JN0-351 Enterprise Routing and Switching Specialist (JNCIS-ENT) Questions and Answers

Option A is correct. Creating multiple areas in OSPF can help to reduce the convergence time . This is because changes in one area do not affect other areas, so fewer routers need to run the SPF algorithm in response to a change.

Option D is correct. Creating multiple areas in OSPF can help to reduce Link State Advertisement (LSA) flooding across the network. This is because LSAs are not flooded out of their area of origin.

The static route to the 0.0.0.0/0 network has a next hop of xe-0/0/0.0, which is a local interface. BGP does not accept static routes with a local interface as the next hop, because it cannot advertise them to other BGP peers. BGP requires a valid IP address as the next hop for static routes that are redistributed into BGP. To fix this issue, the static route should have a next hop of an IP address that is reachable via the xe-0/0/0.0 interface, such as the IP address of the eBGP neighbor. Alternatively, the next hop can be modified by using a route map when redistributing the static route into BGP12.

The other options are not correct because:

The as-path parameter is not required for redistributing static routes into BGP. The as-path attribute is automatically set by BGP when advertising routes to other BGP peers3.

A community string is not required for redistributing static routes into BGP. A community is an optional attribute that can be used to group routes and apply policies to them4.

The no-readvertise feature is not specified in the configuration. The no-readvertise feature is used to prevent routes learned from one iBGP peer from being advertised to another iBGP peer5.

In BGP, routing policies are used to control the flow of routing information between BGP peers 1 .

Option C suggests that import policies are applied after the RIB-In table.  This is correct because import policies in BGP are applied to routes that are received from a BGP peer, before they are installed in the local BGP Routing Information Base (RIB-In) 1 .  The RIB-In is a database that stores all the routes that are received from all peers 1 .

Option D suggests that export policies are applied after the RIB-Local table.  This is correct because export policies in BGP are applied to routes that are being advertised to a BGP peer, after they have been selected from the local BGP Routing Information Base (RIB-Local) 1 .  The RIB-Local is a database that stores all the routes that the local router is using 1 .

Therefore, options C and D are correct.

To create a LAG interface, you need to perform two actions: enable LAG on the chassis and on each member interface. The first action is to configure the chassis stanza with the aggregated-devices statement and specify the number of LAG interfaces and the link-speed for each interface. The second action is to configure each member interface with the family ethernet-switching statement and the aggregated-ether-options statement with the lacp option. The name of the first LAG interface is not relevant, as long as it matches the name of the aggregated interface under the interfaces stanza. The name can be ae0, ae1, or any other valid name. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

IP-IP tunnels encapsulate IP packets within other IP packets, allowing them to traverse networks that wouldn ' t normally support the original IP packets. This encapsulation involves the TTL (Time-to-Live) of the inner packet being decremented as it traverses through the tunnel towards its endpoint.

A  is correct because the interface is configured as a disabled port. A disabled port does not forward any traffic, including DHCP packets.  Therefore, DHCP snooping cannot learn any MAC addresses or lease information from a disabled port 1 .

C  is correct because the interface is configured as a trunk port.  By default, all trunk ports on the switch are trusted for DHCP snooping 2 . This means that DHCP snooping does not inspect or filter any DHCP packets received on a trunk port.  Therefore, DHCP snooping does not add any entries to the snooping database for a trunk port 2 .

In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree 1 .

Option A suggests that the designated port forwards data to the downstream network segment or device.  This is correct because the designated port is the port on a network segment that has the best path to the root bridge 1 .  It’s responsible for forwarding frames towards the root bridge and sending configuration messages into its segment 1 .

Option D suggests that the root port is responsible for forwarding data to the root bridge.  This is also correct because the root port is always the link directly connected to the root bridge, or the shortest path to the root bridge 1 .  It’s used to forward traffic towards the root bridge 1 .

Therefore, options A and D are correct.

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

The maximum allowable MTU size for a default GRE tunnel without IPv4 traffic fragmentation is 1476 bytes 1 .  This is because GRE packets are formed by the addition of the original packets and the required GRE headers 1 .  These headers are 24-bytes in length and since these headers are added to the original frame, depending on the original size of the packet we may run into IP MTU problems 1 .  The most common IP MTU is 1500-bytes in length (Ethernet) 1 .  When the tunnel is created, it deducts the 24-bytes it needs to encapsulate the passenger protocols and that is the IP MTU it will use 1 .  For example, if we are forming a tunnel over FastEthernet (IP MTU 1500) the IOS calculates the IP MTU on the tunnel as: 1500-bytes from Ethernet - 24-bytes for the GRE encapsulation = 1476-Bytes 1 .

The bridging table is a data structure that stores the MAC addresses and the associated interface details and MAC learned time for each MAC address. The bridging table is used by the switch to forward frames based on the destination MAC address. The ether type details and the preamble of Ethernet packet are not stored in the bridging table, as they are not relevant for the switching process. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

[Junos OS Layer 2 Configuration Guide - TechLibrary - Juniper Networks]

Option A is correct. For traffic to be sent through a GRE tunnel, there must be a route that directs the traffic into the tunnel. This is typically accomplished through the use of a static route or a dynamic routing protocol.

Option B is correct. All intermediary devices must have a route to the tunnel endpoints34. In real-world scenarios, the tunnel endpoints for a tunnel going over the Internet must have globally reachable internet addresses. Otherwise, intermediate routers in the Internet cannot forward the tunneled packets.

According to the Juniper documentation 1 , MAC limiting is a feature that enhances port security by limiting the number of MAC addresses that can be learned within a VLAN. When the MAC limit is exceeded, the switch can perform different actions, such as ignoring, dropping, logging, shutting down, or disabling the offending port.  The default action is to drop the packets with new MAC addresses and log a message 2 . Therefore, the correct answer is B.

The other options are not correct because:

A. The switch will not shut down the offending port for five minutes by default.  This is a configurable action, but not the default one 2 .

C. The switch will not flood traffic out of all ports for the offending MAC address by default.  This is a possible consequence of ignoring the packets with new MAC addresses, but not the default action 2 .

D. The switch will not shut down MAC learning on the offending port for five minutes by default.  This is another configurable action, but not the default one 2 .

An aggregate route is a route that summarizes multiple more specific routes into a single route advertisement. For example, an aggregate route to 10.0.0.0/8 can represent many routes to 10.x.x.x/24 subnets. An aggregate route has several purposes, such as:

To decrease the number of route advertisements: By consolidating multiple routes into one, an aggregate route reduces the size of the routing table and the amount of routing updates that need to be exchanged between routers. This can improve the scalability and efficiency of the network12.

To hide internal routes from external peers: By advertising only the aggregate route and not the more specific routes, an aggregate route can provide a level of abstraction and security for the internal network topology. This can prevent external peers from knowing the details of the internal routes and avoid potential attacks or misconfigurations13.

The other options are not correct because:

C. To allow external peers to see internal routes: This is the opposite of what an aggregate route does. An aggregate route hides the internal routes from external peers, not exposes them13.

D. To increase the number of route advertisements: This is also the opposite of what an aggregate route does. An aggregate route decreases the number of route advertisements, not increases them12.

A  is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks.  DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping 1 .  DAI discards any ARP packets that do not match the database or have invalid formats 1 .

C  is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted.  Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports 2 .  DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client 2 .

 References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Juniper Networks Certified Specialist, Enterprise Routing & Switching …

Juniper Networks Certified Specialist, Enterprise Routing & Switching …

[Configuring Layer 2 Firewall Filters - TechLibrary - Juniper Networks]

[Understanding Firewall Filter Terms - TechLibrary - Juniper Networks]

The output of the show bgp neighbor command shows the following information:

The local AS number of R1 is 65400, as indicated by the line “Local: 10.32.1.1+179 AS 65400”.

The peer AS number of 10.32.1.2 is 63645, as indicated by the line “Peer: 10.32.1.2+179 AS 63645”.

The BGP session is established, as indicated by the line “State: Established”.

The routers are exchanging IPv4 routes, as indicated by the line “Type: External State: Established Flags: < Sync > ” and the table showing the number of prefixes received and sent for inet.0 routing table. References:  Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks , [show bgp neighbor - Technical Documentation - Support - Juniper Networks]

A. The routes displayed have traversed one or more autonomous systems. True. The AS path attribute shows AS numbers (e.g., 65401 65520.), indicating the route ' s traversal through various autonomous systems. D. The routes displayed are being learned from an IBGP peer. True. The absence of the ' * > i ' marker before the prefixes indicates they are being learned from an IBGP peer. Therefore, the correct statements are A. The routes displayed have traversed one or more autonomous systems. and D. The routes displayed are being learned from an IBGP peer.

A broadcast storm is a network condition where a large number of broadcast packets are sent and received by multiple devices, causing congestion and performance degradation 1 .  A broadcast storm can occur when there are loops in the network topology, meaning that there are multiple paths between two devices 2 .

A spanning tree protocol is a network protocol that prevents loops from being formed when switches or bridges are interconnected via multiple paths.  It does this by creating a logical tree structure that spans all the devices in the network, and disabling or blocking the links that are not part of the tree, leaving a single active path between any two devices 3 .

By eliminating loops, a spanning tree protocol also eliminates broadcast storms, as broadcast packets will not be forwarded endlessly along the looped paths.  Instead, broadcast packets will be sent only along the tree structure, reaching each device once and avoiding congestion 3 .

The configuration shown in the exhibit is an example of a routing instance of type virtual-router.  A routing instance is a collection of routing tables, interfaces, and routing protocol parameters that create a separate routing domain on a Juniper device 1 .  A virtual-router routing instance allows administrators to divide a device into multiple independent virtual routers, each with its own routing table 2 .

The configuration also includes a rib-group statement, which is used to import routes from one routing table to another. A rib-group consists of an import-rib statement, which specifies the source routing table, and an export-rib statement, which specifies the destination routing table.

In this case, the rib-group name is inet-to-ispi, and the import-rib statement specifies inet.0 as the source routing table. The export-rib statement specifies ispi.inet.0 as the destination routing table. This means that the routes from inet.0 will be imported into ispi.inet.0.

Therefore, the correct answer is B. The inet.0 route table will be imported into the ispi.inet.0 route table.

According to the Juniper documentation 1 , the source and destination addresses of a GRE tunnel interface must be in different subnets. If they are in the same subnet, the router will not be able to route the GRE packets correctly. In the exhibit, the source and destination addresses are both in the 192.168.197.0/24 subnet, which is invalid for GRE tunneling. Therefore, the correct answer is D. References:  Configuring GRE Tunnel Interfaces | Junos OS