Courseiva

CCNA Tunnels Questions

36 questions · Tunnels topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
Multi-Selecthard

Which TWO factors must be carefully managed when running OSPF over a GRE tunnel interface on Junos devices? (Choose two.)

Select 2 answers
A.Mandatory activation of BGP multipath routing on the physical transit interface.
B.Interface MTU settings to account for the additional GRE header size and prevent packet drops or fragmentation issues.
C.Configuring MPLS Label Distribution Protocol (LDP) directly on the gr- interface.
D.OSPF network type configuration (such as point-to-point) to ensure proper adjacency formation without requiring a designated router.
E.Enabling proprietary Junos Layer 2 bridging protocols over the gr- interface.
AnswersB, D

GRE encapsulation consumes bytes from the payload budget, so the tunnel interface MTU must be lowered to match the physical path MTU minus GRE overhead; otherwise OSPF hello packets and LSAs exceed the path MTU and are dropped or fragmented.

Why this answer

Option B is correct because a GRE tunnel adds an outer IP header (typically 24 bytes for GRE + IPv4, or more with additional options), which reduces the effective payload MTU on the gr- interface; if the tunnel interface MTU is not lowered accordingly (e.g., to 1476 or less) or TCP MSS clamping is not applied, OSPF hello packets and other traffic can be dropped or fragmented, breaking adjacency. Option D is correct because OSPF over a GRE tunnel is normally configured with the point-to-point network type, since a point-to-point link does not require DR/BDR election and avoids the multicast/unicast adjacency issues that can arise on a broadcast-type tunnel; this ensures reliable adjacency formation between the two tunnel endpoints. Option A is not required because BGP multipath on the physical transit interface is unrelated to running OSPF over GRE and is not a prerequisite for OSPF adjacency.

Option C is incorrect because LDP is an MPLS label distribution protocol and is not configured on a gr- interface to run OSPF. Option E is incorrect because proprietary Junos Layer 2 bridging protocols are not used to run OSPF over GRE.

Exam trap

The trap is assuming OSPF over GRE requires additional protocols like BGP or MPLS — candidates may overcomplicate the design and pick options A or C, missing the fundamental MTU and network-type considerations.

Practice this question →
2
MCQhard

An administrator configures a GRE tunnel with a tunnel key enabled for security segmentation between two sites. The tunnel comes up, but traffic fails to pass. Debugging reveals that packets are dropped because the receiving router rejects the packets. What is the most probable configuration mismatch?

A.The tunnel key value configured on one router does not match the tunnel key value configured on the remote peer router.
B.The tunnel source address is using a loopback interface instead of a physical interface.
C.The physical interface MTU is set too high on the ingress router.
D.The GRE tunnel interface family inet is missing the primary address.
AnswerA

GRE tunnel keys are carried in the GRE header and validated on receipt. If the local and remote key values differ, the receiving router discards the encapsulated packets, so the tunnel shows up but no payload traffic passes. Matching keys on both peers resolves the drop.

Why this answer

GRE tunnel keys are used to multiplex multiple GRE tunnels between the same pair of endpoints, and both ends must be configured with the same key value for the receiver to accept the encapsulated packets. If the keys mismatch, the receiving router drops the packets because it cannot match them to the expected tunnel, even though the tunnel interface itself shows as up. This is the classic cause of 'tunnel up but traffic fails' with GRE keys.

Exam trap

JNCIS-ENT often tests 'tunnel up but no traffic' scenarios — candidates chase MTU or routing issues, but the specific mention of 'tunnel key enabled' points directly to a key mismatch as the intended answer.

How to eliminate wrong answers

Option B is wrong because using a loopback as the tunnel source is a common and valid design for redundancy — it does not cause packet drops by itself. Option C is wrong because an MTU that is too high typically causes fragmentation or PMTUD issues, not outright rejection of packets by the receiving router. Option D is wrong because a missing primary address on the tunnel interface would prevent the tunnel from coming up or routing traffic, but the question states the tunnel is up, so this is not the cause.

Practice this question →
3
MCQhard

You are configuring a GRE tunnel over an IPv4 network, but you want to secure the GRE traffic using IPsec (GRE over IPsec). In Junos, how is this typically structured on SRX or MX devices?

A.GRE and IPsec operate simultaneously as a single unified protocol without nested headers.
B.IPsec encapsulates the traffic first, and GRE wraps the encrypted payload.
C.IPsec replaces the GRE header entirely while maintaining GRE interface numbers.
D.Traffic is encapsulated in GRE, and the resulting GRE packets are subsequently protected by IPsec VPN policies.
AnswerD

GRE first encapsulates the payload, producing outer GRE packets; IPsec VPN policies then encrypt and authenticate those GRE packets as tunnel traffic. This layered order satisfies the requirement to secure GRE traffic, unlike transport mode, which would protect only the inner payload and leave GRE headers exposed.

Why this answer

In a GRE over IPsec configuration, traffic is first encapsulated in GRE, and then the resulting GRE packets are protected by IPsec VPN policies. This means the GRE header is added first, and then IPsec encrypts the entire GRE packet. This structure allows dynamic routing protocols to run over GRE while being secured by IPsec.

Exam trap

The trap is the order of encapsulation; candidates may think IPsec wraps first, but GRE must encapsulate before IPsec to allow multicast and routing protocols over the tunnel.

How to eliminate wrong answers

Option A is wrong because GRE and IPsec are separate protocols; they do not merge into a single unified protocol. Option B is wrong because IPsec does not encapsulate first; GRE encapsulation occurs before IPsec encryption. Option C is wrong because IPsec does not replace the GRE header; both headers are present in the final packet.

Practice this question →
4
MCQhard

On an MX Series router, you configure a GRE tunnel that terminates on a routing instance (VRF). Where must the tunnel source and destination addresses be routable?

A.They must be part of the same subnet as the tunnel payload addresses.
B.They must be routable within the routing table associated with the underlying transport interface (often the master routing instance or specific VRF).
C.They must be resolved via BGP inet-vpn routes only.
D.They must be configured as loopback addresses in the destination VRF exclusively.
AnswerB

GRE encapsulates the payload, then forwards the resulting packet using the outer header, so tunnel endpoints must resolve in the transport table. This satisfies the stem's constraint: the source and destination addresses must be routable in the routing table associated with the underlying transport interface.

Why this answer

For a GRE tunnel terminating in a routing instance (VRF), the tunnel source and destination addresses must be routable within the routing table associated with the underlying transport interface. This is typically the master routing instance or a specific VRF that has reachability to the tunnel endpoints. The tunnel itself can be in a different VRF, but the transport must be resolvable.

Exam trap

JNCIS-ENT often tests the separation of transport and tunnel routing instances; candidates may incorrectly assume that tunnel endpoints must be in the same VRF as the tunnel interface or that they require BGP VPN routes.

How to eliminate wrong answers

Option A is wrong because tunnel source/destination addresses do not need to be in the same subnet as payload addresses; they only need to be reachable. Option C is wrong because BGP inet-vpn routes are not the only way to resolve tunnel endpoints; any routing protocol or static route can provide reachability. Option D is wrong because loopback addresses in the destination VRF are not required; the addresses just need to be routable in the transport routing table.

Practice this question →
5
Multi-Selecteasy

Which TWO parameters are mandatory when configuring a basic GRE tunnel interface in Junos? (Choose two)

Select 2 answers
A.GRE keepalive interval timer
B.Tunnel destination IP address
C.Tunnel source IP address
D.Routing protocol authentication key
E.IPsec security association profile
AnswersB, C

A GRE tunnel requires the destination address to identify the remote tunnel endpoint, encapsulating the original packet inside a new IP header. Junos mandates both source and destination for the tunnel interface to come up, since the destination defines where encapsulated traffic is sent. Without it, the tunnel interface remains down.

Why this answer

Option B (Tunnel destination IP address) is mandatory because a GRE tunnel interface must know the remote endpoint to encapsulate and forward packets to; in Junos this is configured with the tunnel destination statement under the gr- interface. Option C (Tunnel source IP address) is also mandatory because the local tunnel endpoint must be identified so return traffic and the outer IP header use a reachable, routable source address, configured via the tunnel source statement. Together, source and destination define the two endpoints of the point-to-point GRE tunnel and are the minimum required parameters.

Option A (GRE keepalive interval timer) is optional, as keepalives are not required for basic GRE operation and can be omitted. Option D (Routing protocol authentication key) is unrelated to GRE tunnel interface configuration and belongs to routing protocol security. Option E (IPsec security association profile) is not required for basic GRE, since GRE itself provides no encryption and IPsec would only be added for secure GRE scenarios.

Exam trap

The trap here is confusing optional tunnel features (keepalives, IPsec, authentication) with the two truly mandatory parameters — source and destination — that define the tunnel endpoints.

Practice this question →
6
MCQhard

When configuring an IP-IP tunnel on Junos, can you run multicast routing protocols like PIM over the IP-IP tunnel?

A.Yes, by enabling PIM sparse-mode directly on the ip-0/0/0 interface.
B.No, because Junos prohibits all routing protocols over IP-IP interfaces.
C.No, because IP-IP does not support multicast or broadcast packet encapsulation, whereas GRE does.
D.Yes, but only if IGMP version 3 is explicitly configured.
AnswerC

IP-IP encapsulates only unicast IP payloads, adding an outer IP header with no support for multicast or broadcast addressing. GRE carries a protocol type field and supports multicast, so PIM cannot run over IP-IP but can over GRE.

Why this answer

IP-IP tunnels (ip-x/x/x interfaces on Junos) encapsulate only unicast IP packets inside an outer IP header, per RFC 2003. They do not carry the Ethernet-like or multicast/broadcast semantics that PIM requires to form adjacencies and exchange hello messages. GRE, by contrast, supports multicast and broadcast encapsulation, which is why PIM and other multicast routing protocols can run over GRE but not over IP-IP.

Exam trap

JNCIS-ENT often tests the assumption that 'a tunnel is a tunnel' — candidates forget that IP-IP is unicast-only while GRE supports multicast/broadcast, and pick the 'yes, just enable PIM' answer.

How to eliminate wrong answers

Option A is wrong because PIM sparse-mode cannot form adjacencies over an ip-0/0/0 interface — the tunnel simply cannot transport the multicast hellos and join/prune messages PIM needs. Option B is wrong because Junos does not prohibit all routing protocols over IP-IP; unicast protocols like OSPF, IS-IS, and BGP can run over IP-IP tunnels — only multicast-dependent protocols cannot. Option D is wrong because IGMP version 3 is a host-to-router protocol for group membership and has no bearing on whether the IP-IP tunnel can encapsulate multicast traffic in the first place.

Practice this question →
7
MCQhard

You are configuring a GRE tunnel carrying IPv6 traffic over an IPv4 transport network (GRE over IPv4). Which interface family must be configured under the gr- interface unit?

A.family inet
B.family inet6
C.family iso
D.family mpls
AnswerB

GRE over IPv4 encapsulates the IPv6 payload, so the tunnel's logical unit must carry the inner protocol. Configuring family inet6 on gr-0/0/0/0 assigns the IPv6 address and enables IPv6 processing across the tunnel, satisfying the requirement to pass IPv6 traffic over the IPv4 transport.

Why this answer

The GRE tunnel is being used to carry IPv6 traffic, so the logical unit must be configured with family inet6 to process IPv6 packets. The transport is IPv4, but that is handled by the tunnel's source/destination addresses configured under the tunnel parameters, not by the unit's family. Configuring family inet6 on the gr- interface unit enables IPv6 forwarding, addressing, and protocol processing inside the tunnel.

Exam trap

JNCIS-ENT often tests the distinction between the tunnel transport family and the payload family, tricking candidates into selecting family inet simply because the outer transport is IPv4.

How to eliminate wrong answers

Option A is wrong because family inet would configure the unit to process IPv4 payloads, not the IPv6 traffic the tunnel is meant to carry. Option C is wrong because family iso is used for IS-IS routing over OSI CLNP, which is unrelated to carrying IPv6 over GRE. Option D is wrong because family mpls is used for MPLS label switching over the interface, not for IPv6 payload forwarding.

Practice this question →
8
Multi-Selectmedium

Which THREE characteristics distinguish GRE tunnels from IP-IP tunnels on Junos devices? (Choose three)

Select 3 answers
A.IP-IP tunnels require a specialized Routing Engine hardware card.
B.GRE supports optional features like checksums and keys.
C.GRE uses IP protocol number 47 in the outer header.
D.GRE supports encapsulation of multicast and broadcast traffic.
E.IP-IP tunnels inherently encrypt all transmitted data payloads.
AnswersB, C, D

GRE's header carries optional fields, including checksum and key, that IP-IP lacks entirely. This satisfies the stem's requirement to distinguish the two encapsulation types: IP-IP adds only a bare outer IP header, offering no such optional verification or identification fields.

Why this answer

Option B is correct because GRE headers include optional fields such as Checksum and Key that IP-IP (IP protocol 4) headers do not provide, allowing integrity verification and tunnel identification. Option C is correct because GRE is identified by IP protocol number 47 in the outer IP header, whereas IP-IP uses protocol number 4. Option D is correct because GRE can carry multicast and broadcast traffic by encapsulating it in a unicast GRE packet, while IP-IP is limited to unicast IP payloads.

Option A is wrong because IP-IP tunnels are a software feature on Junos and do not require a specialized Routing Engine hardware card. Option E is wrong because IP-IP provides encapsulation only and does not inherently encrypt payloads; encryption would require IPsec.

Exam trap

JNCIS-ENT often tests the distinction between GRE and IP-IP by emphasizing GRE's optional features and protocol number, while candidates may incorrectly assume IP-IP provides encryption or requires special hardware.

Practice this question →
9
MCQmedium

You need to configure an IP-IP tunnel on a Junos device. Which interface prefix is designated for IP-IP tunnels in the Junos CLI?

A.mt-
B.ip-
C.gr-
D.st-
AnswerB

Junos reserves the ip- prefix for IP-IP tunnel interfaces, created as ip-0/0/0, distinct from gr- (GRE) and gre-. Configuring the tunnel logical unit under this interface type satisfies the requirement to build an IP-IP tunnel in the CLI.

Why this answer

In Junos, IP-IP tunnels are configured on interfaces with the 'ip-' prefix (e.g., ip-0/0/0). This naming convention distinguishes IP-IP tunnels from other tunnel types like GRE (gr-), multicast tunnels (mt-), and generic routing encapsulations. The 'ip-' interface is specifically designated for IP-in-IP encapsulation as defined in RFC 2003.

Exam trap

JNCIS-ENT often tests the specific interface prefix for each tunnel type; candidates frequently confuse 'ip-' with 'gr-' or 'mt-' because they don't memorize the Junos naming conventions.

How to eliminate wrong answers

Option A is wrong because 'mt-' interfaces are used for multicast tunnels, not IP-IP tunnels. Option C is wrong because 'gr-' interfaces are used for GRE tunnels, which encapsulate a wider variety of protocols. Option D is wrong because 'st-' interfaces are used for source-and-destination-based tunnels, not IP-IP.

Practice this question →
10
MCQmedium

You have configured an IP-IP tunnel, but traffic fails to pass through. You run 'show interfaces ip-0/0/0' and see that the output displays 'Input drops' incrementing rapidly. What is the most likely reason?

A.The security policies are blocking the return traffic.
B.Packets exceeding the interface MTU with the Don't Fragment (DF) bit set are being dropped.
C.OSPF hello packets are malformed.
D.The tunnel destination IP address is unreachable via the routing table.
AnswerB

IP-IP tunnels add an outer header, reducing effective MTU. Packets with the DF bit set that exceed this reduced MTU cannot be fragmented and are dropped, incrementing input drops. This matches the observed symptom on the tunnel interface.

Why this answer

Input drops incrementing rapidly on an IP-IP tunnel interface typically indicate that packets are being dropped due to MTU issues. When a packet exceeds the tunnel interface MTU and has the Don't Fragment (DF) bit set, the router cannot fragment it and must drop it, often sending an ICMP 'fragmentation needed' message. This is a common cause of input drops on tunnel interfaces.

Exam trap

The trap is overlooking MTU and DF-bit issues — candidates may blame routing or security policies, but input drops on a tunnel interface often point to fragmentation problems.

How to eliminate wrong answers

Option A is wrong because security policies blocking return traffic would cause output drops or session failures, not input drops on the tunnel interface. Option C is wrong because malformed OSPF hello packets would not cause input drops; they would be ignored or cause adjacency issues. Option D is wrong because an unreachable tunnel destination would prevent the tunnel interface from being up, and you would see no traffic, not input drops.

Practice this question →
11
MCQmedium

You are configuring an IP-IP tunnel on a Junos routing platform. Which statement correctly identifies how IP-IP encapsulation differs from GRE encapsulation?

A.IP-IP encapsulation includes a 4-byte protocol header while GRE includes routing and key fields.
B.IP-IP requires a logical tunnel (lt-) interface to function properly.
C.IP-IP encapsulates an IP packet inside another IP packet with an outer IP header and no extra transport header, whereas GRE includes a GRE header.
D.GRE supports only IPv4 payloads while IP-IP supports both IPv4 and IPv6.
AnswerC

IP-IP prepends only an outer IP header, using protocol number 4, with no transport or GRE header between outer and inner packets. GRE inserts its own GRE header, adding fields such as protocol type and optional keys, making it the axis of difference.

Why this answer

IP-IP tunneling (RFC 2003) prepends only an outer IPv4 header to the original packet, with protocol number 4 indicating IP-in-IP. GRE (RFC 2784/2890) inserts a GRE header between the outer IP header and the payload, adding fields like protocol type, checksum, key, and sequence number. This makes GRE more feature-rich but with more overhead (typically 24 bytes vs 20 for IP-IP).

Exam trap

The trap is assuming IP-IP has some extra header (option A) or that GRE is more limited than IP-IP (option D); candidates must remember IP-IP is the minimal encapsulation and GRE is the feature-rich one.

How to eliminate wrong answers

Option A is wrong because IP-IP has no extra protocol header beyond the outer IP header — the '4-byte protocol header' description actually resembles GRE's base header, not IP-IP's. Option B is wrong because IP-IP tunnels on Junos use gr- or ip- interfaces depending on configuration; the lt- (logical tunnel) interface is used for other tunnel types like PIM or DVMRP, not standard IP-IP. Option D is wrong because GRE can carry IPv4, IPv6, and even non-IP protocols (via EtherType), while IP-IP is limited to IP payloads — the statement reverses the actual capabilities.

Practice this question →
12
MCQhard

An administrator has configured a GRE tunnel between two SRX Series devices. Traffic originating from behind the local security zone destined for the tunnel interface is being dropped by default security policies. Which action must be taken to ensure transit traffic can enter the GRE tunnel?

A.Disable flow-based mode globally on the SRX Series device.
B.Enable proxy-arp on the physical interface.
C.Configure a security policy from the internal zone to the zone containing the gr- interface allowing all traffic.
D.Add the gr- interface to the junos-default security zone.
AnswerC

SRX Series devices evaluate transit traffic against security policies between zones. Because the gr- interface sits in its own zone, a policy from the internal zone to that tunnel zone permitting all traffic is required for transit packets to enter.

Why this answer

On SRX Series devices in flow mode, all transit traffic — including traffic destined to a tunnel interface — is subject to security policy evaluation. The gr- interface belongs to a security zone, and traffic from the internal zone to that tunnel zone must be explicitly permitted by a security policy. Without this policy, the default deny-all policy drops the traffic before it can be encapsulated and sent through the GRE tunnel.

Exam trap

JNCIS-ENT often tests the assumption that tunnel interfaces bypass security policy — candidates forget that on SRX flow mode, gr- interfaces are zone-bound and require explicit policies just like any other interface.

How to eliminate wrong answers

Option A is wrong because disabling flow-based mode globally would convert the SRX to packet mode, which removes stateful inspection and is not a valid or desirable fix for a policy issue — it also breaks most SRX security features. Option B is wrong because proxy-arp on the physical interface is unrelated to security policy evaluation for tunnel transit traffic; it only affects ARP resolution behavior. Option D is wrong because adding the gr- interface to the junos-default security zone is not a supported or recommended practice — the junos-default zone is reserved for management-plane traffic and does not bypass policy evaluation for transit traffic.

Practice this question →
13
MCQeasy

Which protocol number is used in the outer IP header for an IP-IP tunnel?

A.47
B.6
C.4
D.17
AnswerC

IP-in-IP encapsulation carries the inner packet as payload of an outer IPv4 header whose Protocol field is set to 4, the assigned value for IPv4 encapsulation. This identifies the tunnel payload to the receiving endpoint.

Why this answer

IP-IP tunneling (RFC 2003) encapsulates an inner IP packet inside an outer IP header with the protocol field set to 4, which is the IANA-assigned protocol number for IP-in-IP encapsulation. This is distinct from GRE (protocol 47), TCP (6), and UDP (17), making 4 the correct answer for IP-IP tunnels.

Exam trap

JNCIS-ENT often tests memorization of IP protocol numbers — candidates confuse GRE (47) with IP-IP (4) or pick TCP/UDP numbers, so precise recall of the IANA protocol registry is required.

How to eliminate wrong answers

Option A is wrong because protocol 47 is GRE (Generic Routing Encapsulation), not IP-IP — GRE adds its own header between the outer IP header and the payload. Option B is wrong because protocol 6 is TCP, a transport-layer protocol, not a tunneling encapsulation protocol. Option D is wrong because protocol 17 is UDP, also a transport-layer protocol and unrelated to IP-IP encapsulation.

Practice this question →
14
MCQmedium

You are configuring a GRE tunnel and want to ensure that integrity checks are performed on the transmitted packets to detect corruption. Which parameter should you add to the tunnel configuration?

A.set interfaces gr-0/0/0 unit 0 tunnel verify-integrity
B.set protocols gre checksum-validation enable
C.set interfaces gr-0/0/0 unit 0 tunnel checksum
D.set interfaces gr-0/0/0 unit 0 family inet encryption aes256
AnswerC

The `tunnel checksum` parameter enables GRE header and payload checksumming, satisfying the requirement to detect packet corruption in transit. Unlike `tunnel key`, which only provides weak sender identification, checksums verify data integrity end-to-end. This directly addresses the stem's integrity-check constraint for the gr-0/0/0 tunnel interface.

Why this answer

The tunnel checksum parameter enables GRE header checksumming, which adds a checksum to the GRE header so the receiving endpoint can detect corruption in the encapsulated packet. On Junos, this is configured with 'set interfaces gr-0/0/0 unit 0 tunnel checksum'. It is the only option that maps to a real Junos GRE integrity feature.

Exam trap

The trap here is confusing GRE's optional checksum feature with IPsec integrity or with non-existent global 'protocols gre' knobs, leading candidates to pick plausible-sounding but invalid Junos commands.

How to eliminate wrong answers

Option A is wrong because 'tunnel verify-integrity' is not a valid Junos GRE configuration statement — there is no such parameter. Option B is wrong because 'protocols gre checksum-validation' does not exist in Junos; GRE checksum is an interface-level tunnel parameter, not a global protocol setting. Option D is wrong because 'family inet encryption aes256' is not valid syntax and encryption is not a GRE integrity mechanism — IPsec would be used for confidentiality, not GRE checksums.

Practice this question →
15
Multi-Selectmedium

Which THREE factors should be considered when planning MTU size for traffic traversing a GRE tunnel? (Choose three)

Select 3 answers
A.Adjusting TCP MSS or tunnel interface MTU helps prevent packet fragmentation and drop issues.
B.The GRE header adds additional byte overhead to every encapsulated packet.
C.GRE tunnels automatically expand physical interface MTU sizes to accommodate overhead.
D.IP-IP headers are larger than GRE headers, requiring larger MTU adjustments.
E.If the Don't Fragment (DF) bit is set and the packet exceeds the path MTU, it will be dropped if fragmentation cannot occur.
AnswersA, B, E

Adjusting TCP MSS or the tunnel interface MTU directly addresses GRE's 24-byte overhead, which reduces the usable payload and causes fragmentation when the underlying path MTU is exceeded. Lowering MSS on tunnel traffic prevents oversized segments from being encapsulated, satisfying the requirement to avoid fragmentation and drops across the GRE tunnel.

Why this answer

Option A is correct because lowering the tunnel interface MTU or clamping TCP MSS (e.g., ip tcp adjust-mss) prevents encapsulated packets from exceeding the physical path MTU, avoiding fragmentation and drops. Option B is correct because GRE adds a 4-byte GRE header plus a new 20-byte outer IP header (24 bytes total, more with options), which reduces the effective payload MTU inside the tunnel. Option E is correct because when the DF bit is set and a packet exceeds the path MTU, routers cannot fragment it and will drop it, typically returning an ICMP 'fragmentation needed' message.

Option C is wrong because GRE does not automatically enlarge the physical interface MTU; MTU must be manually adjusted on the tunnel interface. Option D is wrong because IP-IP (IP-in-IP) headers are 20 bytes, which is smaller than GRE's 24-byte overhead, not larger.

Exam trap

JNCIS-ENT often tests the misconception that tunnels automatically adjust MTU or that IP-IP overhead exceeds GRE overhead — candidates who do not memorize the exact byte counts (24 for GRE, 20 for IP-IP) pick the wrong option.

Practice this question →
16
MCQhard

An administrator notices that CPU utilization on the Routing Engine spikes when a high volume of transit traffic is directed through a locally terminated GRE tunnel on an MX router without inline services configured. What is the cause?

A.GRE keepalives are transmitting every 1 millisecond.
B.IP-IP tunnels require software processing, whereas GRE is always hardware-switched.
C.The firewall filter logging feature is active on all tunnel interfaces.
D.Tunnel encapsulation/decapsulation is falling back to Routing Engine CPU processing due to missing inline services PIC configuration.
AnswerD

Without an inline services PIC or MPC-based inline processing, GRE encapsulation and decapsulation for locally terminated tunnels is handled in software by the Routing Engine, so high transit volume drives RE CPU utilisation upward, matching the observed spike.

Why this answer

On MX routers, GRE tunnel encapsulation and decapsulation are normally handled by inline services (such as the MS-MPC or MS-DPC) in hardware. Without inline services configured, the RE (Routing Engine) must perform the encapsulation/decapsulation in software, which drives up CPU utilization when transit traffic is tunneled.

Exam trap

JNCIS-ENT often tests the assumption that GRE is always hardware-accelerated — candidates must recognize that on MX without inline services, GRE/IP-IP tunnels fall back to RE software processing, causing CPU spikes.

How to eliminate wrong answers

Option A is wrong because GRE keepalives are not transmitted every 1 millisecond by default — the default keepalive interval is 10 seconds, and even if configured aggressively, it would not cause CPU spikes from high-volume transit traffic. Option B is wrong because the statement is factually inverted: IP-IP tunnels are typically software-processed on many platforms, while GRE can be hardware-switched only when inline services are available; the claim that GRE is 'always hardware-switched' is false. Option C is wrong because firewall filter logging is not enabled by default on tunnel interfaces and would not be the cause of CPU spikes from transit traffic unless explicitly configured.

Practice this question →
17
MCQeasy

Which Junos operational mode command is used to verify the operational status and packet statistics of configured GRE tunnel interfaces?

A.show interfaces gr-0/0/0
B.show protocols tunnel status
C.show chassis tunnels
D.show gre tunnel summary
AnswerA

The 'show interfaces gr-0/0/0' command displays link state, traffic counters and error statistics for the GRE tunnel interface. It directly satisfies the stem's requirement to verify operational status and packet statistics on the configured gr- interface.

Why this answer

The 'show interfaces' command in Junos operational mode displays detailed status, counters, and statistics for any interface, including GRE tunnel interfaces named gr-0/0/0. It shows operational state (up/down), traffic counters, errors, and protocol family information. This is the standard way to verify GRE tunnel health and packet flow on Junos devices.

Exam trap

JNCIS-ENT often tests the specific Junos command syntax for verifying tunnel interfaces; candidates may confuse generic tunnel commands from other vendors with Junos-specific 'show interfaces' syntax.

How to eliminate wrong answers

Option B is wrong because 'show protocols tunnel status' is not a valid Junos command; tunnel status is viewed via interface commands. Option C is wrong because 'show chassis tunnels' does not exist in Junos; chassis commands relate to hardware, not tunnel interfaces. Option D is wrong because 'show gre tunnel summary' is not a Junos command; GRE tunnels are monitored through the generic interface command.

Practice this question →
18
MCQeasy

An administrator needs to configure a basic GRE tunnel between two Junos devices across a routed IP network. Which interface family must be enabled on the physical transit interface to allow the GRE encapsulated packets to traverse the network?

A.family mpls
B.family iso
C.family ccc
D.family inet
AnswerD

GRE encapsulation requires the transit interface to forward the outer IPv4 header, so enabling family inet satisfies the routed IP network constraint. The tunnel interface itself carries family inet or inet6 for payload traffic, but the physical path only needs IPv4 forwarding to deliver encapsulated packets between the Junos peers.

Why this answer

GRE encapsulated packets are IP packets with protocol number 47, so the physical transit interface must have 'family inet' enabled to forward them across the routed IP network. Without family inet, the interface cannot process IPv4 packets, and the GRE tunnel will not come up. This is the fundamental requirement for GRE over an IP-routed underlay.

Exam trap

JNCIS-ENT often tests the confusion between the tunnel interface family (inner payload) and the physical interface family (outer transport), leading candidates to pick family mpls or family ccc incorrectly.

How to eliminate wrong answers

Option A is wrong because family mpls is for MPLS label switching, not for carrying GRE-encapsulated IP packets. Option B is wrong because family iso is for IS-IS routing (OSI protocol), which is unrelated to GRE transport. Option C is wrong because family ccc is for circuit cross-connect (Layer 2 VPN), not for IP-routed GRE transport.

Practice this question →
19
Multi-Selecteasy

Which TWO statements are true regarding Junos tunnel interface naming conventions? (Choose two)

Select 2 answers
A.GRE tunnel interfaces begin with the prefix 'gr-'.
B.Secure tunnel interfaces (IPsec) begin with the prefix 'gr-'.
C.Logical tunnel interfaces begin with the prefix 'ip-'.
D.IP-IP tunnel interfaces begin with the prefix 'ip-'.
E.All tunnel interfaces must start with the prefix 'xe-'.
AnswersA, D

GRE tunnel interfaces in Junos use the 'gr-' prefix, satisfying the question's requirement for a true naming-convention statement. This distinguishes them from IP-IP tunnels, which use 'ip-', and from logical tunnel interfaces, which use 'lt-'. The prefix directly reflects the encapsulation type configured on the physical interface.

Why this answer

Option A is correct because Junos names GRE (Generic Routing Encapsulation) tunnel interfaces with the 'gr-' prefix, for example gr-0/0/0, which is the standard convention for GRE tunnels. Option D is correct because IP-IP (IP-in-IP) tunnel interfaces use the 'ip-' prefix, such as ip-0/0/0, distinguishing them from GRE tunnels. Option B is incorrect because IPsec secure tunnel interfaces are not named with 'gr-'; they are configured as st0 (secure tunnel) interfaces.

Option C is incorrect because logical tunnel (lt-) interfaces use the 'lt-' prefix, not 'ip-'. Option E is incorrect because 'xe-' is the prefix for 10-Gigabit Ethernet physical interfaces, not tunnel interfaces.

Exam trap

JNCIS-ENT often tests interface naming prefixes; candidates may confuse 'st-' with 'gr-' or 'lt-' with 'ip-', leading to incorrect answers.

Practice this question →
20
Multi-Selecthard

When troubleshooting a non-functional GRE tunnel on a Junos device, which TWO operational commands or verification steps are most effective for diagnosing the root cause? (Choose two)

Select 2 answers
A.Verify that the routing table has an active path to the remote tunnel destination IP address.
B.Execute 'clear gre statistics' to restart the tunnel encapsulation engine.
C.Check that the RSVP bandwidth reservation is set to 100% on the tunnel interface.
D.Run 'show interfaces gr-0/0/0 extensive' to check for error counters, input/output drops, and correct source/destination parameters.
E.Verify that the BGP AS path matches the tunnel ID.
AnswersA, D

GRE encapsulates packets to the remote endpoint, so the tunnel interface stays down unless the underlay can reach that destination. Checking the routing table confirms an active route to the remote tunnel address, directly satisfying the requirement to diagnose why the tunnel is non-functional.

Why this answer

Option A is correct because a GRE tunnel cannot come up unless the transport (underlay) network provides a reachable route to the remote tunnel endpoint; verifying an active path to the remote tunnel destination IP in the routing table (e.g., via 'show route <remote-endpoint>') confirms the tunnel source can reach the tunnel destination, which is a prerequisite for GRE encapsulation to succeed. Option D is correct because 'show interfaces gr-0/0/0 extensive' reveals the tunnel interface's operational state, error counters, input/output drops, and the configured source/destination addresses, allowing you to confirm the tunnel endpoints are correctly configured and whether traffic is being dropped or encapsulated improperly. Option B is incorrect because 'clear gre statistics' merely resets counters and does not restart any encapsulation engine, so it does not diagnose the root cause.

Option C is incorrect because GRE is a stateless, non-resource-reserving protocol and does not use RSVP bandwidth reservations, which apply to MPLS TE tunnels. Option E is incorrect because BGP AS paths are unrelated to GRE tunnel IDs, and no such matching requirement exists for GRE tunnel operation.

Exam trap

JNCIS-ENT often tests GRE troubleshooting by mixing in unrelated protocols (RSVP, BGP) and non-existent commands, and candidates who do not know Junos GRE specifics may pick them as plausible-sounding steps.

Practice this question →
21
MCQeasy

When configuring a GRE tunnel on Junos, which two parameters are mandatory under the specific gr- interface hierarchy to establish the tunnel endpoint connectivity?

A.tunnel key and tunnel checksum
B.tunnel source and tunnel destination
C.tunnel metric and tunnel preference
D.tunnel bandwidth and tunnel delay
AnswerB

Under the gr- interface hierarchy, Junos requires both tunnel source and tunnel destination to define the encapsulating endpoints. Without these, the router cannot build the outer IP header, so the GRE tunnel never establishes connectivity.

Why this answer

A GRE tunnel requires at least a source address and a destination address to define the tunnel endpoints.

Practice this question →
22
Multi-Selecteasy

Which TWO tools or commands can be used on Junos to verify the operational packet flow through a tunnel interface? (Choose two)

Select 2 answers
A.show chassis alarms
B.show interfaces gr-0/0/0 extensive
C.monitor traffic interface gr-0/0/0
D.request system snapshot
E.show route summary
AnswersB, C

The extensive form of show interfaces gr-0/0/0 reports tunnel-specific counters, including input and output packet and byte statistics, plus error and discard counts. These confirm whether traffic is actually traversing the generic routing encapsulation tunnel, satisfying the requirement to verify operational packet flow.

Why this answer

Option B, `show interfaces gr-0/0/0 extensive`, is correct because the extensive output for a tunnel interface includes operational and traffic statistics such as input/output packets, bytes, errors, and tunnel-specific counters, which directly confirm whether packets are flowing through the gr-0/0/0 tunnel. Option C, `monitor traffic interface gr-0/0/0`, is correct because it captures live packets traversing the tunnel interface, providing real-time verification of the operational packet flow. Option A, `show chassis alarms`, only reports hardware and system alarm conditions and does not show tunnel packet flow.

Option D, `request system snapshot`, creates a backup copy of the file system and has nothing to do with verifying traffic. Option E, `show route summary`, displays routing table prefix counts and protocol summaries, not per-interface packet flow through a tunnel.

Exam trap

JNCIS-ENT often tests the difference between commands that show interface statistics versus those that show live traffic; candidates may mistakenly choose commands that display routing or system information instead of packet flow.

Practice this question →
23
Multi-Selecthard

Which TWO actions must be performed when configuring a functional GRE tunnel between two Junos devices over an intermediate IP network? (Choose two.)

Select 2 answers
A.Enable family mpls on the gr- interface.
B.Configure the tunnel source IP address under the gr- interface hierarchy.
C.Configure the tunnel destination IP address under the gr- interface hierarchy.
D.Enable family iso on the physical transit interface.
E.Configure a static route pointing directly to the gr- interface as the next-hop for all internet traffic.
AnswersB, C

The gr- interface requires an explicit source address so Junos knows which local IP the outer GRE header uses. Without it, the tunnel cannot form, since the intermediate network needs a routable source for return traffic and the remote peer must match it.

Why this answer

Options B and C are correct because a GRE tunnel interface on Junos requires both a source and a destination address to define the tunnel endpoints: the source is configured with 'set interfaces gr-0/0/0 tunnel source <ip>' and the destination with 'set interfaces gr-0/0/0 tunnel destination <ip>', which are mandatory for the tunnel to encapsulate and forward traffic. Option A is incorrect because family mpls is only needed if MPLS is being run over the tunnel, not for a basic functional GRE tunnel. Option D is incorrect because family iso is used for IS-IS, which is unrelated to establishing a GRE tunnel.

Option E is incorrect because a static route to the gr- interface as next-hop for all internet traffic is a routing design choice, not a requirement for the tunnel itself to function.

Exam trap

JNCIS-ENT often tests the misconception that additional configurations like enabling MPLS or ISO are required for GRE, when in fact only the source and destination addresses are mandatory.

Practice this question →
24
MCQmedium

You have configured a GRE tunnel, and you want to verify that the tunnel source and destination parameters match what is expected. Which command shows the configured tunnel source and destination addresses?

A.show route protocol gre
B.show interfaces gr-0/0/0 extensive
C.show system tunnel-info
D.show chassis hardware
AnswerB

The `show interfaces gr-0/0/0 extensive` command displays the full configuration detail for the GRE interface, including the configured tunnel source and destination addresses. The extensive keyword exposes parameters that the brief output omits, directly satisfying the requirement to verify the tunnel endpoints match expectations.

Why this answer

The command 'show interfaces gr-0/0/0 extensive' displays detailed information about the GRE tunnel interface, including the configured source and destination addresses. The 'extensive' option provides additional parameters beyond the basic interface status, such as tunnel source, destination, and other GRE-specific settings. This is the standard Junos command to verify tunnel configuration parameters on a specific interface.

Exam trap

JNCIS-ENT often tests the distinction between commands that show operational status versus configuration details; candidates may mistakenly choose a command that displays routes or hardware instead of the specific interface configuration.

How to eliminate wrong answers

Option A is wrong because 'show route protocol gre' displays routes learned via GRE, not the tunnel interface configuration. Option C is wrong because 'show system tunnel-info' is not a valid Junos command; there is no such command to display tunnel information. Option D is wrong because 'show chassis hardware' displays hardware inventory and serial numbers, not tunnel configuration.

Practice this question →
25
Multi-Selectmedium

Which THREE statements regarding IP-IP tunnels on Junos devices are accurate? (Choose three)

Select 3 answers
A.IP-IP encapsulation uses IP protocol number 4.
B.IP-IP tunnels require a mandatory 4-byte key field in the header.
C.IP-IP tunnels provide built-in hardware encryption by default.
D.IP-IP tunnels do not natively support multicast traffic.
E.IP-IP tunnels add an outer IP header to the original IP packet.
AnswersA, D, E

IP-IP encapsulation is identified by IP protocol number 4 in the outer header, distinguishing it from GRE (protocol 47) and other tunnelling protocols. This protocol number lets Junos and intermediate devices recognise and de-encapsulate the tunnel payload correctly.

Why this answer

Option A is correct because IP-in-IP encapsulation is identified by IP protocol number 4 in the outer IP header, which is the standard assigned value for IP-IP tunneling. Option D is correct because IP-IP tunnels are point-to-point unicast tunnels and do not natively carry multicast or broadcast traffic without additional mechanisms such as GRE or multicast tunneling configurations. Option E is correct because IP-IP tunneling works by prepending a new outer IP header to the original IP packet, encapsulating the entire original packet as the payload.

Option B is incorrect because the 4-byte key field is a feature of GRE headers, not IP-IP headers, which have no key field. Option C is incorrect because IP-IP tunnels provide no encryption or hardware encryption by default; they are plain encapsulation and would require IPsec to secure the traffic.

Exam trap

JNCIS-ENT often tests the differences between IP-IP and GRE, such as the presence of a key field or encryption, causing candidates to incorrectly attribute GRE features to IP-IP.

Practice this question →
26
MCQhard

When configuring an IP-IP tunnel on a Junos device, what happens to the source and destination IP addresses of the original packet when it is encapsulated?

A.The original packet is placed inside a new outer IP header, leaving the inner IP header and its source/destination unchanged.
B.The original packet has its source address replaced by the tunnel interface address and destination kept intact.
C.The original source and destination IP addresses are overwritten by the tunnel endpoint addresses.
D.The original packet header is stripped and replaced entirely by a GRE header.
AnswerA

IP-IP encapsulation prepends a new outer IP header whose source and destination are the tunnel endpoints, while the original packet, including its inner IP header and addresses, remains untouched as payload. This preserves end-to-end addressing across the transit network.

Why this answer

IP-IP tunneling (RFC 2003) encapsulates the original IP packet inside a new outer IP header. The inner IP header, including original source and destination addresses, remains unchanged. The outer header uses the tunnel endpoints' addresses.

Exam trap

JNCIS-ENT often tests the difference between IP-IP and GRE encapsulation, causing candidates to think the original addresses are overwritten or that GRE headers are involved in IP-IP.

How to eliminate wrong answers

Option B is wrong because the original source address is not replaced; the entire original packet is encapsulated, preserving both source and destination. Option C is wrong because the original addresses are not overwritten; they are hidden inside the outer header. Option D is wrong because IP-IP does not use a GRE header; it simply adds an outer IP header, whereas GRE adds a GRE header between the outer IP and inner IP.

Practice this question →
27
MCQeasy

Which interface naming convention is used by Junos OS to identify a generic routing encapsulation (GRE) tunnel interface?

A.gr-
B.lt-
C.st-
D.ip-
AnswerA

Junos OS reserves the `gr-` prefix exclusively for generic routing encapsulation tunnel interfaces, satisfying the stem's requirement for the GRE-specific naming convention. Other tunnel types use distinct prefixes, such as `ip-` for IP-IP and `vt-` for virtual tunnels, so `gr-` uniquely identifies GRE logical units.

Why this answer

Junos OS uses the 'gr-' prefix to identify GRE tunnel interfaces, for example gr-0/0/0. This naming convention is fixed and is used consistently in configuration and operational commands for GRE tunnels.

Exam trap

JNCIS-ENT often tests interface naming conventions, and candidates confuse gr- with lt-, st-, or ip- because all are tunnel-related prefixes with similar functions.

How to eliminate wrong answers

Option B is wrong because 'lt-' identifies logical tunnel interfaces used for tunnel services such as GRE, IPIP, and PIM encapsulation on certain platforms — it is not the standard GRE interface name. Option C is wrong because 'st-' identifies secure tunnel interfaces used for IPsec VPN tunnels. Option D is wrong because 'ip-' identifies IP-over-IP (IPIP) tunnel interfaces, not GRE.

Practice this question →
28
Multi-Selectmedium

Which THREE statements are true regarding IP-IP encapsulation in Junos OS? (Choose three.)

Select 3 answers
A.IP-IP tunnels encapsulate an IP packet directly inside another IP packet without adding a GRE header.
B.IP-IP encapsulation introduces less header overhead compared to GRE encapsulation.
C.IP-IP tunnels natively support multi-protocol payloads such as AppleTalk and IPX.
D.IP-IP tunnels require a specialized physical line card with built-in hardware cryptographic engines.
E.IP-IP tunnels utilize interface names starting with the ip- prefix.
AnswersA, B, E

IP-IP encapsulation adds only an outer IP header, so no GRE header is inserted between the payload and the tunnel header. This satisfies the stem's requirement for a true statement about IP-IP behaviour in Junos OS, distinguishing it from GRE tunnels, which do add that extra header.

Why this answer

Option A is correct because IP-IP (IP-in-IP) tunneling, as defined in RFC 2003, simply wraps an original IP packet inside a new outer IP header with protocol number 4, without inserting a GRE header. Option B is correct because GRE adds at least 4 bytes of GRE header (plus optional fields) on top of the outer IP header, whereas IP-IP adds only the outer IP header, resulting in lower overhead. Option E is correct because in Junos OS, IP-IP tunnel interfaces are configured with names beginning with the ip- prefix (for example, ip-0/0/0), distinguishing them from gr- (GRE) and other tunnel interface types.

Option C is not correct because IP-IP encapsulation only carries IP payloads; multi-protocol payloads like AppleTalk or IPX require GRE, which supports a protocol type field. Option D is not correct because IP-IP tunnels are software-based logical interfaces and do not require any specialized physical line card with hardware cryptographic engines.

Exam trap

JNCIS-ENT often tests the difference between IP-IP and GRE, so candidates may incorrectly assume IP-IP supports multi-protocol payloads or requires special hardware, when it is actually a simple IP-only tunnel.

Practice this question →
29
MCQeasy

What is the primary function of a Junos tunnel interface when used in conjunction with routing protocols?

A.To provide a virtual point-to-point layer 3 link for routing protocol adjacencies across an untrusted or disjointed transport network.
B.To act as a physical layer 2 bridge for VLAN extension without IP addresses.
C.To encrypt all transit traffic by default using hardware-based AES-256.
D.To replace physical interfaces for standard local area network connections.
AnswerA

A tunnel interface presents a virtual point-to-point Layer 3 link, allowing routing protocol adjacencies to form across transport networks that lack direct connectivity or are untrusted. It satisfies the need to run protocols such as OSPF or BGP over disjointed or insecure paths.

Why this answer

A Junos tunnel interface provides a virtual point-to-point Layer 3 link that can carry routing protocol adjacencies across a transport network that may not support multicast or is disjointed. This allows routing protocols like OSPF or BGP to form neighbors over the tunnel, treating it as a direct connection.

Exam trap

The trap is assuming tunnels provide encryption or Layer 2 bridging; candidates may confuse tunnel interfaces with IPsec or bridge interfaces.

How to eliminate wrong answers

Option B is wrong because tunnel interfaces operate at Layer 3, not Layer 2, and do not provide bridging. Option C is wrong because tunnel interfaces do not encrypt traffic by default; encryption requires IPsec. Option D is wrong because tunnel interfaces are not replacements for physical LAN interfaces; they are used for overlay connectivity.

Practice this question →
30
Multi-Selecthard

You are configuring a GRE tunnel between two Juniper routers to carry OSPF traffic. The tunnel is up, but OSPF adjacencies are not forming. Which two actions would you take to troubleshoot and resolve this issue? (Choose two.)

Select 2 answers
A.Increase the MTU on the tunnel interface to prevent OSPF hello packets from being fragmented.
B.Verify that the tunnel interfaces on both routers are in the same subnet and have OSPF enabled.
C.Enable OSPF point-to-point network type on the tunnel interface to avoid DR/BDR election.
D.Ensure that the tunnel source and destination addresses are reachable and that the tunnel is not flapping.
E.Configure OSPF to use a different hello interval on the tunnel interface than on the physical interface.
AnswersB, D

OSPF requires that interfaces be in the same subnet to form an adjacency. If the tunnel interfaces have IP addresses in different subnets, OSPF will not establish a neighbor relationship. Also, OSPF must be enabled on the tunnel interface (e.g., by including it in an OSPF area). Checking these ensures that the fundamental OSPF requirements are met over the tunnel.

Why this answer

OSPF over GRE tunnels requires that the tunnel interfaces be in the same subnet and have OSPF enabled on both ends. Additionally, the tunnel must be stable and reachable; if the underlying transport is flapping, OSPF adjacencies will drop. These two checks address the most common reasons for OSPF adjacency failures over tunnels: misconfigured IP subnets and an unstable tunnel.

Exam trap

The trap here is focusing on OSPF tuning parameters like hello intervals or network type when the root cause is often a basic IP subnet mismatch or an unstable tunnel.

Practice this question →
31
MCQmedium

You are configuring a GRE tunnel between two Juniper routers. The tunnel interface is gr-0/0/0, and you have configured the tunnel source as ge-0/0/0.0 and the tunnel destination as 192.0.2.2. You notice that the tunnel interface is up, but traffic sent through the tunnel is being dropped. Which action would you take to resolve this issue?

A.Ensure that the tunnel destination is reachable via the tunnel source interface's routing table.
B.Increase the MTU on the tunnel interface to accommodate the GRE overhead.
C.Configure a firewall filter on the tunnel interface to allow GRE traffic.
D.Change the tunnel mode from GRE to IP-IP to reduce overhead.
AnswerA

For a GRE tunnel to pass traffic, the tunnel destination must be reachable through the tunnel source interface. If the route to the destination points elsewhere, the encapsulated packets may be sent out the wrong interface or dropped. Verifying and correcting the route ensures that the outer IP packets reach the remote endpoint, allowing the tunnel to function properly.

Why this answer

The tunnel interface being up indicates that the tunnel configuration is recognized, but traffic drops often occur when the tunnel destination is not reachable through the tunnel source interface. Ensuring that the route to the destination points out the source interface allows the encapsulated packets to be sent correctly. This is a common oversight when the underlying network has multiple paths or when the source interface is not the preferred route.

Exam trap

The trap here is assuming that an up tunnel interface guarantees end-to-end connectivity, when in fact the tunnel can be up even if the destination is unreachable via the source interface.

Practice this question →
32
MCQeasy

Which Junos configuration statement defines the destination address of a GRE tunnel?

A.destination <ip-address>
B.remote-endpoint <ip-address>
C.peer-address <ip-address>
D.tunnel-destination <ip-address>
AnswerA

Under the `gr-` interface, the `destination` statement specifies the tunnel's remote endpoint, which becomes the outer IPv4 header's destination address for encapsulated traffic. This satisfies the stem's requirement to define the GRE tunnel's destination address, unlike source or routing statements that serve different purposes.

Why this answer

On Junos, the GRE tunnel destination is configured with the 'destination <ip-address>' statement under the tunnel interface unit hierarchy, for example 'set interfaces gr-0/0/0 unit 0 tunnel destination 203.0.113.2'. This statement specifies the remote endpoint IP address to which the GRE-encapsulated packets are sent.

Exam trap

JNCIS-ENT often tests exact Junos CLI keyword recall — candidates who have used other vendors' syntax pick 'remote-endpoint' or 'tunnel-destination', but Junos uses the simple 'destination' keyword under the tunnel stanza.

How to eliminate wrong answers

Option B is wrong because 'remote-endpoint' is not a valid Junos statement for GRE tunnel configuration — it is not part of the tunnel interface hierarchy. Option C is wrong because 'peer-address' is not a Junos GRE tunnel keyword; it is not recognized under the tunnel stanza. Option D is wrong because 'tunnel-destination' is not valid Junos syntax — the correct keyword is simply 'destination' under the 'tunnel' stanza.

Practice this question →
33
MCQmedium

You configure a GRE tunnel between two routers. Router A can ping Router B's tunnel IP address successfully, but devices behind Router A cannot ping devices behind Router B across the tunnel. What is the most likely cause?

A.The GRE tunnel source IP address is configured incorrectly.
B.Missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface.
C.The physical interface MTU is set too high.
D.The gr- interface family inet address is missing.
AnswerB

Tunnel IP connectivity confirms GRE encapsulation works, but the routers lack routes for the remote private subnets via the tunnel interface. Without static routes or a dynamic routing protocol advertising those prefixes across the tunnel, transit traffic is dropped.

Why this answer

The most likely cause is missing static routes or dynamic routing protocol entries for the remote subnets pointing across the GRE tunnel interface. The tunnel itself is up (since Router A can ping Router B's tunnel IP), but traffic from behind Router A to behind Router B requires routes to the remote subnets via the tunnel. Without these routes, packets are dropped or sent elsewhere.

Exam trap

JNCIS-ENT often tests the distinction between tunnel reachability and end-to-end host reachability; candidates may overlook the need for routing entries for remote subnets.

How to eliminate wrong answers

Option A is wrong because if the tunnel source IP were incorrect, the tunnel would not come up and pings to the tunnel IP would fail. Option C is wrong because a high MTU would cause fragmentation issues, but pings of small packets would still work; it would not completely block all traffic. Option D is wrong because if the gr- interface family inet address were missing, the tunnel IP ping would fail.

Practice this question →
34
MCQhard

An enterprise network uses a GRE tunnel to connect two sites running OSPF. OSPF neighbor adjacencies fail to form over the GRE tunnel even though unicast pings between the tunnel endpoints succeed. Upon inspecting interface configurations, you notice that OSPF hellos are not being received by the peer. What is the most likely cause of this issue?

A.The tunnel source address must match the loopback address exactly on both ends for OSPF to initialize.
B.OSPF hello packets are being sent as multicast, and the underlying network or tunnel configuration does not properly forward multicast traffic or protocol 89 is blocked.
C.Junos requires explicit enabling of dynamic routing inside gr- interfaces using the command set protocols gre ospf enable.
D.GRE tunnels do not support routing protocols such as OSPF under any circumstances.
AnswerB

OSPF hellos use multicast destination 224.0.0.5, and GRE alone does not guarantee multicast forwarding across the transit network. If the underlay drops multicast or filters IP protocol 89, hellos never reach the peer, so adjacencies stall despite unicast pings succeeding.

Why this answer

OSPF sends hello packets to the multicast address 224.0.0.5 (AllSPFRouters) using IP protocol 89. For OSPF to form an adjacency over a GRE tunnel, the tunnel must properly forward multicast traffic and not filter protocol 89. If the underlying network or tunnel configuration blocks multicast or protocol 89, hellos are not received, and the adjacency fails.

Unicast pings succeed because they are unicast IP packets, not multicast, and may use a different protocol (ICMP), so they do not test the multicast forwarding path or protocol 89 filtering. Thus, the most likely cause is that multicast hellos are not being delivered.

Exam trap

JNCIS-ENT often tests the misconception that if unicast pings work, all traffic including multicast routing protocols should work, but OSPF relies on multicast and protocol 89, which may be blocked independently.

How to eliminate wrong answers

Option A is wrong because OSPF does not require tunnel source addresses to match loopback addresses exactly; OSPF forms adjacencies based on interface IP addresses and network reachability, not on source address matching. Option C is wrong because Junos does not require a special command to enable OSPF on GRE interfaces; OSPF is configured under the tunnel interface like any other interface, and there is no 'set protocols gre ospf enable' command. Option D is wrong because GRE tunnels do support routing protocols such as OSPF; GRE is designed to carry multiprotocol traffic, including multicast, and OSPF over GRE is a common deployment.

Practice this question →
35
MCQeasy

What is the official protocol number assigned in the outer IP header for GRE encapsulation?

A.50
B.4
C.47
D.89
AnswerC

GRE-encapsulated packets carry IP protocol number 47 in the outer IP header's Protocol field, identifying the payload as GRE. This value is assigned by IANA and distinguishes GRE from protocols such as TCP (6), UDP (17) and ESP (50).

Why this answer

The official protocol number assigned to GRE (Generic Routing Encapsulation) in the outer IP header is 47, as defined by IANA. This number is used in the IP protocol field to indicate that the payload is a GRE packet. Therefore, option C is correct.

Exam trap

The trap here is confusing GRE with other tunneling protocols like IP-in-IP (protocol 4) or IPsec ESP (protocol 50); candidates might recall that GRE is '47' but second-guess under pressure.

How to eliminate wrong answers

Option A is wrong because protocol number 50 is assigned to ESP (Encapsulating Security Payload) for IPsec. Option B is wrong because protocol number 4 is assigned to IP-in-IP encapsulation. Option D is wrong because protocol number 89 is assigned to OSPF.

None of these correspond to GRE.

Practice this question →
36
MCQeasy

When configuring a GRE tunnel source and destination address on a Junos device, which configuration hierarchy is used?

A.set interfaces gr-0/0/0 unit 0 tunnel source <ip> destination <ip>
B.set routing-options tunnels source <ip> destination <ip>
C.set protocols gre source <ip> destination <ip>
D.set system tunnel source <ip> destination <ip>
AnswerA

GRE tunnel endpoints are configured under the tunnel interface's unit stanza using the tunnel source and destination statements. Setting them at interfaces gr-0/0/0 unit 0 matches the stem's requirement for the correct Junos configuration hierarchy.

Why this answer

On Junos, GRE tunnel source and destination addresses are configured under the tunnel interface unit hierarchy using 'set interfaces gr-0/0/0 unit 0 tunnel source <ip> destination <ip>'. This is the standard syntax for GRE tunnels, where the tunnel interface is a gr- interface and parameters are applied at the unit level.

Exam trap

JNCIS-ENT often tests the confusion between interface-level and protocol-level configuration, tricking candidates into selecting non-existent hierarchies like 'protocols gre' or 'routing-options tunnels'.

How to eliminate wrong answers

Option B is wrong because 'routing-options tunnels' is not a valid hierarchy for GRE tunnel configuration on Junos. Option C is wrong because 'protocols gre' does not exist; GRE is configured under interfaces, not protocols. Option D is wrong because 'system tunnel' is not a valid configuration hierarchy for GRE tunnels.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Tunnels questions.

Start 20-question session