JN0-352 Exam Dumps - Juniper JNCIS-ENT Questions and Answers

The described symptom — excessive packet drops specifically attributed to exceeding the MTU on a GRE tunnel carrying full-size video streaming traffic across default-MTU gigabit Ethernet interfaces — is a direct consequence of the 24 bytes of GRE encapsulation overhead pushing packets that were already at or near the standard 1500-byte Ethernet MTU past the physical interface's transmission limit once the outer GRE and IP headers are added. The most durable fix is to proactively increase the physical member interfaces' MTU beyond the 1500-byte default — to 1524 bytes or higher — which provides sufficient headroom to absorb the full GRE encapsulation overhead without ever causing the fully encapsulated packet to exceed the interface's transmission capability, allowing full-size 1500-byte payloads to pass through the tunnel intact and without fragmentation or drops. As a complementary measure, configuring the clear-dont-fragment-bit option on the tunnel or member interfaces instructs Junos to clear the DF (don't fragment) bit on oversized packets rather than dropping them outright when they do exceed the available MTU, allowing the Packet Forwarding Engine to fragment and later reassemble the traffic instead of silently discarding it, which directly addresses the reported packet loss even under transient conditions. Simply raising the MTU only to 1500 bytes fails to account for the 24-byte GRE overhead and would not resolve the underlying oversize condition. Routing the tunnel over a higher-bandwidth link addresses potential congestion but does nothing to correct an MTU-based packet-size violation, which is the root cause explicitly identified in this scenario. Reference topics: Junos Enterprise Routing – Tunneling, GRE MTU Sizing and Fragmentation Handling for High-Throughput Applications.

This detailed adjacency output shows R3 maintaining four separate, fully Up adjacencies, evenly split between the two IS-IS levels. R1 and R2 are both formed at Level 1, confirming that R3 is directly adjacent to exactly two Level 1 neighbors within its local area, which validates that statement. R4 and R5 are both formed at Level 2, and Level 2 adjacencies are, by definition, part of the IS-IS backbone that interconnects areas; a router maintaining any Level 2 adjacency is by that fact participating in and connected to the Level 2 backbone, confirming R3's backbone connectivity as well. Every one of the four listed adjacencies explicitly shows 'Speaks: IP, IPv6' in its detail output, which is Junos's way of indicating that both the IPv4 and IPv6 address families have been successfully negotiated and are active over that circuit; this directly contradicts, rather than supports, the claim that IPv6 is disabled on these neighbors — if IPv6 were disabled, the Speaks field would list only IP. Regarding authentication, the output contains no field, flag, or indication whatsoever referencing authentication configuration or state for the R5 adjacency (or any adjacency); Junos would typically surface authentication-related information separately if it were configured and relevant, and its complete absence here means no basis exists in the exhibit to conclude authentication is required for that specific adjacency. Reference topics: Junos Enterprise Routing – IS-IS, Level 1 and Level 2 Adjacencies and Address Family Negotiation.

BGP employs two distinct loop-prevention mechanisms depending on whether peers are external or internal to the same autonomous system. Between external peers (EBGP), loop prevention relies on the AS path attribute: every time a route crosses an AS boundary, the local AS number is prepended to the path, and a router rejects any incoming route whose AS path already contains its own AS number, since that would indicate the route has looped back around. Between internal peers (IBGP) within the same AS, however, the AS path attribute never changes, because IBGP does not add AS numbers as routes are readvertised internally — meaning AS path alone cannot detect an internal loop. Instead, IBGP enforces a strict split-horizon-style rule: a router that learns a route via IBGP must never readvertise that route to another IBGP peer. This rule guarantees that every IBGP speaker within the AS must be directly peered with every other IBGP speaker (a logical full mesh) in order for all routers to receive all routes, since no IBGP router will relay IBGP-learned routes onward on another router's behalf. This full-mesh requirement is precisely why techniques such as route reflection and confederations were later developed — they preserve the same loop-prevention guarantee while relaxing the physical full-mesh peering burden. VRRP and BFD serve entirely unrelated purposes (gateway redundancy and fast failure detection, respectively) and play no role in BGP loop prevention. Reference topics: Junos Enterprise Routing – BGP, IBGP Split-Horizon and the Full-Mesh Requirement.

MACsec (IEEE 802.1AE) secures a point-to-point Ethernet link independently of how the logical unit above it is configured for VLAN tagging, so neither trunk mode nor access mode has any bearing on whether the MACsec Key Agreement (MKA) protocol can establish a secure channel. What does determine success is the pre-shared key material: when static CAK security mode is used, the Connectivity Association Key (CAK) and the Connectivity Association Key Name (CKN) must be configured identically on both ends of the link. If they do not match, MKA never completes the exchange, no secure channel is created, and all traffic on that interface is dropped rather than merely left unencrypted. Equally important, and frequently overlooked, is that MACsec adds up to 32 bytes of overhead per frame for the security tag (SecTAG) and integrity check value (ICV); Juniper's official guidance is to ensure the difference between the interface's physical MTU and the protocol MTU is large enough to absorb this overhead, or frames will be silently discarded once encryption is active, producing symptoms that look identical to a failed session. Both the CAK/CKN and MTU checks are documented first-line troubleshooting steps for MACsec on EX Series switches. Reference topics: Junos Enterprise Switching – Layer 2 Security, Configuring and Troubleshooting MACsec on EX Series Switches.

The show ethernet-switching table command displays the Layer 2 forwarding database (the bridge or MAC table) that an EX Series switch builds dynamically by inspecting the source MAC address of every frame it receives. Each entry records the learned MAC address, the VLAN it was learned on, the type of entry (dynamic, static, or persistent), and the specific interface through which that address was seen, which is precisely the information needed to confirm whether the switch has learned the host connected to ge-0/0/3. If the host's MAC address is absent from the table, that immediately points to a Layer 1/2 issue — no frames have been received from the host, a cabling or port problem exists, or the interface is administratively down or blocked by spanning tree — rather than a Layer 3 routing or VLAN membership problem. show interfaces terse only reports administrative and link state along with any assigned protocol family addresses, offering no MAC-learning visibility. show vlans lists VLAN definitions and their member interfaces but does not display learned host addresses. show interfaces extensive provides detailed physical-layer counters and error statistics, useful for diagnosing frame loss or interface errors, but it does not expose the switching table. For intra-VLAN reachability troubleshooting, verifying MAC learning is always the first and most direct Layer 2 checkpoint. Reference topics: Junos Enterprise Switching – Layer 2 Switching Fundamentals, Monitoring the Ethernet Switching Table.

The entire purpose of route aggregation is summarization — replacing a set of more-specific contributing routes with a single, broader prefix advertised outward — and this summarization inherently hides internal routing instability from external peers: if one of the underlying contributing /24 blocks within a summarized /16 flaps up and down due to a local link issue, external peers who only see the stable, unchanging /16 aggregate are completely insulated from that churn, since the aggregate itself remains active and advertised as long as at least one contributing route is present, regardless of how much internal fluctuation occurs among the individual contributors. This stability-hiding characteristic is one of the primary operational benefits that motivates using aggregate routes in the first place, confirming that statement as correct. Regarding next-hop behavior, official Juniper documentation is explicit and unambiguous: when an aggregate route is installed in the routing table, Junos assigns it a reject next hop by default, meaning traffic matching only the aggregate (and no more-specific contributor) is dropped and an ICMP unreachable message is returned to the source; a discard next hop is available only as an optional, explicitly configured alternative when silent dropping without ICMP notification is preferred, but it is not the default. Aggregate routes categorically do not advertise their individual contributing routes; suppressing those specific, more-granular prefixes from onward advertisement in favor of the single summary is the aggregate's defining function, directly contradicting the first statement. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Default Reject Next Hop and Route Summarization Benefits.

OSPF neighbor state progression, as defined in RFC 2328 and displayed by Junos through show ospf neighbor, moves through a well-defined set of named states: Down, Attempt, Init, 2-Way, ExStart, Exchange, Loading, and Full. Down is the initial state, indicating no Hello packets have been recently received from a potential neighbor on that interface; it is a genuine, valid OSPF state and is correctly included here. Init indicates that a Hello packet has been received from the neighbor, but that neighbor has not yet listed the local router's own router ID within its Hello packet, so bidirectional communication has not yet been confirmed; this too is a standard, valid state. Loading occurs after the Exchange state, during which Database Description packets have been fully exchanged and the router is now actively requesting the specific, more-detailed LSAs it identified as missing or outdated from its neighbor via Link State Request packets; it is likewise a standard, valid OSPF neighbor state. 'Established' is not an OSPF state at all — that terminology belongs to BGP's finite state machine, where Established represents the fully operational session state; the OSPF equivalent concept is instead called Full. 'Reject' is not a recognized OSPF neighbor state under any circumstance and does not appear anywhere in the RFC 2328 state machine, making it an invalid distractor as well. Reference topics: Junos Enterprise Routing – OSPF, The OSPF Neighbor State Machine.

The show route advertising-protocol bgp command displays exactly what would be transmitted to a specific BGP neighbor after all configured export routing policy has already been evaluated and applied, meaning any prefixes shown in this output have successfully passed through the export policy chain — confirming the export routing policy has been processed. The command header explicitly states '7 destinations, 7 routes (7 active, ...)' and every listed prefix is preceded by an asterisk, Junos's standard marker for an active route, confirming all seven displayed routes are active in the local routing table. The routing table name shown, XYZ.inet.0, indicates these routes reside in a named routing instance called XYZ rather than the default master routing instance, whose table would instead be labeled simply inet.0; this rules out the statement claiming the routes belong to the default instance. The AS path column shows only the origin code 'I' (IGP) with no AS numbers prepended ahead of it, meaning the AS path is empty, which indicates these prefixes were originated locally within R1's own AS (through redistribution or local origination) rather than having been learned from and passed through an external AS, ruling out that statement as well. Finally, the Nexthop column explicitly shows 'Self' for every route rather than an actual peer or learned address, confirming R1 is rewriting the next-hop attribute to its own address before advertising — a deliberate next-hop-self policy action typically applied toward IBGP peers. Reference topics: Junos Enterprise Routing – BGP, Verifying Advertised Routes and Export Policy Effects.

VLAN 5 and VLAN 7 are two entirely separate Layer 2 broadcast domains, each with its own distinct IP subnet, and devices in one VLAN can never reach devices in the other through switching alone — Layer 3 routing between the two subnets is mandatory for any inter-VLAN communication to occur, regardless of how the VLANs are configured at Layer 2. On a single EX Series switch, the correct and standard mechanism for enabling this routing without an external router is to create one integrated routing and bridging (IRB) logical interface for each VLAN, assign each IRB the appropriate gateway IP address for its respective subnet (192.168.5.1 for VLAN 5's irb.5 and 192.168.7.1 for VLAN 7's irb.7, for example), and ensure routing is active on the switch so that traffic arriving at one IRB's gateway address destined for the other VLAN's subnet is routed internally between the two IRB interfaces. Attempting to bind a single family inet interface with two distinct subnet addresses via secondary addressing conflates two separate broadcast domains onto one Layer 3 interface incorrectly and is not how VLAN routing is architected in Junos. Spanning tree exists purely to prevent Layer 2 loops and has no routing function whatsoever, so configuring it cannot enable inter-VLAN reachability. Placing both VLANs on a single trunk with Multiple VLAN Registration Protocol (MVRP) only automates VLAN membership propagation across trunk links; it does not provide any Layer 3 routing capability between the VLANs either. Reference topics: Junos Enterprise Switching – Routing VLANs, Configuring IRB Interfaces for Inter-VLAN Routing.