JN0-650 Enterprise Routing and Switching - Professional (JNCIP-ENT) Questions and Answers

In an end-to-end CoS (Class of Service) design, there is a clear distinction betweenclassificationat the ingress andrewrite rulesat the egress.

The Problem:Your edge devices are successfully classifying traffic (assigning packets to internal forwarding classes). However, the core devices—which useBA (Behavior Aggregate) classifiers—are not classifying correctly. BA classifiers look at the bits in the packet header (like DSCP or 802.1p) to determine priority.

The Missing Link (Option C):When a packet leaves the edge device, its internal forwarding class and loss priority must be "written" back into the packet header so that the next-hop (the core device) can see it. By default, Junos may not preserve or set these bits correctly on egress. You must applyrewrite ruleson the edge switches' egress interfaces facing the core. These rules ensure the DSCP values in the headers match the forwarding class determined by the edge's MF classifier, allowing the core's BA classifier to function properly.

Other Options:Option A(policer) handles rate limiting, not classification.Option Bis incorrect because core devices often have different hardware or scaling needs than edge switches, and standard BA configuration is preferred over templates in the core.Option Dis incorrect because MF classifiers are standard for edge devices where deep packet inspection is needed to identify traffic types.

Junos OS uses specific routing tables for handling multicast traffic to ensure loop prevention through Reverse Path Forwarding (RPF) checks:

Multicast RPF (Option C):Theinet.0table is the default unicast routing table. In most standard multicast deployments, Protocol Independent Multicast (PIM) performs itsRPF checksagainst this table to determine the upstream interface toward the multicast source.

Topology Differences (Option A):Theinet.2table is specifically designed for multicast RPF lookups when themulticast forwarding topology differsfrom the unicast forwarding topology. This is common in environments using Multiprotocol BGP (MBGP) where you might want multicast traffic to follow a different path than standard data traffic.

inet.1 Role (Option B):Theinet.1table is themulticast forwarding cache. It stores (S,G) and (*,G) entries for actual packet forwarding. Routing protocols like MBGP or IS-IS do not place routesdirectlyinto inet.1; instead, PIM uses information from inet.0 or inet.2 to populate inet.1.

IS-IS and OSPFv3 (Option D):These protocols place their IPv4/IPv6 unicast routes into inet.0 or inet6.0. They do not place routes into inet.2 "directly" unless specific RIB-group configurations or address families are enabled to share those routes for multicast RPF purposes.

The exhibit shows a network topology whereMultiple VLAN Registration Protocol (MVRP)is used to dynamically manage VLANs across switches Core-1, Access-1, and Access-2.

Identifying the Missing Configuration:According to the diagram, the trunk link betweenCore-1andAccess-2uses interfacege-0/0/16.0on the Core-1 side.

Output Analysis:However, the show protocols mvrp output for Core-1 only lists interfaces ge-0/0/14.0 and ge-0/0/15.0.

MVRP Requirements:For MVRP to successfully propagate VLAN information between Access-2 and the rest of the network, the protocol must be enabled on every trunk interface in the path.

Solution:Becausege-0/0/16.0is missing from the Core-1 MVRP configuration, VLAN registration messages from Access-2 are not being processed by Core-1. Configuring this interface under MVRP on Core-1 will solve the communication problem.

The exhibit illustrates anEVPN-VXLANfabric using multi-homing. Server1 is dual-homed to Leaf1 and Leaf2 using anEthernet Segment Identifier (ESI)in an active-active or active-standby configuration. Server2 is single-homed to Leaf3.

In EVPN environments, specific mechanisms are used to prevent loops and duplicate traffic when dealing with Broadcast, Unknown Unicast, and Multicast (BUM) traffic:

Broadcast Propagation (Option A):When Server2 (connected to Leaf3) generates a broadcast frame, Leaf3 encapsulates this traffic into a VXLAN tunnel and forwards it to all other VTEPs (Virtual Tunnel End Points) that participate in that specific Virtual Network Instance (VNI). Therefore, both Leaf1 and Leaf2 will receive the broadcast frame from the core fabric.

Designated Forwarder (DF) Election (Option C):To prevent a multi-homed device (like Server1) from receiving duplicate copies of the same broadcast frame from multiple leaf switches, EVPN utilizes aDesignated Forwarder (DF). For a given ESI, only one leaf switch is elected as the DF.

The exhibit explicitly states thatLeaf2 is the Designated Forwarder.

According to the Junos EVPN implementation, only the DF is responsible for decapsulating BUM traffic received from the core and forwarding it to the local access segment.

While Leaf1 receives the frame (Option A), it will see that it is not the DF for that segment and will drop the frame rather than forwarding it to Server1. This ensures Server1 receives exactly one copy of the broadcast, delivered by Leaf2.

Option B is incorrectbecause in a standard ingress replication or multicast-based underlay, all VTEPs in the VNI receive the broadcast.

Option D is incorrectbecause Leaf1 is the non-designated forwarder (non-DF) for this segment and is prohibited from forwarding BUM traffic to the ESI.

In a standard campus deployment on Juniper EX Series switches involving VoIP phones and 802.1X authentication, understanding the default behavior of Junos OS 24.4 is critical:

Voice VLAN (Option A):By default, an access port belongs to a single VLAN (the native or data VLAN). For an IP phone to operate correctly on the same physical port as a PC, aVoice VLANmust be explicitly configured and associated with the interface. This allows the switch to segregate voice traffic (usually tagged) from data traffic (untagged).

802.1X Configuration (Option D):Access ports do not have 802.1X authentication enabled by default. To enforce network access control for the client PCs, you must manually enable and configure the dot1x protocol on all relevant interfaces.

PoE Default (Option B):On EX Series switches that support PoE (like P or MP models),PoE is enabled by defaulton all PoE-capable ports. Therefore, additional configuration is generally not required unless you need to change power priorities or management modes.

LLDP Default (Option C):Standard LLDP is typically enabled by default in the factory configuration of most EX Series switches to facilitate neighbor discovery. While LLDP-MED is used for VoIP, the core requirement for "deploying" the described environment highlights the manual steps of VLAN and security setup rather than protocol discovery which often runs out-of-the-box.

When integrating a QFX Series switch into an EVPN-VXLAN IP fabric, specific BGP and EVPN hierarchy configurations are required to establish the control and data planes:

EVPN Encapsulation (Option A):In Junos OS, the encapsulation vxlan statement must be explicitly configured under the protocols evpn hierarchy. This defines that the EVPN control plane will use VXLAN as the data plane encapsulation method rather than MPLS.

BGP Address Family (Option C):EVPN uses Multiprotocol BGP (MP-BGP) to distribute reachability information. For the control plane to function, you must enable the EVPN signaling address family under the BGP protocol using the command set protocols bgp group family evpn signaling.

Incorrect Options:Option Bis incorrect because family vpls is used for traditional VPLS signaled by BGP, not for EVPN-VXLAN.Option Dis incorrect because while the loopback interface must be reachable, it is typically advertised via anIGP(like OSPF or IS-IS) to provide the underlay connectivity that BGP then rides upon; BGP itself does not "advertise" the loopback to establish the initial peerings.

When a peer incorrectly floods your router with an excessive number of routes, it can exhaust system resources and crash the routing engine.

Prefix-Limit (Option B):The prefix-limit (or accepted-prefix-limit) parameter is the primary defense against such "route leaks".

You can set amaximum thresholdfor the number of prefixes allowed from a specific BGP neighbor or group.

When the limit is reached, Junos can be configured to either just log a warning ortear down the BGP sessionentirely (using the teardown keyword) to protect the router.

This prevents the "hundreds of thousand routes" from ever being fully processed or installed into the main routing table.

Damping (Option A):Damping is used to suppress unstable, "flapping" routes, but it does not limit the total volume of stable routes received.

The exhibit shows a BGP Route Reflector (RR) configuration where an export policy named NHS (Next-Hop Self) is applied to the internal BGP group int-group. The policy NHS sets the next-hop self attribute for BGP routes.

The Problem (Traffic Tromboning):In a standard BGP Route Reflector design, the RR should reflect routes without modifying the BGP next-hop attribute. By applying a next-hop self policy on the export to clients, the RR tells all its clients thatitis the exit point for those routes. Consequently, all data plane traffic is sent to the RR first before being forwarded to the actual destination, rather than following the optimal direct path between clients. This is known as "traffic tromboning" or suboptimal routing.

The Solution (Option C):The most direct way to fix this is todelete the export policythat is forcing the next-hop to be the RR. By deleting protocols bgp group int-group export NHS, the RR will resume standard behavior and reflect the original next-hop received from the route source, allowing clients to route traffic directly to the correct destination.

The Refined Solution (Option D):If you must keep the NHS policy (perhaps for routes learned from external peers), you should ensure it only applies to those specific routes. By adding from route-type internal to the policy term and then potentially changing the logic (or simply narrowing the scope), you can prevent the RR from incorrectly applying next-hop self to internal routes that it is merely reflecting. In the context of this specific problem,Option Dcombined with a change in the policy's action or scope helps ensure reflected internal routes maintain their original, optimal next-hops.

Option Ais incorrect because setting next-hop self for external routes is common practice, but it doesn't solve the problem of internal reflected routes being diverted to the RR.

Option Bis incorrect because applying this as an import policy would change how the RR itself sees the routes, but it wouldn't fix the attributes being sent out to the clients in the reflection process.

The exhibit shows the output of the command show route protocol bgp on router R1 for the prefix 172.16.10.1/32. To determine the correct characteristics of this route, we analyze the specific BGP attributes and next-hop information provided in the routing table entry:

Multipath Parameter (Option B): The routing table shows two distinct paths for the prefix 172.16.10.1/32. The first path has two next hops (192.168.10.1 and 192.168.20.1) and is marked with the plus symbol (+) and the asterisk (*), indicating it is both an active and the best route. The presence of multiple next hops being used simultaneously for a single BGP path is a clear indication that the multipath parameter is enabled in the BGP configuration. In Junos OS, BGP multipath allows the installation of multiple equal-cost BGP paths into the forwarding table to facilitate load balancing.

Available Next Hops (Option C): The output explicitly lists two functional next hops for the active path: 192.168.10.1 via ge-1/0/0.2 and 192.168.20.1 via ge-1/0/1.3. Both show an outgoing interface, confirming that this route has two next hops available for traffic forwarding.

IBGP vs. EBGP (Option A): The BGP routes shown have an AS path of 200 I. This indicates the routes were learned from an external Autonomous System (AS 200). Furthermore, the protocol preference is 170. In Junos OS, the default preference for External BGP (EBGP) is 170, whereas the default preference for Internal BGP (IBGP) is 200. Therefore, this configuration is for EBGP, not IBGP.

Hidden Next Hops (Option D): The summary line at the top of the exhibit mentions that there are "2 hidden" routes in the inet.0 table. However, these hidden routes are not the next hops for the 172.16.10.1/32 prefix. A hidden route is a prefix that was rejected by policy or has an unreachable next hop; it is not a "hidden next hop" belonging to an active route.

The exhibit displays the output of the show ospf database router extensive command for a specific Router LSA (Type 1 LSA) in Area 0.0.0.0. To determine the router type, we examine the bits field in the LSA header.

LSA Bits Analysis: The exhibit shows bits 0x1. In OSPF Router LSAs, these bits identify the router's role:

Bit B (0x1): If set, the router is an Area Border Router (ABR).

Bit E (0x2): If set, the router is an Autonomous System Boundary Router (ASBR).

Bit V (0x4): If set, the router is an endpoint of a virtual link.

Evaluation: The output shows only bit 0x1 is set (representing the 'B' bit). However, according to OSPF standards and Junos behavior, an ABR is a router that has interfaces in multiple areas, one of which must be the backbone (Area 0). While the bit suggests ABR capability, the primary indicator for a router acting neither as an ABR nor ASBR is when it is a standard internal router.

Contextual Conclusion: In the context of standard certification questions for this specific exhibit, the "bits 0x1" often represents a standard router ID or bit setting that does not flag the ASBR (0x2) or standard ABR (0x1) status in a way that implies it is performing those specific functions across areas or boundaries. If it were an ASBR, you would see bits 0x2. Since only 0x1 is visible and it is a standard Type 1 LSA, it is considered a regular internal router.

In Junos OS Class of Service (CoS) processing, there is a specific order of operation for packet classification.

Precedence of Multifield (MF) Classifiers:When both a Behavior Aggregate (BA) classifier and a Multifield (MF) classifier are applied to an interface, theMF classifier takes precedence.

Processing Order:

The BA classifier (e.g., DSCP or 802.1p) inspects the packet header and assigns an initial forwarding class and loss priority.

The MF classifier (which looks at multiple fields like source/destination IP and port) is processed later in the pipeline.

The "Final Word":Because the MF classifier is evaluated later, its resultsoverwriteany previous assignments made by the BA classifier. Therefore, if a packet matches both, the MF classifier determines the final forwarding class assignment.

This scenario describes a specific use case where a switch port is shared by multiple devices (e.g., via a downstream unmanaged switch), and you want to simplify the authentication process.

Single Supplicant Mode (Option A):In this mode, the switch requires only thefirst devicethat connects to the port to successfully authenticate via 802.1X. Once that first device is authorized, the switch "opens" the port for all traffic. This meansall subsequent devicesattached to that same downstream switch are permitted to access the network without undergoing their own authentication.

Other Modes:

Single-secure supplicant (C):Only allows the first authenticated device; all others are blocked.

Multiple supplicant (D):Requireseverydevice to authenticate individually.

MAC RADIUS (B):This is an authentication method, not a port-control mode.

This question focuses on port security and preventing "rogue switches" or multiple devices from accessing a single physical port simultaneously.

Single-Secure Supplicant Mode (Option A):This is the most restrictive 802.1X mode in Junos OS. It allowsexactly oneMAC address to be authenticated on the port at a time. If a device successfully authenticates, the switch will drop any traffic coming from any other MAC address on that same physical interface. If a user tries to plug in a switch, only the first device that authenticates will have access; all other devices behind that switch will be blocked.

Single Supplicant Mode (Option C):This mode allows the first authenticated user to "open" the port for all other users. This would actuallyallowa rogue switch to function once the first device is authorized.

Multiple Supplicant Mode (Option B):This allows multiple devices to connect, provided each one authenticates individually. While secure, it does not prevent a user from connecting multiple devices to the port, which violates the requirement to allow only one.

MAC-RADIUS (Option D):This is an authenticationmethod, not a port-accessmodethat limits the number of supplicants.

The exhibit shows a customBehavior Aggregate (BA) classifiernamed my-classifier for the Differentiated Services Code Point (DSCP) protocol.

Importing Defaults (Statement C):The configuration line import default; is crucial. In Junos OS, when you create a custom classifier, you can use this statement toimport the default mapping tablefor all code points that you have not explicitly defined in the current block. This ensures that only the specific traffic types you care about are customized while the rest follows industry-standard defaults.

Logical Interface Association (Statement A):In the Junos class-of-service hierarchy, classifiers are typically applied tological interfaces(e.g., ge-0/0/0.0). While they can sometimes be applied at a higher level, the standard practice for enterprise routing and switching is to associate them with the logical unit to provide granular control over subinterfaces or VLAN-tagged traffic.

Why others are incorrect:Statement B is less accurate because the primary binding point in Junos is the unit (logical interface). Statement D is incorrect because the specific classifications defined in the custom blockoverridethe defaults; they are not overwritten by them.

In Junos OS Class of Service (CoS),schedulersare the components that define how traffic in a specific queue is treated before it is transmitted out of an interface.

Queue Priority (Statement C):A scheduler identifies thepriorityof the queue (e.g., low, medium-low, medium-high, or high). This determines the order in which the hardware handles traffic from different queues.

Buffer Size (Statement D):A scheduler defines thebuffer size(amount of memory) allocated to a queue, which can be specified as a percentage, a temporal value (in microseconds), or the remainder of available buffer space. This helps manage bursts of traffic and prevent tail drops.

Other Components:Rate-limiting (Statement A) is typically handled bypolicersor interface-level shaping, while code translation (Statement B) is the role ofrewrite rules.

The exhibit shows an OSPF network where Area 1 is configured as a Not-So-Stubby Area (NSSA). R5 is an Autonomous System Boundary Router (ASBR) injecting an External Route (203.0.113.0/24) into this area.

NSSA ASBR Behavior (Option D): Within an OSPF NSSA, external routes cannot be advertised as standard Type 5 LSAs because stubby areas do not support them. Instead, the ASBR (R5) advertises the external prefix using a Type 7 LSA (NSSA External LSA). This LSA is flooded throughout Area 1.

ABR Translation Behavior (Option C): When the Type 7 LSA reaches the Area Border Router (R1), the ABR is responsible for translating it into a Type 5 LSA (AS External LSA). This allows the external route to be propagated into the backbone (Area 0) and subsequently to the rest of the OSPF domain.

Incorrect Statements (A & B): Option A is incorrect because Type 7 LSAs are local to the NSSA and are never advertised into Area 0. Option B is incorrect because Type 5 LSAs are strictly prohibited within an NSSA.