Juniper JN0-352 - Enterprise Routing and Switching, Specialist (JNCIS-ENT)

RSTP, as defined in IEEE 802.1w, introduces explicit, well-defined port roles that go beyond legacy 802.1D STP's simpler root/designated/blocking model, and the alternate port role is one of RSTP's key refinements. An alternate port is a port that receives BPDUs from a bridge other than the one through which the local switch's actual root port reaches the root bridge — in other words, it represents a second, redundant path toward the root bridge learned from a different upstream bridge than the one currently providing the best (root port) path. Because the existing root port already provides the lowest-cost, actively used path to the root, the alternate port is deliberately held in the discarding (non-forwarding) state during normal, stable operation, functioning purely as a pre-computed, ready-to-use backup; critically, RSTP's major performance advantage over legacy STP is that if the current root port fails, the switch can transition its alternate port directly and almost instantly into the forwarding root port role without needing to pass through the lengthy listening and learning timer-based states that classic STP required, since the alternate port's suitability as a backup was already continuously verified through ongoing BPDU reception. It is not simply 'not receiving BPDUs' (an alternate port receives BPDUs continuously, just inferior ones relative to the current root port), it is not itself the least-cost path (that describes the root port), and it does not forward based on designated-port overload, which is not a concept that exists in RSTP's port-role logic at all. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Port Roles: Alternate and Backup Ports.

Configuring interface-type p2p under an OSPF interface tells Junos to treat that interface as a point-to-point network type regardless of the underlying physical medium, which removes the interface from the standard broadcast-network state machine entirely. On a true broadcast network, two routers must first complete a Designated Router and Backup Designated Router election, wait through the associated timers, and only then proceed through 2-Way, ExStart, Exchange, and Loading before reaching Full — a multi-step process. A point-to-point interface skips DR/BDR election altogether and proceeds directly from 2-Way into ExStart, so adjacencies form measurably faster, which is the first correct benefit. Because there is no DR on a point-to-point interface, Junos also does not generate a Type 2 Network LSA to describe the segment; the connected subnet is instead advertised as a simple stub-network entry inside the Router LSA itself, eliminating an entire LSA type from the area's link-state database and reducing its overall size, which is the second correct benefit. Point-to-point configuration is entirely incompatible with DR election, so a router configured this way cannot 'win' a DR election — there is no DR to win. Advertisement of the connected network happens on any operational OSPF interface irrespective of network type, so that option describes normal OSPF behavior rather than a benefit specific to the point-to-point setting. Reference topics: Junos Enterprise Routing – OSPF Network Types, Configuring OSPF Interface Type.

A floating static route is a backup static route that remains present in the configuration but stays inactive in the routing table under normal conditions, only becoming active if the primary, preferred route to the same destination is withdrawn or otherwise becomes unavailable. Junos determines which of several competing routes to the same prefix becomes active strictly by comparing each route's preference value (administrative distance), with the numerically lowest preference always winning; every routing protocol and static routes themselves carry a default preference (5 for standard static routes), and this value can be explicitly overridden per route using the preference statement under the static route's configuration. To create a floating static route, the administrator deliberately configures a preference value higher (that is, numerically worse, less preferred) than the preference of the primary route it is meant to back up — for example, a value higher than the 5 default of an ordinary static route, or higher than a dynamic protocol's preference such as OSPF's 10 — ensuring the floating route only becomes active once the more-preferred primary route disappears from the table entirely. This preference-based mechanism is the essential, defining configuration element of a floating static route. Priority is not a valid Junos static-route statement, next-hop simply defines where matching traffic is forwarded without controlling route selection behavior, and qualified-next-hop is a related but distinct mechanism used to assign a per-next-hop preference within a single multi-next-hop static route statement rather than between the standalone static route and its dynamic counterpart. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Configuring Floating Static Routes with Preference.

Correctly blocking SSH traffic originating from a specific network requires matching three precise conditions simultaneously in the from clause: the traffic's source-address must equal the 192.168.10.0/24 network, since the requirement is to block traffic coming from that network rather than traffic destined to it; the protocol must be explicitly set to tcp, since SSH operates exclusively over TCP; and the destination-port must be set to 22, because an inbound SSH connection request is always directed at the well-known SSH listening port 22 on the receiving side, regardless of which ephemeral source port the initiating client happens to use. The first option satisfies all three conditions correctly and pairs them with a discard action, cleanly dropping matching traffic. The second option incorrectly substitutes destination-address for source-address, which would match traffic heading toward that /24 rather than traffic originating from it, inverting the intended match direction. The third option incorrectly uses source-port 22 instead of destination-port 22; since the SSH client's source port is a randomly assigned ephemeral value rather than a fixed 22, this term would almost never match real SSH session-initiation traffic. The fourth option relies on a service ssh match condition, which is not valid syntax within the standard Junos firewall filter grammar for family inet; there is no such application-based keyword available at that hierarchy, making the term invalid regardless of the reject action chosen. Reference topics: Junos Enterprise Switching – Firewall Filters, Matching on Address, Protocol, and Port Conditions.

The factory-default storm control configuration on EX Series switches operates in a purely rate-limiting mode rather than an interface-shutdown mode. When broadcast, multicast, or unknown-unicast traffic on a port exceeds the configured bandwidth-percentage threshold, the default action is simply to police the offending traffic type and silently drop only the packets that exceed that threshold, while all traffic within the allowed rate continues to be forwarded normally and the interface itself remains administratively and operationally up throughout the event. This explains the observed symptom precisely: during the burst of unknown-unicast frames, the switch dropped the excess volume above the configured limit, producing a brief period of packet loss, but as soon as the burst subsided and traffic fell back under the threshold, storm control simply stopped dropping packets and normal forwarding resumed automatically — no administrative shutdown, recovery timer, or manual intervention was ever involved, because the interface was never taken down in the first place. This default drop-only behavior is distinct from the optional interface-shutdown action, which must be explicitly configured if an administrator wants storm control to disable a port outright on violation (as seen in a related scenario requiring the clear ethernet-switching recovery-timeout command). Storm control by default covers broadcast, multicast, and unknown-unicast traffic types together, not multicast alone, and it has no functional relationship to GRES, which governs Routing Engine redundancy rather than Layer 2 traffic policing. Reference topics: Junos Enterprise Switching – Storm Control, Default Drop Behavior Versus Interface Shutdown Action.

A BGP NOTIFICATION message is one of the four core message types defined in RFC 4271, alongside OPEN, UPDATE, and KEEPALIVE, and it serves a very specific and narrow purpose within the protocol: whenever a BGP speaker detects an unrecoverable, fatal condition in the session — such as a malformed OPEN message, an unsupported capability, a hold-timer expiration, a finite-state-machine error, or an administratively initiated reset — it transmits a NOTIFICATION message to its peer immediately before closing the underlying TCP connection and tearing down the session entirely. This confirms that a NOTIFICATION always signals the termination of the session upon a fatal error, never a routine, in-session update. Structurally, every NOTIFICATION message carries a defined error code and error subcode field, which together precisely classify the category and specific nature of the fault that triggered the termination (for example, 'Cease' with a subcode indicating administrative shutdown, or 'Update Message Error' with a subcode indicating a malformed attribute), giving the receiving peer's administrator concrete diagnostic information about exactly why the session was torn down. Updating route attributes while keeping a session alive is the role of the UPDATE message, not NOTIFICATION, and refreshing a neighbor's table without resetting the session describes the optional Route Refresh capability (a separate, distinct BGP mechanism), neither of which describes NOTIFICATION's function. Reference topics: Junos Enterprise Routing – BGP, BGP Message Types and the NOTIFICATION Message.

Switch A is already fixed as the root bridge in this topology (priority 0), so the outcome being engineered here is not about root bridge election at all, but about which of Switch C's two available paths toward that already-established root — the direct C-to-A link, or the indirect C-to-B-to-A path — RSTP selects as the lower-cost, primary path. RSTP's path-cost calculation for any non-root switch sums the port costs of every link along a candidate path to the root and always selects whichever candidate path has the lowest total accumulated cost as that switch's active root path, placing the corresponding local port into the forwarding root port role while any higher-cost alternative path is placed into a non-forwarding (alternate) role. To force Switch C to prefer routing through Switch B rather than connecting to Switch A directly, the administrator must make the direct C-to-A link's cost higher than the combined cost of the C-to-B link plus the B-to-A link added together, so that the indirect, two-hop path through Switch B mathematically totals to a lower cumulative cost than the single direct hop, causing RSTP's cost comparison to favor the indirect path as primary. Setting Switch B's priority (to either 1 or 0) is irrelevant here, since Switch B is not a root bridge candidate in this scenario and priority manipulation would only affect a root bridge election, not path cost preference between a fixed root and a downstream switch. Lowering the direct link's cost, the inverse of the correct answer, would instead reinforce the direct path rather than override it. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Path Cost and Root Port Selection.

The 10.20.0.0/22 aggregate covers the four /24 blocks 10.20.0.0/24 through 10.20.3.0/24, but only the first three of those (10.20.0.0/24, 10.20.1.0/24, and 10.20.2.0/24) are configured and present as active contributing routes; 10.20.3.0/24, the block containing the destination address 10.20.3.100, has no corresponding contributing route in this configuration. Because no more-specific route exists for 10.20.3.100, the longest-match lookup falls through the missing /24 and matches only the broader /22 aggregate itself. By default, when Junos installs an aggregate route, it assigns that route a reject next hop rather than any usable forwarding next hop; this is a deliberate design choice so that traffic destined for gaps within an advertised summary block — gaps where no real, more-specific path actually exists — is not blindly forwarded toward whatever next hop happens to belong to one of the unrelated contributing routes. A reject next hop causes the router to drop the packet and generate and return an ICMP destination-unreachable message to the originating source, explicitly informing it that no path exists, which is functionally and behaviorally distinct from a silent discard next hop that would drop the packet without any such notification. Aggregate routes never adopt or forward through any single contributing route's next hop, which rules out the two forwarding-based answer choices entirely. Reference topics: Junos Enterprise Routing – Protocol Independent Routing, Default Reject Next Hop for Aggregate Routes.

The described symptom — excessive packet drops specifically attributed to exceeding the MTU on a GRE tunnel carrying full-size video streaming traffic across default-MTU gigabit Ethernet interfaces — is a direct consequence of the 24 bytes of GRE encapsulation overhead pushing packets that were already at or near the standard 1500-byte Ethernet MTU past the physical interface's transmission limit once the outer GRE and IP headers are added. The most durable fix is to proactively increase the physical member interfaces' MTU beyond the 1500-byte default — to 1524 bytes or higher — which provides sufficient headroom to absorb the full GRE encapsulation overhead without ever causing the fully encapsulated packet to exceed the interface's transmission capability, allowing full-size 1500-byte payloads to pass through the tunnel intact and without fragmentation or drops. As a complementary measure, configuring the clear-dont-fragment-bit option on the tunnel or member interfaces instructs Junos to clear the DF (don't fragment) bit on oversized packets rather than dropping them outright when they do exceed the available MTU, allowing the Packet Forwarding Engine to fragment and later reassemble the traffic instead of silently discarding it, which directly addresses the reported packet loss even under transient conditions. Simply raising the MTU only to 1500 bytes fails to account for the 24-byte GRE overhead and would not resolve the underlying oversize condition. Routing the tunnel over a higher-bandwidth link addresses potential congestion but does nothing to correct an MTU-based packet-size violation, which is the root cause explicitly identified in this scenario. Reference topics: Junos Enterprise Routing – Tunneling, GRE MTU Sizing and Fragmentation Handling for High-Throughput Applications.