Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 151–225

RSTP introduces the backup port role, which provides a redundant path to a segment already reached through a designated port on the same bridge. Legacy 802.1D STP defined only root, designated and blocked roles, so backup did not exist.

When multiple routers have the same interface priority, OSPF uses the highest Router ID as the tiebreaker to determine the DR. This is a standard part of the OSPF DR election process and is accurately described in this statement.

BPDU protection administratively disables an edge port that receives BPDUs, so inferior BPDUs from the attached device can no longer trigger RSTP topology changes. This directly stops the continual traffic drops described in the stem.

Import policies applied at the BGP neighbour or group level modify attributes of routes received from that peer before they enter the routing table. Configuring 'import' under protocols bgp group neighbour therefore satisfies the requirement to alter Local Preference for all routes from the specific external peer.

`show spanning-tree interface` displays per-port spanning-tree state, role, cost and edge status on EX Series switches, satisfying the requirement to view spanning tree information. It queries the interface-level STP database directly, confirming which ports forward or block, unlike configuration or non-STP commands.

Junos uses lower preference values to indicate more preferred routes. The route with preference 5 is preferred over the one with preference 10. Therefore, the route with next-hop 10.0.0.2 will be installed in the routing table and used for forwarding, assuming both next-hops are reachable.

The 'show lacp interface' command exposes live LACPDU exchange state and partner system ID per member link, satisfying the requirement for real-time LACP status on the aggregated interface. Other operational commands show aggregate bundle state but not per-link partner identifiers.

The OPEN message initiates the BGP session after TCP establishment, carrying the version, local AS number, hold time, router ID, and optional capability parameters. This negotiation satisfies the stem's requirement by exchanging ASNs and timers before any UPDATE messages flow.

Junos enables both Level 1 and Level 2 by default when IS-IS is configured on an interface, satisfying the stem's default-level question. The interface therefore forms Level 1 adjacencies within its area and Level 2 adjacencies across areas unless the level is explicitly restricted.

The designated port for a segment advertises the lowest-cost path from that segment toward the root bridge, based on root path cost. It is the forwarding port elected per segment to carry traffic toward the root.

The receiving switch compares the received MST configuration digest and region parameters (name, revision, VLAN-to-instance mapping) against its own. A mismatch in any of these identifies the boundary, so the port becomes a boundary port linking the two distinct MST regions.

Without dual primary detection, each Virtual Chassis partition independently elects its own primary Routing Engine, since the split severs the control-plane path used for mastership arbitration. Both partitions then remain active, so identical IP and MAC addresses can appear on the network simultaneously, satisfying the stem's default split-brain behaviour.

IIH PDUs carry the IS-IS hello and DIS election fields, so they are exchanged on multi-access links to elect the Designated Intermediate System. The DIS election is triggered by hello adjacency formation, not by link-state flooding, making the IIH PDU the specific carrier for this process.

On a broadcast multi-access segment, routers that are neither DR nor BDR remain in 2-Way with each other by design, since full adjacency is only formed with the DR and BDR. This is expected, not a fault.

The digest is computed from the MSTP configuration name and the revision number, hashed together. The revision number lets administrators version the MST region configuration, so switches sharing a name but differing revisions land in separate regions.

Static IP clients bypass DHCP snooping, so no binding entry exists for their addresses. Dynamic ARP Inspection validates every ARP packet against that database, and the 'invalid-ip' counter increments when the sender IP is absent from it. The intermittent loss reflects only those statically addressed hosts on VLAN 20, not DHCP clients.

VRRP tracking reduces the master's priority by the configured decrement when a monitored interface fails. Once that decremented value drops below the backup's priority, the backup preempts and assumes mastership, which is exactly the failover behaviour described.

The VRRP virtual IP must sit in the same subnet as the physical interface on the broadcast domain, so hosts can resolve it via ARP. This satisfies the scenario's requirement for the virtual IP address assigned to the group.

Interface tracking with a priority decrement lowers the VRRP priority when a monitored upstream link fails, forcing mastership to transfer to a healthier router. This directly customises failover behaviour by making the active router step down on link loss, satisfying the stem's requirement for tunable failover parameters.

Layer 2 firewall filters on EX Series switches match fields within the Ethernet header, and the source MAC address is one such matchable characteristic. This satisfies the stem's Layer 2 constraint, since matching occurs on frame header data rather than Layer 3 or Layer 4 information.

GRE encapsulates packets to the remote endpoint, so the tunnel interface stays down unless the underlay can reach that destination. Checking the routing table confirms an active route to the remote tunnel address, directly satisfying the requirement to diagnose why the tunnel is non-functional.

RSTP bridge priority is configured under the rstp hierarchy using the bridge-priority statement, and 4096 is a valid multiple of 4096. This command sets the switch's priority low enough to win root election, satisfying the requirement to become root bridge.

RPM probes send periodic ICMP or TCP checks to a target; pairing the static route with the RPM test means the route is installed only while the probe succeeds. This conditional installation is the tracked-object behaviour the scenario demands.

Junos defaults to a 100 Mbps reference bandwidth, so 10Gbps and 40Gbps interfaces all calculate a cost of 1 and become indistinguishable. Raising the reference bandwidth (for example to 10G or higher) restores meaningful cost differentiation across high-speed links.

A Notification message signals an unrecoverable error, so the receiving speaker tears down the underlying TCP connection carrying the session. This satisfies the scenario's requirement that the TCP connection associated with the BGP session is closed.

AS_TRANS (AS 23456) is a reserved 2-byte placeholder defined in RFC 6793, allowing a 4-byte-ASN speaker to present a compatible 2-byte value to a legacy peer. The real 4-byte ASN travels in the AS4_PATH attribute, so the constraint of 2-byte-only remote support is satisfied without losing path information.

The bridge MAC table maps each learned layer-2 address to the VLAN it was learned in and the egress interface toward that host, which is exactly the forwarding information needed to trace unknown unicast flooding or stale entries on EX Series switches.

Under the gr- interface hierarchy, Junos requires both tunnel source and tunnel destination to define the encapsulating endpoints. Without these, the router cannot build the outer IP header, so the GRE tunnel never establishes connectivity.

Within an NSSA, the ABR with the highest router ID performs Type 7 to Type 5 translation, flooding those external LSAs into the backbone. Other ABRs suppress translation to avoid duplicate Type 5 advertisements, so only one translator is elected.

OSPF neighbours exchange DBD packets during ExStart, and a mismatched interface MTU prevents them from agreeing on the master/slave relationship and database description sequence numbers, leaving the adjacency stuck. Matching MTU values on both interfaces resolves the negotiation.

Port security allows you to specify the maximum number of MAC addresses that can be learned on an interface. Once the limit is reached, frames with new source MAC addresses are dropped, preventing MAC flooding attacks. This directly matches the requirement to learn a maximum of 5 MAC addresses and drop subsequent unknown MACs. It is the correct feature for this scenario.

At MaxAge the LSA is considered invalid; the router floods a MaxAge copy to purge it from every link-state database in the area, then removes it locally. This satisfies the stem's condition for flushing the aged LSA.

ISSU upgrades the backup Routing Engine first, then performs a graceful switchover so the upgraded engine becomes primary, preserving forwarding state. Finally, the newly elected backup is upgraded, maintaining continuous packet forwarding throughout. This satisfies the stem's requirement for non-disruptive upgrade behaviour across both Routing Engines.

The interface stanza under the OSPF area hierarchy targets a single interface, satisfying the requirement to tune Hello and Dead timers per interface rather than globally. Junos applies these values to that interface's OSPF adjacency, so convergence can be adjusted without affecting other links.

Junos assigns each static route a preference value, and the route with the lowest preference wins the active-route election, provided its next hop is reachable. Since the stem specifies multiple static routes to one destination with differing preferences, the numerically lowest preference is installed as active in the routing table.

Graceful Restart preserves BGP forwarding state across the routing engine switchover by having peers retain routes and mark them stale, rather than tearing sessions down. Verifying that both ends negotiated the capability and that helper mode was active ensures the restarting router's peers hold prefixes during the ISSU reboot, preventing the drops observed.

The 'show vlans extensive' command displays PVLAN port roles and mappings, confirming that promiscuous, isolated and community designations match the intended topology. This directly satisfies the stem's requirement to verify operational status and traffic isolation on the EX Series switch.

Qualified next-hop with custom preference lets a static route track a specific next hop and carry a non-default preference value. Lower preference wins in Junos, so this satisfies the stem's path-selection and backup requirements: the route stays installed only while its qualified next hop resolves, and preference orders it against alternates.

Junos aggregate routes are inactive until a contributing more-specific route is present in the routing table. Without at least one such route, the aggregate is not installed, so the 172.16.0.0/16 entry remains hidden and cannot be advertised or used for forwarding.

Well-known mandatory attributes, such as AS_PATH and NEXT_HOP, must be understood by every BGP speaker and carried in each Update advertising a route. This universal recognition and mandatory inclusion is precisely what distinguishes them from optional or discretionary attributes.

The extensive form of show interfaces gr-0/0/0 reports tunnel-specific counters, including input and output packet and byte statistics, plus error and discard counts. These confirm whether traffic is actually traversing the generic routing encapsulation tunnel, satisfying the requirement to verify operational packet flow.

Type 4 ASBR Summary LSAs are flooded by the ABR into non-backbone areas, advertising the route to the ASBR itself. Type 1 describes intra-area routers, Type 3 describes networks, and Type 5 carries the external prefixes, so only Type 4 supplies ASBR reachability.

`delete vlans guest` removes the named VLAN and its associated properties in a single operation, satisfying the requirement to delete the entire VLAN configuration rather than merely clearing member interfaces. Junos matches the VLAN by name, so the VLAN ID and all bound properties are discarded together.

Mastership flapping stems from missed advertisements, so the physical layer must be verified first. Checking error counters and link stability, then raising the advertisement interval, prevents transient congestion from triggering premature failover to the backup EX4600.

A virtual IP address is mandatory because it becomes the shared default gateway that hosts on the subnet point to. Without it, VRRP has no address to assume ownership of during mastership transition, so clients could not reach a redundant next hop.

BFD provides sub-second failure detection by sending rapid, lightweight hello packets independently of routing protocols, then signalling BGP immediately when a session degrades. This satisfies the stem's sub-second failover constraint, since BGP's own keepalive timers (seconds to minutes) are far too slow to detect link degradation promptly.

Configured MAC limits and port-security restrictions directly govern whether learned addresses persist in the bridge table. When a port exceeds its maximum-MAC or secure-MAC threshold, the switch stops learning or drops frames, so the entry never appears. Verifying these settings satisfies the stem's missing-entry constraint before investigating other causes.

AS path prepending increases the length of the AS path attribute. BGP prefers shorter AS paths, so a longer path is less likely to be selected by remote routers. This is a common technique to influence inbound traffic by making a particular path appear less attractive.

A trunk drops tagged frames for VLAN 50 if that VLAN is absent from the allowed member list or removed by an 'except' clause. Verifying membership confirms the trunk permits the tag, satisfying the stem's Layer 2 connectivity constraint before investigating native VLAN or other causes.

Correct. The area range statement under the source area is used on an ABR to summarize prefixes entering the backbone.

Level 2 routers form the IS-IS backbone and route between areas, using Level 2 link-state databases to reach destinations outside their local area. This satisfies the stem's requirement for a characteristic of Level 2 routing behaviour.

The disable statement under protocols rstp applies to the named interface only, stopping RSTP participation on ge-0/0/10.0 while RSTP remains active on all other ports. This precisely satisfies the stem's requirement to disable spanning tree on one access interface.

The gr- interface requires an explicit source address so Junos knows which local IP the outer GRE header uses. Without it, the tunnel cannot form, since the intermediate network needs a routable source for return traffic and the remote peer must match it.

The operational command show ethernet-switching dhcp-snooping binding lists the snooping database, showing each learned MAC, IP, lease, VLAN and interface. It directly satisfies the stem's request for active binding entries on the EX Series switch.

The DIS is identified in IS-IS hello packets by a 7-byte LAN ID: the 6-byte System ID of the DIS router followed by a non-zero pseudonode ID, distinguishing the broadcast LAN's pseudonode from the router itself.

`show bgp neighbor 10.1.1.1` queries the BGP neighbour session directly, displaying its state and the received prefix count for that specific peer. This satisfies the stem's requirement to inspect state and verify received prefixes from one neighbour on the MX Series, unlike summary or route-table commands that lack per-neighbour detail.

The `show interfaces gr-0/0/0 extensive` command displays the full configuration detail for the GRE interface, including the configured tunnel source and destination addresses. The extensive keyword exposes parameters that the brief output omits, directly satisfying the requirement to verify the tunnel endpoints match expectations.

A recursive static next-hop requires the routing table to already resolve that address. If no active, more direct route to the next-hop exists in inet.0, the static route stays hidden. This satisfies the stem's condition for the route becoming active.

Within an MST region, the Internal Root is the bridge elected as root for one specific MSTI, using internal path costs. It governs topology inside the region while the CIST root handles connectivity between regions.

LACP fast timeout expects partner PDUs every second, while slow expects every 30 seconds. A mismatch means one side ages out the partner and tears down the bundle, producing the intermittent flapping and timeout errors observed.

Layer 2 filters applied to a VLAN interface operate on the VLAN's logical instance, inspecting frames from every member port rather than a single physical interface. This satisfies the stem's constraint: the ARP filter must catch the invalid sender hardware address regardless of which access port the offending host connects through.

Junos OS ECMP hashing supports Layer 4 fields, so including TCP/UDP port numbers spreads flows across paths even when source and destination IP addresses match. This satisfies the requirement for a transport-layer header field in the hash, complementing the Layer 3 fields already available.

IP-IP encapsulation is identified by IP protocol number 4 in the outer header, distinguishing it from GRE (protocol 47) and other tunnelling protocols. This protocol number lets Junos and intermediate devices recognise and de-encapsulate the tunnel payload correctly.

When configured mastership priorities are equal, Junos falls back to uptime or boot order: the switch that has been up longest, or booted first, becomes primary. This tie-breaking criterion is evaluated alongside priority and member ID.

IP-IP encapsulation prepends a new outer IP header whose source and destination are the tunnel endpoints, while the original packet, including its inner IP header and addresses, remains untouched as payload. This preserves end-to-end addressing across the transit network.

`show route forwarding-table protocol bgp` queries the FIB itself, filtering to BGP-derived entries, so it directly satisfies the requirement to verify which BGP routes are actually installed for forwarding. The alternative `show route protocol bgp` reads only the routing table (RIB), which may hold BGP routes that never reached the FIB.

LACP bundles the physical member links into one IEEE 802.3ad aggregate, and RSTP runs over that aggregate as a single logical port. This satisfies the stem's constraint: RSTP never blocks individual member links, so no member is placed in a discarding state.

Type 2 Network LSAs are generated by the DR to list every router attached to the multi-access segment, identified by the DR's interface IP address. This satisfies the stem's requirement for describing all routers on a broadcast or NBMA network, unlike Type 1 Router LSAs, which each router originates individually.

The show route protocol static command filters the routing table to display only static routes, listing each with its active or inactive status. Other show route variants display all protocols or lack the protocol filter needed here.

Type 5 AS-external LSAs are flooded domain-wide by the ASBR to describe destinations learned from the external BGP process, satisfying the requirement to inject external routes into the OSPF domain. They carry the forwarding address and external metric, and are the standard mechanism for redistributed routes in a single-area or backbone-connected topology.

Defining the policy alone does nothing; it must be attached via 'routing-options forwarding-table export'. This binding applies the load-balancing policy to the forwarding table, enabling multiple equal-cost next hops to be installed and used, which the ECMP scenario requires.

MSTP regions require three matching attributes: the configuration name, the revision number, and the VLAN-to-instance mapping table. Switches sharing these identical values join the same region, so the stem's requirement for consistent region membership is satisfied. Mismatched mapping tables would place a switch in a separate region, breaking the intended topology.

Area 0, the backbone area, is mandatory in any multi-area OSPF architecture. All other areas must connect to it, either physically or through a virtual link, because inter-area routing information is distributed through the backbone.

A Level 2 adjacency requires both routers to be configured for Level 2 operation, since the hello PDU's circuit type must match on both sides. If one router only supports Level 1, the Level 2 adjacency cannot form regardless of other parameters.

MAC limiting allows you to restrict the number of source MAC addresses that can be learned on an interface. Setting the limit to one ensures that only a single MAC address is permitted, effectively blocking additional devices connected through an unmanaged switch.