The Enterprise Routing and Switching Specialist (JNCIS-ENT) (JN0-351)

According to the Juniper documentation 1 , MAC limiting is a feature that enhances port security by limiting the number of MAC addresses that can be learned within a VLAN. When the MAC limit is exceeded, the switch can perform different actions, such as ignoring, dropping, logging, shutting down, or disabling the offending port.  The default action is to drop the packets with new MAC addresses and log a message 2 . Therefore, the correct answer is B.

The other options are not correct because:

A. The switch will not shut down the offending port for five minutes by default.  This is a configurable action, but not the default one 2 .

C. The switch will not flood traffic out of all ports for the offending MAC address by default.  This is a possible consequence of ignoring the packets with new MAC addresses, but not the default action 2 .

D. The switch will not shut down MAC learning on the offending port for five minutes by default.  This is another configurable action, but not the default one 2 .

A  is correct because you can deploy only stateless firewall filters on an EX Series switch.  A stateless firewall filter is a filter that evaluates each packet individually based on the header information, such as source and destination addresses, protocol, and port numbers 1 .  A stateless firewall filter does not keep track of the state or context of a packet flow, such as the sequence number, flags, or session information 1 .  EX Series switches support only stateless firewall filters, which are also called access control lists (ACLs) or packet filters 2 .

C  is correct because you can apply firewall filters to both Layer 2 and Layer 3 traffic on an EX Series switch.  Layer 2 traffic is traffic that is switched within a VLAN or a bridge domain, while Layer 3 traffic is traffic that is routed between VLANs or networks 3 .  EX Series switches support three types of firewall filters: port (Layer 2) firewall filters, VLAN firewall filters, and router (Layer 3) firewall filters 4 . You can apply these filters to different interfaces and directions to control the traffic entering or exiting the switch.

The BGP attribute that you would use to forward all Internet traffic through the R1 device is the  local preference 1 .

The local preference is an attribute that is used within an autonomous system (AS) and exchanged between iBGP routers 1 .  It is used to select an exit point from the AS 1 .  The path with the highest local preference is preferred 1 .  By setting a higher local preference for the routes received from R1, you can make R1 the preferred exit point for all Internet traffic 1 .

The solution that should be implemented in this scenario is to create a default generate route that includes an import policy to match BGP routes from ISP1 and assign a preference value of four or less. This way, the default route will be advertised to the internal OSPF neighbors only when there is a BGP route from ISP1 in the routing table, and it will have a higher preference than any other default route from ISP2 or ISP3. If ISP1 is not available, the default generate route will be withdrawn and the traffic will use the next available default route from ISP2 or ISP3.

Option A is incorrect because creating a default static route with ISP1’s address as the next hop while specifying the addresses for ISP2 and ISP3 as qualified next hops with a preference value of six or higher will not ensure that the default route is advertised to the internal OSPF neighbors only when ISP1 is available. The default static route will always be in the routing table regardless of the availability of ISP1, and it will have a lower preference than any other default route from ISP2 or ISP3.

Option C is incorrect because creating a default static route with each neighbor address as the next hop will not ensure that all traffic uses ISP1 as the primary connection and only uses ISP2 and ISP3 when ISP1 is not available. The default static route will always be in the routing table regardless of the availability of ISP1, and it will load balance the traffic among the three ISPs.

Option D is incorrect because creating a default aggregated route will not ensure that the default route is advertised to the internal OSPF neighbors only when ISP1 is available. The default aggregated route will always be in the routing table regardless of the availability of ISP1, and it will not have any preference value associated with it. References:

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

Enterprise Routing and Switching, Specialist (JNCIS-ENT) - Juniper Networks

BGP attributes are properties that BGP uses for route advertisement, path selection, and loop prevention 1 .  There are four categories of BGP attributes 1 2 3 :

Well-known mandatory: Must be recognized by all BGP routers, present in all BGP updates, and passed on to other BGP routers 1 2 3 .

Well-known discretionary: Supported by all BGP implementations, and are optionally included in BGP updates 1 .

Optional transitive: May not be supported by all implementations of BGP 1 .

Optional non-transitive: May not be supported by all implementations of BGP 1 .

The well-known mandatory attributes must be supported by all BGP implementations and must be included in every update 1 2 3 .  These include the AS path and next hop attributes 2 3 . Therefore, options A and C are correct.

The exhibit shows the configuration of RSTP on EX-4, which has the command  force-version stp .  This command forces the switch to use the legacy STP protocol instead of RSTP, even though the switch supports RSTP 1 .  This means that EX-4 will not be able to take advantage of the faster convergence and enhanced features of RSTP, such as edge ports, link type, and proposal/agreement sequence 2 .

The other switches in the network are likely to be running RSTP, as it is the default protocol for EX Series switches 3 . Therefore, there will be a compatibility issue between EX-4 and the other switches, which will result in longer convergence times and suboptimal performance.  The switch will also generate a warning message that says “Warning: STP version mismatch with neighbor” when it receives a BPDU from a RSTP neighbor 1 .

To solve this problem, the force-version command must be removed from EX-4, so that it can run RSTP natively and interoperate with the other switches in the network. This will enable faster convergence and better stability for the network topology.  To remove the command, you can use the  delete protocols rstp force-version  command in configuration mode 1 .

An ISO NET address is a type of network address used by the IS-IS routing protocol.  It identifies a point of connection to the network, such as a router interface, and is also called a Network Service Access Point (NSAP) 1 .

An ISO NET address consists of three parts: an area ID, a system ID, and a selector 2 . The area ID identifies the IS-IS area to which the device belongs. The system ID uniquely identifies the device within the area.  The selector identifies a specific service or function on the device, such as routing or management 2 .

An ISO NET address must be unique for each device in the network, because it is used by IS-IS to establish adjacencies, exchange routing information, and compute shortest paths 2 . If two devices have the same ISO NET address, they will not be able to communicate with each other or with other devices in the network. Therefore, it is important to assign different ISO NET addresses to each device in the network.

BFD is a protocol that can be used to quickly detect failures in the forwarding path between two adjacent routers or switches. BFD can be integrated with various routing protocols and link aggregation protocols to provide faster convergence and fault recovery.

According to the Juniper Networks documentation, the following protocols support BFD on Junos OS devices 1 :

BGP: BFD can be used to monitor the connectivity between BGP peers and trigger a session reset if a failure is detected.  BFD can be configured for both internal and external BGP sessions, as well as for IPv4 and IPv6 address families 2 .

OSPF: BFD can be used to monitor the connectivity between OSPF neighbors and trigger a state change if a failure is detected.  BFD can be configured for both OSPFv2 and OSPFv3 protocols, as well as for point-to-point and broadcast network types 3 .

LACP: BFD can be used to monitor the connectivity between LACP members and trigger a link state change if a failure is detected.  BFD can be configured for both active and passive LACP modes, as well as for static and dynamic LAGs 4 .

Other protocols that support BFD on Junos OS devices are:

IS-IS: BFD can be used to monitor the connectivity between IS-IS neighbors and trigger a state change if a failure is detected. BFD can be configured for both level 1 and level 2 IS-IS adjacencies, as well as for point-to-point and broadcast network types.

RIP: BFD can be used to monitor the connectivity between RIP neighbors and trigger a route update if a failure is detected. BFD can be configured for both RIP version 1 and version 2 protocols, as well as for IPv4 and IPv6 address families.

VRRP: BFD can be used to monitor the connectivity between VRRP routers and trigger a priority change if a failure is detected. BFD can be configured for both VRRP version 2 and version 3 protocols, as well as for IPv4 and IPv6 address families.

The protocols that do not support BFD on Junos OS devices are:

RSTP: RSTP is a spanning tree protocol that provides loop prevention and rapid convergence in layer 2 networks. RSTP does not use BFD to detect link failures, but relies on its own hello mechanism that sends BPDU packets every 2 seconds by default.

FTP: FTP is an application layer protocol that is used to transfer files between hosts over a TCP connection. FTP does not use BFD to detect connection failures, but relies on TCP’s own retransmission and timeout mechanisms.

When the MAC address limit feature with the shutdown action is implemented on a switch, if a violation occurs, the interface is disabled and a system log entry is generated 1 .  If the switch has been configured with the port-error-disable statement, the disabled interface recovers automatically upon expiration of the specified disable timeout 1 .  However, if the switch has not been configured for auto-recovery from port error disabled conditions, you must manually clear the violation by running the clear ethernet-switching port-error command for the interface to send and receive traffic again 1 .  This explanation is based on the Enterprise Routing and Switching Specialist (JNCIS-ENT) documents and learning resources available at Juniper Networks 1 .