JN0-664 Questions and Answers

To transport IPv6 traffic over an IPv4-based MPLS network using BGP, you need to configure two address families: family inet6 labeled-unicast and family inet6 unicast. The former is used to exchange IPv6 routes with MPLS labels between PE routers, and the latter is used to exchange IPv6 routes without labels between PE and CE routers. The mpis ipv6-tunneling command enables the PE routers to encapsulate the IPv6 packets with an MPLS label stack and an IPv4 header before sending them over the MPLS network.

Interprovider Option C for Layer 3 VPNs involves the use of Autonomous System Boundary Routers (ASBRs) to exchange labeled VPN-IPv4 routes between different Autonomous Systems (AS). This option requires BGP sessions between ASBRs, and the VPN routes are carried end-to-end using MPLS labels. Here’s a detailed analysis of the roles of different routers in this scenario:

1. **ASBR Routers**:

- ASBRs are responsible for exchanging VPN-IPv4 routes between different ASes.

- **A. ASBR routers maintain the internal routes from its own AS and the loopback addresses from the other AS PEs.**

- Correct. ASBRs maintain routes to internal destinations within their own AS, and they also need to know the loopback addresses of PEs in the other AS to set up the BGP sessions and MPLS tunnels.

2. **PE Routers**:

- PE routers are responsible for maintaining VPN routes and label information to forward VPN traffic correctly.

- **B. PE routers maintain the internal routes from its own AS, the loopback address from the other AS PEs, and the L3VPN routes.**

- Correct. PE routers need to maintain:

- Internal routes within their AS for routing.

- Loopback addresses of other AS PEs for establishing MPLS LSPs.

- L3VPN routes to provide end-to-end VPN connectivity.

3. **P Routers**:

- P routers are the core routers that do not participate in BGP VPN routing but forward labeled packets based on MPLS labels.

- **C. P routers only maintain the internal routes from their own AS.**

- Correct. P routers maintain the internal routing information to forward packets within the AS and use MPLS labels for forwarding VPN packets. They do not maintain VPN routes or routes from other ASes.

4. **Incorrect Statements**:

- **D. P routers maintain the internal routes from its own AS and the loopback address from the other AS PEs.**

- Incorrect. P routers do not need to maintain the loopback addresses of other AS PEs. They only maintain internal routing and MPLS label information.

- **E. ASBR routers maintain the internal routes from its own AS, the loopback address from the other AS PEs, and the L3VPN routes.**

- Incorrect. ASBR routers do not maintain L3VPN routes. They exchange labeled VPN-IPv4 routes with other ASBRs and forward them to PE routers.

**Conclusion**:

The correct answers are:

**A. ASBR routers maintain the internal routes from its own AS and the loopback addresses from the other AS PEs.**

**B. PE routers maintain the internal routes from its own AS, the loopback address from the other AS PEs, and the L3VPN routes.**

**C. P routers only maintain the internal routes from their own AS.**

**References**:

- Juniper Networks Documentation on Interprovider VPNs: [Interprovider VPN Configuration](https://www.juniper.net/documentation/en_US/junos/topics/topic-map/mpls-vpn-interprovider.html)

- MPLS and VPN Architectures, CCIP Edition by Ivan Pepelnjak and Jim Guichard

The OSPF cost is carried in the LSAs that are exchanged within an OSPF area. When a router calculates the cost to a destination it uses the cost of the exit interface of each router in the path to the destination.

Class of Service (CoS) in networking is used to manage traffic by classifying, scheduling, and sometimes modifying packets to ensure network performance and Quality of Service (QoS). Different CoS components are used to achieve these goals. Let's analyze each option to determine which CoS component allows you to alter class-of-service values on the outbound interface of an edge router.

1. **Output Policer**:

- Policing is used to control the rate of traffic sent to or from a network interface. It can drop or remark traffic that exceeds a certain rate.

- Policing is not typically used to alter CoS values but to enforce traffic limits.

2. **Scheduler**:

- A scheduler is responsible for managing the order in which packets are transmitted out of an interface based on their CoS markings. It can allocate bandwidth and prioritize traffic.

- The scheduler manages how packets are queued and sent but does not alter the CoS values of packets.

3. **Rewrite Rules**:

- Rewrite rules are used to modify the CoS values of packets, such as DSCP (Differentiated Services Code Point) or 802.1p bits, as they exit an interface.

- Rewrite rules can alter the class-of-service values in the packet headers to match the desired policies of the outbound interface.

- Therefore, rewrite rules are the correct component for altering CoS values on an outbound interface.

4. **Forwarding Classes**:

- Forwarding classes are used to categorize packets into different traffic classes within a router for QoS handling.

- They help in defining how packets should be treated by the scheduler but do not directly modify the CoS values.

**Conclusion**:

To alter class-of-service values in packets on the outbound interface of an edge router, the correct CoS component to use is:

**C. rewrite rules**

**References**:

- Juniper Networks Documentation on CoS: [Class of Service Overview](https://www.juniper.net/documentation/en_US/junos/topics/concept/class-of-service-overview.html)

- Junos OS CoS Configuration Guide: [Rewrite Rules](https://www.juniper.net/documentation/en_US/junos/topics/topic-map/class-of-service-rewrite-rules.html)

To reduce the impact of suboptimal routing in OSPF and OSPFv3 after devices reboot, you can use the overload feature to prevent a router from being used as a transit router for a specified period of time. This allows the router to stabilize its routing table before forwarding traffic for other routers. To enable the overload feature, you need to do the following:

For OSPF, configure the overload statement under [edit protocols ospf] hierarchy level. You can also specify a timeout value in seconds to indicate how long the router should remain in overload state after it boots up. For example, set protocols ospf overload timeout 900 means that the router will be in overload state for 15 minutes after it boots up.

For OSPFv3, configure the overload statement under [edit protocols ospf3] hierarchy level. You can also specify a realm (ipv4-unicast or ipv6-unicast) and a timeout value in seconds to indicate how long the router should remain in overload state after it boots up for each realm. For example, set protocols ospf3 realm ipv4-unicast overload timeout 900 means that the router will be in overload state for 15 minutes after it boots up for IPv4 unicast routing.

To determine the correct answer, let's analyze the BGP path selection process and identify which attribute would be considered next in this scenario.

Background on BGP Path Selection

When multiple paths to the same destination are received via BGP, the router uses a step-by-step process to select the best path. The order of attributes considered is as follows (simplified for this scenario):

Highest Local Preference : The path with the highest local preference is preferred.

Shortest AS Path : The path with the shortest AS path length is preferred.

Lowest Origin Code : Paths with an origin code of IGP are preferred over EGP, and EGP is preferred over Incomplete.

Lowest MED (Multi-Exit Discriminator) : If the first three attributes are identical, the path with the lowest MED value is preferred.

eBGP over iBGP : eBGP paths are preferred over iBGP paths.

IGP Metric to Next Hop : The path with the lowest IGP metric to the next-hop router is preferred.

Router ID : If all else is equal, the path from the router with the lowest Router ID is preferred.

Peer IP Address : As a last tiebreaker, the path from the peer with the lowest IP address is preferred.

Scenario Analysis

In this scenario:

You are receiving the 203.0.113.0/24 network via EBGP from two different autonomous systems (AS 64500 and AS 64501).

Both advertisements have identical local-preference values , AS-path lengths , and BGP origin codes .

Given that the first three attributes in the BGP path selection process are identical, the next attribute to consider is the MED (Multi-Exit Discriminator) value.

Analysis of the Options

Option A: Router ID

Incorrect : The Router ID is considered much later in the BGP path selection process, only after other attributes like MED and IGP metric have been evaluated. Since MED is still relevant here, Router ID is not the next attribute to consider.

Option B: MED value

Correct : The MED value is used to influence inbound traffic from neighboring ASes. When local preference, AS path length, and origin code are identical, the path with the lowest MED value is preferred. This makes MED the next attribute to consider in this scenario.

Option C: Peer IP Address

Incorrect : The peer IP address is a tiebreaker used only at the very end of the BGP path selection process, after all other attributes have been evaluated. It is not relevant here because MED has not yet been considered.

Option D: IGP Metric

Incorrect : The IGP metric to the next-hop router is considered after MED. Since MED is still relevant in this scenario, IGP metric is not the next attribute to evaluate.

Final Answer

The correct answer is:

B. MED value

Summary

When local preference, AS path length, and origin code are identical, the MED value is the next attribute considered in the BGP path selection process.

MED is used to influence how traffic enters your AS from neighboring ASes.

Layer 2 VPNs don’t support fragmentation in the provider network. It is critical that the provider network supports the largest frame that the CE devices can generate after the MPLS and virtual routing and forwarding (VRF) labels are added by the PE devices. This example leaves the CE devices at the default 1500-byte maximum transmission unit (MTU) while configuring the provider core to support a 4000 byte MTU. This configuration avoids discards by ensuring the CE devices cannot exceed the MTU in the provider’s network.

The vrf-target statement is used in routing-instances to define route-target communities for VPN route import and export policies.

vrf-target export → Controls which route targets (RTs) are added to advertised routes (used when sending routes to remote PEs).

vrf-target import → Controls which VPN routes are accepted into the VRF (used when receiving routes from remote PEs).

BGP add-path is a feature that allows the advertisement of multiple paths through the same peering session for the same prefix without the new paths implicitly replacing any previous paths. This behavior promotes path diversity and reduces multi-exit discriminator (MED) oscillations. BGP add-path is implemented by adding a path identifier to each path in the NLRI. The path identifier can be considered as something similar to a route distinguisher in VPNs, except that a path ID can apply to any address family. Path IDs are unique to a peering session and are generated for each network3. In this question, we have a route reflector (RR) that receives two routes for the same prefix (192.168.0.0/16) from an EBGP neighbor. By default, the RR will only advertise its best path to its clients (R1 and R2). However, we want R1 and R2 to receive both routes from the RR. To achieve this, we need to configure BGP add-path on the RR and enable it to send multiple paths for the same prefix to its clients.

The resolve-vpn parameter is a BGP option that allows a router to resolve labeled VPN-IPv4 routes using unlabeled IPv4 routes received from another BGP peer with family inet labeled-unicast configured. This option enables interprovider VPNs without requiring MPLS labels between ASBRs or using VRF tables on ASBRs. In this scenario, you need to configure the resolve-vpn parameter under [edit protocols bgp group external family inet labeled-unicast] hierarchy level on both ASBRs.

https://www.juniper.net/documentation/us/en/software/nce/feature-guide-virtual-private-lan-service/topics/task/vpls-ldp-signaling-solutions.html

https://www.juniper.net/documentation/us/en/software/junos/vpn-l2/topics/concept/vpns-configuring-vpls-routing-instances.html#id-11510150__id-11568648

In the context of Ethernet VPN (EVPN) and the behavior described in the exhibit, it's essential to understand the different EVPN route types and their specific functionalities. Here, CE-2 is receiving unicast traffic on both of its multihomed links to PE-2 and PE-3, but broadcast traffic is received only on one of these links.

**Explanation of EVPN Route Types**:

1. **Type 1 (Ethernet Auto-Discovery Routes)**:

- These routes are used for auto-discovery of Ethernet segments and for advertising VLAN membership.

- They do not directly influence the behavior described in the question.

2. **Type 2 (MAC/IP Advertisement Routes)**:

- These routes are used to advertise MAC addresses and IP-to-MAC bindings within the EVPN.

- They handle unicast traffic forwarding and are crucial for populating the MAC address tables on the PE devices.

- While important, they do not explain the selective broadcast behavior.

3. **Type 3 (Inclusive Multicast Ethernet Tag Routes)**:

- These routes are used to build multicast distribution trees for delivering broadcast, unknown unicast, and multicast (BUM) traffic.

- They ensure that BUM traffic is sent only once per Ethernet segment, preventing duplicate frames from being sent to multihomed CEs.

- This aligns with the behavior described where CE-2 receives broadcast traffic on only one link to prevent duplication.

4. **Type 4 (Ethernet Segment Routes)**:

- These routes are used to advertise the presence of an Ethernet segment and are crucial for Designated Forwarder (DF) election processes in multihoming scenarios.

- While relevant to multihoming, they are not directly responsible for the selective broadcast behavior.

**Conclusion**:

The behavior described, where CE-2 receives broadcast traffic on only one of its multihomed links, is controlled by Type 3 routes. These routes are specifically designed to handle inclusive multicast and broadcast traffic efficiently in EVPN environments, ensuring that such traffic is not duplicated across multiple links to the same CE.

**References**:

- Juniper Networks EVPN Documentation: [EVPN Overview](https://www.juniper.net/documentation/en_US/junos/topics/concept/evpn-overview.html)

- RFC 7432, BGP MPLS-Based Ethernet VPN: [RFC 7432](https://tools.ietf.org/html/rfc7432) provides detailed descriptions of EVPN route types and their functions.

- Junos OS EVPN Configuration Guide: [Junos OS EVPN Configuration Guide](https://www.juniper.net/documentation/en_US/junos/topics/topic-map/evpn.html)

OSPF uses different types of LSAs to describe different aspects of the network topology. Type 1 LSAs are also known as router LSAs, and they describe the links and interfaces of a router within an area. Type 3 LSAs are also known as summary LSAs, and they describe routes to networks outside an area but within the same autonomous system (AS). By default, OSPF will summarize routes from Type 1 LSAs into Type 3 LSAs when advertising them across area boundaries .

The customer interface in an LDP-signaled pseudowire is the interface on the PE router that connects to the CE device. An LDP-signaled pseudowire is a type of Layer 2 circuit that uses LDP to establish a point-to-point connection between two PE routers over an MPLS network. The customer interface can have different encapsulation types depending on the type of traffic that is carried over the pseudowire. The encapsulation types are ethernet-ccc, vlan-ccc, extended-vlan-ccc, atm-ccc, frame-relay-ccc, ppp-ccc, cisco-hdlc-ccc, and tcc-ccc. Depending on the encapsulation type, the customer interface can accept or reject tagged or untagged frames in the data plane, and include or exclude VLAN tags in the control plane LDP advertisement. The following table summarizes the behavior of different encapsulation types:

IS-IS is an interior gateway protocol that uses link-state routing to exchange routing information among routers within a single autonomous system. IS-IS uses two types of addresses to identify routers and areas: system ID and area address. The system ID is a unique identifier for each router in an IS-IS domain. The system ID is 6 octets long and can be derived from the MAC address or manually configured. The area address is a variable-length identifier for each area in an IS-IS domain. The area address can be 1 to 13 octets long and is composed of high-order octets of the address. An IS-IS instance may be assigned multiple area addresses, which are considered synonymous. Multiple synonymous area addresses are useful when merging or splitting areas in the domain1. In this question, we have a network based on IS-IS with four routers (R1_1, R1_2, R2_1, and R2_2) belonging to area 0001. The area address for area 0001 is 49.0001. The NSEL byte for area 0001 is the last octet of the address, which is 01. The NSEL byte stands for Network Service Access Point Selector (NSAP Selector) and indicates the type of service requested from the network layer2. Therefore, the correct statement in this scenario is that the NSEL byte for area 0001 is 01.

Intermediate System to Intermediate System (IS-IS) is a link-state routing protocol designed to move information efficiently within a computer network, a group of physically connected computers or similar devices. It operates in two levels, Level 1 (L1) and Level 2 (L2), and supports hierarchical routing within a multi-area network.

Let's analyze each statement to determine its correctness in the context of IS-IS multi-area networks.

1. **Statement A: Internal L1 PDUs are flooded to the local area's L2 routers.**

- This statement is correct. L1 PDUs (Protocol Data Units) are flooded within the L1 area and also to the L2 routers that are present in the same area. These L2 routers act as the boundary routers that connect the local L1 area to other L1 areas via L2.

2. **Statement B: External L2 PDUs are flooded to all L2 routers in other areas.**

- This statement is correct. L2 PDUs are flooded throughout the entire L2 backbone, which includes all L2 routers in different areas. This ensures that inter-area routing information is shared across the network.

3. **Statement C: Internal L1 PDUs are flooded to all L1 routers in other areas.**

- This statement is incorrect. Internal L1 PDUs are only flooded within the local L1 area. They do not cross L1 area boundaries; inter-area communication is handled by L2 routers.

4. **Statement D: Internal L1 PDUs are only flooded to the local area's L1 routers.**

- This statement is correct. Internal L1 PDUs are indeed only flooded within their local L1 area, and do not go beyond it.

5. **Statement E: External L2 PDUs are only flooded to the local area's L2 routers.**

- This statement is incorrect. External L2 PDUs are flooded to all L2 routers throughout the IS-IS network, not just to those in the local area. This allows L2 routers to maintain a complete map of the network's topology.

**Conclusion**:

Given the analysis, the correct answers are:

**A. Internal L1 PDUs are flooded to the local area's L2 routers.**

**B. External L2 PDUs are flooded to all L2 routers in other areas.**

**D. Internal L1 PDUs are only flooded to the local area's L1 routers.**

**References**:

- Juniper Networks Documentation on IS-IS: [IS-IS Overview](https://www.juniper.net/documentation/en_US/junos/topics/concept/is-is-routing-overview.html)

- RFC 1195, Use of OSI IS-IS for Routing in TCP/IP and Dual Environments: [RFC 1195](https://tools.ietf.org/html/rfc1195) which details the operation of IS-IS in multi-area networks.

This configuration applies to IGMP (Internet Group Management Protocol) and is designed to control multicast group memberships on the interface ge-0/0/0.0.

Breaking Down the Configuration

1️⃣ Policy-Statement: block-igmp

policy-statement block-igmp {

term 1 {

from {

route-filter 224.7.7.7/32 exact;

source-address-filter 192.168.100.10/32 exact;

}

then reject;

}

}

This policy blocks IGMP joins for group 224.7.7.7 only if the source IP is 192.168.100.10.

If both conditions match, the request is rejected.

2️⃣ IGMP Configuration on Interface ge-0/0/0.0

[edit protocols igmp]

user@router# show

interface ge-0/0/0.0 {

group-policy block-igmp;

group-limit 25;

}

group-policy block-igmp applies the policy statement block-igmp, meaning IGMP join requests are evaluated based on this policy.

group-limit 25 means the interface allows up to 25 multicast groups.

Evaluating the Answer Choices

✅ A. Joins for group 224.7.7.7 are rejected if the source address is 192.168.100.10.

Correct, because:

The policy specifically matches group 224.7.7.7 and source IP 192.168.100.10.

If both conditions are met, the join is rejected.

❌ B. Joins for any group are accepted if the group count value is less than 25.

Incorrect, because:

The group-limit (25) applies to the total number of IGMP groups but does not override explicit policy rules.

Even if there are fewer than 25 groups, a join request can still be rejected by the policy statement.

❌ C. Joins for group 224.7.7.7 are always rejected, regardless of the group count.

Incorrect, because:

The policy only blocks joins from the specific source 192.168.100.10.

Joins from other sources to 224.7.7.7 are allowed.

❌ D. Joins for group 224.7.7.7 are accepted if the group count is less than 25.

Incorrect, because:

Joins for 224.7.7.7 from source 192.168.100.10 will always be rejected, even if the group count is below 25.

The group-limit does not override the rejection policy.

"Joins for group 224.7.7.7 are rejected if the source address is 192.168.100.10."

???? Official Juniper Documentation Reference:

???? Junos IGMP Policy Configuration Guide

"A group-policy statement allows filtering IGMP joins based on multicast group address and source IP."

VPLS is a technology that provides Layer 2 VPN services over an MPLS network. VPLS uses BGP as its control protocol to exchange VPN membership information between PE routers. The route target is a BGP extended community attribute that identifies which VPN a route belongs to. The route target must match on PE routers that participate in the same VPLS instance, otherwise they will not accept or advertise routes for that VPLS.

The output is from the show l2vpn connections command on a Juniper router. This command is used to verify the status of Layer 2 VPN (L2VPN) pseudowires between Provider Edge (PE) routers.

Breakdown of Key Information:

Instance: vpn-A

This is the L2VPN instance being monitored.

Connection Status (St)

The connection status is "Up", meaning the pseudowire is operational.

Local Site: CE1-2 (2)

The PE router is attached to a single local site (CE1-2).

Uptime & Connection Flaps

The output shows the last time the connection was up:

Time last up: Apr 11 14:35:27 2020

The "# Up trans" value is 1, meaning this connection has been established once and has not flapped since it was initiated.

VLAN ID Mismatch Check

The legend includes "VM – VLAN ID mismatch", but this status is not present in the connection output.

This means there is NO VLAN ID mismatch.

Flow Labels

The Flow Label Transmit is No, and the Flow Label Receive is No.

This means the PE router does NOT have the capability to pop flow labels.

To allow Site 1 to access three VLANs that are located in Site 2 and Site 3, you need to configure three L2VPN routing instances on PE-1, one for each VLAN. Each L2VPN routing instance will have a different VLAN ID and a different VNI for VXLAN encapsulation. Each L2VPN routing instance will also have a different vrf-target export value to identify which VPN routes belong to which VLAN. This way, PE-1 can forward traffic from Site 1 to Site 2 and Site 3 based on the VLAN tags and VNIs.

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/bgp/topics/example/bgp-advertise-peer-as.html