Juniper Networks Enterprise Routing and Switching, Specialist (JNCIS-ENT, JN0-352) (JNCIS-ENT) (JNCIS-ENT) — Questions 226–300

BGP treats a malformed path attribute as a fatal error under RFC 4271. The receiving speaker must send a NOTIFICATION with the appropriate error code and subcode, then tear down the peering session rather than silently discard the UPDATE or retain the route.

Forwarding-type routing instances are designed for filter-based forwarding, where firewall filters direct matching traffic into a separate routing table for alternate next-hop treatment. This is their primary deployment scenario, distinguishing them from virtual-router or VRF instances.

The minimum-links setting defines how many active member links must be up before the aggregate interface is marked up. Setting it to 2 on ae0 ensures the bundle drops traffic when fewer than two links remain operational.

Setting the interface mode to access under family ethernet-switching binds the port to a single VLAN untagged, satisfying the requirement to assign a physical interface as an access port. Without this, the port defaults to trunk mode and cannot carry the newly created VLAN's traffic correctly.

The csnp-interval controls how often Complete Sequence Number PDUs are sent on a broadcast link. Increasing it lengthens the gap between CSNPs, reducing control traffic overhead on slow links where frequent flooding would otherwise consume scarce bandwidth.

Junos OS reserves the `gr-` prefix exclusively for generic routing encapsulation tunnel interfaces, satisfying the stem's requirement for the GRE-specific naming convention. Other tunnel types use distinct prefixes, such as `ip-` for IP-IP and `vt-` for virtual tunnels, so `gr-` uniquely identifies GRE logical units.

IEEE 802.1X with multiple supplicants authenticates several devices independently on one port, while MAB authenticates devices lacking a supplicant via their MAC address. This lets the phone and attached PC both pass port security's single-MAC limit securely.

IP Source Guard inspects source addresses against the DHCP snooping binding table, dropping packets whose IP/MAC pair is absent. This filtering directly blocks spoofed source addresses, satisfying the stem's requirement to prevent IP spoofing attacks on untrusted access ports.

Access VLAN membership is assigned under the interface's unit 0 family ethernet-switching hierarchy, where the vlan member statement names the target VLAN. This is the Junos hierarchy that binds a switched port to VLAN finance, satisfying the access port requirement.

Edge port, equivalent to RSTP edge or Cisco PortFast, lets an access port skip listening and learning and enter forwarding immediately when a link comes up. This removes the roughly 30-second STP startup delay before end devices can pass traffic.

Loop protection detects a designated port that stops receiving BPDUs from its upstream neighbour. It then moves that port into a discarding state, preventing a unidirectional link failure from creating a bridging loop, which matches the described RSTP behaviour.

`show isis interface` directly queries the IS-IS interface database, returning per-interface parameters such as circuit type, metric, hello interval, and DIS priority. This satisfies the stem's requirement for interface-level IS-IS parameters, unlike commands that display adjacency or link-state database information.

Booting the new member standalone lets you align its Junos OS release with the master before rejoining, resolving the image mismatch and hardware errors on the Virtual Chassis ports. Isolation prevents the incompatible member from disrupting the existing chassis during the upgrade.

A direct route in Junos OS carries a default preference of 0, the lowest value available, which makes it the most preferred route in the routing table. This satisfies the stem's requirement precisely: directly connected interfaces always win over static, OSPF, or BGP routes when identical prefixes compete.

Max-age sets the interval BPDU information is retained before being discarded as stale. Once this timer expires without a fresh BPDU from the root or designated bridge, the switch ages out that topology information and reconverges, preventing indefinite reliance on outdated spanning-tree data.

BGP communities are optional transitive path attributes, so a router that does not recognise them still propagates them to peers. This satisfies the stem's requirement for a true statement about Junos BGP communities, as Junos stores and matches them without stripping the attribute.

MACsec encapsulates each frame with a SecTAG header and an ICV trailer, adding up to 32 bytes of overhead. On a 1500-byte MTU path, frames at full size exceed the transport's capacity and are dropped. Raising the MTU on all intervening interfaces accommodates this encapsulation overhead, satisfying the untrusted Metro Ethernet circuit's size constraint.

IIH (IS-IS Hello) PDUs are the valid IS-IS PDU type used to establish and maintain adjacencies on broadcast and point-to-point circuits, carrying neighbour and circuit information. Alongside LSP and SNP types, IIH forms the complete set of IS-IS PDU categories defined by the protocol.

Filter-based forwarding relies on the alternate routing instance having a matching route for the destination. If none exists, the packet cannot be forwarded and is dropped, which is the most likely cause of the described behaviour.

Both peers must be configured with the identical Connectivity Association Key, the secret used to derive MACsec session keys. A mismatch causes the secure association to fail, so the CAK is a mandatory matching parameter for PSK-based MACsec.

This command correctly modifies the hello and dead intervals for OSPF on the specified interface. The hello-interval and dead-interval statements are valid under the interface hierarchy in OSPF. This allows per-interface tuning, which is essential for convergence. The dead interval is typically four times the hello interval, so 5 and 20 are consistent.

The detail keyword expands each LSP, displaying its TLVs, including extended IP reachability entries carrying wide metrics. The summary form omits TLV contents, so only the detailed database output satisfies the requirement to inspect those specific TLVs.

Storm control enforces the configured threshold directly in switch hardware, so frames exceeding the limit are discarded at line rate rather than punted to the control plane. This satisfies the stem's requirement for true behaviour on threshold breach: excess traffic is dropped, not merely logged or rate-limited in software.

Virtual links traverse a non-backbone transit area, creating a topology dependent on that area's stability and complicating fault isolation. Juniper documentation therefore recommends them only as temporary fixes for migration or repair, not as permanent design elements.

down/down means the physical link is not established: the switch sees no signal from the host. The usual causes are a disconnected or damaged cable, a faulty or incompatible SFP transceiver, or a host network interface that is disabled or broken. Check the port and host LEDs, try a known-good cable or optic, and use 'show interfaces ge-0/0/1 extensive' or the optics diagnostics command to inspect link details.

The 'next policy' action halts evaluation of the current policy immediately, so no further terms within it are assessed. The route then passes to the next policy in the chain, satisfying the stem's requirement for this terminating behaviour rather than accepting or rejecting the route.

IS-IS hello packets are padded to the interface MTU by default, so if link MTU sizes differ, oversized IIHs are silently dropped and adjacency never forms. Matching MTU satisfies the link-level constraint required for reliable IIH exchange between neighbours.

With restrict, frames sourced from violating MAC addresses are discarded, while traffic from permitted addresses continues forwarding. The switch also increments a violation counter and emits a syslog message, giving visibility without shutting the interface down as shutdown mode would.

VRRP interface tracking decrements the gateway's priority by the configured value when the monitored uplink fails, allowing the backup to preempt and become master. This satisfies the stem's requirement that the backup router assumes the master role after core connectivity loss.

Aggregating multiple physical links into one logical LAG sums their individual capacities, so the bundle carries more traffic than any single member. This satisfies the stem's bandwidth benefit: aggregate throughput between connected devices increases, and traffic is load-balanced across active member links.

In a Virtual Chassis, the management IP address is a virtual address associated with the master role. When a switchover occurs, the backup becomes master and the virtual management IP is reassigned to the new master, so management connectivity is preserved without manual reconfiguration. This is a core high-availability behavior of the Virtual Chassis architecture.

IP-IP encapsulation adds only an outer IP header, so no GRE header is inserted between the payload and the tunnel header. This satisfies the stem's requirement for a true statement about IP-IP behaviour in Junos OS, distinguishing it from GRE tunnels, which do add that extra header.

IS-IS authentication passwords can be configured at both the interface level, controlling hello PDUs on a specific link, and the global level, securing link-state PDUs across the routing domain. This dual placement satisfies the stem's requirement by allowing authentication at either scope, matching how Junos applies IS-IS authentication.

The 'no-readvertise' statement prevents the static route from being redistributed into dynamic routing protocols, including OSPF. It is configured under the static route. This is useful when you want the route to be used locally but not advertised to other routers, maintaining control over routing information propagation.

A tunnel interface presents a virtual point-to-point Layer 3 link, allowing routing protocol adjacencies to form across transport networks that lack direct connectivity or are untrusted. It satisfies the need to run protocols such as OSPF or BGP over disjointed or insecure paths.

Hello packets (Type 1) are exchanged periodically on OSPF-enabled interfaces to discover neighbours and maintain adjacencies. They carry parameters such as hello and dead intervals, area ID and router priority, which must match before an adjacency forms.

DHCP snooping and Dynamic ARP Inspection are Layer 2 security features configured under the `secure-access-port` stanza within the `ethernet-switching-options` hierarchy on EX Series switches. This satisfies the stem's requirement for the Junos hierarchy dedicated to secure access port features, binding trusted interfaces and VLANs to those protections.

MSTP instance 0, the CIST, carries all VLANs not explicitly mapped to another user-defined MST instance. This default mapping ensures every VLAN has a spanning-tree topology even when administrators define additional instances for load balancing.

NEXT_HOP carries attribute type code 3 and holds an IP address, exactly matching the observed BGP update. As a well-known mandatory attribute, it specifies the next-hop IP for the advertised prefix, satisfying the stem's requirement to identify the attribute by its type code and IP-address value.

ICCP runs between the two MC-LAG peer switches over the inter-chassis link, exchanging state and synchronising MAC address information so both control planes present consistent forwarding. This satisfies the requirement for MAC table consistency across separate control plane devices.

AS_PATH is a well-known mandatory attribute, meaning every BGP update carrying reachable NLRI must include it, and all BGP implementations must recognise and process it. This mandatory classification distinguishes it from optional or discretionary attributes.

Setting the interface mode to trunk under the ethernet-switching family enables 802.1Q encapsulation, which is what allows the port to carry multiple VLANs and correctly process untagged and priority-tagged frames. Without this mode, the interface defaults to access behaviour and cannot satisfy the trunking requirement.

The third-party switch sends untagged frames on its native VLAN 1. The EX4300 trunk port must be configured with 'native-vlan-id 1' so that untagged frames are classified into VLAN 1. Without this, untagged frames are dropped because the trunk port expects tagged frames for VLAN 10 and 20. Creating VLAN 1 on the EX4300 is also necessary for the frames to be bridged, making this the correct fix.

On broadcast networks the DIS advertises a pseudonode LSP on behalf of the LAN, representing the multi-access segment as a single virtual node. This reduces adjacency and LSP flooding overhead, which is precisely the DIS function the question targets.

IP Source Guard relies on the DHCP snooping binding table to validate source IP and MAC pairs. Without DHCP snooping enabled on the client's VLAN, no binding is created, so all traffic is dropped despite successful DHCP lease acquisition.

Once ExStart and Exchange complete, the router sends Link-State Request (Type 3) packets to ask neighbours for the specific LSAs missing from its database. This directly resolves the incomplete database that keeps the adjacency looping in Exchange.

MD5 authentication is configured at the BGP group level under protocols bgp, using the authentication-key statement, which applies the TCP MD5 signature to every session in that group. This prevents spoofed TCP segments from establishing or hijacking the peering.

The show bgp neighbor command displays per-peer session details, including the negotiated hold time and keepalive interval exchanged with the eBGP peer. This directly satisfies the requirement to verify the exact timers actually agreed, rather than configured values.

A qualified next-hop lists multiple next-hop addresses with different preference values, so Junos installs the preferred path and switches to the alternate when it fails. This provides static route redundancy without dynamic protocols, satisfying the high-availability requirement for path redundancy.

`show virtual-chassis` queries the Virtual Chassis operational state directly, returning each member's ID, configured priority, and current role (Master, Backup, or Linecard). This satisfies the stem's requirement for a single command exposing all three fields, unlike interface or protocol-specific commands that omit member priority data.

OSPF requires that interfaces be in the same subnet to form an adjacency. If the tunnel interfaces have IP addresses in different subnets, OSPF will not establish a neighbor relationship. Also, OSPF must be enabled on the tunnel interface (e.g., by including it in an OSPF area). Checking these ensures that the fundamental OSPF requirements are met over the tunnel.

The forwarding table holds the router's active next-hop and egress interface entries, distinct from the routing table's protocol paths. Running this command displays those installed forwarding entries, letting you confirm which next-hop each destination actually resolves to on the Junos device.

Storm control meters ingress traffic per type against configured thresholds. Multicast frames are one monitored category, so a multicast rate exceeding its configured threshold triggers the interface to drop excess multicast packets until the rate falls back below the limit.

For a GRE tunnel to pass traffic, the tunnel destination must be reachable through the tunnel source interface. If the route to the destination points elsewhere, the encapsulated packets may be sent out the wrong interface or dropped. Verifying and correcting the route ensures that the outer IP packets reach the remote endpoint, allowing the tunnel to function properly.

The 'no-summaries' option configures a totally stubby area, blocking Type 3, 4, and 5 LSAs.

Junos stores VLAN membership under the [vlans] hierarchy, where the VLAN name is the identifier and vlan-id assigns the 802.1Q tag. Setting 'voice' with vlan-id 50 creates the required VLAN and binds it to tag 50, satisfying the named-VLAN-with-ID-50 constraint.

If the physical link is flapping (e.g., due to a bad cable or NIC), RSTP will detect link up/down events and transition the port accordingly. Even with edge port configured, link flapping causes the port to go down and up, leading to state changes. This is the most likely cause given the server is not sending BPDUs and edge is configured.

On Juniper EX Series switches, the 'show spanning-tree interface detail' command provides detailed information for each interface, including any BPDU inconsistencies detected, such as type or version mismatches. This is the correct command to identify why a port might be flapping due to inconsistent BPDUs.

MACsec decryption requires both peers to share identical connectivity association key material and matching security association parameters. A mismatch in CAK/CKN or SA settings causes received encrypted frames to fail integrity and decryption checks, so they are discarded.

RSTP elects one Root Port per non-root bridge: the port advertising the lowest cumulative root path cost toward the root bridge. This satisfies the stem's requirement, giving that switch its single best path to the root, with Designated Ports forwarding downstream.

Virtual routers maintain separate routing tables, so no route sharing occurs by default. Leaking routes via rib-groups or routing policies imports prefixes between the virtual router and the default instance, which is what enables communication between them.

The area ID is configured under the OSPF area hierarchy, so mismatches are corrected at [edit protocols ospf area <area-id>]. Both switches must share an identical area ID on the connecting interface for the adjacency to form; editing this stanza resolves the logged mismatch error directly.

AS4_PATH is an optional transitive attribute, carrying 4-byte AS path information when older 2-byte speakers are involved, satisfying the "optional transitive" classification. Its transitive nature ensures it propagates across autonomous systems that lack native 4-byte AS support, unlike well-known mandatory attributes such as AS_PATH, which every BGP speaker must recognise and include.

Selective QinQ pushes an outer service VLAN tag, so every upstream transit port must be a trunk permitting that outer VLAN or the tagged frames are dropped. This satisfies the question's requirement that transit ports carry the outer service VLAN.

IP Source Guard validates each ingress packet's source address against the DHCP snooping binding database, dropping frames whose IP-MAC pair is absent. Without that binding table, the feature cannot verify legitimate clients, so it depends on snooping.

The command 'set chassis redundancy graceful-switchover' enables GRES globally at the chassis level, allowing the backup Routing Engine to assume control without restarting the Packet Forwarding Engine. This matches the stem's requirement for a global GRES configuration command.

Static LAG requires no LACP negotiation, so omitting the lacp stanza under aggregated-ether-options lets the Junos bundle form without protocol handshakes. The server's static mode cannot respond to LACPDUs, so enabling LACP would keep links down. Matching the server's non-negotiated mode satisfies the stem's constraint.

Under the `gr-` interface, the `destination` statement specifies the tunnel's remote endpoint, which becomes the outer IPv4 header's destination address for encapsulated traffic. This satisfies the stem's requirement to define the GRE tunnel's destination address, unlike source or routing statements that serve different purposes.

BGP Graceful Restart preserves forwarding state during a routing daemon restart by having the helper router retain previously learned routes, avoiding traffic loss. The restarting router's peers keep the TCP session alive, satisfying the requirement to restart BGP without dropping the underlying session or disrupting forwarding.

Tunnel IP connectivity confirms GRE encapsulation works, but the routers lack routes for the remote private subnets via the tunnel interface. Without static routes or a dynamic routing protocol advertising those prefixes across the tunnel, transit traffic is dropped.

The 'lsp-lifetime' command defines how long a router's own IS-IS link-state PDUs remain valid before expiring from the link-state database. This satisfies the stem's requirement by setting the LSP's remaining lifetime field, which the originating router refreshes before expiry to prevent neighbours discarding the LSP.

OSPF hellos use multicast destination 224.0.0.5, and GRE alone does not guarantee multicast forwarding across the transit network. If the underlay drops multicast or filters IP protocol 89, hellos never reach the peer, so adjacencies stall despite unicast pings succeeding.

The configuration digest is an MD5 hash computed from the region name, revision level and VLAN-to-instance mapping. Neighbours compare digests in BPDUs, so mismatched values prove the switches sit in different MST regions rather than merely different revisions.

GRE-encapsulated packets carry IP protocol number 47 in the outer IP header's Protocol field, identifying the payload as GRE. This value is assigned by IANA and distinguishes GRE from protocols such as TCP (6), UDP (17) and ESP (50).

`show interfaces ae0` displays the aggregated Ethernet interface's operational state, including its LACP bundle status and member link roles, directly satisfying the stem's requirement to verify link aggregation and LACP operation. It confirms whether member interfaces are actively bundled or detached, which is the precise operational evidence the question demands.