JN0-351 Enterprise Routing and Switching Specialist (JNCIS-ENT) Questions and Answers

Option B is correct.  Filter-based forwarding (FBF), also known as Policy Based Routing (PBR), uses the forwarding routing instance type 1 2 .

Option C is correct.  Routing Information Base (RIB) groups are used to copy routes from one routing table to another 3 4 .  In the context of FBF, RIB groups can be used to copy routes from the inet.0 routing table 3 4 .

Option A is incorrect.  FBF does not use the no-forwarding routing instance type 1 5 .

Option D is incorrect.  RIB groups are not used to hide routes in the inet.0 routing table 3 4 .  They are used to share or copy routes between different routing tables 3 4 .

A  is correct because the interface is configured as a disabled port. A disabled port does not forward any traffic, including DHCP packets.  Therefore, DHCP snooping cannot learn any MAC addresses or lease information from a disabled port 1 .

C  is correct because the interface is configured as a trunk port.  By default, all trunk ports on the switch are trusted for DHCP snooping 2 . This means that DHCP snooping does not inspect or filter any DHCP packets received on a trunk port.  Therefore, DHCP snooping does not add any entries to the snooping database for a trunk port 2 .

A  is correct because generated routes require a contributing route.  A contributing route is a route that matches the destination prefix of the generated route and has a valid next hop 1 .  A generated route is only installed in the routing table if there is at least one contributing route available 2 . This ensures that the generated route is reachable and useful.  If there is no contributing route, the generated route is not added to the routing table 2 .

B  is correct because generated routes show a next hop in the routing table.  A generated route inherits the next hop of its primary contributing route, which is the most preferred route among all the contributing routes 2 .  The next hop of the generated route can be either an IP address or an interface name, depending on the type of the contributing route 2 .  The next hop of the generated route can also be modified by a routing policy 3 .

The configuration shown in the exhibit is an example of a routing instance of type virtual-router.  A routing instance is a collection of routing tables, interfaces, and routing protocol parameters that create a separate routing domain on a Juniper device 1 .  A virtual-router routing instance allows administrators to divide a device into multiple independent virtual routers, each with its own routing table 2 .

The configuration also includes a rib-group statement, which is used to import routes from one routing table to another. A rib-group consists of an import-rib statement, which specifies the source routing table, and an export-rib statement, which specifies the destination routing table.

In this case, the rib-group name is inet-to-ispi, and the import-rib statement specifies inet.0 as the source routing table. The export-rib statement specifies ispi.inet.0 as the destination routing table. This means that the routes from inet.0 will be imported into ispi.inet.0.

Therefore, the correct answer is B. The inet.0 route table will be imported into the ispi.inet.0 route table.

IS-IS (Intermediate System to Intermediate System) is a routing protocol that is designed to move information efficiently within a computer network 1 2 .  It supports multiple protocol topologies, including IPv4, IPv6, and multicast 1 2 . Therefore, options C, E, and D are correct.

The exhibit shows the output of the command  show vlans brief , which displays brief information about VLANs and their associated interfaces 1 .

The output has four columns: Routing instance, VLAN name, Interfaces, and Tagging.

The * symbol indicates that the interface is active, meaning that it is up and forwarding traffic 1 .  This can be verified by the command  show interfaces terse , which displays the status of the interfaces 2 .

IP-IP tunnels encapsulate IP packets within other IP packets, allowing them to traverse networks that wouldn ' t normally support the original IP packets. This encapsulation involves the TTL (Time-to-Live) of the inner packet being decremented as it traverses through the tunnel towards its endpoint.

A route reflector is a BGP router that is allowed to break the iBGP loop avoidance rule and advertise routes received from an iBGP peer to another iBGP peer under specific conditions 1 .  A route reflector can have three types of peerings: EBGP neighbor, IBGP client neighbor, and IBGP non-client neighbor 2 .  A cluster is a group of route reflectors and their clients that are fully meshed 3 .  The cluster ID is a 4-byte value that identifies the route reflector cluster and is carried in the ORIGINATOR_ID attribute of the BGP update message 4 . The cluster ID is used to prevent routing loops among route reflectors and their clients.  If a route reflector receives a route with its own cluster ID, it discards the route 5 . Therefore, the cluster ID is required to prevent routing loops when using route reflectors.

A broadcast storm is a network condition where a large number of broadcast packets are sent and received by multiple devices, causing congestion and performance degradation 1 .  A broadcast storm can occur when there are loops in the network topology, meaning that there are multiple paths between two devices 2 .

A spanning tree protocol is a network protocol that prevents loops from being formed when switches or bridges are interconnected via multiple paths.  It does this by creating a logical tree structure that spans all the devices in the network, and disabling or blocking the links that are not part of the tree, leaving a single active path between any two devices 3 .

By eliminating loops, a spanning tree protocol also eliminates broadcast storms, as broadcast packets will not be forwarded endlessly along the looped paths.  Instead, broadcast packets will be sent only along the tree structure, reaching each device once and avoiding congestion 3 .

According to the OSPF protocol, the designated router (DR) is the router that acts as the focal point for exchanging routing information on a multi-access network segment, such as a LAN 1 .  The DR election process is based on the following criteria, in order of precedence 1 :

The router with the highest OSPF priority becomes the DR. The default priority is 1, and a priority of 0 means the router will not participate in the election.

If there is a tie in priority, the router with the highest router ID becomes the DR. The router ID is a 32-bit number that uniquely identifies a router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address of a loopback interface or a physical interface.

If there is a tie in router ID, the router that was first to become an OSPF neighbor becomes the DR.

In your scenario, two routers share the same highest priority and start time. This means that they have equal chances of becoming the DR based on the first and third criteria. Therefore, the second criterion will be used to break the tie, which is the router ID.  The router with the highest router ID will become the DR, and the other router will become the backup designated router (BDR), which is ready to take over the role of DR if it fails 1 .

Both aggregate and generated routes would work, but the best choice is generated routes.

According to the Juniper documentation 1 , the output of the show vlans command displays the forwarding options for the VLAN, including the DHCP security features. In the exhibit, the output shows that DHCP security is enabled, and that ARP inspection and IP source guard are also enabled. These features work together to protect the switch from IP spoofing and ARP spoofing attacks. DHCP snooping builds a database of IP/MAC bindings by snooping DHCP messages. ARP inspection validates ARP packets against the DHCP snooping database and drops invalid packets.  IP source guard checks the IP and MAC source addresses of packets against the DHCP snooping database and drops spoofed packets 2 3 . Therefore, the correct answer is A, B, and C.

The other options are not correct because:

D. The DHCP snooping database is not protected by default.  To protect the database from corruption or loss, you need to configure a file name and a location for storing the database, and enable periodic write operations to the file 4 . The exhibit does not show any such configuration.

E. DHCP snooping is not enabled for IPv6 traffic by default.  To enable DHCPv6 snooping, you need to configure a DHCPv6 relay agent and specify the trusted interfaces for DHCPv6 messages 5 . The exhibit does not show any such configuration.

Option A suggests that the MTU is not at least 1492 bytes.  This is correct because IS-IS requires a minimum MTU of 1492 bytes to establish adjacencies 1 .  If the MTU is less than this, IS-IS adjacencies will not be established 1 .

Option D suggests that the lo0 interface is not included as an IS-IS interface.  This is also correct because the loopback interface (lo0) is typically used as the router ID in IS-IS 1 .  If the loopback interface is not included in IS-IS, it could prevent IS-IS adjacencies from being established 1 .

Therefore, options A and D are correct.

The DHCP snooping feature in Juniper Networks’ EX Series switches works by building a binding database that maps the IP address, MAC address, lease time, binding type, VLAN number, and interface information 1 .  This database is used to filter and validate DHCP messages from untrusted sources 1 .

However, there are certain conditions that could prevent entries from being automatically created in the snooping database for an interface:

MAC limiting: If MAC limiting is enabled on the interface, it could potentially interfere with the operation of DHCP snooping.  MAC limiting restricts the number of MAC addresses that can be learned on a physical interface to prevent MAC flooding attacks 1 . This could inadvertently limit the number of DHCP clients that can be learned on an interface, thus preventing new entries from being added to the DHCP snooping database.

Static IP address : If the device connected to the interface is configured with a static IP address, it will not go through the DHCP process and therefore will not have an entry in the DHCP snooping database 1 .  The DHCP snooping feature relies on monitoring DHCP messages to build its database 1 , so devices with static IP addresses that do not send DHCP messages will not have their information added.

Therefore, options B and C are correct.  Options A and D are not correct because performing a DHCPRELEASE would simply remove an existing entry from the database 1 , and Dynamic ARP inspection (DAI) uses the information stored in the DHCP snooping binding database but does not prevent entries from being created 1 .

In BGP, routing policies are used to control the flow of routing information between BGP peers 1 .

Option C suggests that import policies are applied after the RIB-In table.  This is correct because import policies in BGP are applied to routes that are received from a BGP peer, before they are installed in the local BGP Routing Information Base (RIB-In) 1 .  The RIB-In is a database that stores all the routes that are received from all peers 1 .

Option D suggests that export policies are applied after the RIB-Local table.  This is correct because export policies in BGP are applied to routes that are being advertised to a BGP peer, after they have been selected from the local BGP Routing Information Base (RIB-Local) 1 .  The RIB-Local is a database that stores all the routes that the local router is using 1 .

Therefore, options C and D are correct.

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

The two reasons for the failure to form an adjacency in a network running IS-IS could be:

B. There is no configured ISO address on any IS-IS interface. IS-IS requires each router interface to have an ISO address configured.  Without this address, the routers cannot form an adjacency 1 .

D. The family iso configuration is missing from the adjacency interface. The ‘family iso’ configuration is essential for IS-IS to function correctly.  If this configuration is missing from the adjacency interface, it could prevent the formation of an adjacency 1 .

These explanations are based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 2 3 .

According to the Juniper documentation1, when a switch receives a unicast frame destined to a MAC address that is not registered in the bridging table, it floods the frame out all ports that are part of the same VLAN, except the receiving port. This is the default behavior of a switch when it does not know the destination MAC address. The switch does not perform an ARP request, send an error message, or flood the frame to all VLANs. References: Understanding Unicast Flooding | Junos OS | Juniper Networks

The exhibit shows the output of the command  show ip bgp , which displays information about the BGP routes in the routing table 1 . The output shows two routes for the destination 192.168.10.0/24, one from R1 and one from R2.

The route from R1 has a local preference of 200, while the route from R2 has a local preference of 100.  Local preference is a BGP attribute that indicates the degree of preference for a route within an autonomous system (AS) 2 .  A higher local preference means a more preferred route 2 .

BGP uses a best path selection algorithm to choose the best route for each destination among multiple paths.  The algorithm compares different attributes of the routes in a specific order of precedence 3 .  The first attribute that is compared is weight, which is a Cisco-specific attribute that is local to the router 3 .  If the weight is equal or not set, the next attribute that is compared is local preference 3 .

In this case, both routes have the same weight of 0, which means that they are learned from external BGP (eBGP) peers 3 . Therefore, the next attribute that is compared is local preference.  Since R1’s route has a higher local preference than R2’s route, it is chosen as the best path and installed in the routing table 3 . The other attributes, such as origin code and AS path, are not considered in this case.

A keepalive OAM probe is a mechanism that can be used to monitor the state of a GRE tunnel and detect any failures in the tunnel path. A keepalive OAM probe consists of sending periodic packets from one end of the tunnel to the other and expecting a reply.  If no reply is received within a specified time, the tunnel is considered down and the line protocol of the tunnel interface is changed to down 1 .

To configure a keepalive OAM probe for a GRE tunnel, you need to specify two parameters: the keepalive-time and the hold-time. The keepalive-time is the interval between each keepalive packet sent by the local router.  The hold-time is the maximum time that the local router waits for a reply from the remote router before declaring the tunnel down 2 .

According to the Juniper Networks documentation, the hold-time value must be two times the keepalive-time value for a GRE tunnel 2 . This is because the hold-time value must account for both the round-trip time of the keepalive packet and the processing time of the remote router. If the hold-time value is too small, it may cause false positives and unnecessary tunnel flaps.

In the exhibit, the configuration shows that the keepalive-time is set to 10 seconds and the hold-time is set to 15 seconds for the gr-1/1/10.1 interface. This means that the local router will send a keepalive packet every 10 seconds and will wait for 15 seconds for a reply from the remote router. However, this hold-time value is not two times the keepalive-time value, which violates the recommended configuration. This may cause traffic drops if the remote router takes longer than 15 seconds to reply.

Therefore, option D is correct, because the hold-time value must be two times the keepalive-time value for a GRE tunnel.  Option A is incorrect, because BFD is not required for GRE tunnels; BFD is another protocol that can be used to monitor tunnels, but it is not compatible with GRE keepalives 3 .  Option B is incorrect, because the “event link-adjacency-loss” option is not related to GRE tunnels; it is an option that can be used to trigger an action when a link goes down 4 .  Option C is incorrect, because LLDP does not need to be removed from the gr-1/1/10.1 interface; LLDP is a protocol that can be used to discover neighboring devices and their capabilities, but it does not interfere with GRE tunnels 5 .

The correct answer to your question is  C. Option C . Here is why:

Option C shows the configuration of the  chassis  statement, which defines the properties of the router chassis, such as the number of aggregated Ethernet interfaces, the number of FPCs, and the number of PICs 1 .

To enable aggregated Ethernet interfaces on a router, you need to specify the  aggregated-devices  statement under the  chassis  statement and set the  ethernet  parameter to the desired number of interfaces 2 . For example, to enable two aggregated Ethernet interfaces, you can use the following configuration:

chassis { aggregated-devices { ethernet { device-count 2; } } }

Option C shows this configuration with the device-count set to 2, which will enable two aggregated Ethernet interfaces on the router. The other options do not show this configuration and will not enable any aggregated Ethernet interfaces on the router.

Therefore, option C is the correct answer to your question.