Tunnels practice questions

ip-0/0/0

Junos names IP-IP tunnel interfaces using the `ip-` prefix, so `ip-0/0/0` satisfies the question's requirement for the IP-IP tunnel naming convention. The `ip-` interface type is created when configuring `tunnel` encapsulation with an IP-IP tunnel, distinct from `gre-` and `gr-` interfaces.

Configure path-mtu-discovery or reduce the tunnel interface MTU to account for the IP-IP encapsulation header size.

IP-IP adds a 20-byte outer header, so the tunnel MTU must drop below 1500 to prevent drops of oversized packets. Enabling path-MTU discovery or lowering the tunnel interface MTU lets Junos signal or avoid fragmentation, restoring connectivity for packets above 1476 bytes.

OSPF network type mismatch, requiring explicit point-to-point setting on the tunnel interface.

GRE interfaces often require explicit point-to-point network type definition for OSPF to form adjacencies correctly.

TTL propagation is disabled by default, hiding inner router hops from traceroute.

Junos disables TTL propagation for IP-IP tunnels by default, so the outer header's TTL is not copied from the inner packet. Transit routers decrement only the outer TTL, and their addresses never appear in the returned ICMP Time Exceeded messages, which is why traceroute shows the tunnel as a single hop.

show interfaces gr-0/0/0 extensive

The `extensive` variant returns the tunnel's operational state alongside detailed packet counters, satisfying the requirement to monitor both status and traffic on gr-0/0/0. Plain `show interfaces gr-0/0/0` omits the richer statistics, while `terse` suppresses them entirely, so extensive is the precise fit.

The tunnel mode must be explicitly set to layer2-transport.

Layer 2 transport is incorrect for a standard routed GRE tunnel.

Security policies allowing traffic between the tunnel zone and internal/external zones are missing.

SRX devices require explicit security policies to allow traffic through tunnel interfaces.

set chassis fpc 0 pic 0 tunnel-services

Inline tunnel services on MX Series require the tunnel-services statement at the FPC/PIC level, here 'set chassis fpc 0 pic 0 tunnel-services'. This defines the anchor point where GRE encapsulation and decapsulation are performed, enabling the point-to-point tunnel between the two routers.

show interfaces gr*

Using wildcards with the show interfaces command displays all GRE interfaces.

set interfaces gr-0/0/0 unit 0 tunnel keepalives

This enables GRE keepalives on the specified tunnel unit.

set system services gre-keepalive

System services does not manage interface keepalives.

Multiprotocol BGP (MP-BGP) running over the GRE interface with VPN inet-vpn unicast family.

MP-BGP with the inet-vpn unicast family carries per-VRF route targets and labels over the single GRE interface, so distinct customer VRFs remain isolated while sharing one transport. Plain BGP cannot separate overlapping customer prefixes; the VPN address family supplies the route distinguishers and MPLS labels that make multi-VRF routing work.

Proper IP routing protocol metric design and TTL decrementing through the encapsulated IP headers.

TTL decrementing in the outer GRE header ensures packets expire rather than circulate indefinitely, while consistent routing metrics prevent the mutual recursion that causes endpoints to bounce traffic. Together these satisfy the stem's loop-prevention requirement.

show interfaces gr-0/0/0

This command displays the interface configuration in both operational and configuration modes.

TCP MSS clamping or adjustment via security options or firewall policers.

TCP MSS clamping rewrites the MSS value in TCP SYN packets traversing the GRE tunnel, so endpoints negotiate a segment size that fits the tunnel MTU. This dynamically mitigates fragmentation without manual interface MTU changes.

show interfaces gr-0/0/0

The show interfaces gr-0/0/0 command reports GRE-specific counters, including encapsulation and decapsulation statistics, directly confirming tunnel traffic. Generic interface or ping output cannot isolate those GRE processing counters, so this command satisfies the requirement to verify packets traversing the tunnel.

Failure of GRE keepalives when keepalive monitoring is enabled and the peer stops responding.

When keepalives are configured and fail, the interface brings itself down.

Loss of IP reachability to the remote tunnel destination address in the routing table.

If the destination IP becomes unreachable, the tunnel interface operational state reflects down.

Disabling the physical interface associated with the tunnel source address.

If the source interface goes down, the tunnel source becomes unavailable, bringing the tunnel down.

edit chassis

Chassis configuration is required to enable tunnel services on supported FPCs/PICs.

edit interfaces gr-0/0/0 unit 0

Configuring the logical unit under the gr-0/0/0 interface assigns the tunnel's IP address, satisfying the requirement for a functional GRE tunnel with an IP address. The unit hierarchy is where the tunnel endpoint address is applied, distinct from the tunnel and family hierarchies.

Ensure that the tunnel interface has a valid IP address matching the subnet of the remote tunnel end.

The tunnel interface needs an IP address within the same subnet as the remote tunnel endpoint, otherwise OSPF cannot form an adjacency across the GRE link or exchange hello packets, breaking neighbour stability and route propagation.

Configure the OSPF network type as point-to-point on the tunnel interface.

GRE tunnels are inherently point-to-point, so the default OSPF broadcast network type wastes time electing a DR/BDR and can stall adjacency formation. Setting the tunnel interface's OSPF network type to point-to-point removes DR/BDR election, giving stable adjacencies and correct route propagation.

family inet address <ip-address>

Assigning an IPv4 address via `family inet address` is mandatory on the tunnel interface, because the GRE endpoints need routable addresses to source and terminate encapsulated traffic. Without it, the tunnel interface cannot pass traffic, satisfying the stem's requirement for a standard configuration parameter.

tunnel destination <ip-address>

The tunnel destination parameter specifies the remote endpoint IP address that the GRE tunnel encapsulates traffic towards, defining where the outer IP header is addressed. Junos requires this alongside source and key to establish the point-to-point GRE interface, satisfying the stem's demand for standard tunnel interface configuration parameters.

tunnel source <ip-address>

Defining the tunnel source address is mandatory for a Junos GRE interface, as it specifies the local endpoint IP used to build the outer packet header. Without it, the tunnel cannot encapsulate traffic toward the remote destination, so this parameter satisfies the standard configuration block requirement.

set interfaces gr-0/0/0 unit 0 family inet mtu 1400

Lowering the MTU on the GRE interface ensures that encapsulated packets do not exceed the path MTU of the underlying physical network.

Tunnel key

The tunnel key is a 32-bit GRE field that identifies a specific tunnel, allowing multiple GRE tunnels to share the same source and destination endpoints. It enhances functionality by demultiplexing traffic, satisfying the optional parameter requirement.

Tunnel checksum

The GRE checksum field verifies integrity of the encapsulated packet's header and payload, detecting corruption in transit. It is optional and enhances security by allowing the receiving endpoint to discard tampered or damaged GRE packets.

IP TOS (Type of Service) inheritance / copying

IP TOS inheritance copies the inner packet's Type of Service bits onto the GRE outer header, so differentiated-services markings survive encapsulation across the transit network. This satisfies the stem's optional enhancement of tunnel functionality, since Junos applies it per tunnel interface without altering the payload itself.