JN0-351 Questions and Answers

 A firewall filter is a Junos security solution to filter or control traffic at the data plane as they enter or exit an interface 1 .  A firewall filter consists of one or more terms, each with a set of conditions and actions 2 .  The device evaluates every packet against the firewall filter terms in the order they are defined, and performs the actions specified in the first term that matches the packet 3 .  If no term matches the packet, the device discards the packet by default 3 .

In the exhibit, the firewall filter  mac-address  is applied to the  family ethernet-switching  and involves filtering MAC addresses. There are two terms,  term one  and  term two , each with different conditions and actions. The  from  statement specifies the match conditions, and the  then  statement specifies the actions.  If the  from  statement is omitted, all packets are considered to match and the actions in the  then  statement are taken 2 .  If the  then  statement is omitted, the packets that match the conditions in the  from  statement are accepted by default 2 .

Term one  logs traffic from a specific source MAC address  88:05:00:29:3c:de/48 .  The  log  action is a nonterminating action, which means that the device continues to evaluate the packet against the remaining terms in the filter 2 . Therefore, traffic that matches the  from  statement in term one is not discarded, and option A is incorrect.

Term two  accepts all other traffic not specified in term one.  The  then accept  action is a terminating action, which means that the device stops evaluating the packet against the filter and forwards the packet 2 . Therefore, all traffic not matching the  from  statement in term one is accepted by term two, and option D is correct.

Term two  does not have a  from  statement, which means that all packets are considered to match this term. Therefore, traffic matching the  from  statement in term two is not logged, and option B is incorrect.

Term one  does not have a  then  statement other than the  log  action, which means that the packets that match the  from  statement are accepted by default. Therefore, traffic that matches the  from  statement in term one is accepted, and option C is correct.

A  is correct because generated routes require a contributing route.  A contributing route is a route that matches the destination prefix of the generated route and has a valid next hop 1 .  A generated route is only installed in the routing table if there is at least one contributing route available 2 . This ensures that the generated route is reachable and useful.  If there is no contributing route, the generated route is not added to the routing table 2 .

B  is correct because generated routes show a next hop in the routing table.  A generated route inherits the next hop of its primary contributing route, which is the most preferred route among all the contributing routes 2 .  The next hop of the generated route can be either an IP address or an interface name, depending on the type of the contributing route 2 .  The next hop of the generated route can also be modified by a routing policy 3 .

B  is correct because the loops do not exist is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid.  A loop in BGP means that a route has been advertised by the same AS more than once, which can cause routing instability and inefficiency 1 .  To prevent loops, BGP uses the AS-path attribute, which lists the AS numbers that a route has traversed from the origin to the destination 2 .  The receiving router checks the AS-path attribute of the received route and discards it if it finds its own AS number in the list 2 . This way, BGP avoids accepting routes that contain loops.

C  is correct because the next hop is reachable is one of the conditions that are verified by the receiving router to ensure that the received BGP route is valid.  The next hop is the IP address of the next router that is used to forward packets to the destination network 3 .  The receiving router checks the next hop attribute of the received route and verifies that it has a valid route to reach it 3 .  If the next hop is not reachable, the received route is not usable and is rejected by the receiving router 3 . This way, BGP ensures that only feasible routes are accepted.

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/lsa-refresh-interval-edit-protocols-ospf.html

IS-IS (Intermediate System to Intermediate System) is a routing protocol that is designed to move information efficiently within a computer network 1 2 .  It supports multiple protocol topologies, including IPv4, IPv6, and multicast 1 2 . Therefore, options C, E, and D are correct.

 References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Juniper Networks Certified Specialist, Enterprise Routing & Switching …

Juniper Networks Certified Specialist, Enterprise Routing & Switching …

[Configuring Layer 2 Firewall Filters - TechLibrary - Juniper Networks]

[Understanding Firewall Filter Terms - TechLibrary - Juniper Networks]

The configuration shown in the exhibit is an example of a routing instance of type virtual-router.  A routing instance is a collection of routing tables, interfaces, and routing protocol parameters that create a separate routing domain on a Juniper device 1 .  A virtual-router routing instance allows administrators to divide a device into multiple independent virtual routers, each with its own routing table 2 .

The configuration also includes a rib-group statement, which is used to import routes from one routing table to another. A rib-group consists of an import-rib statement, which specifies the source routing table, and an export-rib statement, which specifies the destination routing table.

In this case, the rib-group name is inet-to-ispi, and the import-rib statement specifies inet.0 as the source routing table. The export-rib statement specifies ispi.inet.0 as the destination routing table. This means that the routes from inet.0 will be imported into ispi.inet.0.

Therefore, the correct answer is B. The inet.0 route table will be imported into the ispi.inet.0 route table.

In Rapid Spanning Tree Protocol (RSTP), there are several port roles that determine the behavior of the port in the spanning tree 1 .

Option A suggests that the designated port forwards data to the downstream network segment or device.  This is correct because the designated port is the port on a network segment that has the best path to the root bridge 1 .  It’s responsible for forwarding frames towards the root bridge and sending configuration messages into its segment 1 .

Option D suggests that the root port is responsible for forwarding data to the root bridge.  This is also correct because the root port is always the link directly connected to the root bridge, or the shortest path to the root bridge 1 .  It’s used to forward traffic towards the root bridge 1 .

Therefore, options A and D are correct.

In OSPF, the state of the neighbor relationship is determined by the exchange of OSPF packets between routers 1 .  The state “2Way” as shown in the exhibit indicates that bi-directional communication has been established between the two OSPF routers 1 .  This is the normal state for a neighbor that is not the Designated Router (DR) or Backup Designated Router (BDR) on a broadcast, non-broadcast multi-access (NBMA), or point-to-multipoint network 1 .  These neighbors are often referred to as " DRothers " 1 . Therefore, option B is correct.

The solution that should be implemented in this scenario is to create a default generate route that includes an import policy to match BGP routes from ISP1 and assign a preference value of four or less. This way, the default route will be advertised to the internal OSPF neighbors only when there is a BGP route from ISP1 in the routing table, and it will have a higher preference than any other default route from ISP2 or ISP3. If ISP1 is not available, the default generate route will be withdrawn and the traffic will use the next available default route from ISP2 or ISP3.

Option A is incorrect because creating a default static route with ISP1’s address as the next hop while specifying the addresses for ISP2 and ISP3 as qualified next hops with a preference value of six or higher will not ensure that the default route is advertised to the internal OSPF neighbors only when ISP1 is available. The default static route will always be in the routing table regardless of the availability of ISP1, and it will have a lower preference than any other default route from ISP2 or ISP3.

Option C is incorrect because creating a default static route with each neighbor address as the next hop will not ensure that all traffic uses ISP1 as the primary connection and only uses ISP2 and ISP3 when ISP1 is not available. The default static route will always be in the routing table regardless of the availability of ISP1, and it will load balance the traffic among the three ISPs.

Option D is incorrect because creating a default aggregated route will not ensure that the default route is advertised to the internal OSPF neighbors only when ISP1 is available. The default aggregated route will always be in the routing table regardless of the availability of ISP1, and it will not have any preference value associated with it. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Redundant Trunk Groups (RTGs) on EX Series switches provide a simple solution for network recovery when a trunk port on a switch goes down 1 .  They are configured on the access switch and contain two links: a primary or active link, and a secondary link 1 .  Therefore, option B is correct because if the active link fails, the secondary link automatically starts forwarding data traffic without waiting for normal spanning-tree protocol convergence 1 .

Option D is also correct.  In a typical enterprise network composed of distribution and access layers, RTGs are used where one Access switch is connected to two different uplink switches 2 .  This implies that RTGs must be connected to the same aggregation switch 2 .

The default hello interval on an OSPF interface depends on the network type of the interface. For point-to-point and broadcast network types, the default hello interval is 10 seconds. For non-broadcast and point-to-multipoint network types, the default hello interval is 30 seconds. The hello interval is the time between sending hello packets to establish and maintain neighbor adjacencies. The hello interval can be configured manually on each interface using the  ip ospf hello-interval  command. References:

OSPF Hello and Dead Interval - NetworkLessons.com

OSPF Hello and Dead Interval: Operation and Configuration

Adjusting OSPF Timers - Cisco IOS Cookbook, 2nd Edition

ospf timer hello - WLAN AC V200R010C00 Command Reference - Huawei

OSPF Timers – Hello and Dead Intervals - Packet Lab

The exhibit shows the output of the command  show ip bgp , which displays information about the BGP routes in the routing table 1 . The output shows two routes for the destination 192.168.10.0/24, one from R1 and one from R2.

The route from R1 has a local preference of 200, while the route from R2 has a local preference of 100.  Local preference is a BGP attribute that indicates the degree of preference for a route within an autonomous system (AS) 2 .  A higher local preference means a more preferred route 2 .

BGP uses a best path selection algorithm to choose the best route for each destination among multiple paths.  The algorithm compares different attributes of the routes in a specific order of precedence 3 .  The first attribute that is compared is weight, which is a Cisco-specific attribute that is local to the router 3 .  If the weight is equal or not set, the next attribute that is compared is local preference 3 .

In this case, both routes have the same weight of 0, which means that they are learned from external BGP (eBGP) peers 3 . Therefore, the next attribute that is compared is local preference.  Since R1’s route has a higher local preference than R2’s route, it is chosen as the best path and installed in the routing table 3 . The other attributes, such as origin code and AS path, are not considered in this case.

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

According to the OSPF protocol, the designated router (DR) is the router that acts as the focal point for exchanging routing information on a multi-access network segment, such as a LAN 1 .  The DR election process is based on the following criteria, in order of precedence 1 :

The router with the highest OSPF priority becomes the DR. The default priority is 1, and a priority of 0 means the router will not participate in the election.

If there is a tie in priority, the router with the highest router ID becomes the DR. The router ID is a 32-bit number that uniquely identifies a router in an OSPF domain. It can be manually configured or automatically derived from the highest IP address of a loopback interface or a physical interface.

If there is a tie in router ID, the router that was first to become an OSPF neighbor becomes the DR.

In your scenario, two routers share the same highest priority and start time. This means that they have equal chances of becoming the DR based on the first and third criteria. Therefore, the second criterion will be used to break the tie, which is the router ID.  The router with the highest router ID will become the DR, and the other router will become the backup designated router (BDR), which is ready to take over the role of DR if it fails 1 .

The output of the show bgp neighbor command shows the following information:

The local AS number of R1 is 65400, as indicated by the line “Local: 10.32.1.1+179 AS 65400”.

The peer AS number of 10.32.1.2 is 63645, as indicated by the line “Peer: 10.32.1.2+179 AS 63645”.

The BGP session is established, as indicated by the line “State: Established”.

The routers are exchanging IPv4 routes, as indicated by the line “Type: External State: Established Flags: < Sync > ” and the table showing the number of prefixes received and sent for inet.0 routing table. References:  Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks , [show bgp neighbor - Technical Documentation - Support - Juniper Networks]

A. The routes displayed have traversed one or more autonomous systems. True. The AS path attribute shows AS numbers (e.g., 65401 65520.), indicating the route ' s traversal through various autonomous systems. D. The routes displayed are being learned from an IBGP peer. True. The absence of the ' * > i ' marker before the prefixes indicates they are being learned from an IBGP peer. Therefore, the correct statements are A. The routes displayed have traversed one or more autonomous systems. and D. The routes displayed are being learned from an IBGP peer.

The correct answer to your question is  C. Option C . Here is why:

Option C shows the configuration of the  chassis  statement, which defines the properties of the router chassis, such as the number of aggregated Ethernet interfaces, the number of FPCs, and the number of PICs 1 .

To enable aggregated Ethernet interfaces on a router, you need to specify the  aggregated-devices  statement under the  chassis  statement and set the  ethernet  parameter to the desired number of interfaces 2 . For example, to enable two aggregated Ethernet interfaces, you can use the following configuration:

chassis { aggregated-devices { ethernet { device-count 2; } } }

Option C shows this configuration with the device-count set to 2, which will enable two aggregated Ethernet interfaces on the router. The other options do not show this configuration and will not enable any aggregated Ethernet interfaces on the router.

Therefore, option C is the correct answer to your question.

A  is correct because you need to configure BGP multihop to enable redundancy for the EBGP peering between the two routers.  BGP multihop is a feature that allows BGP peers to establish a session over multiple hops, instead of requiring them to be directly connected 1 .  By default, EBGP peers use a time-to-live (TTL) value of 1 for their packets, which means that they can only reach adjacent neighbors 1 .  However, if you configure BGP multihop with a higher TTL value, you can allow EBGP peers to communicate over multiple routers in between 1 . This can provide redundancy in case of a link failure or a router failure between the EBGP peers.

B  is correct because you need to configure loopback interface peering to enable redundancy for the EBGP peering between the two routers.  Loopback interface peering is a technique that uses loopback interfaces as the source and destination addresses for BGP sessions, instead of physical interfaces 2 .  Loopback interfaces are virtual interfaces that are always up and reachable as long as the router is operational 2 .  By using loopback interface peering, you can avoid the dependency on a single physical interface or link for the BGP session, and use multiple paths to reach the loopback address of the peer 2 . This can provide redundancy and load balancing for the EBGP peering.

C  is correct because you need to configure routes for the peer loopback interface IP addresses to enable redundancy for the EBGP peering between the two routers.  Routes for the peer loopback interface IP addresses are necessary to ensure that the routers can reach each other’s loopback addresses over multiple hops 2 .  You can use static routes or dynamic routing protocols to advertise and learn the routes for the peer loopback interface IP addresses 2 . Without these routes, the routers will not be able to establish or maintain the BGP session using their loopback interfaces.