Juniper JN0-351 Dumps

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

Link-state update packets are used to flood link-state advertisements (LSAs) among OSPF routers. The destination IP address of these packets depends on the network type and the state of the interface. On broadcast and point-to-point networks, OSPF uses two IP multicast addresses: 224.0.0.5 for all OSPF routers and 224.0.0.6 for all designated routers (DRs) and backup designated routers (BDRs)12. If the interface state is DR or BDR, the link-state update packets are sent to 224.0.0.5. Otherwise, they are sent to 224.0.0.63. On non-broadcast networks, such as Frame Relay or ATM, link-state update packets are sent as unicasts to each adjacent neighbor3. Therefore, the correct answer is A and D. References: Understanding OSPF Areas | Junos OS, How OSPF Works - IP Routing [Book] - O’Reilly Media, Link state packet - Wikipedia

OSPF DR/BDR election is a process that occurs on multi-access data links. It is intended to select two OSPF nodes: one to be acting as the Designated Router (DR), and another to be acting as the Backup Designated Router (BDR). The DR and BDR are responsible for generating network LSAs for the multi-access network and synchronizing the LSDB with other routers on the same network 1 .

The DR/BDR election is based on two criteria: the OSPF priority and the router ID. The OSPF priority is a value between 0 and 255 that can be configured on each interface participating in OSPF. The default priority is 1. A priority of 0 means that the router will not participate in the election and will never become a DR or BDR. The router with the highest priority will become the DR, and the router with the second highest priority will become the BDR. If there is a tie in priority, then the router ID is used as a tie-breaker. The router ID is a 32-bit number that uniquely identifies each router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address on a loopback interface or any active interface 2 .

In this scenario, all routers have the same priority of 1, so the router ID will determine the outcome of the election. The router IDs are shown in the exhibit as RID values. The highest RID belongs to R4 (10.10.10.4), so R4 will become the DR. The second highest RID belongs to R3 (10.10.10.3), so R3 will become the BDR.

The exhibit shows the configuration of RSTP on EX-4, which has the command  force-version stp .  This command forces the switch to use the legacy STP protocol instead of RSTP, even though the switch supports RSTP 1 .  This means that EX-4 will not be able to take advantage of the faster convergence and enhanced features of RSTP, such as edge ports, link type, and proposal/agreement sequence 2 .

The other switches in the network are likely to be running RSTP, as it is the default protocol for EX Series switches 3 . Therefore, there will be a compatibility issue between EX-4 and the other switches, which will result in longer convergence times and suboptimal performance.  The switch will also generate a warning message that says “Warning: STP version mismatch with neighbor” when it receives a BPDU from a RSTP neighbor 1 .

To solve this problem, the force-version command must be removed from EX-4, so that it can run RSTP natively and interoperate with the other switches in the network. This will enable faster convergence and better stability for the network topology.  To remove the command, you can use the  delete protocols rstp force-version  command in configuration mode 1 .

The DHCP snooping feature in Juniper Networks’ EX Series switches works by building a binding database that maps the IP address, MAC address, lease time, binding type, VLAN number, and interface information 1 .  This database is used to filter and validate DHCP messages from untrusted sources 1 .

However, there are certain conditions that could prevent entries from being automatically created in the snooping database for an interface:

MAC limiting: If MAC limiting is enabled on the interface, it could potentially interfere with the operation of DHCP snooping.  MAC limiting restricts the number of MAC addresses that can be learned on a physical interface to prevent MAC flooding attacks 1 . This could inadvertently limit the number of DHCP clients that can be learned on an interface, thus preventing new entries from being added to the DHCP snooping database.

Static IP address : If the device connected to the interface is configured with a static IP address, it will not go through the DHCP process and therefore will not have an entry in the DHCP snooping database 1 .  The DHCP snooping feature relies on monitoring DHCP messages to build its database 1 , so devices with static IP addresses that do not send DHCP messages will not have their information added.

Therefore, options B and C are correct.  Options A and D are not correct because performing a DHCPRELEASE would simply remove an existing entry from the database 1 , and Dynamic ARP inspection (DAI) uses the information stored in the DHCP snooping binding database but does not prevent entries from being created 1 .

 In a Rapid Spanning Tree Protocol (RSTP) topology, the root bridge is determined by the switch with the lowest bridge priority value 1 2 .  If all switches have the same priority, then the root bridge is assigned to the switch whose MAC address’s hex value is the lowest 2 .  The default bridge priority value is 32768 3 2 . However, without the actual exhibit, it’s difficult to definitively determine which device is the root bridge.  But based on the options provided, if we assume that the local device has a lower bridge priority or a lower MAC address than other devices in the network, then it could be considered as the root bridge for this RSTP topology 4 5 .

According to the Juniper documentation1, a native VLAN is a VLAN that carries untagged traffic on a trunk port. A Wi-Fi access point may need a native VLAN to associate untagged traffic with a specific VLAN, such as the management VLAN. On Juniper EX Series switches, you can enable a native VLAN on a switch port by setting the interface-mode to trunk and specifying a native-vlan-id. For example, the following configuration enables a native VLAN with ID 1 on the switch port ge-0/0/12:

set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk

set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members all

set interfaces ge-0/0/1 unit 0 family ethernet-switching native-vlan-id 1

The other options are not correct because they do not address the requirement of untagged traffic. VLAN tagging is the process of adding a VLAN identifier to a frame, which is not needed for untagged traffic. Flexible VLAN tagging is a feature that allows multiple VLAN tags on a single interface, which is not relevant for this scenario. Voice VLAN is a feature that allows voice traffic to be separated from data traffic on a switch port, which is not related to untagged traffic or Wi-Fi access points. References: Understanding Native VLANs on Trunks | Junos OS, Configuring a Native VLAN on a Trunk Port | Junos OS

On Juniper switches, the default VLAN is set to a VLAN ID of 1 by default 1 2 .  This means that all interfaces on the switch are members of VLAN 1 until they are specifically assigned to another VLAN 1 2 . Therefore, option A is correct.

The default VLAN ID can be changed 1 2 .  This allows network administrators to configure the switch to use a different VLAN as the default, if necessary 1 2 . Therefore, option D is correct.

A  is correct because you can deploy only stateless firewall filters on an EX Series switch.  A stateless firewall filter is a filter that evaluates each packet individually based on the header information, such as source and destination addresses, protocol, and port numbers 1 .  A stateless firewall filter does not keep track of the state or context of a packet flow, such as the sequence number, flags, or session information 1 .  EX Series switches support only stateless firewall filters, which are also called access control lists (ACLs) or packet filters 2 .

C  is correct because you can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch.  Layer 2 traffic is traffic that is switched within a VLAN or a bridge domain, while Layer 3 traffic is traffic that is routed between VLANs or networks 3 .  EX Series switches support three types of firewall filters: port (Layer 2) firewall filters, VLAN firewall filters, and router (Layer 3) firewall filters 4 . You can apply these filters to different interfaces and directions to control the traffic entering or exiting the switch.

The Graceful Routing Engine Switchover (GRES) feature in Junos OS enables a router with redundant Routing Engines to continue forwarding packets, even if one Routing Engine fails 1 .  GRES preserves interface and kernel information, ensuring that traffic is not interrupted 1 .  However, GRES does not preserve the control plane 1 .

To preserve routing during a switchover, GRES must be combined with either Graceful Restart protocol extensions or Nonstop Active Routing (NSR) 1 .  When GRES is combined with NSR, nearly 75 percent of line rate worth of traffic per Packet Forwarding Engine remains uninterrupted during GRES 1 .  Any updates to the primary Routing Engine are replicated to the backup Routing Engine as soon as they occur 1 .

Therefore, when GRES is combined with NSR, routing is preserved and the new master RE does not restart rpd 1 .

To isolate management traffic in a non-default routing-instance on Junos-based devices, you can use the  set system management-instance  and  set routing-instances mgmt_junos  commands 1 2 .

set system management-instance : This command associates the management interface (usually named fxp0 or em0 for Junos OS, or re0:mgmt-* or re1:mgmt-* for Junos OS Evolved) with the non-default virtual routing and forwarding (VRF) instance 1 .  After you configure the non-default management VRF instance, management traffic no longer has to share a routing table with other control traffic or protocol traffic 1 .

set routing-instances mgmt_junos : This command creates a new routing instance named  mgmt_junos .  The name of the dedicated management VRF instance is reserved and hardcoded as  mgmt_junos ; you cannot configure any other routing instance by the name  mgmt_junos 1 .

Therefore, options C and D are correct.  Options A and B are not correct because they attempt to assign an interface to the  mgmt_junos  routing instance, which is not necessary for isolating management traffic 1 .

According to the OSPF protocol, the designated router (DR) is the router that acts as the focal point for exchanging routing information on a multi-access network segment, such as a LAN 1 .  The DR election process is based on the following criteria, in order of precedence 1 :

The router with the highest OSPF priority becomes the DR. The default priority is 1, and a priority of 0 means the router will not participate in the election.

If there is a tie in priority, the router with the highest router ID becomes the DR. The router ID is a 32-bit number that uniquely identifies a router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address of a loopback interface or a physical interface.

If there is a tie in router ID, the router that was first to become an OSPF neighbor becomes the DR.

In your scenario, two routers share the same highest priority and start time. This means that they have equal chances of becoming the DR based on the first and third criteria. Therefore, the second criterion will be used to break the tie, which is the router ID.  The router with the highest router ID will become the DR, and the other router will become the backup designated router (BDR), which is ready to take over the role of DR if it fails 1 .

IS-IS (Intermediate System to Intermediate System) is a routing protocol that is designed to move information efficiently within a computer network 1 2 .  It supports multiple protocol topologies, including IPv4, IPv6, and multicast 1 2 . Therefore, options C, E, and D are correct.

BGP has a simple loop prevention mechanism for eBGP that checks the AS path for its own AS number. However, this mechanism does not work for iBGP, since all routers in the same AS have the same AS number. Therefore, iBGP has two additional rules to prevent routing loops within an autonomous system:

A router does not advertise a route learned from an iBGP neighbor to another iBGP neighbor. This rule ensures that a route does not loop back to the original iBGP router through another iBGP path.

A router does not accept a route learned from an iBGP neighbor if the next hop is not reachable via an IGP. This rule ensures that a router does not forward packets to an unreachable next hop.

These two rules imply that iBGP sessions must be configured as a logical full mesh, meaning that every iBGP router must have a direct iBGP session with every other iBGP router in the same AS. This way, every iBGP router can learn the best route from the eBGP routers and use the IGP to reach the next hop. A logical full mesh does not require a physical full mesh, meaning that iBGP routers do not have to be directly connected. They can use intermediate routers to establish iBGP sessions, as long as the IGP can reach the next hop.

A logical full mesh can be challenging to scale and maintain, especially for large ASes with many iBGP routers. Therefore, some alternatives to the full mesh requirement have been developed, such as route reflectors and confederations. These alternatives relax the iBGP rules and introduce additional attributes and mechanisms to prevent routing loops, such as originator ID and cluster list. References:

BGP Fundamentals

BGP - eBGP loop prevention mechanism same AS number

Loop Prevention in BGP Routing

A  is correct because RSTP alternate ports block traffic while receiving superior BPDUs from a neighboring switch.  An alternate port is a backup port for a root port, which means it receives better BPDUs from another bridge than the current root port 1 .  However, an alternate port does not forward any traffic, as it is in a discarding state 2 . It only listens to BPDUs and waits for the root port to fail.  If the root port fails, the alternate port can immediately transition to a forwarding state and become the new root port 1 .

C  is correct because RSTP alternate ports provide an alternate higher cost path to the root bridge.  An alternate port is selected based on the same criteria as the root port, which are the lowest bridge ID, the lowest path cost, the lowest sender port ID, and the lowest receiver port ID 3 .  However, an alternate port receives a higher cost BPDU than the root port, otherwise it would be the root port itself 1 . Therefore, an alternate port provides an alternate higher cost path to the root bridge than the root port.

A route reflector is a BGP router that is allowed to break the iBGP loop avoidance rule and advertise routes received from an iBGP peer to another iBGP peer under specific conditions 1 .  A route reflector can have three types of peerings: EBGP neighbor, IBGP client neighbor, and IBGP non-client neighbor 2 .  A cluster is a group of route reflectors and their clients that are fully meshed 3 .  The cluster ID is a 4-byte value that identifies the route reflector cluster and is carried in the ORIGINATOR_ID attribute of the BGP update message 4 . The cluster ID is used to prevent routing loops among route reflectors and their clients.  If a route reflector receives a route with its own cluster ID, it discards the route 5 . Therefore, the cluster ID is required to prevent routing loops when using route reflectors.

MAC limiting protects against flooding of the Ethernet switching table (also known as the MAC forwarding table or Layer 2 forwarding table). This feature is enabled on interfaces (ports). MAC limiting sets a limit on the number of MAC addresses that can be learned on a single Layer 2 access port. The MAC limit value in the EX-series switch’s default configuration is five MAC addresses. You can configure the MAC limit on an interface, on an interface in a VLAN, or on all interfaces. You can also specify the action to be taken when the MAC limit is exceeded, such as dropping packets, logging messages, or shutting down the interface. Additionally, you can configure specific “allowed” MAC addresses for the access port. Any MAC address that is not in the list of configured addresses is not learned. Allowed MAC binds MAC addresses to a VLAN so that the address does not get registered outside the VLAN. References:

[EX] How to control MAC address access through Junos OS for EX Series switches1

Configuring MAC Limiting2

Understanding MAC Limiting and MAC Move Limiting3

A broadcast storm is a network condition where a large number of broadcast packets are sent and received by multiple devices, causing congestion and performance degradation 1 .  A broadcast storm can occur when there are loops in the network topology, meaning that there are multiple paths between two devices 2 .

A spanning tree protocol is a network protocol that prevents loops from being formed when switches or bridges are interconnected via multiple paths.  It does this by creating a logical tree structure that spans all the devices in the network, and disabling or blocking the links that are not part of the tree, leaving a single active path between any two devices 3 .

By eliminating loops, a spanning tree protocol also eliminates broadcast storms, as broadcast packets will not be forwarded endlessly along the looped paths.  Instead, broadcast packets will be sent only along the tree structure, reaching each device once and avoiding congestion 3 .

A  is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks.  DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping 1 .  DAI discards any ARP packets that do not match the database or have invalid formats 1 .

C  is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted.  Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports 2 .  DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client 2 .

The two reasons for the failure to form an adjacency in a network running IS-IS could be:

B. There is no configured ISO address on any IS-IS interface. IS-IS requires each router interface to have an ISO address configured.  Without this address, the routers cannot form an adjacency 1 .

D. The family iso configuration is missing from the adjacency interface. The ‘family iso’ configuration is essential for IS-IS to function correctly.  If this configuration is missing from the adjacency interface, it could prevent the formation of an adjacency 1 .

These explanations are based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 2 3 .

The BGP attribute that you would use to forward all Internet traffic through the R1 device is the  local preference 1 .

The local preference is an attribute that is used within an autonomous system (AS) and exchanged between iBGP routers 1 .  It is used to select an exit point from the AS 1 .  The path with the highest local preference is preferred 1 .  By setting a higher local preference for the routes received from R1, you can make R1 the preferred exit point for all Internet traffic 1 .

In OSPF, the state of the neighbor relationship is determined by the exchange of OSPF packets between routers 1 .  The state “2Way” as shown in the exhibit indicates that bi-directional communication has been established between the two OSPF routers 1 .  This is the normal state for a neighbor that is not the Designated Router (DR) or Backup Designated Router (BDR) on a broadcast, non-broadcast multi-access (NBMA), or point-to-multipoint network 1 .  These neighbors are often referred to as " DRothers " 1 . Therefore, option B is correct.

Option A suggests that the MTU is not at least 1492 bytes.  This is correct because IS-IS requires a minimum MTU of 1492 bytes to establish adjacencies 1 .  If the MTU is less than this, IS-IS adjacencies will not be established 1 .

Option D suggests that the lo0 interface is not included as an IS-IS interface.  This is also correct because the loopback interface (lo0) is typically used as the router ID in IS-IS 1 .  If the loopback interface is not included in IS-IS, it could prevent IS-IS adjacencies from being established 1 .

Therefore, options A and D are correct.

A. On R1, enable Level 1 on the ge-0/0/1 interface.  In IS-IS, both levels (Level 1 and Level 2) are enabled by default when you enable IS-IS on an interface 1 .  Level 1 systems route within an area 2 .  If the destination is outside an area, Level 1 systems route toward a Level 2 system 2 . Therefore, enabling Level 1 on the ge-0/0/1 interface on R1 would allow packets to reach from R1 to R3.

D. On R3 enable Level 1 on the ge-0/0/4 interface Similarly, enabling Level 1 on the ge-0/0/4 interface on R3 would allow packets to reach from R1 to R3.

These explanations are based on the IS-IS configuration documents and learning resources available at Juniper Networks 1  and Cisco 3 4 .

In OSPF, the Designated Router (DR) and Backup Designated Router (BDR) are elected based on the priority of the routers 1 .  The router with the highest priority becomes the DR, and the router with the second highest priority becomes the BDR 1 .  If there is a tie in priority, then the router with the highest Router ID is chosen 1 .

In this scenario, R2 has a higher priority (64) than R1 (32), so R2 will become the DR 1 .  Since R1 has the second highest priority, it will become the BDR 1 . Therefore, option D is correct.