Troubleshooting Scenario Questions

The native VLAN ID does not match the upstream trunk switch.

Why it fails: Native VLAN settings apply to trunk ports, and a mismatch causes traffic to land in the wrong VLAN or spanning tree inconsistencies, while the physical links stay up. This port is an access port, and down/down means there is no physical link at all, so a native VLAN mismatch cannot explain it. Layer 1 has to be fixed before any VLAN setting matters.

BPDU protection has disabled the port due to a loop.

Why it fails: BPDU protection on Junos does disable a port when a BPDU is received, but the switch reports it as blocked or disabled by BPDU protection in spanning tree and Ethernet switching output, a distinct state with its own reason. down/down instead means no link signal, typically a disconnected or faulty cable, a bad transceiver, or a host interface that is off. Check 'show interfaces ge-0/0/1 extensive' first.

The VLAN 100 has not been created under the [edit vlans] hierarchy.

Why it fails: If VLAN 100 were missing, the configuration referencing it would fail to commit or the port would not belong to a working VLAN, but the physical link would still come up, showing up/up. down/down is a Layer 1 condition, no link signal, so a VLAN configuration error cannot explain it. Fix the physical link first, then confirm VLAN membership with 'show vlans' or 'show ethernet-switching interface'.

KEEPALIVE

Why it fails: KEEPALIVE maintains an idle session by refreshing the hold timer; it carries no error code and cannot terminate a peering. Notification performs that teardown. KEEPALIVE is tempting because a flapping session may show missed keepalives, but the error-driven closure itself is signalled by Notification.

UPDATE

Why it fails: UPDATE advertises reachability and withdrawn routes between peers; it never carries an error code or closes a session. Notification does both. UPDATE is tempting because route churn often accompanies flapping, but the message type that reports the error condition and tears the session down is Notification.

OPEN

Why it fails: OPEN negotiates session parameters such as hold time and capabilities at session establishment; it does not carry error codes or terminate an established session. Notification performs that teardown. OPEN is tempting because it is the first message exchanged, but a flapping session's error-driven closure is signalled by Notification, not by capability negotiation.

[edit system services ospf]

Why it fails: OSPF is configured under [edit protocols ospf], not under [edit system services], which holds management daemons such as SSH and Telnet; the area ID is set in the protocols hierarchy. It is tempting because system services groups global daemon settings, but OSPF parameters never reside there.

[edit protocols ospf area <area-id> stub]

Why it fails: The stub statement configures stub-area behaviour, not the area identifier itself; correcting the mismatch requires editing the area number under [edit protocols ospf area], since the stub flag does not set the ID carried in hello packets. It is tempting because it sits inside the area hierarchy, but it governs stubby behaviour only.

[edit routing-options router-id <ip-address>]

Why it fails: The area ID is configured under [edit protocols ospf area], not routing-options, so this path cannot correct the mismatch. The router ID is a separate 32-bit identifier set in routing-options; it would be the right place only when two devices advertise identical router IDs, which is not the logged fault.

Type 2 (Network LSA)

Why it fails: Type 2 LSAs describe the routers attached to a multi-access segment and are generated by the DR; they carry no ASBR reachability between areas. Type 2 is correct when mapping a broadcast or NBMA network's transit subnet and its attached routers.

Type 7 (NSSA External LSA)

Why it fails: Type 7 LSAs flood external routes only within an NSSA and are translated to Type 5 by the ABR; they do not advertise the ASBR's own reachability to other areas. Type 7 is correct when an NSSA's ASBR injects external routes without a backbone connection.

Type 5 (AS-external LSA)

Why it fails: Type 5 LSAs carry external prefix information, not the ASBR's own reachability; routers in other areas learn the ASBR's location through Type 4 summary ASBR LSAs generated by the ABR. Type 5 is correct when flooding redistributed external destinations throughout the OSPF domain.

The GRE tunnel source IP address is configured incorrectly.

Why it fails: An incorrect tunnel source would prevent the tunnel interface from coming up, so Router A could not ping Router B's tunnel IP. It is tempting because source misconfiguration does break GRE, but the successful tunnel ping rules it out; the fault lies in routing or firewall policy for transit traffic.

The physical interface MTU is set too high.

Why it fails: An MTU set too high causes fragmentation or drops for large packets, not total failure of all transit pings. It is tempting because MTU mismatches do break GRE transit traffic, but small pings would still succeed; the stem shows complete transit failure, indicating a routing or policy issue.

The gr- interface family inet address is missing.

Why it fails: If the tunnel interface lacked its inet address, Router A could not ping Router B's tunnel IP at all, so this contradicts the stem. It is tempting because a missing tunnel address does break transit traffic, but the successful tunnel ping proves the address exists.

Duplicate OSPF router IDs in the network

Why it fails: Duplicate router IDs stall the database exchange, but the symptom is repeated ExStart/ExStart negotiation or a router cycling through states, not a persistent ExStart stall. Duplicate IDs are the correct diagnosis when adjacency resets repeatedly during DD exchange.

Different authentication passwords on the links

Why it fails: Authentication mismatch fails at the Hello stage, leaving the neighbour stuck in Down or Init, never ExStart. Checking passwords is right when Hellos are rejected outright or when one side logs authentication failures while the other shows no neighbour.

A mismatch in the OSPF area ID configuration

Why it fails: Area ID mismatch prevents the Hello packets from forming a neighbour relationship at all, so the routers never reach ExStart. Area configuration is the right check when adjacencies stall in Down or Init, or when routers in different areas refuse to form any adjacency.

The Virtual Chassis primary routing engine license has expired.

Why it fails: LACP 'Expired' means no LACPDUs have been received within the period timeout, indicating a link or peer problem, not a licensing issue. A licence expiry would surface as a feature or commit error, and Virtual Chassis licensing is unrelated to LACP timers.

The Junos software license for aggregated Ethernet has expired.

Why it fails: The 'Expired' state is an LACP protocol timer condition: no LACPDUs were received from the peer within the period defined by the short or long timeout, so the member link is removed from the bundle. It does not reference Junos licensing. Feature-based licence expiry would instead block aggregated Ethernet configuration entirely, producing a commit or configuration error rather than an LACP status.

The GRES synchronization timer has timed out.

Why it fails: GRES synchronisation concerns graceful Routing Engine switchover on chassis-based devices, not LACP packet exchange. The 'Expired' state arises when LACP PDUs stop arriving within the periodic interval, so the peer ages out the aggregation. GRES timers would be the relevant consideration when tuning Routing Engine failover behaviour, not link aggregation negotiation.

Configure GRES on the replacement switch using the CLI before connecting stacking cables.

Why it fails: GRES only preserves routing state during a master switchover and cannot reconcile mismatched Junos images or Virtual Chassis port hardware errors. It tempts because GRES is configured on members in high-availability designs, so it would be the right step when planning graceful Routing Engine failover, not for image incompatibility.

Disable LACP on all aggregated links across the stack.

Why it fails: LACP operates on aggregated Ethernet bundles and has no bearing on Virtual Chassis image compatibility or port mismatch errors, so disabling it changes nothing about the boot failure. It tempts because link aggregation faults can destabilise a stack, so it would be relevant if the symptom were member links flapping rather than incompatible Junos images.

Factory reset all existing switches in the Virtual Chassis via the master console.

Why it fails: Factory resetting every existing member erases the working configuration and disrupts production traffic, while the fault lies only with the new member's Junos image and port settings. It tempts because resets do clear corrupted state, so it would suit a chassis-wide configuration corruption, not one incompatible switch.

The interface automatically recovers after a default hold-down timer of 300 seconds.

Why it fails: Shutdown places the port in an err-disabled state requiring manual intervention; no 300-second hold-down timer exists, so it cannot self-recover. The timer idea tempts because other violation actions, such as drop, allow continued operation, but shutdown demands administrative clearance.

The interface drops violating packets but remains operationally up until manually disabled.

Why it fails: Dropping violating packets while staying up describes the drop action, not shutdown, which err-disables the port. It is tempting because drop preserves connectivity for legitimate traffic, and would be correct where only offending frames should be discarded without taking the link down.

The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.

Why it fails: Shutdown err-disables the interface outright; it does not block and periodically flush its MAC table. That behaviour resembles other port-security responses, making it tempting, but the configured action simply disables the port until an administrator clears it.

Identical system IDs configured on both neighboring nodes

Why it fails: System IDs must be unique across the entire IS-IS routing domain; identical system IDs cause conflicts.

Identical DIS priority values on multi-access networks

Why it fails: DIS priorities do not need to be identical; the highest priority wins the election regardless.

The local router has successfully completed the TCP handshake and is waiting for an Open message.

Why it fails: The TCP handshake completing and awaiting an Open message describes OpenSent, not Active. Active means the router is actively attempting to initiate a TCP connection and has not yet completed the handshake, indicating the peer is unreachable or refusing the connection.

BGP has exchanged Open messages and is currently negotiating capability parameters.

Why it fails: Active means the router is actively attempting to establish a TCP connection to the peer, having not yet received a valid response; Open messages are exchanged later, in OpenSent and OpenConfirm. It is tempting because capability negotiation does occur during session setup, but that happens after the TCP handshake completes.

The BGP session is fully operational and exchanging Keepalive messages.

Why it fails: Active is a non-established BGP state where the router is retrying TCP connection attempts; it is not the Established state. Established is the correct answer for a fully operational session exchanging Keepalive and Update messages, which is what the engineer would see on a healthy peer.

The tunnel source address is using a loopback interface instead of a physical interface.

Why it fails: Sourcing the tunnel from a loopback is normal and valid practise, provided the loopback is advertised and reachable; it does not cause the receiver to reject packets. It is tempting because loopback sourcing can break tunnels when routing is absent, and would be correct if the loopback prefix were unreachable.

The physical interface MTU is set too high on the ingress router.

Why it fails: An excessive physical MTU causes fragmentation or silent drops of oversized packets, not receiver-side rejection of GRE packets; the stem attributes drops to the receiving router. It is tempting because MTU mismatches commonly break GRE, and it would be correct if the symptom were fragmentation or PMTU black-holing rather than rejection.

The GRE tunnel interface family inet is missing the primary address.

Why it fails: A missing primary address on the tunnel interface prevents the tunnel from being usable at all, so it would not come up; the stem states the tunnel is up. It is tempting because addressing errors do break GRE forwarding, and it would be correct if the interface showed no inet address and the tunnel remained down.

BGP AS path settings on core interfaces

Why it fails: BGP AS path attributes govern inter-domain route selection, not Layer 2 forwarding, so they cannot explain a missing bridge-table entry. This is tempting because BGP troubleshooting does involve path verification, but that applies to routing-table issues on core interfaces, not MAC learning.

Routing protocol adjacencies in the default VRF

Why it fails: Routing protocol adjacencies populate the routing table, not the bridge table, so they are irrelevant to MAC learning failures. It is tempting because adjacency checks are standard when diagnosing traffic loss, yet they belong to Layer 3 reachability troubleshooting rather than Layer 2 forwarding-table investigation.

Disable LACP on all aggregated links across the stack.

Why it fails: LACP state on aggregated links is irrelevant to software version compatibility, which is the precaution the scenario demands. Disabling LACP is tempting because it is a real troubleshooting step for link aggregation issues, and would be correct when a member's bundled interfaces fail to form.

Format the flash memory of the existing master switch before inserting the replacement.

Why it fails: Formatting the existing master's flash would erase its Junos OS and configuration, breaking the surviving chassis rather than preparing the replacement. Formatting is tempting because it is a genuine recovery step for corrupted installations, and would be correct when a single switch's software is unusable.

Change the root password of the replacement switch to match the backup routing engine.

Why it fails: Matching root passwords has no bearing on Virtual Chassis formation; the replacement must instead run a Junos OS version compatible with the existing members. Password alignment is tempting because it is a real prerequisite for some management-plane operations, and would matter when merging devices into shared authentication.

The ASBR that originally injected the external route

Why it fails: The ASBR originates Type 7 LSAs inside the NSSA but cannot translate them, since translation requires an interface in the backbone. It is tempting because the ASBR created the external route. The NSSA ABR, not the ASBR, converts Type 7 into Type 5.

Any internal router residing within the NSSA backbone

Why it fails: Internal routers inside the NSSA hold no Type 5 capability and never perform translation; only the NSSA ABR does. The idea tempts because internal routers do flood Type 7 LSAs within the area. The ABR, not an internal router, converts Type 7 to Type 5 toward the backbone.

The designated router (DR) of the NSSA segment

Why it fails: The DR manages adjacency and LSA flooding on the segment, but Type 7 to Type 5 translation is an area-border function, not a broadcast-segment role. Confusing the two is tempting because the DR does originate network LSAs. Only the NSSA ABR performs the translation.