JN0-650 Enterprise Routing and Switching - Professional (JNCIP-ENT) Questions and Answers

The IETF standards for EVPN-VXLAN define the scalability and forwarding behavior of the architecture.

VXLAN Scale (Statement B):The Virtual Network Identifier (VNI) is a24-bit fieldin the VXLAN header. This allows for up to $2^{24}$ unique identifiers, which translates to approximately16 milliondistinct VXLAN broadcast domains (segments) within a single fabric. *Forwarding Behavior (Statement D):VXLAN is a MAC-in-UDP encapsulation technology. When a Layer 2 frame enters the tunnel at a VTEP, theoriginal Layer 2 frame(including the original source and destination MAC addresses) is encapsulated into a UDP/IP packet and transported across the IP underlay. When it reaches the egress VTEP, the header is removed and theLayer 2 frame is forwarded unchangedto the destination host.

Why others are incorrect:Statement A is incorrect because EVPN itself can technically support more than 16 million domains, but the data plane (VXLAN) is the limiting factor in this specific deployment scenario. Statement C is incorrect because VXLAN encapsulates Layer 2 frames, not just "IP packets," and it treats the entire frame as a payload.

Junos OS 24.4 provides several server-failover options for 802.1X authentication to maintain network availability when the RADIUS server is unreachable.

Fallback Behavior (Option D):Theuse-cachefallback action allows the switch to consult its local cache of previously authenticated MAC addresses.

If a device was already authorized and its information is in the cache, the switch willcontinue to permit accessbased on those cached credentials.

However, if a new device (not in the cache) attempts to connect while the server is down, the switch cannot verify its credentials and willdeny the access attempt. This matches the specific requirement to permit authorized devices while denying new ones.

Other Fallback Options:

permit (Option C):This would allowalldevices (even new ones) to access the network, typically in a restricted "guest" or "bypass" VLAN.

deny (Option A):This would drop all traffic from all devices on the port if the server is unreachable.

vlan-name (Option B):This moves authenticated or unauthenticated users into a specific fallback VLAN.

In an EVPN-VXLAN architecture, the network is divided into two distinct planes: theUnderlayand theOverlay.

Underlay (IP Fabric):The underlay's only job is to provide IP reachability between the loopback addresses of all VTEPs (Virtual Tunnel Endpoints). This is typically achieved using OSPF, IS-IS, or EBGP.

Overlay (EVPN Control Plane):The overlay is responsible for carrying Layer 2 MAC and Layer 3 IP reachability information between switches.EVPN signalingis the standard mechanism for this task.

Protocol Choice (Option D):EVPN usesMP-BGP (Multiprotocol BGP)as its control plane protocol. On Juniper EX Series and QFX Series switches, the most scalable and recommended design for the overlay isEBGP(External BGP).

In a 3-stage or 5-stage Clos architecture, EBGP is used in the overlay to exchange EVPN routes (Route Types 1-5) between Leaf and Spine switches.

EBGP simplifies configuration by avoiding the need for Route Reflectors (required for IBGP) and provides better control over route propagation through BGP community and policy management.

Incorrect Options:

Options A and Brefer to the underlay protocols. While they provide the path for the VXLAN tunnels, they do not handle the EVPN signaling itself.

Option C(MPLS) is a different transport technology. While EVPN can run over MPLS (EVPN-MPLS), campus designs on EX series devices specifically use VXLAN as the data plane, making EBGP the standard signaling protocol for the EVPN-VXLAN overlay.

The exhibit illustrates an Autonomous System (AS 65512) receiving the same prefix ($203.0.113.0/24$) from two different neighbors, ISP A and ISP B. To influence outbound traffic from AS 65512 so that ISP A is preferred, you must manipulate the BGP Local Preference attribute.BGP Path Selection and Local Preference: Local preference is the first attribute evaluated by BGP after checking if the next hop is reachable. A higher local preference value is always preferred over a lower one. The default value in Junos OS is 100.Applying the Preference (Option B): By applying an import policy on router R1 to set a local preference higher than 100 (e.g., 200) for routes from ISP A, R1, R2, and R3 will all prefer the path through R1 to reach ISP A.Applying the Preference (Option C): Alternatively, you can achieve the same result by applying an import policy on R2 to set a local preference lower than 100 (e.g., 50) for routes from ISP B. Since the routes from R1 remain at the default of 100, the path through ISP A (100) will be preferred over ISP B (50).Why A and D are incorrect: Setting a lower preference for ISP A (Option A) or a higher preference for ISP B (Option D) would result in ISP B being preferred for outbound traffic, which is the opposite of the requirement.

This question focuses on port security and preventing "rogue switches" or multiple devices from accessing a single physical port simultaneously.

Single-Secure Supplicant Mode (Option A):This is the most restrictive 802.1X mode in Junos OS. It allowsexactly oneMAC address to be authenticated on the port at a time. If a device successfully authenticates, the switch will drop any traffic coming from any other MAC address on that same physical interface. If a user tries to plug in a switch, only the first device that authenticates will have access; all other devices behind that switch will be blocked.

Single Supplicant Mode (Option C):This mode allows the first authenticated user to "open" the port for all other users. This would actuallyallowa rogue switch to function once the first device is authorized.

Multiple Supplicant Mode (Option B):This allows multiple devices to connect, provided each one authenticates individually. While secure, it does not prevent a user from connecting multiple devices to the port, which violates the requirement to allow only one.

MAC-RADIUS (Option D):This is an authenticationmethod, not a port-accessmodethat limits the number of supplicants.

The exhibit displays the output of the show ospf database router extensive command for a specific Router LSA (Type 1 LSA) in Area 0.0.0.0. To determine the router type, we examine the bits field in the LSA header.

LSA Bits Analysis: The exhibit shows bits 0x1. In OSPF Router LSAs, these bits identify the router's role:

Bit B (0x1): If set, the router is an Area Border Router (ABR).

Bit E (0x2): If set, the router is an Autonomous System Boundary Router (ASBR).

Bit V (0x4): If set, the router is an endpoint of a virtual link.

Evaluation: The output shows only bit 0x1 is set (representing the 'B' bit). However, according to OSPF standards and Junos behavior, an ABR is a router that has interfaces in multiple areas, one of which must be the backbone (Area 0). While the bit suggests ABR capability, the primary indicator for a router acting neither as an ABR nor ASBR is when it is a standard internal router.

Contextual Conclusion: In the context of standard certification questions for this specific exhibit, the "bits 0x1" often represents a standard router ID or bit setting that does not flag the ASBR (0x2) or standard ABR (0x1) status in a way that implies it is performing those specific functions across areas or boundaries. If it were an ASBR, you would see bits 0x2. Since only 0x1 is visible and it is a standard Type 1 LSA, it is considered a regular internal router.

In External BGP (EBGP), there is a default safety mechanism that requires the peer's next hop to be on a directly connected network.

TTL Constraint: By default, EBGP packets are sent with a Time-to-Live (TTL) value of 1. If the next hop is not directly connected (e.g., when peering via loopback interfaces or across a multi-hop path), the packet will expire before reaching the destination, causing the route to be discarded or the session to fail.

The Multihop Solution (Option B): To override this behavior, you must configure the multihop statement under the BGP neighbor or group hierarchy. This allows the BGP session to establish by increasing the TTL (typically to 64 or a user-defined value) and bypasses the "directly connected" check.

Incorrect Options: Option A (accept-remote-nexthop) is used in internal BGP or specific routing-instance scenarios to resolve next hops that aren't in the local routing table, but it doesn't solve the EBGP TTL/direct-connection requirement. Option C (advertise-inactive) allows BGP to advertise routes that are not the best path in the routing table, which is irrelevant to next-hop reachability. Option D (multipath) is used for load-sharing across multiple paths.

EVPN Route Type 5 (IP Prefix Route) is used to advertise IP prefixes (subnets) between broadcast domains or between VRFs in an EVPN fabric.

IP-VRF-to-IP-VRF (Statement C):In an EVPN-VXLAN architecture, Type 5 routes are primarily used forLayer 3 connectivity. They allow different IP-VRFs on different VTEPs to exchange prefix information directly. This model is widely referred to asIP-VRF-to-IP-VRFrouting because it enables inter-subnet routing at the leaf layer without requiring Layer 2 MAC learning for those specific prefixes.

Overlay Next Hop (Statement B):For a PE router to reach a prefix advertised via a Type 5 route, it must resolve theoverlay next hop. This next hop is typically the loopback IP address of the originating VTEP, which the receiving router uses to build the VXLAN tunnel.

Why others are incorrect:Statement A is incorrect because Type 7 routes are used for IGMP/MLD join synchronization. Statement D is incorrect because Type 5 routes advertise IP prefixes, not MAC addresses; MAC extended communities are associated with Type 2 routes.

The exhibit shows the output of the show poe interface command on a Juniper switch.

VTEP Power Capabilities (Statement D):The exhibit shows the Pair/Mode as 2P/AT, which refers to theIEEE 802.3at(PoE+) standard. Under this standard, a switch can supply up to30 Wof power per port to attached devices (PDs). *Dynamic Learning (Statement C):Looking at the Max power column for port ge-0/0/0, it shows 19.5W(L). The(L)indicator signifies that the power has beendynamically learned(negotiated) via LLDP or hardware classification, rather than being statically configured by an administrator. Additionally, it has identified the device asClass 4, which is a standard dynamic classification for PoE+ devices.

Why others are incorrect:Statement A (60 W) refers to the 802.3bt (PoE++) standard, which is not indicated here. Statement B is incorrect because the "(L)" confirms the configuration is not static.

In an end-to-end CoS (Class of Service) design, there is a clear distinction betweenclassificationat the ingress andrewrite rulesat the egress.

The Problem:Your edge devices are successfully classifying traffic (assigning packets to internal forwarding classes). However, the core devices—which useBA (Behavior Aggregate) classifiers—are not classifying correctly. BA classifiers look at the bits in the packet header (like DSCP or 802.1p) to determine priority.

The Missing Link (Option C):When a packet leaves the edge device, its internal forwarding class and loss priority must be "written" back into the packet header so that the next-hop (the core device) can see it. By default, Junos may not preserve or set these bits correctly on egress. You must applyrewrite ruleson the edge switches' egress interfaces facing the core. These rules ensure the DSCP values in the headers match the forwarding class determined by the edge's MF classifier, allowing the core's BA classifier to function properly.

Other Options:Option A(policer) handles rate limiting, not classification.Option Bis incorrect because core devices often have different hardware or scaling needs than edge switches, and standard BA configuration is preferred over templates in the core.Option Dis incorrect because MF classifiers are standard for edge devices where deep packet inspection is needed to identify traffic types.

To secure a Layer 2 network runningMultiple VLAN Registration Protocol (MVRP)against unauthorized VLAN propagation from rogue devices, you must control the registration state of the ports.

Forbidden Registration Mode (Option D):This mode is specifically designed to prevent an interface from participating in the MVRP exchange.

When a port is set to forbidden, it willneither register nor declare VLANs(except those statically configured on the interface).

If a rogue device sends MVRP PDUs to this interface, the distribution switch willignore those PDUs, preventing the rogue device from dynamically creating or learning VLANs through that port.

Registration Hierarchy:In Junos OS 24.4, this is configured at the [edit protocols mvrp interface registration forbidden] level.

Other Modes:normal (default) allows full participation, while restricted ignores joins for VLANs not already statically defined on the switch but still declares its own.

To provide IP phones with geographic location details (such as civic addresses or coordinates) automatically, Juniper EX Series switches utilize theLLDP-MED (Link Layer Discovery Protocol - Media Endpoint Discovery)protocol.

VoIP Specifics:While standard LLDP (C) is for general device discovery,LLDP-MEDis an enhancement specifically designed for network-to-endpoint communication for VoIP devices.

Location Identification:LLDP-MED supportsLocation Identification TLVs(Type-Length-Values). These allow a switch to push geographic or civic location data to an IP phone, which is critical for E911 services and asset tracking.

Junos Implementation:On EX Series switches, this is typically configured under protocols lldp-med to ensure the switch advertises the necessary location information to connected endpoints.

In Junos OS, particularly in BGP-based environments like EVPN-VXLAN or MPLS, the router often needs to perform arecursive lookupto resolve the BGP next-hop of a route.

Next-Hop Resolution (Option C):When an EVPN route (found in default-switch.evpn.0) is received, the protocol next-hop is typically the loopback IP of the remote VTEP. To actually forward traffic, the switch must know how to reach that loopback IP.

Theinet.3table is the default table in Junos used to store egress interface information for BGP next-hops.

While inet.0 handles standard unicast routing, inet.3 is specifically consulted for resolving the path toward BGP peers. In an EVPN context, this ensures that the VXLAN tunnel endpoint is reachable and properly resolved through the underlay.

Other Tables:*inet.2 (Option A)is used for Multicast RPF checks.

default-switch.evpn.0 (Option B)stores the EVPN routes themselves (MAC/IP), but it is thesourceof the lookup, not the table where the recursive resolution occurs.

vxlan.inet (Option D)is an internal table used to track active VXLAN tunnels but is not the primary table for recursive BGP next-hop validation.

OSPFv2 (IPv4) and OSPFv3 (IPv6) share many fundamental concepts, such as the SPF algorithm and the use of areas, but they have distinct differences in how they handle prefix information and LSA headers in Junos OS.

Backbone Requirement (Option C):Both OSPFv2 and OSPFv3 utilize a hierarchical structure. In both versions, all areas must connect to a centralArea 0 (the backbone)to allow for inter-area routing. If an area is not physically connected to Area 0, a virtual link must be established.

Flooding Scope (Option D):One of the significant architectural changes in OSPFv3 is the inclusion of theflooding scopedirectly into the LSA header. In OSPFv3, the LS Type field is expanded to 16 bits, where the top three bits define the flooding scope (e.g., Link-local, Area, or AS scope). This allows routers to understand how far an LSA should be propagated without needing to understand the specific LSA type itself.

LSA Prefix Information (Option A):This statement is misleading. In OSPFv2, Router and Network LSAs (Type 1 and 2) carry both topology and prefix information. However, a key design goal of OSPFv3 was toseparatetopology from prefix information. In OSPFv3, Type 1 and 2 LSAs only describe the topology, while prefixes are carried in new LSA types:Intra-Area-Prefix-LSAs(Type 9) andLink-LSAs(Type 8).

Processing (Option B):OSPFv2 is processed "per-subnet" because it forms adjacencies based on IPv4 subnets. OSPFv3 is processed"per-link", meaning it forms adjacencies between interfaces on the same physical link regardless of whether they share a common IPv6 prefix.

Private VLANs (PVLANs) provide Layer 2 isolation between ports within the same broadcast domain. When a PVLAN spans multiple switches, a special type of trunk configuration is required to maintain the isolation and community logic across the inter-switch links.

Isolated VLAN Trunking (Option D):To extend an isolated VLAN across multiple switches, you must configure the trunk port on each switch to allow the isolated VLAN ID. In Junos OS, this is specifically achieved by configuring the interface as a trunk and associating it with the primary VLAN and the specific isolated VLAN. The correct syntax for enabling this inter-switch communication is to configure trunk ports that recognize the isolated VLAN tag (e.g., set interfaces unit 0 family ethernet-switching vlan members [ primary-vlan isolated-vlan ]).

Forwarding Rules:Traffic from an isolated port on Switch A must reach a promiscuous port (often on Switch B) to exit the PVLAN. The inter-switch trunk carries this traffic using the secondary (isolated) VLAN ID, ensuring that it remains isolated from other host ports on the remote switch.

Option A (inter-switch-link):In standard Junos switching, the inter-switch-link statement is used in Virtual Chassis or specific fabric designs, but for standard PVLAN extension, standard 802.1Q trunking with secondary VLAN IDs is the mechanism used.

Options B and C:These describe specific portroles(isolated vs. community) rather than the method used to enable trunking between switches.

The exhibit illustrates a standard end-to-end Class of Service (CoS) path consisting of an edge router (R1) and core/intermediate routers (R2 and R3).

Edge Classification (Option B):The scenario specifies that video traffic enters the networkwithout any class-of-service markings. Because there are no DSCP or 802.1p bits to inspect, the ingress router (R1) cannot use simple Behavior Aggregate (BA) classification. Instead, it must useMultifield (MF) classification. MF classification allows the router to look deeper into the packet (Source/Destination IP, Protocol, Port numbers) to identify the video stream and assign it to a specific forwarding class. *Core Classification (Option D):Once R1 has identified the traffic, it will typically apply arewrite ruleon its egress interface to mark the packets with a specific CoS value (like a DSCP code). Consequently, the downstream routers (R2 and R3) do not need to perform expensive deep-packet inspection again. They can useBehavior Aggregate (BA) classification, which simply looks at the markings in the packet header to determine the appropriate forwarding priority.

Option A and C:These are incorrect because BA classification is impossible on unmarked ingress traffic, and performing MF classification in the core is inefficient and not a recommended Juniper design practice for high-speed transit.