Knowledge + Practice

CCNA Tunnels Questions

51 questions · Tunnels · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQmedium

You want to run OSPF inside a GRE tunnel on Junos. After configuring the gr- interface, OSPF neighbor adjacencies fail to form. What is a common cause specific to tunnel interfaces in Junos?

A.OSPF network type mismatch, requiring explicit point-to-point setting on the tunnel interface.

B.OSPF authentication must be disabled globally before running over GRE.

C.GRE tunnels do not support OSPF routing protocol traffic.

D.The tunnel interface must be added to a security zone even on routing devices.

AnswerA

GRE interfaces often require explicit point-to-point network type definition for OSPF to form adjacencies correctly.

Why this answer

OSPF defaults to broadcast network type for multi-access interfaces. GRE tunnels on Junos default to a point-to-point or point-to-multipoint behavior depending on configuration, but often require explicit OSPF network-type point-to-point configuration if mismatched with the remote end.

Practice this question →

2

Multi-Selecthard

Which TWO factors must be carefully managed when running OSPF over a GRE tunnel interface on Junos devices? (Choose two.)

Select 2 answers

A.Mandatory activation of BGP multipath routing on the physical transit interface.

B.Interface MTU settings to account for the additional GRE header size and prevent packet drops or fragmentation issues.

C.Configuring MPLS Label Distribution Protocol (LDP) directly on the gr- interface.

D.OSPF network type configuration (such as point-to-point) to ensure proper adjacency formation without requiring a designated router.

E.Enabling proprietary Junos Layer 2 bridging protocols over the gr- interface.

AnswersB, D

Account for the added GRE header by adjusting interface MTU or TCP MSS to prevent packet drops.

Why this answer

Running OSPF over GRE requires managing MTU/fragmentation to avoid dropped packets and configuring the OSPF network type appropriately (such as point-to-point) since GRE does not natively support broadcast or standard multi-access LAN semantics without special mapping.

Practice this question →

3

MCQhard

An administrator configures a GRE tunnel with a tunnel key enabled for security segmentation between two sites. The tunnel comes up, but traffic fails to pass. Debugging reveals that packets are dropped because the receiving router rejects the packets. What is the most probable configuration mismatch?

A.The tunnel key value configured on one router does not match the tunnel key value configured on the remote peer router.

B.The tunnel source address is using a loopback interface instead of a physical interface.

C.The physical interface MTU is set too high on the ingress router.

D.The GRE tunnel interface family inet is missing the primary address.

AnswerA

GRE tunnel keys act as a simple password/identifier; a mismatch results in packet drops at the receiver.

Why this answer

If a tunnel key is configured, both ends must match the key exactly; a mismatch causes the receiver to drop the packets.

Practice this question →

4

MCQhard

You are configuring a GRE tunnel over an IPv4 network, but you want to secure the GRE traffic using IPsec (GRE over IPsec). In Junos, how is this typically structured on SRX or MX devices?

A.GRE and IPsec operate simultaneously as a single unified protocol without nested headers.

B.IPsec encapsulates the traffic first, and GRE wraps the encrypted payload.

C.IPsec replaces the GRE header entirely while maintaining GRE interface numbers.

D.Traffic is encapsulated in GRE, and the resulting GRE packets are subsequently protected by IPsec VPN policies.

AnswerD

GRE over IPsec tunnels route traffic through the GRE interface first, and IPsec crypto maps or security policies encrypt the outer GRE packets.

Why this answer

GRE over IPsec involves encapsulating traffic in GRE first, and then applying IPsec protection to the GRE packets by referencing the tunnel or transport zones/policies.

Practice this question →

5

MCQmedium

You need to monitor the operational status and packet counters of a specific GRE tunnel interface named gr-0/0/0. Which operational mode command should you use?

A.show route forwarding-table interface gr-0/0/0

B.show gre statistics

C.show interfaces gr-0/0/0 extensive

D.show chassis tencent status

AnswerC

This operational command displays comprehensive statistics and status for the GRE tunnel interface.

Why this answer

The command 'show interfaces gr-0/0/0' provides detailed operational status, traffic counters, and encapsulation details for the GRE interface.

Practice this question →

6

MCQhard

On an MX Series router, you configure a GRE tunnel that terminates on a routing instance (VRF). Where must the tunnel source and destination addresses be routable?

A.They must be part of the same subnet as the tunnel payload addresses.

B.They must be routable within the routing table associated with the underlying transport interface (often the master routing instance or specific VRF).

C.They must be resolved via BGP inet-vpn routes only.

D.They must be configured as loopback addresses in the destination VRF exclusively.

AnswerB

The physical transport endpoints of the GRE tunnel must be reachable within the respective routing table context.

Why this answer

For a tunnel to establish successfully, its source and destination IP addresses must be resolvable in the routing table of the routing instance that owns or routes the transport path, or the global routing table depending on where the tunnel interface is bound.

Practice this question →

7

Multi-Selecteasy

Which TWO parameters are mandatory when configuring a basic GRE tunnel interface in Junos? (Choose two)

Select 2 answers

A.GRE keepalive interval timer

B.Tunnel destination IP address

C.Tunnel source IP address

D.Routing protocol authentication key

E.IPsec security association profile

AnswersB, C

The destination IP address is mandatory to identify the remote tunnel endpoint.

Why this answer

Configuring a GRE tunnel requires defining both the tunnel source IP address and the tunnel destination IP address.

Practice this question →

8

Multi-Selecthard

When configuring OSPF over a GRE tunnel on Junos, which TWO configurations ensure stable neighbor adjacencies and correct route propagation? (Choose two)

Select 2 answers

A.Disable IP-IP encapsulation on the OSPF routing options.

B.Ensure that the tunnel interface has a valid IP address matching the subnet of the remote tunnel end.

C.Enable BGP graceful restart on the tunnel interface.

D.Set the OSPF dead interval to 1 second globally.

E.Configure the OSPF network type as point-to-point on the tunnel interface.

AnswersB, E

OSPF requires matching subnet connectivity between peers to form adjacencies.

Why this answer

Setting the OSPF network type to point-to-point and ensuring correct subnet assignment/reachability are critical.

Practice this question →

9

MCQhard

You are troubleshooting an IP-IP tunnel between two Junos devices where packets larger than 1476 bytes are being dropped without generating ICMP fragmentation needed messages. Which configuration command will resolve this issue by ensuring proper MTU adjustment?

A.set security flow tcp-mss mss-adjust 1360

B.set interfaces ip-0/0/0 unit 0 family inet mtu 1500

C.set routing-options encapsulation-limit 0

D.Configure path-mtu-discovery or reduce the tunnel interface MTU to account for the IP-IP encapsulation header size.

AnswerD

Accounting for the outer IP header by reducing tunnel interface MTU or enabling PMTUD ensures packets fit within the physical interface MTU.

Why this answer

Enabling ip-mtu or adjusting the interface MTU, or utilizing tcp-mss parameters on the routing-options or interfaces hierarchy helps prevent fragmentation issues when encapsulating traffic.

Practice this question →

10

MCQhard

When configuring an IP-IP tunnel on Junos, can you run multicast routing protocols like PIM over the IP-IP tunnel?

A.Yes, by enabling PIM sparse-mode directly on the ip-0/0/0 interface.

B.No, because Junos prohibits all routing protocols over IP-IP interfaces.

C.No, because IP-IP does not support multicast or broadcast packet encapsulation, whereas GRE does.

D.Yes, but only if IGMP version 3 is explicitly configured.

AnswerC

IP-IP tunnels only encapsulate unicast IPv4 packets, making multicast protocols like PIM unusable over IP-IP.

Why this answer

Unlike GRE, standard IP-IP encapsulation does not support broadcast or multicast traffic natively because IP-IP is strictly point-to-point unicast encapsulation without multicast destination mapping capabilities.

Practice this question →

11

MCQhard

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

A.family inet

B.family inet6

C.family iso

D.family mpls

AnswerB

When carrying IPv6 traffic through the GRE tunnel, the family under the tunnel unit must be inet6.

Why this answer

Even when carrying IPv6 payload traffic, the core tunnel interface family depends on whether the payload is inet6, while the tunnel source/destination addresses handle the IPv4 transport.

Practice this question →

12

Multi-Selectmedium

Which THREE characteristics distinguish GRE tunnels from IP-IP tunnels on Junos devices? (Choose three)

Select 3 answers

A.IP-IP tunnels require a specialized Routing Engine hardware card.

B.GRE supports optional features like checksums and keys.

C.GRE uses IP protocol number 47 in the outer header.

D.GRE supports encapsulation of multicast and broadcast traffic.

E.IP-IP tunnels inherently encrypt all transmitted data payloads.

AnswersB, C, D

GRE headers can include optional fields such as checksum and key identification.

Why this answer

GRE supports multicast, has an optional checksum/key, and protocol type field, whereas IP-IP is simpler, supports protocol 4, and lacks multicast support.

Practice this question →

13

MCQmedium

You need to configure an IP-IP tunnel on a Junos device. Which interface prefix is designated for IP-IP tunnels in the Junos CLI?

A.mt-

B.ip-

C.gr-

D.st-

AnswerB

ip- is the correct prefix for IP-IP tunnel interfaces in Junos OS.

Why this answer

IP-IP tunnels use the ip- interface prefix.

Practice this question →

14

MCQmedium

You have configured an IP-IP tunnel, but traffic fails to pass through. You run 'show interfaces ip-0/0/0' and see that the output displays 'Input drops' incrementing rapidly. What is the most likely reason?

A.The security policies are blocking the return traffic.

B.Packets exceeding the interface MTU with the Don't Fragment (DF) bit set are being dropped.

C.OSPF hello packets are malformed.

D.The tunnel destination IP address is unreachable via the routing table.

AnswerB

IP-IP encapsulation adds overhead. If packets exceed MTU and DF is set, they are dropped, incrementing input drops.

Why this answer

Input drops on tunnel interfaces frequently occur due to MTU mismatches where incoming encapsulated packets exceed the tunnel interface or physical interface capability and cannot be fragmented because the DF bit is set.

Practice this question →

15

MCQmedium

You are configuring an IP-IP tunnel on a Junos routing platform. Which statement correctly identifies how IP-IP encapsulation differs from GRE encapsulation?

A.IP-IP encapsulation includes a 4-byte protocol header while GRE includes routing and key fields.

B.IP-IP requires a logical tunnel (lt-) interface to function properly.

C.IP-IP encapsulates an IP packet inside another IP packet with an outer IP header and no extra transport header, whereas GRE includes a GRE header.

D.GRE supports only IPv4 payloads while IP-IP supports both IPv4 and IPv6.

AnswerC

IP-IP tunnels wrap the inner IP packet directly in an outer IP header, whereas GRE includes a dedicated GRE header for features like keying and multiple protocols.

Why this answer

IP-IP encapsulation simply encapsulates an IP packet inside another IP packet without any additional headers, whereas GRE adds a specific GRE header.

Practice this question →

16

MCQhard

An administrator has configured a GRE tunnel between two SRX Series devices. Traffic originating from behind the local security zone destined for the tunnel interface is being dropped by default security policies. Which action must be taken to ensure transit traffic can enter the GRE tunnel?

A.Disable flow-based mode globally on the SRX Series device.

B.Enable proxy-arp on the physical interface.

C.Configure a security policy from the internal zone to the zone containing the gr- interface allowing all traffic.

D.Add the gr- interface to the junos-default security zone.

AnswerC

SRX Series devices require explicit security policies to permit traffic entering or leaving tunnel interfaces associated with security zones.

Why this answer

Security zones and policies must permit traffic from the internal security zone to the zone where the gr- interface resides, or configure appropriate self-traffic/zone policies.

Practice this question →

17

MCQeasy

Which protocol number is used in the outer IP header for an IP-IP tunnel?

A.47

B.6

C.4

D.17

AnswerC

Protocol 4 is the standard assigned protocol number for IP-in-IP encapsulation.

Why this answer

IP-IP encapsulation (Protocol 4) encapsulates IPv4 packets inside IPv4 packets.

Practice this question →

18

MCQmedium

You are configuring a GRE tunnel and want to ensure that integrity checks are performed on the transmitted packets to detect corruption. Which parameter should you add to the tunnel configuration?

A.set interfaces gr-0/0/0 unit 0 tunnel verify-integrity

B.set protocols gre checksum-validation enable

C.set interfaces gr-0/0/0 unit 0 tunnel checksum

D.set interfaces gr-0/0/0 unit 0 family inet encryption aes256

AnswerC

The tunnel checksum command enables the optional GRE checksum field for error detection.

Why this answer

Enabling checksum validation ensures integrity checking of the GRE header and payload.

Practice this question →

19

Multi-Selectmedium

Which THREE factors should be considered when planning MTU size for traffic traversing a GRE tunnel? (Choose three)

Select 3 answers

A.Adjusting TCP MSS or tunnel interface MTU helps prevent packet fragmentation and drop issues.

B.The GRE header adds additional byte overhead to every encapsulated packet.

C.GRE tunnels automatically expand physical interface MTU sizes to accommodate overhead.

D.IP-IP headers are larger than GRE headers, requiring larger MTU adjustments.

E.If the Don't Fragment (DF) bit is set and the packet exceeds the path MTU, it will be dropped if fragmentation cannot occur.

AnswersA, B, E

Lowering interface MTU or adjusting TCP MSS prevents MTU-related packet drops.

Why this answer

GRE adds overhead, DF bit behavior matters, and fragmenting or adjusting MSS avoids drops.

Practice this question →

20

MCQhard

An administrator notices that CPU utilization on the Routing Engine spikes when a high volume of transit traffic is directed through a locally terminated GRE tunnel on an MX router without inline services configured. What is the cause?

A.GRE keepalives are transmitting every 1 millisecond.

B.IP-IP tunnels require software processing, whereas GRE is always hardware-switched.

C.The firewall filter logging feature is active on all tunnel interfaces.

D.Tunnel encapsulation/decapsulation is falling back to Routing Engine CPU processing due to missing inline services PIC configuration.

AnswerD

Without hardware-based tunnel services enabled on capable FPCs/PICs, GRE processing can impact the Routing Engine CPU.

Why this answer

Without inline services or appropriate PIC support configured for tunnel services, packet processing for encapsulation and decapsulation may fallback to software processing on the Routing Engine or non-optimized paths.

Practice this question →

21

MCQeasy

Which Junos operational mode command is used to verify the operational status and packet statistics of configured GRE tunnel interfaces?

A.show interfaces gr-0/0/0

B.show protocols tunnel status

C.show chassis tunnels

D.show gre tunnel summary

AnswerA

The show interfaces command followed by the specific gr- interface name displays operational details, traffic counters, and link status.

Why this answer

show interfaces gr-0/0/0 or show interfaces terse displays the operational status of GRE interfaces.

Practice this question →

22

MCQeasy

An administrator needs to configure a basic GRE tunnel between two Junos devices across a routed IP network. Which interface family must be enabled on the physical transit interface to allow the GRE encapsulated packets to traverse the network?

A.family mpls

B.family iso

C.family ccc

D.family inet

AnswerD

The transit interface requires family inet to route the outer IP header of the GRE packet.

Why this answer

The physical transit interface must have the inet family enabled to route the outer IP packets containing the GRE encapsulation.

Practice this question →

23

Multi-Selecteasy

Which TWO statements are true regarding Junos tunnel interface naming conventions? (Choose two)

Select 2 answers

A.GRE tunnel interfaces begin with the prefix 'gr-'.

B.Secure tunnel interfaces (IPsec) begin with the prefix 'gr-'.

C.Logical tunnel interfaces begin with the prefix 'ip-'.

D.IP-IP tunnel interfaces begin with the prefix 'ip-'.

E.All tunnel interfaces must start with the prefix 'xe-'.

AnswersA, D

GRE interfaces are named gr-FPC/PIC/PORT.

Why this answer

GRE tunnels use 'gr-' and IP-IP tunnels use 'ip-' prefixes.

Practice this question →

24

MCQeasy

Which command displays the configuration of a specific GRE tunnel interface in candidate configuration mode on Junos?

A.display interface gr-0/0/0

B.view gr-0/0/0 configuration

C.get interface gr-0/0/0

D.show interfaces gr-0/0/0

AnswerD

This command displays the interface configuration in both operational and configuration modes.

Why this answer

To view the active or candidate configuration for a specific interface, the 'show interfaces gr-0/0/0' command is used in operational mode, or 'show interfaces gr-0/0/0' within configuration mode.

Practice this question →

25

Multi-Selecthard

When troubleshooting a non-functional GRE tunnel on a Junos device, which TWO operational commands or verification steps are most effective for diagnosing the root cause? (Choose two)

Select 2 answers

A.Verify that the routing table has an active path to the remote tunnel destination IP address.

B.Execute 'clear gre statistics' to restart the tunnel encapsulation engine.

C.Check that the RSVP bandwidth reservation is set to 100% on the tunnel interface.

D.Run 'show interfaces gr-0/0/0 extensive' to check for error counters, input/output drops, and correct source/destination parameters.

E.Verify that the BGP AS path matches the tunnel ID.

AnswersA, D

Without reachability to the destination endpoint, the tunnel cannot pass encapsulated traffic.

Why this answer

Checking interface extensive statistics and verifying route reachability to the tunnel destination are primary troubleshooting steps.

Practice this question →

26

MCQmedium

You are troubleshooting a GRE tunnel on a Junos device and notice that traffic passing through the tunnel is being dropped due to packet size exceeding the path MTU. Which command can you use directly on the tunnel interface to prevent fragmentation issues by adjusting the MSS?

A.set interfaces gr-0/0/0 unit 0 tunnel destination 192.168.1.2

B.set protocols gre path-discovery enable

C.set routing-options ip-options drop

D.set interfaces gr-0/0/0 unit 0 family inet mtu 1400

AnswerD

Lowering the MTU on the GRE interface ensures that encapsulated packets do not exceed the path MTU of the underlying physical network.

Why this answer

The mtu and tcp-mss settings on the gr- interface or applying path-mtu-discovery helps manage packet sizes, but setting tcp-mss under the logical interface or routing options is typical. Alternatively, setting tunnel MTU properly is managed on the gr- interface.

Practice this question →

27

MCQmedium

You are troubleshooting a GRE tunnel where traceroute shows packets looping between the tunnel endpoints. Which mechanism prevents routing loops in GRE tunnels on Junos?

A.The GRE header hop-count field dropping packets exceeding 32 hops.

B.Junos automatically shuts down interfaces when a routing loop is detected.

C.An automatic split-horizon check built into the GRE driver.

D.Proper IP routing protocol metric design and TTL decrementing through the encapsulated IP headers.

AnswerD

Routing loops are prevented by proper routing protocol design and IP TTL expiration.

Why this answer

GRE does not have an inherent TTL field in the GRE header itself, but Junos copies or handles the inner IP header TTL, and enabling keepalives or proper routing protocol design prevents loops. However, MTU and TTL settings are critical. Wait, what about tunnel loop prevention features? Tunnel interfaces rely on proper routing configuration, but let's look at options.

Practice this question →

28

Multi-Selecteasy

Which TWO tools or commands can be used on Junos to verify the operational packet flow through a tunnel interface? (Choose two)

Select 2 answers

A.show chassis alarms

B.show interfaces gr-0/0/0 extensive

C.monitor traffic interface gr-0/0/0

D.request system snapshot

E.show route summary

AnswersB, C

Shows detailed packet statistics and drop counters.

Why this answer

show interfaces extensive and monitor traffic interface are standard troubleshooting tools.

Practice this question →

29

Multi-Selecthard

Which TWO actions must be performed when configuring a functional GRE tunnel between two Junos devices over an intermediate IP network? (Choose two.)

Select 2 answers

A.Enable family mpls on the gr- interface.

B.Configure the tunnel source IP address under the gr- interface hierarchy.

C.Configure the tunnel destination IP address under the gr- interface hierarchy.

D.Enable family iso on the physical transit interface.

E.Configure a static route pointing directly to the gr- interface as the next-hop for all internet traffic.

AnswersB, C

The tunnel source address must be explicitly configured to define where outgoing encapsulated packets originate.

Why this answer

Configuring a GRE tunnel requires specifying both the tunnel source and destination IP addresses, and configuring the physical transit interface with family inet.

Practice this question →

30

MCQmedium

You have configured a GRE tunnel, and you want to verify that the tunnel source and destination parameters match what is expected. Which command shows the configured tunnel source and destination addresses?

A.show route protocol gre

B.show interfaces gr-0/0/0 extensive

C.show system tunnel-info

D.show chassis hardware

AnswerB

Extensive output displays detailed encapsulation properties including tunnel source and destination IP addresses.

Why this answer

The 'show interfaces gr-0/0/0 extensive' command displays detailed properties including tunnel source and destination addresses.

Practice this question →

31

Multi-Selectmedium

Which THREE statements regarding IP-IP tunnels on Junos devices are accurate? (Choose three)

Select 3 answers

A.IP-IP encapsulation uses IP protocol number 4.

B.IP-IP tunnels require a mandatory 4-byte key field in the header.

C.IP-IP tunnels provide built-in hardware encryption by default.

D.IP-IP tunnels do not natively support multicast traffic.

E.IP-IP tunnels add an outer IP header to the original IP packet.

AnswersA, D, E

IP-IP protocol number is 4.

Why this answer

IP-IP uses protocol 4, encapsulates IP in IP, and does not support multicast.

Practice this question →

32

MCQhard

When configuring an IP-IP tunnel on a Junos device, what happens to the source and destination IP addresses of the original packet when it is encapsulated?

A.The original packet is placed inside a new outer IP header, leaving the inner IP header and its source/destination unchanged.

B.The original packet has its source address replaced by the tunnel interface address and destination kept intact.

C.The original source and destination IP addresses are overwritten by the tunnel endpoint addresses.

D.The original packet header is stripped and replaced entirely by a GRE header.

AnswerA

IP-IP encapsulation wraps the entire original IP packet with a new outer IP header.

Why this answer

IP-IP encapsulation takes the original IP packet and prepends a new (outer) IP header, leaving the inner IP header completely intact.

Practice this question →

33

MCQeasy

Which interface naming convention is used by Junos OS to identify a generic routing encapsulation (GRE) tunnel interface?

A.gr-

B.lt-

C.st-

D.ip-

AnswerA

The gr- prefix specifically designates a GRE tunnel interface in Junos OS.

Why this answer

Junos uses the gr- prefix for GRE tunnel interfaces.

Practice this question →

34

MCQhard

An IP-IP tunnel is established between Router A and Router B. Traceroute packets traversing the tunnel show that all hops inside the tunnel are hidden. How does IP-IP encapsulation handle TTL by default on Junos?

A.The outer header drops packets with TTL less than 10.

B.IP-IP forces a fixed TTL of 255 on all encapsulated packets.

C.IP-IP tunnels do not decrement TTL.

D.TTL propagation is disabled by default, hiding inner router hops from traceroute.

AnswerD

By default, Junos handles IP-IP tunnels such that the inner TTL is not automatically decremented by or exposed to transit routers unless TTL propagation is enabled.

Why this answer

By default, standard IP-IP encapsulation copies the TTL from the inner IP header to the outer IP header, or decrements it, but standard IP-IP behavior can mask inner routing hops depending on whether TTL propagation is enabled or disabled.

Practice this question →

35

MCQhard

You are designing a network where MTU issues across a GRE tunnel must be mitigated automatically without relying on manual interface MTU adjustments. Which feature can be enabled on Junos routers to dynamically adjust TCP Maximum Segment Size?

A.TCP MSS clamping or adjustment via security options or firewall policers.

B.Automatic GRE header compression.

C.Enabling IPv6 extension header rewriting.

D.Setting the ip-ip encapsulation flag to auto-fragment.

AnswerA

TCP MSS adjustment modifies the MSS option in TCP SYN packets to prevent fragmentation across tunnels.

Why this answer

Junos allows configuring TCP MSS adjustment under security flow or firewall options to ensure TCP segments fit within the tunnel MTU.

Practice this question →

36

Multi-Selectmedium

Which THREE parameters can be optionally configured on a Junos GRE tunnel interface (gr-) to enhance functionality or security? (Choose three.)

Select 3 answers

A.BGP AS override

B.IPsec encryption profile

C.Tunnel key

D.Tunnel checksum

E.IP TOS (Type of Service) inheritance / copying

AnswersC, D, E

A tunnel key can be configured to identify specific traffic streams or provide a basic layer of segmentation.

Why this answer

GRE tunnel configurations support optional features such as tunnel keys, checksums, and explicit routing or TOS/DSCP copying.

Practice this question →

37

MCQeasy

Which interface naming convention is used for an IP-IP tunnel interface in Junos?

A.st-0/0/0

B.ip-0/0/0

C.gr-0/0/0

D.lt-0/0/0

AnswerB

The 'ip-' prefix designates an IP-IP tunnel interface.

Why this answer

IP-IP tunnels use the 'ip-' prefix for their interface names in Junos.

Practice this question →

38

MCQeasy

Which Junos command displays the status of all configured tunnel interfaces on the device?

A.show tunnel summary

B.show routing-options tunnels

C.show interfaces gr*

D.show chassis tunnels

AnswerC

Using wildcards with the show interfaces command displays all GRE interfaces.

Why this answer

The concise or standard interface display command filters or shows tunnel interfaces when specified, such as 'show interfaces gr*'.

Practice this question →

39

Multi-Selectmedium

Which THREE statements are true regarding IP-IP encapsulation in Junos OS? (Choose three.)

Select 3 answers

A.IP-IP tunnels encapsulate an IP packet directly inside another IP packet without adding a GRE header.

B.IP-IP encapsulation introduces less header overhead compared to GRE encapsulation.

C.IP-IP tunnels natively support multi-protocol payloads such as AppleTalk and IPX.

D.IP-IP tunnels require a specialized physical line card with built-in hardware cryptographic engines.

E.IP-IP tunnels utilize interface names starting with the ip- prefix.

AnswersA, B, E

IP-IP is a simpler encapsulation mechanism that wraps an IP packet inside an outer IP header without extra protocol headers like GRE.

Why this answer

IP-IP tunnels encapsulate IP packets within IP packets, use ip- interfaces, and have lower overhead than GRE because they lack extra transport headers.

Practice this question →

40

MCQeasy

What is the primary function of a Junos tunnel interface when used in conjunction with routing protocols?

A.To provide a virtual point-to-point layer 3 link for routing protocol adjacencies across an untrusted or disjointed transport network.

B.To act as a physical layer 2 bridge for VLAN extension without IP addresses.

C.To encrypt all transit traffic by default using hardware-based AES-256.

D.To replace physical interfaces for standard local area network connections.

AnswerA

Tunnel interfaces abstract transport networks, creating direct logical links for routing protocols.

Why this answer

Tunnel interfaces provide a virtual point-to-point link over which routing protocols can establish adjacencies and exchange routing information across an intermediate network.

Practice this question →

41

Multi-Selectmedium

Which THREE parameters are part of a standard Junos GRE tunnel interface configuration block? (Choose three)

Select 3 answers

A.gre-key <number>

B.encapsulation-type ipsec

C.family inet address <ip-address>

D.tunnel destination <ip-address>

E.tunnel source <ip-address>

AnswersC, D, E

Defines the IP address used for routing payload traffic over the tunnel.

Why this answer

Source IP, destination IP, and family inet address are part of the gr- unit configuration.

Practice this question →

42

Multi-Selecteasy

Which TWO Junos configuration hierarchies are involved when setting up a functional GRE tunnel with an IP address? (Choose two)

Select 2 answers

A.edit chassis

B.edit system services tftp

C.edit interfaces gr-0/0/0 unit 0

D.edit firewall

E.edit protocols bgp

AnswersA, C

Chassis configuration is required to enable tunnel services on supported FPCs/PICs.

Why this answer

Interfaces hierarchy configures both the gr- tunnel unit parameters and the physical/transport routing.

Practice this question →

43

Multi-Selecthard

When troubleshooting a non-functional IP-IP or GRE tunnel on a Junos routing device, which TWO diagnostic steps or commands are commonly utilized? (Choose two.)

Select 2 answers

A.Execute request system reboot immediately to restart tunnel daemon processing.

B.Use clear ip-ip statistics to reset tunnel counters.

C.Use show interfaces gr-0/0/0 to verify that the physical and logical link states are up and packet counters are incrementing.

D.Run show chassis routing-engine to check control plane memory utilization of tunnel encapsulation modules.

E.Use ping with the do-not-fragment bit set and appropriate sizing to test path MTU issues across the tunnel.

AnswersC, E

Checking interface status and counters confirms if encapsulation and decapsulation are occurring.

Why this answer

Troubleshooting tunnel interfaces involves checking interface status with show interfaces and verifying packet forwarding using traceroute or ping with appropriate packet sizes and do-not-fragment flags.

Practice this question →

44

MCQeasy

You need to establish a point-to-point GRE tunnel between two Juniper MX Series routers. Which tunnel services type must be defined under the chassis configuration when using aggregated interface inline services?

A.set routing-options interface-routes

B.set system services gre

C.set interfaces gr-0/0/0 unit 0 family inet

D.set chassis fpc 0 pic 0 tunnel-services

AnswerD

This command enables tunnel services on the specified FPC and PIC.

Why this answer

To configure GRE tunnels on MX Series routers using inline services, you must configure the tunnel-services under the chassis FPC settings to enable the physical or virtual services pic capabilities.

Practice this question →

45

MCQeasy

Which Junos configuration statement defines the destination address of a GRE tunnel?

A.destination <ip-address>

B.remote-endpoint <ip-address>

C.peer-address <ip-address>

D.tunnel-destination <ip-address>

AnswerA

The destination keyword specifies the remote peer IP address for the tunnel.

Why this answer

The destination address is defined using the 'destination' keyword under the tunnel configuration of the gr- interface.

Practice this question →

46

MCQmedium

You configure a GRE tunnel between two routers. Router A can ping Router B's tunnel IP address successfully, but devices behind Router A cannot ping devices behind Router B across the tunnel. What is the most likely cause?

A.The GRE tunnel source IP address is configured incorrectly.

B.Missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface.

C.The physical interface MTU is set too high.

D.The gr- interface family inet address is missing.

AnswerB

Tunnel endpoint connectivity confirms the link is up, but remote subnets require routing configuration to direct traffic into the tunnel.

Why this answer

If local tunnel endpoints can reach each other, the tunnel itself is up. Failure of transit traffic behind the routers typically points to missing static or dynamic routing entries pointing to the remote subnet across the tunnel.

Practice this question →

47

MCQhard

An enterprise network uses a GRE tunnel to connect two sites running OSPF. OSPF neighbor adjacencies fail to form over the GRE tunnel even though unicast pings between the tunnel endpoints succeed. Upon inspecting interface configurations, you notice that OSPF hellos are not being received by the peer. What is the most likely cause of this issue?

A.The tunnel source address must match the loopback address exactly on both ends for OSPF to initialize.

B.OSPF hello packets are being sent as multicast, and the underlying network or tunnel configuration does not properly forward multicast traffic or protocol 89 is blocked.

C.Junos requires explicit enabling of dynamic routing inside gr- interfaces using the command set protocols gre ospf enable.

D.GRE tunnels do not support routing protocols such as OSPF under any circumstances.

AnswerB

GRE tunnels pass unicast traffic successfully, but OSPF relies on multicast (224.0.0.5/6) and IP protocol 89, which can be blocked by intermediate firewalls or require specific tunnel mapping.

Why this answer

OSPF multicast traffic needs to be supported across the link, or OSPF network type must be correctly configured (e.g., point-to-point) since GRE does not natively support multicast broadcasts unless configured or handled appropriately, or firewall filters are blocking protocol 89.

Practice this question →

48

MCQmedium

You need to configure a GRE tunnel that requires routing multiple distinct customer VRFs over a single GRE transport link. Which feature should you combine with the GRE tunnel interface?

A.Static routes pointing directly to each customer default gateway.

B.Enabling native VLAN tagging on the gr-0/0/0 unit 0 interface.

C.Multiprotocol BGP (MP-BGP) running over the GRE interface with VPN inet-vpn unicast family.

D.Layer 2 bridging configuration under the gr- interface.

AnswerC

MP-BGP with VPN-IPv4/IPv6 families allows carrying multiple VRF routing tables across a single layer 3 tunnel link.

Why this answer

To transport multiple VRFs across a single tunnel interface, BGP or another routing protocol running over the tunnel must exchange VPN-IPv4/VPN-IPv6 routes, or Logical Systems / Multiprotocol BGP can be utilized.

Practice this question →

49

MCQeasy

What is the official protocol number assigned in the outer IP header for GRE encapsulation?

A.50

B.4

C.47

D.89

AnswerC

Protocol 47 is officially assigned to Generic Routing Encapsulation (GRE).

Why this answer

GRE is designated as IP protocol number 47.

Practice this question →

50

MCQmedium

An administrator wants to verify that packets are successfully traversing a GRE tunnel interface. Which operational command displays packet counters specifically incrementing for the GRE encapsulation and decapsulation processes?

A.show interfaces gr-0/0/0

B.Placeholder note for JSON formatting compliance

C.show security flow session interface gr-0/0/0

D.show chassis traffic-counters

E.show gre traffic

AnswerA

This command displays input and output packet/byte counters for the tunnel interface.

Why this answer

Interface statistics command 'show interfaces gr-0/0/0' shows input and output packet and byte counters.

Practice this question →

51

MCQeasy

When configuring a GRE tunnel source and destination address on a Junos device, which configuration hierarchy is used?

A.set interfaces gr-0/0/0 unit 0 tunnel source <ip> destination <ip>

B.set routing-options tunnels source <ip> destination <ip>

C.set protocols gre source <ip> destination <ip>

D.set system tunnel source <ip> destination <ip>

AnswerA

This is the correct Junos CLI syntax for defining GRE tunnel endpoints.

Why this answer

GRE tunnel source and destination addresses are defined under the specific logical tunnel interface configuration hierarchy.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Tunnels questions.

Start 20-question session