Pass the Juniper JNCIP-ENT JN0-650 Questions and answers with Dumpstech

The exhibit shows a BGP Route Reflector (RR) configuration where an export policy named NHS (Next-Hop Self) is applied to the internal BGP group int-group. The policy NHS sets the next-hop self attribute for BGP routes.

The Problem (Traffic Tromboning):In a standard BGP Route Reflector design, the RR should reflect routes without modifying the BGP next-hop attribute. By applying a next-hop self policy on the export to clients, the RR tells all its clients thatitis the exit point for those routes. Consequently, all data plane traffic is sent to the RR first before being forwarded to the actual destination, rather than following the optimal direct path between clients. This is known as "traffic tromboning" or suboptimal routing.

The Solution (Option C):The most direct way to fix this is todelete the export policythat is forcing the next-hop to be the RR. By deleting protocols bgp group int-group export NHS, the RR will resume standard behavior and reflect the original next-hop received from the route source, allowing clients to route traffic directly to the correct destination.

The Refined Solution (Option D):If you must keep the NHS policy (perhaps for routes learned from external peers), you should ensure it only applies to those specific routes. By adding from route-type internal to the policy term and then potentially changing the logic (or simply narrowing the scope), you can prevent the RR from incorrectly applying next-hop self to internal routes that it is merely reflecting. In the context of this specific problem,Option Dcombined with a change in the policy's action or scope helps ensure reflected internal routes maintain their original, optimal next-hops.

Option Ais incorrect because setting next-hop self for external routes is common practice, but it doesn't solve the problem of internal reflected routes being diverted to the RR.

Option Bis incorrect because applying this as an import policy would change how the RR itself sees the routes, but it wouldn't fix the attributes being sent out to the clients in the reflection process.

The exhibit displays the default-switch.evpn.0 routing table, which is used on Juniper leaf devices to store EVPN Type 2 (MAC/IP) routes.

Route Distinguisher (Option C):In EVPN, theRoute Distinguisher (RD)is an 8-byte prefix added to a route to make it unique within the BGP control plane. The RD format in the exhibit is :.

For example, the prefix 2:192.168.100.1:1::5010::... indicates an EVPN Type 2 route (2:) where 192.168.100.1:1 is theRoute Distinguisher.

This RD identifies the specific routing instance on the originating VTEP that advertised the MAC/IP address.

Option A is incorrect:The RD 192.168.100.2:1 does not necessarily mean thehostdevice has that IP; it means theoriginating switchhas that router ID/IP used for its RD.

Option B is incorrect:While the RD oftenincorporatesthe router ID, the RD itself is the full string (e.g., 192.168.100.1:1), which is distinct from the raw Router ID used in the BGP summary.

Option D is incorrect:Looking at the entries for 10.1.1.1 and 10.1.2.3, they are associated with different identifiers in the RD strings (5010 and 5020 respectively), which typically map to different VNIs or bridge domains.

OSPF (Open Shortest Path First) is a standards-based Link-State Interior Gateway Protocol (IGP) implemented within Junos OS 24.4:

Intra-AS Routing:OSPF is designed to distribute routing information and performneighbor discovery within a single Autonomous System (AS). It divides the AS into areas to localize Link-State Advertisements (LSAs) and reduce the size of the Link-State Database (LSDB) on each router. (Option B)

Algorithm:OSPF uses theShortest Path First (SPF) or Dijkstra algorithm, not a distance vector algorithm (which would be RIP or BGP). This makesOption Aincorrect.

Directly Connected Routes:In Junos OS, you must explicitly configure an interface under the [edit protocols ospf] hierarchy to include it in the OSPF process. Once an interface is added, its prefix isautomatically advertisedto neighbors via Router (Type 1) LSAs. This makesOption Ctechnically inaccurate in the context of interfaces participating in the protocol.

Scope:Protocols used between multiple autonomous systems are External Gateway Protocols (EGPs), such as BGP. This makesOption Dincorrect.

The exhibit illustrates an Autonomous System (AS 65512) receiving the same prefix ($203.0.113.0/24$) from two different neighbors, ISP A and ISP B. To influence outbound traffic from AS 65512 so that ISP A is preferred, you must manipulate the BGP Local Preference attribute.BGP Path Selection and Local Preference: Local preference is the first attribute evaluated by BGP after checking if the next hop is reachable. A higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.Applying the Preference (Option B): By applying an import policy on router R1 to set a local preference higher than 100 (e.g., 200) for routes from ISP A, R1, R2, and R3 will all prefer the path through R1 to reach ISP A.Applying the Preference (Option C): Alternatively, you can achieve the same result by applying an import policy on R2 to set a local preference lower than 100 (e.g., 50) for routes from ISP B. Since the routes from R1 remain at the default of 100, the path through ISP A (100) will be preferred over ISP B (50).Why A and D are incorrect: Setting a lower preference for ISP A (Option A) or a higher preference for ISP B (Option D) would result in ISP B being preferred for outbound traffic, which is the opposite of the requirement.

In Junos OS, particularly in BGP-based environments like EVPN-VXLAN or MPLS, the router often needs to perform arecursive lookupto resolve the BGP next-hop of a route.

Next-Hop Resolution (Option C):When an EVPN route (found in default-switch.evpn.0) is received, the protocol next-hop is typically the loopback IP of the remote VTEP. To actually forward traffic, the switch must know how to reach that loopback IP.

Theinet.3table is the default table in Junos used to store egress interface information for BGP next-hops.

While inet.0 handles standard unicast routing, inet.3 is specifically consulted for resolving the path toward BGP peers. In an EVPN context, this ensures that the VXLAN tunnel endpoint is reachable and properly resolved through the underlay.

Other Tables:*inet.2 (Option A)is used for Multicast RPF checks.

default-switch.evpn.0 (Option B)stores the EVPN routes themselves (MAC/IP), but it is thesourceof the lookup, not the table where the recursive resolution occurs.

vxlan.inet (Option D)is an internal table used to track active VXLAN tunnels but is not the primary table for recursive BGP next-hop validation.

In Junos OS 24.4, Captive Portal is used as a web-based authentication method for Layer 2 network access control, often in environments where 802.1X is not feasible for all users.

Fallback Mechanism (Option D):On EX Series switches, Juniper supports aflexible authentication order. By default, the switch attempts authentication in the order of802.1X, thenMAC RADIUS, and finallyCaptive Portal. If a client fails both 802.1X and MAC RADIUS, the switch can fall back to Captive Portal to redirect the user to a login page.

MAC Allowlist (Option B):Captive Portal relies on intercepting HTTP/HTTPS traffic to redirect users. However, "headless" devices like printers or cameras lack web browsers and cannot interact with the portal. To accommodate these, Junos allows administrators to configure anauthentication allowlist(or whitelist), which identifies these devices by their MAC addresses and permits them to bypass the portal entirely.

Precedence (Option A):This is incorrect because Captive Portal is generally thelastmethod in the default sequence, not the first.

Layer 2 Participation (Option C):While Captive Portal requires a Layer 3 interface (RVI/IRB) for the redirection process, it is explicitly used to controlLayer 2 accesson EX Series switches.

This question focuses on port security and preventing "rogue switches" or multiple devices from accessing a single physical port simultaneously.

Single-Secure Supplicant Mode (Option A):This is the most restrictive 802.1X mode in Junos OS. It allowsexactly oneMAC address to be authenticated on the port at a time. If a device successfully authenticates, the switch will drop any traffic coming from any other MAC address on that same physical interface. If a user tries to plug in a switch, only the first device that authenticates will have access; all other devices behind that switch will be blocked.

Single Supplicant Mode (Option C):This mode allows the first authenticated user to "open" the port for all other users. This would actuallyallowa rogue switch to function once the first device is authorized.

Multiple Supplicant Mode (Option B):This allows multiple devices to connect, provided each one authenticates individually. While secure, it does not prevent a user from connecting multiple devices to the port, which violates the requirement to allow only one.

MAC-RADIUS (Option D):This is an authenticationmethod, not a port-accessmodethat limits the number of supplicants.

OSPF determines the best path to a destination by calculating themetric (cost)of each link. By default, Junos OS uses areference bandwidthof100 Mbpsto calculate this cost using the formula:

When the reference bandwidth is left at the default 100 Mbps, any interface with a speed of 100 Mbps or higher (including 1 GbE and 10 GbE) is assigned a cost of1because the minimum OSPF cost is 1. This results in equal-cost paths, preventing the router from preferring the faster 10 GbE link.

To ensure 10 GbE interfaces are preferred, you must create a cost differential:

Option A (Reference Bandwidth):By increasing the reference bandwidth to10G(or higher), the calculation changes. For a 10 GbE link, the cost becomes $10,000 / 10,000 = 1$. For a 1 GbE link, the cost becomes $10,000 / 1,000 = 10$. Since OSPF prefers the path with thelowest cumulative cost, the 10 GbE link is now preferred.

Option D (Manual Metric):You can manually override the automatic cost calculation by assigning a higher metric specifically to the 1 GbE interfaces. If a 1 GbE interface is manually set to a cost of 50 and the 10 GbE interface remains at 1 (or is set to a lower value), the router will prioritize the 10 GbE path.

Option Bis incorrect because a higher metric makes a pathlesspreferred.Option Cis incorrect because a 1G reference bandwidth would still result in both 1 GbE and 10 GbE interfaces having a cost of 1.

When integrating a QFX Series switch into an EVPN-VXLAN IP fabric, specific BGP and EVPN hierarchy configurations are required to establish the control and data planes:

EVPN Encapsulation (Option A):In Junos OS, the encapsulation vxlan statement must be explicitly configured under the protocols evpn hierarchy. This defines that the EVPN control plane will use VXLAN as the data plane encapsulation method rather than MPLS.

BGP Address Family (Option C):EVPN uses Multiprotocol BGP (MP-BGP) to distribute reachability information. For the control plane to function, you must enable the EVPN signaling address family under the BGP protocol using the command set protocols bgp group family evpn signaling.

Incorrect Options:Option Bis incorrect because family vpls is used for traditional VPLS signaled by BGP, not for EVPN-VXLAN.Option Dis incorrect because while the loopback interface must be reachable, it is typically advertised via anIGP(like OSPF or IS-IS) to provide the underlay connectivity that BGP then rides upon; BGP itself does not "advertise" the loopback to establish the initial peerings.

VSTP (VLAN Spanning Tree Protocol) is designed for interoperability with environments running Cisco’s Per-VLAN Spanning Tree Plus (PVST+).

Per-VLAN Instances (Option E): The core function of VSTP is to maintain a separate spanning tree instance for every VLAN configured on the switch. This allows for different root bridges and different topologies per VLAN, enabling traffic load-balancing across various physical links.

BPDU Generation (Option A): Because each VLAN has its own instance, VSTP must send separate BPDUs for each VLAN. These BPDUs are tagged with the respective VLAN ID to ensure the receiving switch can process them for the correct instance.

Instance Limits (Option D): On many Juniper platforms, VSTP is limited to supporting a maximum of 253 unique spanning tree topologies (instances). If the number of VLANs exceeds this limit, additional VLANs will not have spanning tree protection unless migrated to a different protocol like MSTP.

Incorrect Statements: Option B is incorrect because VSTP is compatible with RSTP; it actually uses RSTP algorithms (Rapid-VSTP) by default in modern Junos versions to provide fast convergence. Option C is incorrect because STP or RSTP is usually the default spanning tree protocol on EX Series switches, not VSTP.