JN0-650 Questions and Answers

In an EVPN-VXLAN environment, different BGP route types serve distinct purposes in building the control plane. The Ethernet Segment Identifier (ESI) is a unique 10-byte identifier used to represent a multi-homed segment.

Type 1: Ethernet Auto-Discovery (A-D) Route (Option A): This route type is essential for multi-homing scenarios. It carries the ESI to support features like fast convergence and aliasing. By advertising an A-D route per Ethernet Segment, a PE tells other routers that it is connected to that specific ESI. It does not carry individual host MAC addresses; instead, it provides a "mass withdraw" mechanism to quickly update paths if the entire segment goes down.

Type 4: Ethernet Segment Route (Option D): This route is used exclusively for Designated Forwarder (DF) election. It advertises the existence of an ESI and the ES-Import Route Target to all other PE routers. This allows PE routers connected to the same multi-homed segment to discover each other automatically and elect a DF to handle BUM traffic. Like Type 1, it focuses on the segment identity and does not include MAC addresses.

Type 2: MAC/IP Advertisement Route (Option B): This is the primary route used for host reachability. It must include a MAC address (and optionally an IP). While it also includes the ESI to indicate which segment the host is behind, its primary function is MAC advertisement.

Type 3: Inclusive Multicast Ethernet Tag Route (Option C): This route is used for VTEP discovery and building the replication list for BUM traffic. It identifies the VTEP's IP and the VNI, but it does not carry the ESI or MAC addresses.

In Junos OS, particularly in BGP-based environments like EVPN-VXLAN or MPLS, the router often needs to perform a recursive lookup to resolve the BGP next-hop of a route.

Next-Hop Resolution (Option C): When an EVPN route (found in default-switch.evpn.0) is received, the protocol next-hop is typically the loopback IP of the remote VTEP. To actually forward traffic, the switch must know how to reach that loopback IP.

The inet.3 table is the default table in Junos used to store egress interface information for BGP next-hops.

While inet.0 handles standard unicast routing, inet.3 is specifically consulted for resolving the path toward BGP peers. In an EVPN context, this ensures that the VXLAN tunnel endpoint is reachable and properly resolved through the underlay.

Other Tables: * inet.2 (Option A) is used for Multicast RPF checks.

default-switch.evpn.0 (Option B) stores the EVPN routes themselves (MAC/IP), but it is the source of the lookup, not the table where the recursive resolution occurs.

vxlan.inet (Option D) is an internal table used to track active VXLAN tunnels but is not the primary table for recursive BGP next-hop validation.

The exhibit illustrates an EVPN-VXLAN fabric using multi-homing. Server1 is dual-homed to Leaf1 and Leaf2 using an Ethernet Segment Identifier (ESI) in an active-active or active-standby configuration. Server2 is single-homed to Leaf3.

In EVPN environments, specific mechanisms are used to prevent loops and duplicate traffic when dealing with Broadcast, Unknown Unicast, and Multicast (BUM) traffic:

Broadcast Propagation (Option A): When Server2 (connected to Leaf3) generates a broadcast frame, Leaf3 encapsulates this traffic into a VXLAN tunnel and forwards it to all other VTEPs (Virtual Tunnel End Points) that participate in that specific Virtual Network Instance (VNI). Therefore, both Leaf1 and Leaf2 will receive the broadcast frame from the core fabric.

Designated Forwarder (DF) Election (Option C): To prevent a multi-homed device (like Server1) from receiving duplicate copies of the same broadcast frame from multiple leaf switches, EVPN utilizes a Designated Forwarder (DF). For a given ESI, only one leaf switch is elected as the DF.

The exhibit explicitly states that Leaf2 is the Designated Forwarder.

According to the Junos EVPN implementation, only the DF is responsible for decapsulating BUM traffic received from the core and forwarding it to the local access segment.

While Leaf1 receives the frame (Option A), it will see that it is not the DF for that segment and will drop the frame rather than forwarding it to Server1. This ensures Server1 receives exactly one copy of the broadcast, delivered by Leaf2.

Option B is incorrect because in a standard ingress replication or multicast-based underlay, all VTEPs in the VNI receive the broadcast.

Option D is incorrect because Leaf1 is the non-designated forwarder (non-DF) for this segment and is prohibited from forwarding BUM traffic to the ESI.

In Junos OS Class of Service (CoS), schedulers are the components that define how traffic in a specific queue is treated before it is transmitted out of an interface.

Queue Priority (Statement C): A scheduler identifies the priority of the queue (e.g., low, medium-low, medium-high, or high). This determines the order in which the hardware handles traffic from different queues.

Buffer Size (Statement D): A scheduler defines the buffer size (amount of memory) allocated to a queue, which can be specified as a percentage, a temporal value (in microseconds), or the remainder of available buffer space. This helps manage bursts of traffic and prevent tail drops.

Other Components: Rate-limiting (Statement A) is typically handled by policers or interface-level shaping, while code translation (Statement B) is the role of rewrite rules.

Junos OS 24.4 handles multicast traffic using two distinct models based on whether the source is known in advance.

Knowledge and Sources (Option A): PIM-ASM (Any Source Multicast) is designed for "many-to-many" communication where receivers join a group ($*,G$) and rely on a Rendezvous Point (RP) to discover active sources. In contrast, PIM-SSM (Source-Specific Multicast) is for "one-to-many" scenarios where receivers must already know the exact source IP ($S,G$) before joining.

Protocol and RP Logic (Option D): PIM-SSM bypasses the RP entirely. It relies on IGMPv3 messages from the host, which explicitly include both the source address and the group address. This allows the last-hop router to build a Shortest Path Tree (SPT) directly toward the source immediately.

Register Process (Option B): While PIM-ASM does use registers, it is the First-Hop Router (Designated Router on the source segment) that sends the register to the RP, not the receiver's DR.

RP Role (Option C): This is exactly backwards; PIM-ASM requires an RP for source discovery, whereas PIM-SSM does not use one at all.

When integrating a QFX Series switch into an EVPN-VXLAN IP fabric, specific BGP and EVPN hierarchy configurations are required to establish the control and data planes:

EVPN Encapsulation (Option A): In Junos OS, the encapsulation vxlan statement must be explicitly configured under the protocols evpn hierarchy. This defines that the EVPN control plane will use VXLAN as the data plane encapsulation method rather than MPLS.

BGP Address Family (Option C): EVPN uses Multiprotocol BGP (MP-BGP) to distribute reachability information. For the control plane to function, you must enable the EVPN signaling address family under the BGP protocol using the command set protocols bgp group family evpn signaling.

Incorrect Options: Option B is incorrect because family vpls is used for traditional VPLS signaled by BGP, not for EVPN-VXLAN. Option D is incorrect because while the loopback interface must be reachable, it is typically advertised via an IGP (like OSPF or IS-IS) to provide the underlay connectivity that BGP then rides upon; BGP itself does not "advertise" the loopback to establish the initial peerings.

In Junos OS, the supplicant-mode configuration under protocols dot1x determines how the switch handles multiple MAC addresses on a single physical port. According to the exhibit, the current mode is set to Single, and the Number of connected supplicants is 2. This indicates that the port is currently allowing multiple devices, which contradicts the goal of limiting access to only one device at a time.

Here is the breakdown of why Option C is the correct solution based on Juniper’s standard behavior:

Supplicant Mode: Single (Current State): In this mode, the first device to authenticate opens the port for all subsequent devices. As long as the first device remains authenticated, other devices can send traffic through the port without individual authentication. This is why the exhibit shows 2 connected supplicants despite the mode being "Single."

Supplicant Mode: Single-Secure (The Solution): This mode strictly limits the port to only one MAC address. Once a device successfully authenticates via 802.1X, the switch drops any traffic coming from any other MAC address on that port. If the authenticated device logs off or the session times out, the port becomes available for a new device, but never more than one simultaneously. * Supplicant Mode: Multiple (Option B): This mode allows multiple supplicants to authenticate individually. Each MAC address must go through its own authentication process. This would allow more than one device, which is the opposite of the user's requirement.

MAC RADIUS Restrict (Option A): This feature is used to force MAC-based authentication and does not inherently limit the number of devices to one in the same way that changing the supplicant mode does.

Maximum EAPOL requests (Option D): This parameter defines how many times the switch will send an EAP-Request/Identity frame to a supplicant before giving up. Changing this to 1 does not restrict the number of devices allowed on the port; it only changes the retry logic for a single authentication attempt.

Configuration Example for Junos OS 24.4: To implement this change, you would use the following command: set protocols dot1x edit interface ge-0/0/10.0 supplicant-mode single-secure

In Junos OS routing policies, the order of evaluation and the impact of terminal actions are critical for predictable control.

Immediate Execution (Option D): When a route-filter contains an explicit action like accept or reject within its block, that action is considered terminal if a match is found.

Evaluation Flow: The policy engine processes terms and conditions from top to bottom. If a prefix matches a route-filter that has an embedded accept action, the policy executes that action immediately and stops further evaluation of that specific term. Consequently, any subsequent then clause in the same term is completely ignored.

Best Practice: To ensure a then clause (which might include modifications like changing a preference or community) is executed, the route-filter should be defined without an internal action, allowing the match to fall through to the term's common then statement.

In an EVPN-VXLAN architecture, the interaction between the control plane (EVPN) and the data plane (VXLAN) is defined by specific functional components:

VTEP (VXLAN Tunnel End Point): These are the entities responsible for the encapsulation and de-encapsulation of Layer 2 Ethernet frames into Layer 3 UDP/IP packets. A VTEP can be a physical switch (like a QFX or EX series) or a software-based entity. When traffic enters the fabric, the ingress VTEP wraps it in a VXLAN header; the egress VTEP removes this header before delivering it to the destination host. (Option B)

VNI (Virtual Network Identifier): The VNI is a 24-bit field in the VXLAN header that allows for up to 16 million unique identifiers. It is used to identify specific broadcast domains (or VLANs) within the overlay network. Each VNI effectively represents a virtualized Layer 2 segment that is stretched across the Layer 3 underlay. (Option D)

Incorrect statements: Option A is incorrect because VNIs are identifiers, not the "engine" that performs encapsulation—that is the VTEP's job. Option C is incorrect because VTEPs identify the endpoints of a tunnel, not the individual broadcast domains themselves.

OSPFv2 (IPv4) and OSPFv3 (IPv6) share many fundamental concepts, such as the SPF algorithm and the use of areas, but they have distinct differences in how they handle prefix information and LSA headers in Junos OS.

Backbone Requirement (Option C): Both OSPFv2 and OSPFv3 utilize a hierarchical structure. In both versions, all areas must connect to a central Area 0 (the backbone) to allow for inter-area routing. If an area is not physically connected to Area 0, a virtual link must be established.

Flooding Scope (Option D): One of the significant architectural changes in OSPFv3 is the inclusion of the flooding scope directly into the LSA header. In OSPFv3, the LS Type field is expanded to 16 bits, where the top three bits define the flooding scope (e.g., Link-local, Area, or AS scope). This allows routers to understand how far an LSA should be propagated without needing to understand the specific LSA type itself.

LSA Prefix Information (Option A): This statement is misleading. In OSPFv2, Router and Network LSAs (Type 1 and 2) carry both topology and prefix information. However, a key design goal of OSPFv3 was to separate topology from prefix information. In OSPFv3, Type 1 and 2 LSAs only describe the topology, while prefixes are carried in new LSA types: Intra-Area-Prefix-LSAs (Type 9) and Link-LSAs (Type 8).

Processing (Option B): OSPFv2 is processed "per-subnet" because it forms adjacencies based on IPv4 subnets. OSPFv3 is processed "per-link", meaning it forms adjacencies between interfaces on the same physical link regardless of whether they share a common IPv6 prefix.

In PIM Sparse Mode (PIM-SM), the Rendezvous Point (RP) is the cornerstone of the multicast distribution model.

The Meeting Point (Option A): The RP serves as a central clearinghouse where multicast sources and receivers meet.

When a source starts transmitting, the first-hop router encapsulates the data and sends it to the RP via a PIM Register message.

When a receiver wants to join a group, its last-hop router sends a (*,G) PIM Join request toward the RP.

The RP then manages the distribution from the source to the receivers until a Shortest Path Tree (SPT) can be established directly between them.

Incorrect Statements: Option B is incorrect because PIM Dense Mode does not use an RP; it uses a "flood and prune" mechanism. Option C is incorrect because the RP only forwards traffic to interfaces that have explicitly requested it via Join messages, which is what makes it "sparse". Option D is incorrect because SSM (Source-Specific Multicast) specifically avoids using an RP by having receivers join a known source directly.

The exhibit shows a network topology where Multiple VLAN Registration Protocol (MVRP) is used to dynamically manage VLANs across switches Core-1, Access-1, and Access-2.

Identifying the Missing Configuration: According to the diagram, the trunk link between Core-1 and Access-2 uses interface ge-0/0/16.0 on the Core-1 side.

Output Analysis: However, the show protocols mvrp output for Core-1 only lists interfaces ge-0/0/14.0 and ge-0/0/15.0.

MVRP Requirements: For MVRP to successfully propagate VLAN information between Access-2 and the rest of the network, the protocol must be enabled on every trunk interface in the path.

Solution: Because ge-0/0/16.0 is missing from the Core-1 MVRP configuration, VLAN registration messages from Access-2 are not being processed by Core-1. Configuring this interface under MVRP on Core-1 will solve the communication problem.

To secure a Layer 2 network running Multiple VLAN Registration Protocol (MVRP) against unauthorized VLAN propagation from rogue devices, you must control the registration state of the ports.

Forbidden Registration Mode (Option D): This mode is specifically designed to prevent an interface from participating in the MVRP exchange.

When a port is set to forbidden, it will neither register nor declare VLANs (except those statically configured on the interface).

If a rogue device sends MVRP PDUs to this interface, the distribution switch will ignore those PDUs, preventing the rogue device from dynamically creating or learning VLANs through that port.

Registration Hierarchy: In Junos OS 24.4, this is configured at the [edit protocols mvrp interface registration forbidden] level.

Other Modes: normal (default) allows full participation, while restricted ignores joins for VLANs not already statically defined on the switch but still declares its own.

Private VLANs (PVLANs) provide Layer 2 isolation between ports within the same broadcast domain. When a PVLAN spans multiple switches, a special type of trunk configuration is required to maintain the isolation and community logic across the inter-switch links.

Isolated VLAN Trunking (Option D): To extend an isolated VLAN across multiple switches, you must configure the trunk port on each switch to allow the isolated VLAN ID. In Junos OS, this is specifically achieved by configuring the interface as a trunk and associating it with the primary VLAN and the specific isolated VLAN. The correct syntax for enabling this inter-switch communication is to configure trunk ports that recognize the isolated VLAN tag (e.g., set interfaces unit 0 family ethernet-switching vlan members [ primary-vlan isolated-vlan ]).

Forwarding Rules: Traffic from an isolated port on Switch A must reach a promiscuous port (often on Switch B) to exit the PVLAN. The inter-switch trunk carries this traffic using the secondary (isolated) VLAN ID, ensuring that it remains isolated from other host ports on the remote switch.

Option A (inter-switch-link): In standard Junos switching, the inter-switch-link statement is used in Virtual Chassis or specific fabric designs, but for standard PVLAN extension, standard 802.1Q trunking with secondary VLAN IDs is the mechanism used.

Options B and C: These describe specific port roles (isolated vs. community) rather than the method used to enable trunking between switches.