Pass the Juniper JNCIS-ENT JN0-351 Questions and answers with ExamsMirror

IP-IP tunnels encapsulate IP packets within other IP packets, allowing them to traverse networks that wouldn ' t normally support the original IP packets. This encapsulation involves the TTL (Time-to-Live) of the inner packet being decremented as it traverses through the tunnel towards its endpoint.

The BGP attribute that you would use to forward all Internet traffic through the R1 device is the  local preference 1 .

The local preference is an attribute that is used within an autonomous system (AS) and exchanged between iBGP routers 1 .  It is used to select an exit point from the AS 1 .  The path with the highest local preference is preferred 1 .  By setting a higher local preference for the routes received from R1, you can make R1 the preferred exit point for all Internet traffic 1 .

To isolate management traffic in a non-default routing-instance on Junos-based devices, you can use the  set system management-instance  and  set routing-instances mgmt_junos  commands 1 2 .

set system management-instance : This command associates the management interface (usually named fxp0 or em0 for Junos OS, or re0:mgmt-* or re1:mgmt-* for Junos OS Evolved) with the non-default virtual routing and forwarding (VRF) instance 1 .  After you configure the non-default management VRF instance, management traffic no longer has to share a routing table with other control traffic or protocol traffic 1 .

set routing-instances mgmt_junos : This command creates a new routing instance named  mgmt_junos .  The name of the dedicated management VRF instance is reserved and hardcoded as  mgmt_junos ; you cannot configure any other routing instance by the name  mgmt_junos 1 .

Therefore, options C and D are correct.  Options A and B are not correct because they attempt to assign an interface to the  mgmt_junos  routing instance, which is not necessary for isolating management traffic 1 .

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

A route reflector is a BGP router that is allowed to break the iBGP loop avoidance rule and advertise routes received from an iBGP peer to another iBGP peer under specific conditions 1 .  A route reflector can have three types of peerings: EBGP neighbor, IBGP client neighbor, and IBGP non-client neighbor 2 .  A cluster is a group of route reflectors and their clients that are fully meshed 3 .  The cluster ID is a 4-byte value that identifies the route reflector cluster and is carried in the ORIGINATOR_ID attribute of the BGP update message 4 . The cluster ID is used to prevent routing loops among route reflectors and their clients.  If a route reflector receives a route with its own cluster ID, it discards the route 5 . Therefore, the cluster ID is required to prevent routing loops when using route reflectors.

The DHCP snooping feature in Juniper Networks’ EX Series switches works by building a binding database that maps the IP address, MAC address, lease time, binding type, VLAN number, and interface information 1 .  This database is used to filter and validate DHCP messages from untrusted sources 1 .

However, there are certain conditions that could prevent entries from being automatically created in the snooping database for an interface:

MAC limiting: If MAC limiting is enabled on the interface, it could potentially interfere with the operation of DHCP snooping.  MAC limiting restricts the number of MAC addresses that can be learned on a physical interface to prevent MAC flooding attacks 1 . This could inadvertently limit the number of DHCP clients that can be learned on an interface, thus preventing new entries from being added to the DHCP snooping database.

Static IP address : If the device connected to the interface is configured with a static IP address, it will not go through the DHCP process and therefore will not have an entry in the DHCP snooping database 1 .  The DHCP snooping feature relies on monitoring DHCP messages to build its database 1 , so devices with static IP addresses that do not send DHCP messages will not have their information added.

Therefore, options B and C are correct.  Options A and D are not correct because performing a DHCPRELEASE would simply remove an existing entry from the database 1 , and Dynamic ARP inspection (DAI) uses the information stored in the DHCP snooping binding database but does not prevent entries from being created 1 .

BFD is a protocol that can be used to quickly detect failures in the forwarding path between two adjacent routers or switches. BFD can be integrated with various routing protocols and link aggregation protocols to provide faster convergence and fault recovery.

According to the Juniper Networks documentation, the following protocols support BFD on Junos OS devices 1 :

BGP: BFD can be used to monitor the connectivity between BGP peers and trigger a session reset if a failure is detected.  BFD can be configured for both internal and external BGP sessions, as well as for IPv4 and IPv6 address families 2 .

OSPF: BFD can be used to monitor the connectivity between OSPF neighbors and trigger a state change if a failure is detected.  BFD can be configured for both OSPFv2 and OSPFv3 protocols, as well as for point-to-point and broadcast network types 3 .

LACP: BFD can be used to monitor the connectivity between LACP members and trigger a link state change if a failure is detected.  BFD can be configured for both active and passive LACP modes, as well as for static and dynamic LAGs 4 .

Other protocols that support BFD on Junos OS devices are:

IS-IS: BFD can be used to monitor the connectivity between IS-IS neighbors and trigger a state change if a failure is detected. BFD can be configured for both level 1 and level 2 IS-IS adjacencies, as well as for point-to-point and broadcast network types.

RIP: BFD can be used to monitor the connectivity between RIP neighbors and trigger a route update if a failure is detected. BFD can be configured for both RIP version 1 and version 2 protocols, as well as for IPv4 and IPv6 address families.

VRRP: BFD can be used to monitor the connectivity between VRRP routers and trigger a priority change if a failure is detected. BFD can be configured for both VRRP version 2 and version 3 protocols, as well as for IPv4 and IPv6 address families.

The protocols that do not support BFD on Junos OS devices are:

RSTP: RSTP is a spanning tree protocol that provides loop prevention and rapid convergence in layer 2 networks. RSTP does not use BFD to detect link failures, but relies on its own hello mechanism that sends BPDU packets every 2 seconds by default.

FTP: FTP is an application layer protocol that is used to transfer files between hosts over a TCP connection. FTP does not use BFD to detect connection failures, but relies on TCP’s own retransmission and timeout mechanisms.

In a trunk port configuration with multiple VLANs, the native VLAN carries untagged traffic. This means frames sent or received on the port without a VLAN tag are automatically assigned to the native VLAN.

Here ' s why the other options are incorrect:

A. The native VLAN must be the default VLAN on the port.  This is not necessarily true. The native VLAN and the default VLAN can be different. The default VLAN is the VLAN assigned to untagged traffic on access ports, while the native VLAN applies to trunk ports.

B. The native VLAN is automatically configured through DHCP.  This is incorrect. The native VLAN needs to be manually configured on the switch port. DHCP is used for assigning IP addresses, not VLAN IDs.

D. The native VLAN is the highest tagged VLAN ID on the port.  This is also incorrect. The native VLAN and tagged VLANs are independent. The native VLAN is not related to the highest or lowest tagged VLAN ID.

Therefore, the only true statement is that the native VLAN is an untagged VLAN ID on the port.

Option A suggests that the MTU is not at least 1492 bytes.  This is correct because IS-IS requires a minimum MTU of 1492 bytes to establish adjacencies 1 .  If the MTU is less than this, IS-IS adjacencies will not be established 1 .

Option D suggests that the lo0 interface is not included as an IS-IS interface.  This is also correct because the loopback interface (lo0) is typically used as the router ID in IS-IS 1 .  If the loopback interface is not included in IS-IS, it could prevent IS-IS adjacencies from being established 1 .

Therefore, options A and D are correct.