Tunnels practice questions

GRE requires RSVP-TE signalling enabled on the physical egress interface.

Why wrong: GRE does not require RSVP-TE.

The gr-0/0/0 interface is missing an IP address.

Why wrong: If the interface was missing an IP, it would not be a policy drop issue.

set protocols gre keepalive-interval 10

Why wrong: Protocols gre does not exist.

set routing-options gre monitor

Why wrong: Routing-options does not manage interface keepalives.

A mismatch in the routing protocol metric configured inside the tunnel.

Why wrong: Routing metric mismatches affect routing path selection, not tunnel interface operational state.

An invalid BGP Autonomous System number configuration.

Why wrong: BGP configuration errors do not change tunnel interface operational status.

tunnel key and tunnel checksum

Why wrong: Tunnel keys and checksums are optional features in GRE configuration.

tunnel metric and tunnel preference

Why wrong: Metrics and preferences are routing attributes, not mandatory tunnel endpoint parameters.

tunnel bandwidth and tunnel delay

Why wrong: Bandwidth and delay are traffic engineering or QoS parameters, not mandatory endpoint configurations.

st-0/0/0

Why wrong: The 'st-' prefix designates a secure tunnel (IPsec) interface.

gr-0/0/0

Why wrong: The 'gr-' prefix designates a GRE tunnel interface.

lt-0/0/0

Why wrong: The 'lt-' prefix designates a logical tunnel interface.

set security flow tcp-mss mss-adjust 1360

Why wrong: While TCP MSS adjustment helps, it does not address non-TCP traffic or the root MTU encapsulation issue on the tunnel interface itself.

set interfaces ip-0/0/0 unit 0 family inet mtu 1500

Why wrong: Setting the physical/tunnel MTU to 1500 without accounting for the IP-IP header overhead will still cause drops for standard 1500 byte packets.

set routing-options encapsulation-limit 0

Why wrong: Encapsulation limit applies to IPv6 extension headers, not IP-IP MTU issues.

OSPF authentication must be disabled globally before running over GRE.

Why wrong: OSPF authentication does not prevent adjacencies from forming unless misconfigured symmetrically.

GRE tunnels do not support OSPF routing protocol traffic.

Why wrong: GRE tunnels fully support OSPF and other layer 3 routing protocols.

The tunnel interface must be added to a security zone even on routing devices.

Why wrong: Non-SRX Junos routing devices do not use security zones.

The outer header drops packets with TTL less than 10.

Why wrong: The outer header drops packets when TTL reaches 0, like any IP packet.

IP-IP forces a fixed TTL of 255 on all encapsulated packets.

Why wrong: TTL is not fixed at 255 unless explicitly configured.

IP-IP tunnels do not decrement TTL.

Why wrong: TTL is always decremented by routers forwarding packets.

show route forwarding-table interface gr-0/0/0

Why wrong: This shows forwarding table entries associated with the interface, but not the specific detailed interface statistics and drop counters.

show gre statistics

Why wrong: There is no global show gre statistics command in Junos.

show chassis tencent status

Why wrong: This is an invalid command.

set routing-options tunnels source <ip> destination <ip>

Why wrong: Routing-options does not house tunnel endpoints.

set protocols gre source <ip> destination <ip>

Why wrong: There is no protocols gre hierarchy in Junos.

set system tunnel source <ip> destination <ip>

Why wrong: System tunnel is an invalid configuration path.

set routing-options interface-routes

Why wrong: This deals with direct routes, not chassis tunnel services.

set system services gre

Why wrong: This is not a valid Juniper system services command for GRE tunnels.

set interfaces gr-0/0/0 unit 0 family inet

Why wrong: This configures the interface family, not the underlying chassis services.

50

Why wrong: Protocol 50 is assigned to IPsec ESP.

4

Why wrong: Protocol 4 is assigned to IP-in-IP encapsulation.

89

Why wrong: Protocol 89 is assigned to OSPF.

The security policies are blocking the return traffic.

Why wrong: Input drops on the interface level happen before security policy evaluation on routing devices.

OSPF hello packets are malformed.

Why wrong: Protocol packets do not cause generic interface input drops unless malformed at layer 2/physical layer.

The tunnel destination IP address is unreachable via the routing table.

Why wrong: If the destination were unreachable, the tunnel would be down or output drops/errors would occur.

To act as a physical layer 2 bridge for VLAN extension without IP addresses.

Why wrong: GRE and IP-IP are layer 3 tunneling mechanisms, not layer 2 bridge interfaces.

To encrypt all transit traffic by default using hardware-based AES-256.

Why wrong: GRE and IP-IP tunnels do not provide encryption; IPsec is required for encryption.

To replace physical interfaces for standard local area network connections.

Why wrong: Tunnel interfaces require an underlying transport network and physical interfaces.

They must be part of the same subnet as the tunnel payload addresses.

Why wrong: Transport endpoints and tunnel payload subnets are completely separate.

They must be resolved via BGP inet-vpn routes only.

Why wrong: Any standard routing protocol or static route can provide reachability for tunnel endpoints.

They must be configured as loopback addresses in the destination VRF exclusively.

Why wrong: They do not need to be loopback addresses; physical interface IPs work as well.

family inet

Why wrong: Family inet is for IPv4 payloads.

family iso

Why wrong: Family iso is for OSI/IS-IS traffic.

family mpls

Why wrong: Family mpls is for label-switched paths.

show tunnel summary

Why wrong: There is no show tunnel summary command in Junos.

show routing-options tunnels

Why wrong: This path is invalid.

show chassis tunnels

Why wrong: This command does not exist in Junos.

The original packet has its source address replaced by the tunnel interface address and destination kept intact.

Why wrong: This describes NAT behavior, not IP-IP tunneling.

The original source and destination IP addresses are overwritten by the tunnel endpoint addresses.

Why wrong: Overwriting would destroy end-to-end packet delivery; IP-IP encapsulates rather than translates.

The original packet header is stripped and replaced entirely by a GRE header.

Why wrong: IP-IP does not use a GRE header; it uses an IP header (Protocol 4).

47

Why wrong: Protocol 47 is GRE.

6

Why wrong: Protocol 6 is TCP.

17

Why wrong: Protocol 17 is UDP.

Static routes pointing directly to each customer default gateway.

Why wrong: Static routes do not scale for carrying multiple isolated VRFs across a single interface without heavy overhead.

Enabling native VLAN tagging on the gr-0/0/0 unit 0 interface.

Why wrong: GRE tunnel units in Junos do not support native 802.1Q VLAN subinterfaces directly in the same manner as physical Ethernet interfaces.

Layer 2 bridging configuration under the gr- interface.

Why wrong: gr- interfaces are layer 3 interfaces and do not support direct layer 2 bridging.