Free and Premium Juniper JN0-351 Dumps Questions Answers

A. On R1, enable Level 1 on the ge-0/0/1 interface.  In IS-IS, both levels (Level 1 and Level 2) are enabled by default when you enable IS-IS on an interface 1 .  Level 1 systems route within an area 2 .  If the destination is outside an area, Level 1 systems route toward a Level 2 system 2 . Therefore, enabling Level 1 on the ge-0/0/1 interface on R1 would allow packets to reach from R1 to R3.

D. On R3 enable Level 1 on the ge-0/0/4 interface Similarly, enabling Level 1 on the ge-0/0/4 interface on R3 would allow packets to reach from R1 to R3.

These explanations are based on the IS-IS configuration documents and learning resources available at Juniper Networks 1  and Cisco 3 4 .

A  is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks.  DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping 1 .  DAI discards any ARP packets that do not match the database or have invalid formats 1 .

C  is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted.  Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports 2 .  DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client 2 .

The DHCP snooping feature in Juniper Networks’ EX Series switches works by building a binding database that maps the IP address, MAC address, lease time, binding type, VLAN number, and interface information 1 .  This database is used to filter and validate DHCP messages from untrusted sources 1 .

However, there are certain conditions that could prevent entries from being automatically created in the snooping database for an interface:

MAC limiting: If MAC limiting is enabled on the interface, it could potentially interfere with the operation of DHCP snooping.  MAC limiting restricts the number of MAC addresses that can be learned on a physical interface to prevent MAC flooding attacks 1 . This could inadvertently limit the number of DHCP clients that can be learned on an interface, thus preventing new entries from being added to the DHCP snooping database.

Static IP address : If the device connected to the interface is configured with a static IP address, it will not go through the DHCP process and therefore will not have an entry in the DHCP snooping database 1 .  The DHCP snooping feature relies on monitoring DHCP messages to build its database 1 , so devices with static IP addresses that do not send DHCP messages will not have their information added.

Therefore, options B and C are correct.  Options A and D are not correct because performing a DHCPRELEASE would simply remove an existing entry from the database 1 , and Dynamic ARP inspection (DAI) uses the information stored in the DHCP snooping binding database but does not prevent entries from being created 1 .

Redundant Trunk Groups (RTGs) on EX Series switches provide a simple solution for network recovery when a trunk port on a switch goes down 1 .  They are configured on the access switch and contain two links: a primary or active link, and a secondary link 1 .  Therefore, option B is correct because if the active link fails, the secondary link automatically starts forwarding data traffic without waiting for normal spanning-tree protocol convergence 1 .

Option D is also correct.  In a typical enterprise network composed of distribution and access layers, RTGs are used where one Access switch is connected to two different uplink switches 2 .  This implies that RTGs must be connected to the same aggregation switch 2 .

The output of the show bgp neighbor command shows the following information:

The local AS number of R1 is 65400, as indicated by the line “Local: 10.32.1.1+179 AS 65400”.

The peer AS number of 10.32.1.2 is 63645, as indicated by the line “Peer: 10.32.1.2+179 AS 63645”.

The BGP session is established, as indicated by the line “State: Established”.

The routers are exchanging IPv4 routes, as indicated by the line “Type: External State: Established Flags: < Sync > ” and the table showing the number of prefixes received and sent for inet.0 routing table. References:  Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks , [show bgp neighbor - Technical Documentation - Support - Juniper Networks]

In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree 1 2 3 .  The roles include root, designated, alternate, backup, and disabled 1 2 3 .

The discarding state is associated with the backup, alternate, and disabled roles 1 2 3 .  In a stable topology with consistent port roles throughout the network, RSTP ensures that every root port and designated port immediately transition to the forwarding state while all alternate and backup ports are always in the discarding state 2 .  Disabled ports are also in the discarding state 3 .

Therefore, options B, C, and D are correct.

The exhibit shows the output of the command  show vlans brief , which displays brief information about VLANs and their associated interfaces 1 .

The output has four columns: Routing instance, VLAN name, Interfaces, and Tagging.

The * symbol indicates that the interface is active, meaning that it is up and forwarding traffic 1 .  This can be verified by the command  show interfaces terse , which displays the status of the interfaces 2 .

The output shown in the exhibit is a brief display of the Ethernet switching table, which shows the learned Layer 2 MAC addresses for each VLAN and interface 1 .

The command  show ethernet-switching table  displays the Ethernet switching table with brief information, such as the destination MAC address, the VLAN name, the forwarding state, and the interface name 1 .

The command  show route forwarding-table  displays the routing table information for each protocol family, such as inet, inet6, mpls, iso, and so on 2 . It does not show the Ethernet switching table or the MAC addresses.

The command  show ethernet-switching table extensive  displays the Ethernet switching table with extensive information, such as the destination MAC address, the VLAN name, the forwarding state, the interface name, the VLAN index, and the tag type 1 . It shows more details than the brief output shown in the exhibit.

The command  show route forwarding-table family ethernet-switching  displays the routing table information for the ethernet-switching protocol family, which shows the destination MAC address, the next-hop MAC address, and the interface name 3 . It does not show the VLAN name or the forwarding state.

The two reasons for the failure to form an adjacency in a network running IS-IS could be:

B. There is no configured ISO address on any IS-IS interface. IS-IS requires each router interface to have an ISO address configured.  Without this address, the routers cannot form an adjacency 1 .

D. The family iso configuration is missing from the adjacency interface. The ‘family iso’ configuration is essential for IS-IS to function correctly.  If this configuration is missing from the adjacency interface, it could prevent the formation of an adjacency 1 .

These explanations are based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 2 3 .

The routers that are directly connected to the Dallas and Denver subnets are not advertising the connected subnets.  This can be resolved by redistributing the connected subnets into OSPF 1 .

Option C suggests to configure and apply a routing policy that redistributes the connected Dallas and Denver subnets.  This is correct because redistribution allows routes from one routing protocol to be communicated to another, and in this case, it allows the connected subnets to be advertised through OSPF 1 .

Option D suggests enabling the passive option on the OSPF interfaces that are connected to the Dallas and Denver subnets.  This is also correct because in OSPF, a passive interface is an interface that belongs to the OSPF router, but does not send OSPF Hello packets 1 .  It’s typically used on an interface that you don’t want to use for OSPF adjacencies, but you still want to advertise its IP address 1 . Therefore, enabling passive interface can help in advertising the Dallas and Denver subnets.

Aggregate routes are used for advertising summarized network prefixes 1 2 .  They help minimize the number of routing tables in an IP network by consolidating selected multiple routes into a single route advertisement 1 .  This approach is in contrast to non-aggregation routing, in which every routing table contains a unique entry for each route 1 .

Therefore, option D is correct. Options A, B, and C are not correct because:

Aggregate routes can be used with both static routing and dynamic routing protocols 1 .

Aggregate routes are not automatically generated for all of the subnets in a routing table.  They need to be manually configured 1 .

Aggregate routes are not always preferred over more specific routes.  The route selection process in Junos OS considers several factors, including route preference and metric, before determining the active route 1 .

The static route to the 0.0.0.0/0 network has a next hop of xe-0/0/0.0, which is a local interface. BGP does not accept static routes with a local interface as the next hop, because it cannot advertise them to other BGP peers. BGP requires a valid IP address as the next hop for static routes that are redistributed into BGP. To fix this issue, the static route should have a next hop of an IP address that is reachable via the xe-0/0/0.0 interface, such as the IP address of the eBGP neighbor. Alternatively, the next hop can be modified by using a route map when redistributing the static route into BGP12.

The other options are not correct because:

The as-path parameter is not required for redistributing static routes into BGP. The as-path attribute is automatically set by BGP when advertising routes to other BGP peers3.

A community string is not required for redistributing static routes into BGP. A community is an optional attribute that can be used to group routes and apply policies to them4.

The no-readvertise feature is not specified in the configuration. The no-readvertise feature is used to prevent routes learned from one iBGP peer from being advertised to another iBGP peer5.

The exhibit shows the configuration of RSTP on EX-4, which has the command  force-version stp .  This command forces the switch to use the legacy STP protocol instead of RSTP, even though the switch supports RSTP 1 .  This means that EX-4 will not be able to take advantage of the faster convergence and enhanced features of RSTP, such as edge ports, link type, and proposal/agreement sequence 2 .

The other switches in the network are likely to be running RSTP, as it is the default protocol for EX Series switches 3 . Therefore, there will be a compatibility issue between EX-4 and the other switches, which will result in longer convergence times and suboptimal performance.  The switch will also generate a warning message that says “Warning: STP version mismatch with neighbor” when it receives a BPDU from a RSTP neighbor 1 .

To solve this problem, the force-version command must be removed from EX-4, so that it can run RSTP natively and interoperate with the other switches in the network. This will enable faster convergence and better stability for the network topology.  To remove the command, you can use the  delete protocols rstp force-version  command in configuration mode 1 .

An aggregate route is a route that summarizes multiple more specific routes into a single route advertisement. For example, an aggregate route to 10.0.0.0/8 can represent many routes to 10.x.x.x/24 subnets. An aggregate route has several purposes, such as:

To decrease the number of route advertisements: By consolidating multiple routes into one, an aggregate route reduces the size of the routing table and the amount of routing updates that need to be exchanged between routers. This can improve the scalability and efficiency of the network12.

To hide internal routes from external peers: By advertising only the aggregate route and not the more specific routes, an aggregate route can provide a level of abstraction and security for the internal network topology. This can prevent external peers from knowing the details of the internal routes and avoid potential attacks or misconfigurations13.

The other options are not correct because:

C. To allow external peers to see internal routes: This is the opposite of what an aggregate route does. An aggregate route hides the internal routes from external peers, not exposes them13.

D. To increase the number of route advertisements: This is also the opposite of what an aggregate route does. An aggregate route decreases the number of route advertisements, not increases them12.

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

According to the Juniper documentation1, a native VLAN is a VLAN that carries untagged traffic on a trunk port. A Wi-Fi access point may need a native VLAN to associate untagged traffic with a specific VLAN, such as the management VLAN. On Juniper EX Series switches, you can enable a native VLAN on a switch port by setting the interface-mode to trunk and specifying a native-vlan-id. For example, the following configuration enables a native VLAN with ID 1 on the switch port ge-0/0/12:

set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk

set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members all

set interfaces ge-0/0/1 unit 0 family ethernet-switching native-vlan-id 1

The other options are not correct because they do not address the requirement of untagged traffic. VLAN tagging is the process of adding a VLAN identifier to a frame, which is not needed for untagged traffic. Flexible VLAN tagging is a feature that allows multiple VLAN tags on a single interface, which is not relevant for this scenario. Voice VLAN is a feature that allows voice traffic to be separated from data traffic on a switch port, which is not related to untagged traffic or Wi-Fi access points. References: Understanding Native VLANs on Trunks | Junos OS, Configuring a Native VLAN on a Trunk Port | Junos OS

BGP is a routing protocol that operates between autonomous systems (AS). An AS is a group of routers under a single administrative control. BGP can be classified into two types: internal BGP (IBGP) and external BGP (EBGP). IBGP is the BGP communication between routers within the same AS, while EBGP is the BGP communication between routers in different AS. BGP uses the AS_PATH attribute to record the AS numbers that the route has passed through, and uses it to prevent routing loops and select the best path.

In this scenario, you want to add a second ISP connection and remove the default route to the existing ISP. This means that you want to have more control over the routing decisions and use BGP to exchange routes with both ISPs. To do this, you need to deploy the BGP protocol in your network and configure both IBGP and EBGP sessions. The correct statements about BGP in this scenario are:

IBGP peers advertise routes received from EBGP peers to other IBGP peers. This is the default behavior of IBGP, as it allows the routers within the same AS to learn the routes from different EBGP peers and select the best exit point. However, IBGP has a rule that it does not advertise routes received from IBGP peers to other IBGP peers, to avoid creating routing loops. Therefore, option B is correct and option C is incorrect. To overcome this rule, IBGP requires a full mesh topology, where every IBGP router is directly connected to every other IBGP router, or a route reflector or confederation design, where some IBGP routers act as intermediaries to reflect or aggregate the routes to other IBGP routers.

EBGP peers advertise routes received from IBGP peers to other EBGP peers. This is the default behavior of EBGP, as it allows the routers in different AS to exchange routes and reachability information. However, EBGP has a rule that it does not advertise routes received from EBGP peers to other EBGP peers, to avoid creating routing loops. Therefore, option D is correct and option A is incorrect. To overcome this rule, EBGP uses the AS_PATH attribute to filter out the routes that contain its own AS number, or uses route maps or policies to control the route advertisement. IBGP does not update the next-hop attribute to ensure reachability within an AS, as the next-hop attribute is preserved by IBGP. Instead, IBGP relies on an underlying IGP (Interior Gateway Protocol) to provide reachability to the next-hop.

Junos devices support various types of tunnels for different purposes 1 2 .

Option B is correct.  Generic Routing Encapsulation (GRE) is a tunneling protocol that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network 1 .  Junos devices support GRE tunnels 1 .

Option D is correct.  IPsec (Internet Protocol Security) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session 1 .  Junos devices support IPsec tunnels 1 .

Option A is incorrect. Spanning Tree Protocol (STP) is not a type of tunnel.  It’s a network protocol designed to prevent loops in a bridged Ethernet local area network 2 .

Option C is incorrect.  While Junos devices do support IP-IP (also known as IP tunneling), it’s not supported on all Junos devices 1 .

Option A is correct. Creating multiple areas in OSPF can help to reduce the convergence time . This is because changes in one area do not affect other areas, so fewer routers need to run the SPF algorithm in response to a change.

Option D is correct. Creating multiple areas in OSPF can help to reduce Link State Advertisement (LSA) flooding across the network. This is because LSAs are not flooded out of their area of origin.

 In OSPF, a DR (Designated Router) and a BDR (Backup Designated Router) are elected on each multi-access network, such as Ethernet or Frame Relay. The DR and BDR are responsible for exchanging routing information with other routers on the same network segment. The election is based on two criteria: the OSPF priority and the router ID. The router with the highest priority becomes the DR, and the router with the second-highest priority becomes the BDR. If the priorities are equal, the router with the highest router ID becomes the DR, and the router with the second-highest router ID becomes the BDR. The default priority is 1, and the router ID is either manually configured or derived from the highest IP address on any interface12.

In this scenario, R1 has a priority of 32 and a router ID of 192.168.1.2, and R2 has a priority of 64 and a router ID of 192.168.1.1. Since R2 has a higher priority than R1, it will become the BDR. The router ID does not matter in this case, because the priority is different. Therefore, the correct answer is C.

The other options are not correct because:

A. At least two routers are required for a DR/BDR election, not three2.

B. Router IDs do not have to match for an adjacency to form, they just have to be unique3.

D. R1 will not be the BDR, because it has a lower priority than R212.

The feature that enables an interface on an EX Series switch to receive both untagged traffic (from the computer) and tagged traffic (from the IP phone) is the  voice VLAN 1 2 .

The voice VLAN feature in EX-series switches enables access ports to accept both data (untagged) and voice (tagged) traffic and separate that traffic into different VLANs 1 2 .  This allows the switch to differentiate between voice and data traffic, ensuring that voice traffic can be treated with a higher priority 1 2 . Therefore, option D is correct.

A firewall filter is a configuration that defines the rules that determine whether to forward or discard packets at specific processing points in the packet flow. A firewall filter can also modify the attributes of the packets, such as priority, marking, or logging.  A firewall filter can be applied to various interfaces, protocols, or routing instances on a Juniper device 1 .

A firewall filter has a family attribute, which specifies the type of traffic that the filter can evaluate.  The family attribute can be one of the following: inet, inet6, mpls, vpls, iso, or ethernet-switching 2 . The family inet firewall filter is used to evaluate IPv4 traffic, which is the most common type of Layer 3 traffic on a network.

To create a family inet firewall filter, you need to specify the appropriate match criteria and actions for each term in the filter. The match criteria can include various fields in the IPv4 header, such as source address, destination address, protocol, port number, or DSCP value.  The actions can include accept, discard, reject, count, log, policer, or next term 3 .

To apply a firewall filter to Layer 3 traffic that is being sent between VLANs, you need to apply the filter to the appropriate IRB interface. An IRB interface is an integrated routing and bridging interface that provides Layer 3 functionality for a VLAN on a Juniper device. An IRB interface has an IP address that acts as the default gateway for the hosts in the VLAN.  An IRB interface can also participate in routing protocols and forward packets to other VLANs or networks 4 .

Therefore, option C is correct, because you should create a family inet firewall filter with the appropriate match criteria and actions. Option D is correct, because you should apply the firewall filter to the appropriate IRB interface.

Option A is incorrect, because you should not create a family ethernet-switching firewall filter with the appropriate match criteria and actions. A family ethernet-switching firewall filter is used to evaluate Layer 2 traffic on a Juniper device.  A family ethernet-switching firewall filter can only match on MAC addresses or VLAN IDs, not on IP addresses or protocols 5 .

Option B is incorrect, because you should not apply the firewall filter to the appropriate VLAN. A VLAN is a logical grouping of hosts that share the same broadcast domain on a Layer 2 network. A VLAN does not have an IP address or routing capability.  A firewall filter cannot be applied directly to a VLAN; it must be applied to an interface that belongs to or connects to the VLAN 6 .

A tunnel is a connection between two computer networks, in which data is sent from one network to another through an encrypted link. Tunnels are commonly used to secure data communications between two networks or to connect two networks that use different protocols.

Option B is correct, because tunnel endpoints must have a valid route to the remote tunnel endpoint. A tunnel endpoint is the device that initiates or terminates a tunnel connection. For a tunnel to be established, both endpoints must be able to reach each other over the underlying network.  This means that they must have a valid route to the IP address of the remote endpoint 1 .

Option D is correct, because tunnels add additional overhead to packet size. Tunnels work by encapsulating packets: wrapping packets inside of other packets. This means that the original packet becomes the payload of the surrounding packet, and the surrounding packet has its own header and trailer. The header and trailer of the surrounding packet add extra bytes to the packet size, which is called overhead.  Overhead can reduce the efficiency and performance of a network, as it consumes more bandwidth and processing power 2 .

Option A is incorrect, because BFD can be used to monitor tunnels. BFD is a protocol that can be used to quickly detect failures in the forwarding path between two adjacent routers or switches. BFD can be integrated with various routing protocols and link aggregation protocols to provide faster convergence and fault recovery. BFD can also be used to monitor the connectivity of tunnels, such as GRE, IPsec, or MPLS.

Option C is incorrect, because IP-IP tunnels are stateless. IP-IP tunnels are a type of tunnels that use IP as both the encapsulating and encapsulated protocol. IP-IP tunnels are simple and easy to configure, but they do not provide any security or authentication features. IP-IP tunnels are stateless, which means that they do not keep track of the state or status of the tunnel connection. Stateless tunnels do not require any signaling or negotiation between the endpoints, but they also do not provide any error detection or recovery mechanisms.

Default BGP keepalive timer in Junos is 30 seconds

The default keepalive time for BGP is 30 seconds, which means that BGP peers send keepalive messages to each other every 30 seconds to verify the liveness of the BGP session. If no keepalive message is received from a peer within the hold time, which is 90 seconds by default, the peer is considered to be unavailable and the BGP session is closed. The keepalive time and the hold time can be configured manually for each BGP peer or peer group, but they must match on both ends of the BGP session. The keepalive time should be one third of the hold time for optimal performance. Therefore, option C is correct and the other options are incorrect. References:  BGP keepalive messages and hold time - Juniper Networks