Juniper JN0-352 - Enterprise Routing and Switching, Specialist (JNCIS-ENT)

Because root bridge election is decided primarily by comparing bridge priority values — with the switch advertising the numerically lowest priority always winning, and MAC address serving only as a fallback tiebreaker when priorities are tied — the only deterministic, reliable way to guarantee that a specific switch is elected root regardless of any other switch's hardware characteristics is to explicitly configure that switch with a lower bridge priority than every other participating switch in the topology. Relying on MAC address alone, as the first distractor suggests, is fundamentally unreliable: MAC addresses are burned in at the factory, cannot be predicted or controlled by the administrator, and any future hardware replacement or newly introduced switch with a numerically lower MAC address could unexpectedly seize the root role since MAC comparison only comes into play at equal priority in the first place, meaning a 'highest MAC' strategy does not even align with how the tiebreak actually favors the lowest value. Port priority and port cost are entirely separate STP parameters that influence which port on a non-root switch is selected as its root port, or which port is selected as designated versus blocking on a given segment; neither parameter has any bearing whatsoever on which switch is elected root bridge for the whole topology, since that decision is made purely from the Bridge ID comparison, independent of any per-port settings. Explicitly and deliberately lowering Switch 1's configured bridge priority is the only correct, industry-standard method. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, Guaranteeing Root Bridge Placement via Bridge Priority.

The show ethernet-switching table command displays the Layer 2 forwarding database (the bridge or MAC table) that an EX Series switch builds dynamically by inspecting the source MAC address of every frame it receives. Each entry records the learned MAC address, the VLAN it was learned on, the type of entry (dynamic, static, or persistent), and the specific interface through which that address was seen, which is precisely the information needed to confirm whether the switch has learned the host connected to ge-0/0/3. If the host's MAC address is absent from the table, that immediately points to a Layer 1/2 issue — no frames have been received from the host, a cabling or port problem exists, or the interface is administratively down or blocked by spanning tree — rather than a Layer 3 routing or VLAN membership problem. show interfaces terse only reports administrative and link state along with any assigned protocol family addresses, offering no MAC-learning visibility. show vlans lists VLAN definitions and their member interfaces but does not display learned host addresses. show interfaces extensive provides detailed physical-layer counters and error statistics, useful for diagnosing frame loss or interface errors, but it does not expose the switching table. For intra-VLAN reachability troubleshooting, verifying MAC learning is always the first and most direct Layer 2 checkpoint. Reference topics: Junos Enterprise Switching – Layer 2 Switching Fundamentals, Monitoring the Ethernet Switching Table.

Nonstop active routing is specifically engineered to be completely transparent to the rest of the network: rather than relying on neighboring routers to preserve state during a Routing Engine switchover the way graceful restart does, NSR keeps a fully synchronized instance of the routing protocol process (rpd) running continuously on the backup Routing Engine, mirroring protocol adjacencies, the RIB, and session state in real time. Because neighbors never observe a session reset or restart signal during an NSR-driven switchover, there is no dependency on those neighbors supporting or enabling graceful restart extensions at all — this is the core architectural advantage that distinguishes NSR from GR and is precisely why the first and third answer choices are incorrect distractors. What NSR does require locally is Graceful Routing Engine Switchover (GRES) enabled first, since NSR is built as an extension on top of GRES and depends on it to synchronize kernel and interface state between the two Routing Engines before protocol-level synchronization can occur. Additionally, Juniper's official guidance mandates that both Routing Engines run the identical Junos OS software version; mismatched versions between the primary and backup Routing Engine can introduce incompatible internal data structures or feature behavior during state replication, jeopardizing the integrity of a switchover and is explicitly called out as a hard operational requirement rather than a mere best practice. Reference topics: Junos Enterprise Routing – High Availability, Nonstop Active Routing Requirements and GRES Dependency.

In this configuration, R1's physical interface address (10.10.10.1) is different from the VRRP virtual IP address (10.100.100.1), meaning R1 is operating as a non-owner VRRP master — it did not originate the virtual address as one of its own real interface addresses. By default, Junos VRRP masters that do not own the virtual address will forward transit traffic destined through that address but will not process or respond to traffic addressed directly to the VIP itself, such as ICMP echo requests, Telnet, or SSH sessions aimed at 10.100.100.1. This is deliberate default behavior intended to prevent ambiguity about which physical device is answering on behalf of a shared virtual identity. To allow the master to accept and respond to packets whose destination is the virtual address itself, the accept-data statement must be explicitly configured under the vrrp-group hierarchy. Once enabled, the elected master will process locally destined traffic sent to the VIP, resolving exactly the symptom described. The track option is used for interface or route-based priority adjustment to influence mastership, advertise-interval tunes the frequency of VRRP hello advertisements, and no-preempt prevents a higher-priority router from reclaiming mastership once a lower-priority router has taken over — none of these affect whether the master processes traffic destined to the VIP. Reference topics: Junos Enterprise Routing – High Availability, VRRP accept-data Behavior.

When storm control on an EX Series switch is configured with an action of interface-shutdown (rather than the default of simply dropping excess traffic), exceeding the configured bandwidth threshold for broadcast, multicast, or unknown-unicast traffic causes Junos to administratively disable the offending interface to protect the rest of the switching fabric. Recovery from this condition can happen automatically if a recovery-timeout interval has been configured, but when immediate manual recovery is required, the operational command clear ethernet-switching recovery-timeout interface interface-name explicitly clears the storm-control-triggered violation and re-enables the port without waiting for the timer to expire. This command is purpose-built for this exact condition and is distinct from more general troubleshooting commands: clear ethernet-switching table purges the learned MAC address database and has no bearing on a storm-control-disabled port; clear interface statistics resets traffic counters for diagnostic baselining but does not touch administrative state; and clear log messages simply flushes the local system log buffer. Administrators should also verify the underlying cause of the storm — a switching loop, a misbehaving host, or a misconfigured device — before manually clearing the condition, since without addressing the root cause the port is likely to trip again. This command and workflow are commonly tested as part of the Layer 2 security and resiliency features on EX platforms. Reference topics: Junos Enterprise Switching – Storm Control and Port Security, Recovering Interfaces Disabled by Storm Control.

The Junos BGP path selection algorithm proceeds through a strict, ordered sequence of comparison steps, and once next-hop reachability and route preference (administrative distance) have been confirmed as equal, local preference is the very first BGP-specific path attribute evaluated in the decision process. A route carrying a higher local preference value is always chosen over a competing route to the same prefix with a lower local preference, and this comparison takes absolute precedence over every subsequent attribute in the algorithm; if local preference values differ between candidate paths, the selection process concludes at this step without ever needing to examine AS path length, origin type, or MED at all. Only when two or more competing paths share an identical local preference value does the algorithm proceed to its third step, comparing AS path length and preferring the shortest, and only after a further tie does it move on to origin type (preferring IGP-origin over EGP-origin, and EGP-origin over incomplete), followed by MED comparison (preferring the lowest value, and only among routes learned from the same neighboring AS by default). Because local preference is evaluated strictly before all three of the other listed attributes, it is the attribute BGP consults first among the choices given, making it the deciding factor in scenarios such as this exhibit where multiple autonomous systems advertise competing paths toward the same 192.168.1.0/24 prefix. Reference topics: Junos Enterprise Routing – BGP, Understanding BGP Path Selection Order.

A functioning GRE tunnel interface in Junos requires, at minimum, both a tunnel source address and a tunnel destination address configured together under the tunnel statement of the gr- logical unit, since these two values together define the outer, delivery-layer IP header that will encapsulate every passenger packet sent through the tunnel; the source identifies which of the router's own addresses will originate the encapsulated traffic, and the destination identifies the remote tunnel endpoint the encapsulated traffic must be routed toward across the underlying IP network. The first option correctly supplies both required values in a single, complete statement — source 192.168.1.1 (Router A's own address) and destination 192.168.2.1 (Router B's address) — fully defining the tunnel's endpoints and ensuring the encapsulation and route-resolution process can succeed. The fourth option supplies only the destination and omits the source entirely, which is an incomplete configuration; without an explicit source, Junos cannot always reliably determine which local address to use for encapsulation, particularly on multi-address or multi-interface routers, and the tunnel configuration is left non-deterministic or non-functional as shown. The second option enables the IPv6 protocol family on the tunnel's logical unit, which is irrelevant to a scenario explicitly requiring IPv4 passenger traffic support. The third option attempts to assign a family inet address directly using one of the underlying tunnel endpoint addresses, which conflates the tunnel's own transport addressing with logical-unit protocol addressing and does not by itself establish the required source/destination tunnel definition. Reference topics: Junos Enterprise Routing – Tunneling, Configuring GRE Tunnel Source and Destination.

Layer 2 MAC learning on an EX Series switch, as on any standard Ethernet bridge, is a passive, frame-driven process rather than an active polling or query-based mechanism. Every time a frame arrives on any interface, the switch inspects the frame's source MAC address field and, if that address is not already present in the Ethernet switching (bridge) table for the associated VLAN, creates a new dynamic entry recording the source MAC address, the VLAN it was learned on, and the specific ingress interface through which the frame arrived. Junos also stamps each learned entry with an aging timestamp, which is refreshed every time a subsequent frame from that same source MAC is received; entries that receive no refreshing traffic within the configured MAC aging interval (300 seconds by default) are eventually purged from the table to keep it current and to reclaim table space from hosts that have moved or gone offline. This source-address-driven, per-frame learning process happens continuously and automatically with no dependency on spanning-tree state changes — although a topology change notification can trigger accelerated aging of the table to flush potentially stale entries faster, learning itself is not gated by or contingent upon such an event occurring. The switch never learns addresses from the destination field of a frame, since the destination address, if already known, is used purely for the forwarding lookup decision, not for populating new table entries. Reference topics: Junos Enterprise Switching – Layer 2 Switching Fundamentals, Source MAC Learning and Table Aging.

A GRE tunnel's outer, delivery-layer packets are forwarded using the router's ordinary underlay routing table, meaning the tunnel destination address (192.168.0.1 in this case) must itself be resolvable to a physical, non-tunnel next hop for the encapsulated packets to actually leave the router. Before this configuration change, the default route (or some more specific route) presumably pointed toward a real physical next hop, allowing the router to reach 192.168.0.1 and keep the tunnel operational. When the administrator commits a static default route of 0.0.0.0/0 with a next hop of gr-0/0/0, every destination lookup that previously fell back to the default route — including the lookup for the tunnel's own destination address, 192.168.0.1, since no more specific route exists for it — now recurses through the GRE interface itself. This creates a circular dependency: the router needs to route to 192.168.0.1 to keep the tunnel up, but the only route it has to reach 192.168.0.1 now points back into the tunnel that requires 192.168.0.1 to already be reachable, so the interface's next-hop resolution fails and the tunnel drops. This is an entirely valid and common GRE design pitfall rather than any platform restriction; GRE interfaces can be legitimately used as static route next hops, do not require loopback-sourced encapsulation, and do not require a /32 host route to resolve their destination, provided that route does not recursively point back through the tunnel. Reference topics: Junos Enterprise Routing – Tunneling, Route Recursion and GRE Tunnel Destination Resolution.