Pass the Juniper JNCIS-ENT JN0-352 Questions and answers with Dumpstech

The BGP finite state machine defined in RFC 4271 progresses through Idle, Connect, Active, OpenSent, OpenConfirm, and finally Established. The Active state is entered either directly after Idle, when the local router begins retrying a TCP connection setup toward the configured peer, or after a previous Connect attempt has failed and the ConnectRetry timer has expired, prompting the router to keep trying to complete the underlying TCP three-way handshake. Seeing a peer parked in Active therefore means the local device has a fully valid neighbor configuration and is persistently attempting to reach the remote address on TCP port 179, but the handshake is not succeeding — common root causes include a firewall or ACL blocking TCP 179 between the two endpoints, an unreachable or incorrect peer IP address, the remote BGP process not running or not listening, or an asymmetric routing path preventing the SYN/ACK from returning. It does not indicate a misconfiguration on the local box in the sense of a missing statement (that would typically leave the session as Idle), nor does it indicate an established, functioning session exchanging UPDATE messages (that state is Established), and it is not a deliberately idle/disabled condition, which Junos reports plainly as Idle. Recognizing Active as 'trying to connect' rather than 'connected' is essential for correct BGP troubleshooting sequencing. Reference topics: Junos Enterprise Routing – BGP Fundamentals, BGP Finite State Machine and Session Verification.

A floating static route is a backup static route that remains present in the configuration but stays inactive in the routing table under normal conditions, only becoming active if the primary, preferred route to the same destination is withdrawn or otherwise becomes unavailable. Junos determines which of several competing routes to the same prefix becomes active strictly by comparing each route's preference value (administrative distance), with the numerically lowest preference always winning; every routing protocol and static routes themselves carry a default preference (5 for standard static routes), and this value can be explicitly overridden per route using the preference statement under the static route's configuration. To create a floating static route, the administrator deliberately configures a preference value higher (that is, numerically worse, less preferred) than the preference of the primary route it is meant to back up — for example, a value higher than the 5 default of an ordinary static route, or higher than a dynamic protocol's preference such as OSPF's 10 — ensuring the floating route only becomes active once the more-preferred primary route disappears from the table entirely. This preference-based mechanism is the essential, defining configuration element of a floating static route. Priority is not a valid Junos static-route statement, next-hop simply defines where matching traffic is forwarded without controlling route selection behavior, and qualified-next-hop is a related but distinct mechanism used to assign a per-next-hop preference within a single multi-next-hop static route statement rather than between the standalone static route and its dynamic counterpart. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Configuring Floating Static Routes with Preference.

The factory-default storm control configuration on EX Series switches operates in a purely rate-limiting mode rather than an interface-shutdown mode. When broadcast, multicast, or unknown-unicast traffic on a port exceeds the configured bandwidth-percentage threshold, the default action is simply to police the offending traffic type and silently drop only the packets that exceed that threshold, while all traffic within the allowed rate continues to be forwarded normally and the interface itself remains administratively and operationally up throughout the event. This explains the observed symptom precisely: during the burst of unknown-unicast frames, the switch dropped the excess volume above the configured limit, producing a brief period of packet loss, but as soon as the burst subsided and traffic fell back under the threshold, storm control simply stopped dropping packets and normal forwarding resumed automatically — no administrative shutdown, recovery timer, or manual intervention was ever involved, because the interface was never taken down in the first place. This default drop-only behavior is distinct from the optional interface-shutdown action, which must be explicitly configured if an administrator wants storm control to disable a port outright on violation (as seen in a related scenario requiring the clear ethernet-switching recovery-timeout command). Storm control by default covers broadcast, multicast, and unknown-unicast traffic types together, not multicast alone, and it has no functional relationship to GRES, which governs Routing Engine redundancy rather than Layer 2 traffic policing. Reference topics: Junos Enterprise Switching – Storm Control, Default Drop Behavior Versus Interface Shutdown Action.

Because Server A resides in VLAN 10 and Server B resides in VLAN 20, traffic between them cannot remain a purely Layer 2 switched flow; it must be routed between the two VLANs, which on Switch 1 means the packet traverses the switch's internal routing engine (via an IRB interface) between the ingress and egress switching stages. Junos processes firewall filters along this path in a strict, layered order that mirrors the packet's actual journey through the device. First, any filter applied at the physical ingress port level (Rx-Port) is evaluated as the frame first arrives on ge-0/0/10. Next, any filter applied to the ingress VLAN (Rx-VLAN, i.e., VLAN 10) is evaluated as the frame is classified into its source broadcast domain. Because the destination subnet requires routing, the packet is then handed to the routing engine, where any input/ingress routed filter (Rx-Router) applied to the receiving IRB interface is evaluated next, followed by any output/egress routed filter (Tx-Router) applied as the now-routed packet is handed from the routing engine back out toward VLAN 20. Finally, the packet passes through any egress VLAN filter (Tx-VLAN, for VLAN 20) and then the egress physical port filter (Tx-Port) on ge-0/0/20 immediately before transmission to Server B. This complete six-stage sequence — Rx-Port, Rx-VLAN, Rx-Router, Tx-Router, Tx-VLAN, Tx-Port — reflects every filter-evaluation checkpoint a routed, inter-VLAN packet passes through on an EX Series Layer 3 switch. Reference topics: Junos Enterprise Switching – Layer 2 Switching and Firewall Filter Processing Order for Routed VLAN Traffic.

Correctly blocking SSH traffic originating from a specific network requires matching three precise conditions simultaneously in the from clause: the traffic's source-address must equal the 192.168.10.0/24 network, since the requirement is to block traffic coming from that network rather than traffic destined to it; the protocol must be explicitly set to tcp, since SSH operates exclusively over TCP; and the destination-port must be set to 22, because an inbound SSH connection request is always directed at the well-known SSH listening port 22 on the receiving side, regardless of which ephemeral source port the initiating client happens to use. The first option satisfies all three conditions correctly and pairs them with a discard action, cleanly dropping matching traffic. The second option incorrectly substitutes destination-address for source-address, which would match traffic heading toward that /24 rather than traffic originating from it, inverting the intended match direction. The third option incorrectly uses source-port 22 instead of destination-port 22; since the SSH client's source port is a randomly assigned ephemeral value rather than a fixed 22, this term would almost never match real SSH session-initiation traffic. The fourth option relies on a service ssh match condition, which is not valid syntax within the standard Junos firewall filter grammar for family inet; there is no such application-based keyword available at that hierarchy, making the term invalid regardless of the reject action chosen. Reference topics: Junos Enterprise Switching – Firewall Filters, Matching on Address, Protocol, and Port Conditions.

MACsec (IEEE 802.1AE) secures a point-to-point Ethernet link independently of how the logical unit above it is configured for VLAN tagging, so neither trunk mode nor access mode has any bearing on whether the MACsec Key Agreement (MKA) protocol can establish a secure channel. What does determine success is the pre-shared key material: when static CAK security mode is used, the Connectivity Association Key (CAK) and the Connectivity Association Key Name (CKN) must be configured identically on both ends of the link. If they do not match, MKA never completes the exchange, no secure channel is created, and all traffic on that interface is dropped rather than merely left unencrypted. Equally important, and frequently overlooked, is that MACsec adds up to 32 bytes of overhead per frame for the security tag (SecTAG) and integrity check value (ICV); Juniper's official guidance is to ensure the difference between the interface's physical MTU and the protocol MTU is large enough to absorb this overhead, or frames will be silently discarded once encryption is active, producing symptoms that look identical to a failed session. Both the CAK/CKN and MTU checks are documented first-line troubleshooting steps for MACsec on EX Series switches. Reference topics: Junos Enterprise Switching – Layer 2 Security, Configuring and Troubleshooting MACsec on EX Series Switches.

Switch A is already fixed as the root bridge in this topology (priority 0), so the outcome being engineered here is not about root bridge election at all, but about which of Switch C's two available paths toward that already-established root — the direct C-to-A link, or the indirect C-to-B-to-A path — RSTP selects as the lower-cost, primary path. RSTP's path-cost calculation for any non-root switch sums the port costs of every link along a candidate path to the root and always selects whichever candidate path has the lowest total accumulated cost as that switch's active root path, placing the corresponding local port into the forwarding root port role while any higher-cost alternative path is placed into a non-forwarding (alternate) role. To force Switch C to prefer routing through Switch B rather than connecting to Switch A directly, the administrator must make the direct C-to-A link's cost higher than the combined cost of the C-to-B link plus the B-to-A link added together, so that the indirect, two-hop path through Switch B mathematically totals to a lower cumulative cost than the single direct hop, causing RSTP's cost comparison to favor the indirect path as primary. Setting Switch B's priority (to either 1 or 0) is irrelevant here, since Switch B is not a root bridge candidate in this scenario and priority manipulation would only affect a root bridge election, not path cost preference between a fixed root and a downstream switch. Lowering the direct link's cost, the inverse of the correct answer, would instead reinforce the direct path rather than override it. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Path Cost and Root Port Selection.

GRE encapsulation adds a fixed 24 bytes of overhead to every packet it carries — 4 bytes for the GRE header itself and 20 bytes for the new outer IPv4 delivery header. When a host transmits a full 1500-byte Ethernet payload into a gr- interface, the resulting encapsulated packet becomes 1524 bytes, which exceeds the physical interface's standard 1500-byte MTU and forces fragmentation or drops if the don't-fragment bit is set. The correct remediation is to reduce the effective MTU seen by end hosts so that encapsulated packets never exceed the physical link's transmission limit. Junos automatically applies this logic to gr- logical interfaces, which default to a 1476-byte protocol MTU (1500 minus 24), but when the underlying physical interface or a manually configured path is involved, administrators must explicitly size the interface MTU to 1476 bytes to prevent post-encapsulation oversize packets. Allowing fragmentation with clear-dont-fragment is a workaround that increases CPU load and can degrade performance rather than solving the root cause, BFD addresses link-failure detection rather than MTU sizing, and ToS copying affects only the type-of-service byte, not packet length. Reference topics: Junos Enterprise Routing – Tunneling, GRE Encapsulation and MTU Considerations; Junos OS Configuring GRE Tunnel Interfaces.

A GRE-encapsulated packet consists of the original passenger packet wrapped inside a GRE header and a new outer IP delivery header, and the combined size of these two additions is what constitutes GRE's per-packet overhead. The base GRE header, as defined in RFC 2784 and used in its minimal, non-keyed, non-checksummed form (the default and most common deployment), is exactly 4 bytes in length, containing the flags/version field and the protocol type field identifying the encapsulated payload's ether type. Layered around that GRE header is a completely new outer IPv4 header, which itself consumes a standard 20 bytes, containing the tunnel source and destination addresses used for delivery across the underlying network. Adding these two components together — 4 bytes for the GRE header plus 20 bytes for the new outer IPv4 header — yields a total of exactly 24 bytes of overhead imposed on every encapsulated packet, which is precisely why Junos automatically sets the default protocol MTU on gr- tunnel interfaces to 1476 bytes (1500 minus 24) to prevent oversized, post-encapsulation packets from requiring fragmentation on a standard 1500-byte Ethernet path. The 20-byte figure alone describes only the new IP header in isolation and omits the GRE header itself, while 12 and 32 bytes do not correspond to any standard, non-keyed GRE encapsulation configuration and are included purely as plausible-looking distractors. Reference topics: Junos Enterprise Routing – Tunneling, GRE Header Overhead and MTU Planning.

The Junos BGP path selection algorithm proceeds through a strict, ordered sequence of comparison steps, and once next-hop reachability and route preference (administrative distance) have been confirmed as equal, local preference is the very first BGP-specific path attribute evaluated in the decision process. A route carrying a higher local preference value is always chosen over a competing route to the same prefix with a lower local preference, and this comparison takes absolute precedence over every subsequent attribute in the algorithm; if local preference values differ between candidate paths, the selection process concludes at this step without ever needing to examine AS path length, origin type, or MED at all. Only when two or more competing paths share an identical local preference value does the algorithm proceed to its third step, comparing AS path length and preferring the shortest, and only after a further tie does it move on to origin type (preferring IGP-origin over EGP-origin, and EGP-origin over incomplete), followed by MED comparison (preferring the lowest value, and only among routes learned from the same neighboring AS by default). Because local preference is evaluated strictly before all three of the other listed attributes, it is the attribute BGP consults first among the choices given, making it the deciding factor in scenarios such as this exhibit where multiple autonomous systems advertise competing paths toward the same 192.168.1.0/24 prefix. Reference topics: Junos Enterprise Routing – BGP, Understanding BGP Path Selection Order.