTP computes separate topologies per instance. Mismatched mappings mean switches disagree about which VLANs share a spanning-tree instance, so they cannot form one common region.

Root protection forces a port into a root-inconsistent blocking state if it receives superior BPDUs, preventing a downstream switch with a lowered priority from becoming root. This preserves the core switch's root bridge role, satisfying the requirement to retain its position.

Adjusting TCP MSS or the tunnel interface MTU directly addresses GRE's 24-byte overhead, which reduces the usable payload and causes fragmentation when the underlying path MTU is exceeded. Lowering MSS on tunnel traffic prevents oversized segments from being encapsulated, satisfying the requirement to avoid fragmentation and drops across the GRE tunnel.

A VLAN with no member interfaces or IRB retains its configuration but stays inactive, so it never enters the active switching table. Junos activates a VLAN only once at least one access, trunk, or IRB interface is bound to it, satisfying the stem's forgotten-assignment constraint.

Marking the OSPF interface as passive stops the router from sending Hello packets and forming adjacencies on that interface, but the network is still advertised into OSPF as a stub network. This matches the requirement exactly: no OSPF packets are generated on the interface, and the interface remains in the OSPF configuration.

KEEPALIVE messages carry only the 19-byte BGP header with no path attributes, and their sole function is refreshing the hold timer to confirm the peer session remains active. This satisfies the requirement for a message type that maintains session state without transporting routing information.

`clear ethernet-switching security-violation` resets the DAI violation counters, satisfying the requirement to clear them without disturbing the DHCP snooping database. Unlike `clear arp` or interface-level commands, it targets the ethernet-switching security subsystem where DAI violations are recorded, so counters return to zero while inspection remains active.

The proposal-agreement handshake lets a designated port bypass the 802.1D listening and learning timers, synchronising the downstream bridge immediately. This satisfies the stem's rapid-convergence constraint by replacing timer-based waiting with explicit negotiation, so edge-facing topology changes propagate in seconds rather than the legacy 30–50 second convergence delay.

`clear ospf database` flushes the local link-state database and triggers the device to re-request LSAs from its OSPF neighbours, forcing adjacency re-synchronisation. This directly satisfies the stem's requirement to clear the database and force re-synchronisation, unlike neighbour-specific or protocol-wide reset commands.

VRRP priority determines which router becomes master; the highest priority wins. Raising the priority on the preferred switch's interface ensures it assumes the master role, satisfying the stem's requirement for the higher-capacity switch to lead.

RSTP flushes MAC entries learned on non-edge ports immediately upon topology change, rather than ageing them out. This satisfies the stem's requirement for rapid reconvergence: stale forwarding entries are purged at once, preventing misdirected traffic, while edge ports retain their entries since they cannot create loops.

2-Way appears in Junos OSPF neighbour output once bidirectional communication is confirmed via hello packets, before database synchronisation. It is a genuine operational adjacency state, satisfying the stem, whereas states such as Init, Down or Attempt reflect pre-adjacency conditions rather than formed adjacencies.

RSTP Hello timer sets the interval at which the root bridge generates and transmits configuration BPDUs, defaulting to two seconds; downstream bridges relay these, so it governs topology information freshness rather than port state timers.

ISSU requires both Routing Engines to run compatible Junos releases and matching hardware, since the upgrade proceeds by failing over between them while each RE runs a different software version. Identical models and supported images satisfy the dual-RE synchronisation constraint, allowing traffic to continue during the upgrade.

On a multi-access segment the DR reduces adjacencies to a full mesh by having all other routers form adjacencies only with it and the BDR. This minimises LSA flooding traffic, satisfying the stem's requirement on broadcast segments.

RSTP bridge priority is configured under the protocols rstp hierarchy, so 'set protocols rstp bridge-priority 4096' is a valid path. The value is a multiple of 4096, making it a legal priority that influences root bridge election.

Layer 2 filters on EX Series switches require the family ethernet-switching match condition, which tells Junos to inspect Ethernet header fields rather than IP or IPv6 headers. Without this family context, MAC-based terms cannot be parsed, so the filter must be defined under this hierarchy.

Without an inline services PIC or MPC-based inline processing, GRE encapsulation and decapsulation for locally terminated tunnels is handled in software by the Routing Engine, so high transit volume drives RE CPU utilisation upward, matching the observed spike.

Filter-based forwarding requires the target routing instance to exist within the routing-instances hierarchy, so the filter action resolves against a valid instance at commit. Defining custom-vr under [edit routing-instances] satisfies this constraint, allowing the filter term to direct matching traffic into that virtual router without commit errors.

The `request chassis routing-engine master switch` command triggers a manual Routing Engine failover, satisfying the stem's requirement to initiate switchover on an MX router with GRES enabled. It forces the backup RE to assume the master role, preserving forwarding state through graceful switchover rather than relying on automatic failover.

eBGP peers using loopback addresses are not on the same subnet, so the default TTL of 1 causes the TCP connection to fail. The session remains in Active state because the router cannot establish a TCP session to a non-directly connected peer. Configuring multihop with an appropriate TTL allows the BGP session to be established over multiple hops.

The broadcast term needs a terminating action, and 'discard' silently drops matching frames without generating ICMP messages. This satisfies the requirement to drop broadcast packets while the implicit default permits unicast traffic on the access VLAN.

Dynamic ARP Inspection (DAI) intercepts ARP packets on untrusted access ports and validates the sender's IP-to-MAC binding against the DHCP snooping database. If the binding is invalid, DAI drops the ARP packet and generates a log entry, satisfying the security policy requirement.

Isolated ports have no Layer 2 connectivity to each other or to community ports; their only permitted destination is the promiscuous port, which forwards traffic out of the primary VLAN. This satisfies the isolation constraint while still allowing server traffic to reach the gateway.

BGP ORIGIN codes are IGP, EGP and Incomplete. Incomplete signals the prefix was not learned natively via a BGP network statement but injected through redistribution from a static route or IGP, so its path origin cannot be fully verified.

Juniper EX Series switches use 32768 as the default bridge priority for RSTP, satisfying the stem's request for the out-of-the-box value. This 16-bit field, combined with the switch's MAC address, forms the 8-byte bridge identifier that determines root bridge election; lower values win, so 32768 is the midpoint default.

MSTP enforces the regional hop count through the BPDU's remaining-hops field, which each bridge decrements on receipt. Once the value hits zero the BPDU is discarded, preventing stale topology information from looping indefinitely across the region.

DHCP snooping builds a binding table by inspecting DHCP traffic, mapping each client's MAC address, leased IP address, VLAN and ingress interface. This recorded binding is what later enables dynamic ARP inspection and IP source guard to filter spoofed traffic on untrusted access ports.

The vrf routing-instance type is purpose-built for L3VPNs, holding a separate routing table populated by MP-BGP VPN routes and supporting BGP peering between provider edge devices. Other instance types serve different services, so vrf satisfies the L3VPN requirement.

Filter-based forwarding requires the routing instance to be declared with instance-type forwarding, which activates the forwarding table used by firewall filter actions to steer traffic into that instance. Without this statement, the instance cannot perform filter-based forwarding.

The Active state means the router has sent a TCP connection request to the peer but has not received a response, so it keeps retrying. The session is not established; the router is actively attempting to open TCP port 179, which distinguishes it from Idle or Connect states.

The 'show interfaces gr-0/0/0' command displays link state, traffic counters and error statistics for the GRE tunnel interface. It directly satisfies the stem's requirement to verify operational status and packet statistics on the configured gr- interface.

GRE encapsulation requires the transit interface to forward the outer IPv4 header, so enabling family inet satisfies the routed IP network constraint. The tunnel interface itself carries family inet or inet6 for payload traffic, but the physical path only needs IPv4 forwarding to deliver encapsulated packets between the Junos peers.

A VLAN shows Active when it exists in configuration and is bound to an active Layer 3 interface, such as an IRB or routing instance, even without member ports. The absence of listed interfaces confirms no access or trunk ports are assigned, satisfying the stem's condition of an active VLAN with zero member ports.

MSTP maps every VLAN not explicitly assigned to an instance into the Common and Internal Spanning Tree, Instance 0. That instance carries the CIST topology, so unmapped VLAN traffic follows Instance 0 forwarding rather than being dropped or creating a separate instance.

A forwarding routing instance holds only forwarding tables, with no routing protocol process, and is used with firewall filters to direct traffic into specific next-hop or VRF paths. This satisfies filter-based forwarding without protocol adjacencies.

The route reflector adds ORIGINATOR_ID, carrying the originating client's router ID, and CLUSTER_LIST, recording the reflection path. A client receiving a route containing its own router ID or cluster ID detects the loop and discards it.

GRE tunnel interfaces in Junos use the 'gr-' prefix, satisfying the question's requirement for a true naming-convention statement. This distinguishes them from IP-IP tunnels, which use 'ip-', and from logical tunnel interfaces, which use 'lt-'. The prefix directly reflects the encapsulation type configured on the physical interface.

UPDATE messages carry Network Layer Reachability Information (NLRI) for advertised routes and path attributes, as well as withdrawn routes. They are the primary messages for exchanging routing information. This is a correct description of the UPDATE message's purpose.

An NSSA blocks Type 5 AS-external LSAs from other areas while permitting its own routers to originate external routes as Type 7 LSAs, later translated to Type 5 at the ABR. This exactly matches the stem's dual constraint.

Preemption directly satisfies the requirement that the recovered router immediately reclaims the master role. Enabled by default, it lets a router with higher priority seize mastership from the current backup, rather than waiting for the backup's advertisement timer to expire. Without preemption, the recovered higher-priority router would remain backup indefinitely.

IS-IS does not use a reference bandwidth to calculate interface metrics; metric values are configured manually per interface. Unlike OSPF, changing the reference bandwidth has no effect on IS-IS metric calculation, so wide or narrow metric values remain unchanged.

The area border router generates a default route into the stub area, letting internal routers reach external destinations without carrying external LSAs. This satisfies the stem's stub-area requirement, since Type 5 LSAs are blocked and the default route replaces them.

Direct routes are derived from the subnets configured on active local interfaces, so they appear only while the interface is up. Static routes are manually configured and remain regardless of interface state, which is the distinguishing axis.

With GRES enabled, the backup Routing Engine takes over the primary role while the Packet Forwarding Engine continues forwarding using existing state. Forwarding tables are not reset, so traffic keeps flowing through the switchover without disruption to the forwarding plane.

Storm control enforces its bandwidth threshold through traffic policing: packets exceeding the configured rate are dropped rather than queued or shaped. This directly satisfies the stem's requirement to protect switch CPU and interfaces from broadcast and multicast storms, since policing caps the flooded traffic before it overwhelms control-plane resources.

In OSPF, during the ExStart state, routers exchange Database Description (DBD) packets to negotiate the master/slave relationship and determine the initial sequence number. If the MTU sizes on the interfaces do not match, the routers cannot successfully exchange DBD packets because the MTU is included in the DBD packet and must match. This causes the adjacency to remain in ExStart. The issue is resolved by configuring matching MTU values or using the mtu-ignore option.

Aggregate routes appear in the routing table under the aggregate protocol. 'show route protocol aggregate' filters the table to those entries, confirming whether the aggregate was generated and is active before investigating why BGP is not advertising it.

Root protection on a designated port places the port into the root-inconsistent discarding state when a superior BPDU arrives, blocking that interface to prevent a rogue switch becoming root. The port recovers automatically once superior BPDUs cease.

Passive mode advertises the interface's prefix into the IS-IS link-state PDU so remote routers can reach the network, yet suppresses Hello PDUs, preventing adjacency formation. This satisfies the requirement of including the network in the LSP without forming an adjacency.

Local routes in Junos OS are host routes (/32 for IPv4, /128 for IPv6) installed for each address configured on the router's own interfaces, pointing to the loopback or discard next-hop. They satisfy the stem's requirement by describing addresses assigned directly to local interfaces, distinguishing them from routes learned via routing protocols.

Root protection on a designated access port blocks superior BPDUs that would otherwise let an unauthorised switch become root, preserving the existing topology. It directly counters misconfiguration or rogue devices attempting to hijack the root role on access ports.

BGP peers establish sessions over TCP port 179, using it for the initial three-way handshake and all subsequent UPDATE, KEEPALIVE and NOTIFICATION messages. This satisfies the stem's requirement, distinguishing BGP from protocols such as RIP that operate over UDP.

DBD packets carry link-state advertisement headers only, not full LSAs. Neighbours compare these summaries to determine which LSAs each lacks, then request missing entries via Link State Request packets, achieving database synchronisation before the adjacency reaches Full state.

The show virtual-chassis command outputs member IDs, roles (master, backup, linecard) and status for every switch in the EX Series Virtual Chassis. It directly satisfies the stem's requirement to display operational status and roles of all members.

Storm control meters broadcast, multicast and unknown unicast traffic per interface, dropping frames once a configured bandwidth threshold is exceeded. This directly satisfies the stem's constraint of preventing an untrusted end-user device from flooding the switch with excessive broadcast traffic.