JN0-650 Enterprise Routing and Switching - Professional (JNCIP-ENT) Questions and Answers

In an EVPN-VXLAN architecture, the network is divided into two distinct planes: the Underlay and the Overlay.

Underlay (IP Fabric): The underlay ' s only job is to provide IP reachability between the loopback addresses of all VTEPs (Virtual Tunnel Endpoints). This is typically achieved using OSPF, IS-IS, or EBGP.

Overlay (EVPN Control Plane): The overlay is responsible for carrying Layer 2 MAC and Layer 3 IP reachability information between switches. EVPN signaling is the standard mechanism for this task.

Protocol Choice (Option D): EVPN uses MP-BGP (Multiprotocol BGP) as its control plane protocol. On Juniper EX Series and QFX Series switches, the most scalable and recommended design for the overlay is EBGP (External BGP).

In a 3-stage or 5-stage Clos architecture, EBGP is used in the overlay to exchange EVPN routes (Route Types 1-5) between Leaf and Spine switches.

EBGP simplifies configuration by avoiding the need for Route Reflectors (required for IBGP) and provides better control over route propagation through BGP community and policy management.

Incorrect Options:

Options A and B refer to the underlay protocols. While they provide the path for the VXLAN tunnels, they do not handle the EVPN signaling itself.

Option C (MPLS) is a different transport technology. While EVPN can run over MPLS (EVPN-MPLS), campus designs on EX series devices specifically use VXLAN as the data plane, making EBGP the standard signaling protocol for the EVPN-VXLAN overlay.

The behavior described is the fundamental operational principle of OSPF ' s hierarchical area structure.

LSA Flooding Scope: In OSPFv2, Type-1 (Router) and Type-2 (Network) Link-State Advertisements (LSAs) are restricted to a local area flooding scope . They contain detailed topology information (such as which routers are connected to which links) that is only relevant for calculating the Shortest Path First (SPF) tree within that specific area.

ABR Functionality: Area Border Routers (ABRs), such as R1 in this scenario, act as the gateway between areas. The ABR does not forward Type-1 or Type-2 LSAs from one area to another. Instead, it extracts the prefix information (the network address and mask) from those LSAs and generates a Type-3 (Summary) LSA .

Interarea Reachability: This Type-3 LSA is then flooded into the backbone (Area 0) and subsequently into other non-backbone areas, such as Area 2. This explains why R2 sees an " interarea route " to R3’s network in its routing table and has the corresponding Type-3 LSA in its database, but cannot see the original Type-1 or Type-2 LSAs from Area 1.

Why other options are incorrect: Option A is incorrect because this is standard protocol behavior, not the result of a manual filter. Option B is incorrect as there is no such " disable " feature; the protocol design inherently prevents these LSAs from crossing boundaries. Option C is incorrect because OSPFv3 still uses Type-1 and Type-2 LSAs (renamed but functionally similar for topology), and the prompt specifically identifies the deployment as OSPFv2 .

For maintenance scenarios where a router must remain operational but should not be used as a transit path for OSPF traffic, Junos OS uses the overload functionality.

OSPF Overload (Option B): When you enable overload under protocols ospf, the router advertises its own Link-State Advertisements (LSAs) with a maximum metric (65535) for all of its transit links.

Traffic Diversion: Because OSPF uses the Shortest Path First (SPF) algorithm to find the lowest-cost path, other routers in the network will see the overloaded router as an extremely high-cost path. They will calculate alternate routes, effectively moving transit traffic off the router while still allowing management traffic directed to the router ' s own interfaces.

Timeout Options: You can configure this to be permanent or set a timeout so that the router automatically resumes normal metric advertisements after a set period.

The exhibit shows an OSPF network where Area 1 is configured as a Not-So-Stubby Area (NSSA). R5 is an Autonomous System Boundary Router (ASBR) injecting an External Route (203.0.113.0/24) into this area.

NSSA ASBR Behavior (Option D): Within an OSPF NSSA, external routes cannot be advertised as standard Type 5 LSAs because stubby areas do not support them. Instead, the ASBR (R5) advertises the external prefix using a Type 7 LSA (NSSA External LSA). This LSA is flooded throughout Area 1.

ABR Translation Behavior (Option C): When the Type 7 LSA reaches the Area Border Router (R1), the ABR is responsible for translating it into a Type 5 LSA (AS External LSA). This allows the external route to be propagated into the backbone (Area 0) and subsequently to the rest of the OSPF domain.

Incorrect Statements (A & B): Option A is incorrect because Type 7 LSAs are local to the NSSA and are never advertised into Area 0. Option B is incorrect because Type 5 LSAs are strictly prohibited within an NSSA.

In an EVPN-VXLAN Edge-Routed Bridging (ERB) architecture, also known as a collapsed fabric, the Layer 3 default gateway functionality is moved from the core/spine layer down to the edge (the leaf or distribution layer).

Anycast Gateways: To support seamless host mobility and redundancy, multiple distribution/leaf switches are configured with the same anycast IP address and MAC address on their IRB interfaces for a given VLAN. This allows a host to move between different switches without needing to update its default gateway configuration or ARP cache.

Distributed Routing: Routing occurs locally at the edge (distribution layer). Traffic destined for a different subnet is routed by the first switch it hits (the ingress leaf), rather than being backhauled to a central core router.

Symmetric vs. Asymmetric IRB: Junos OS 24.4 supports both models, but the ERB design typically utilizes symmetric routing for better scalability, where each leaf only needs to know the routes for its locally connected VNIs and uses a transit VNI for inter-subnet communication.

Option A is incorrect because while unique IPs can be used (Method 1 in some docs), the defining characteristic of an efficient ERB design is the use of shared Anycast IPs for the gateway. Option C describes a Centrally-Routed Bridging (CRB) design, not ERB.

The exhibit shows a BGP Route Reflector (RR) configuration where an export policy named NHS (Next-Hop Self) is applied to the internal BGP group int-group. The policy NHS sets the next-hop self attribute for BGP routes.

The Problem (Traffic Tromboning): In a standard BGP Route Reflector design, the RR should reflect routes without modifying the BGP next-hop attribute. By applying a next-hop self policy on the export to clients, the RR tells all its clients that it is the exit point for those routes. Consequently, all data plane traffic is sent to the RR first before being forwarded to the actual destination, rather than following the optimal direct path between clients. This is known as " traffic tromboning " or suboptimal routing.

The Solution (Option C): The most direct way to fix this is to delete the export policy that is forcing the next-hop to be the RR. By deleting protocols bgp group int-group export NHS, the RR will resume standard behavior and reflect the original next-hop received from the route source, allowing clients to route traffic directly to the correct destination.

The Refined Solution (Option D): If you must keep the NHS policy (perhaps for routes learned from external peers), you should ensure it only applies to those specific routes. By adding from route-type internal to the policy term and then potentially changing the logic (or simply narrowing the scope), you can prevent the RR from incorrectly applying next-hop self to internal routes that it is merely reflecting. In the context of this specific problem, Option D combined with a change in the policy ' s action or scope helps ensure reflected internal routes maintain their original, optimal next-hops.

Option A is incorrect because setting next-hop self for external routes is common practice, but it doesn ' t solve the problem of internal reflected routes being diverted to the RR.

Option B is incorrect because applying this as an import policy would change how the RR itself sees the routes, but it wouldn ' t fix the attributes being sent out to the clients in the reflection process.

The exhibit shows the Class of Service (CoS) transmit queue information for interface ge-0/0/11. To determine the correct behavior, we must analyze the bandwidth allocations and the queue limit settings:

Bandwidth Calculation (Option A): In Junos OS, when multiple queues are assigned specific percentages of bandwidth, the " remainder " (represented by ' r ' ) is the total interface bandwidth minus the sum of the explicitly configured percentages.

Bandwidth assigned to Queue 1 (EF) = 10%.

Bandwidth assigned to Queue 2 (AF) = 10%.

Bandwidth assigned to Queue 3 (NC) = 4%.

Total explicitly assigned = $10\% + 10\% + 4\% = 24\%$.

Remainder for Queue 0 (Best Effort) = $100\% - 24\% = 76\%$.

" Limit: exact " Behavior (Option B): The exhibit shows that Queue 2 (assured-forwarding) has a Limit set to exact.

By default, a queue in Junos can consume more than its allocated bandwidth if other queues are idle.

However, when the exact keyword is applied to the transmit-rate (transmission rate), the queue is strictly rate-limited to its configured percentage.

This means that traffic in Queue 2 will be capped at 10% of the interface bandwidth regardless of whether the network is congested or not. If the traffic exceeds 10%, the excess will be dropped or buffered to match the exact rate.

Option C is incorrect because 100% of the bandwidth is not reserved for a single queue; it is distributed across four queues.

Option D is less accurate than B because it implies the drop behavior only occurs during congestion. The exact parameter enforces the limit even when the rest of the interface is completely idle.

When integrating a QFX Series switch into an EVPN-VXLAN IP fabric, specific BGP and EVPN hierarchy configurations are required to establish the control and data planes:

EVPN Encapsulation (Option A): In Junos OS, the encapsulation vxlan statement must be explicitly configured under the protocols evpn hierarchy. This defines that the EVPN control plane will use VXLAN as the data plane encapsulation method rather than MPLS.

BGP Address Family (Option C): EVPN uses Multiprotocol BGP (MP-BGP) to distribute reachability information. For the control plane to function, you must enable the EVPN signaling address family under the BGP protocol using the command set protocols bgp group < name > family evpn signaling.

Incorrect Options: Option B is incorrect because family vpls is used for traditional VPLS signaled by BGP, not for EVPN-VXLAN. Option D is incorrect because while the loopback interface must be reachable, it is typically advertised via an IGP (like OSPF or IS-IS) to provide the underlay connectivity that BGP then rides upon; BGP itself does not " advertise " the loopback to establish the initial peerings.

In Junos OS Class of Service (CoS) processing, there is a specific order of operation for packet classification.

Precedence of Multifield (MF) Classifiers: When both a Behavior Aggregate (BA) classifier and a Multifield (MF) classifier are applied to an interface, the MF classifier takes precedence.

Processing Order:

The BA classifier (e.g., DSCP or 802.1p) inspects the packet header and assigns an initial forwarding class and loss priority.

The MF classifier (which looks at multiple fields like source/destination IP and port) is processed later in the pipeline.

The " Final Word " : Because the MF classifier is evaluated later, its results overwrite any previous assignments made by the BA classifier. Therefore, if a packet matches both, the MF classifier determines the final forwarding class assignment.

OSPF stub areas are used to reduce the size of the Link-State Database (LSDB) in routers with limited resources by restricting the flooding of external routes.

Virtual Links (Option C): According to OSPF standards (both v2 and v3), virtual links cannot pass through stub areas. A virtual link must transit a " transit area, " which must be a standard (non-stub) area with a full routing table.

Totally Stubby Areas (Option D): A stub area (which blocks Type 5 External LSAs) can be further restricted into a totally stubby area. In Junos OS, this is done by adding the no-summaries statement to the stub configuration. This blocks both Type 5 and Type 3 (Inter-area) LSAs, replacing them with a single default route.

Incorrect Statements: Option A is incorrect because standard stub areas cannot contain an ASBR; only Not-So-Stubby Areas (NSSA) allow for an ASBR. Option B is incorrect because an area is either a Stub or an NSSA; they are mutually exclusive configurations for the same area.

The exhibit shows a BGP routing process where an Import Policy is being applied to routes received in the RIB-IN. Specifically, Policy 1 states: " Reject 0.0.0.0/0 from AS 64512. "

In Junos OS, when a routing policy rejects a route, that route is not placed in the main routing table (inet.0) for active use. Instead, it becomes a hidden route. To verify that a specific peer is actually sending a route that is subsequently being rejected by your policy, you must use specific diagnostic commands:

Understanding " Hidden " Routes: When a BGP route is received but fails to meet policy requirements (or has an unreachable next-hop), Junos keeps it in the BGP RIB-IN but marks it as " hidden. " It will not appear in a standard show route command.

Command Logic (Option D): The command show route receive-protocol bgp < peer ip > hidden allows an administrator to view all routes received from a specific neighbor, including those that were rejected by import policies.

show route receive-protocol bgp < peer ip > : Shows only the routes that passed the import policy and were accepted into the table. Since the 0.0.0.0/0 route from AS 64512 is explicitly rejected in the exhibit, it would not show up here.

Adding the hidden keyword is the essential step to see the rejected default route and verify that AS 64512 is indeed sending it before the policy drops it.

Other Options:

Option A is incorrect because it only shows accepted routes.

Option B and C are used to filter the existing active routing table based on gateway or next-hop attributes, but they cannot show routes that have been rejected and excluded from that table.

In this scenario, the requirement is to authenticate devices based on their MAC addresses using a centralized database.

MAC RADIUS (Option A): This is the standard Juniper method for authenticating " headless " or non-802.1X capable devices based on their hardware (MAC) address. The switch acts as a proxy, sending the device ' s MAC address as the username and password to a centralized RADIUS server (the centralized database). If the MAC address is found in the server ' s database, the device is granted access to the network. This perfectly matches the user ' s requirement for MAC-based authentication and a centralized database.

Captive Portal (Option B): This is a web-based authentication method requiring user interaction (login via a browser), which is not based on MAC address identification for the initial authentication phase.

Supplicant Modes (Options C & D): These define how multiple devices are handled on an 802.1X-enabled port, but they are not authentication methods themselves; they rely on 802.1X (EAP-based) or MAC-RADIUS being already configured.

The exhibit shows the output of the show poe interface command on a Juniper switch.

VTEP Power Capabilities (Statement D): The exhibit shows the Pair/Mode as 2P/AT, which refers to the IEEE 802.3at (PoE+) standard. Under this standard, a switch can supply up to 30 W of power per port to attached devices (PDs). * Dynamic Learning (Statement C): Looking at the Max power column for port ge-0/0/0, it shows 19.5W(L). The (L) indicator signifies that the power has been dynamically learned (negotiated) via LLDP or hardware classification, rather than being statically configured by an administrator. Additionally, it has identified the device as Class 4, which is a standard dynamic classification for PoE+ devices.

Why others are incorrect: Statement A (60 W) refers to the 802.3bt (PoE++) standard, which is not indicated here. Statement B is incorrect because the " (L) " confirms the configuration is not static.

Junos OS 24.4 on EX Series switches provides robust support for LLDP (Link Layer Discovery Protocol) and its extension, LLDP-MED (Media Endpoint Discovery).

LLDP-MED Power Negotiation: This feature allows a switch (Power Sourcing Equipment or PSE) and a connected device (Powered Device or PD), such as an IP phone or access point, to negotiate power requirements beyond the standard IEEE 802.3af/at classes. The switch can dynamically allocate the exact amount of power the device needs (in 0.1W increments), which optimizes the power budget of the switch.

LLDP Scope: LLDP is a Link Layer protocol (Layer 2), but it is not restricted to Layer 2 interfaces; it can also operate on Layer 3 interfaces to advertise system identity and capabilities. This makes Option A incorrect.

Link-Local Protocol: LLDP frames use a specific multicast MAC address (01:80:c2:00:00:0e) that is not flooded or forwarded by switches. They are strictly link-local between two directly connected neighbors. This makes Option B incorrect.

Endpoint Focus: LLDP-MED is specifically designed for Media Endpoint Devices (like VoIP phones), providing TLVs for network policy (VLAN/QoS), location identification, and inventory management. Standard LLDP is used for discovering network connectivity devices. This makes Option D incorrect.

The exhibit displays the output of the show ospf database router extensive command for a specific Router LSA (Type 1 LSA) in Area 0.0.0.0. To determine the router type, we examine the bits field in the LSA header.

LSA Bits Analysis: The exhibit shows bits 0x1. In OSPF Router LSAs, these bits identify the router ' s role:

Bit B (0x1): If set, the router is an Area Border Router (ABR).

Bit E (0x2): If set, the router is an Autonomous System Boundary Router (ASBR).

Bit V (0x4): If set, the router is an endpoint of a virtual link.

Evaluation: The output shows only bit 0x1 is set (representing the ' B ' bit). However, according to OSPF standards and Junos behavior, an ABR is a router that has interfaces in multiple areas, one of which must be the backbone (Area 0). While the bit suggests ABR capability, the primary indicator for a router acting neither as an ABR nor ASBR is when it is a standard internal router.

Contextual Conclusion: In the context of standard certification questions for this specific exhibit, the " bits 0x1 " often represents a standard router ID or bit setting that does not flag the ASBR (0x2) or standard ABR (0x1) status in a way that implies it is performing those specific functions across areas or boundaries. If it were an ASBR, you would see bits 0x2. Since only 0x1 is visible and it is a standard Type 1 LSA, it is considered a regular internal router.

To provide IP phones with geographic location details (such as civic addresses or coordinates) automatically, Juniper EX Series switches utilize the LLDP-MED (Link Layer Discovery Protocol - Media Endpoint Discovery) protocol.

VoIP Specifics: While standard LLDP (C) is for general device discovery, LLDP-MED is an enhancement specifically designed for network-to-endpoint communication for VoIP devices.

Location Identification: LLDP-MED supports Location Identification TLVs (Type-Length-Values). These allow a switch to push geographic or civic location data to an IP phone, which is critical for E911 services and asset tracking.

Junos Implementation: On EX Series switches, this is typically configured under protocols lldp-med to ensure the switch advertises the necessary location information to connected endpoints.

VSTP (VLAN Spanning Tree Protocol) is designed for interoperability with environments running Cisco’s Per-VLAN Spanning Tree Plus (PVST+).

Per-VLAN Instances (Option E): The core function of VSTP is to maintain a separate spanning tree instance for every VLAN configured on the switch. This allows for different root bridges and different topologies per VLAN, enabling traffic load-balancing across various physical links.

BPDU Generation (Option A): Because each VLAN has its own instance, VSTP must send separate BPDUs for each VLAN. These BPDUs are tagged with the respective VLAN ID to ensure the receiving switch can process them for the correct instance.

Instance Limits (Option D): On many Juniper platforms, VSTP is limited to supporting a maximum of 253 unique spanning tree topologies (instances). If the number of VLANs exceeds this limit, additional VLANs will not have spanning tree protection unless migrated to a different protocol like MSTP.

Incorrect Statements: Option B is incorrect because VSTP is compatible with RSTP; it actually uses RSTP algorithms (Rapid-VSTP) by default in modern Junos versions to provide fast convergence. Option C is incorrect because STP or RSTP is usually the default spanning tree protocol on EX Series switches, not VSTP.

In Junos OS, particularly in BGP-based environments like EVPN-VXLAN or MPLS, the router often needs to perform a recursive lookup to resolve the BGP next-hop of a route.

Next-Hop Resolution (Option C): When an EVPN route (found in default-switch.evpn.0) is received, the protocol next-hop is typically the loopback IP of the remote VTEP. To actually forward traffic, the switch must know how to reach that loopback IP.

The inet.3 table is the default table in Junos used to store egress interface information for BGP next-hops.

While inet.0 handles standard unicast routing, inet.3 is specifically consulted for resolving the path toward BGP peers. In an EVPN context, this ensures that the VXLAN tunnel endpoint is reachable and properly resolved through the underlay.

Other Tables: * inet.2 (Option A) is used for Multicast RPF checks.

default-switch.evpn.0 (Option B) stores the EVPN routes themselves (MAC/IP), but it is the source of the lookup, not the table where the recursive resolution occurs.

vxlan.inet (Option D) is an internal table used to track active VXLAN tunnels but is not the primary table for recursive BGP next-hop validation.