Juniper JN0-649 - Enterprise Routing and Switching Professional (JNCIP-ENT)

The correct sequence for BGP active route selection when BGP multipath or multihop are not configured is as follows:

Higher local preference: Routes with a higher local preference are preferred.

Shortest AS path: Routes with the shortest AS path are preferred.

Lower origin code: Routes with lower origin code (IGP < EGP < Incomplete) are preferred.

Lowest router ID: Routes with the lowest router ID are preferred.

Lowest peer address: Routes with the lowest peer address are preferred.

References:

Standard BGP route selection criteria as outlined in network routing protocols.

Documentation from "Useful Juniper Commands.txt" and "Juniper Commands.pdf" which include detailed BGP operational commands and preferences​​​​.

To ensure that each host is placed on a separate VLAN when using an unmanaged switch between the hosts and the EX Series switch:

Configure an input firewall filter on interface ge-0/0/3 to match the source MAC or IP address of the hosts to assign the VLANs:

By configuring an input firewall filter, you can match the source MAC or IP address of incoming traffic and assign the appropriate VLAN based on these criteria.

This method ensures that even though the switch between hosts and EX Series is unmanaged, VLAN assignments are still properly enforced at the EX Series switch.

Configuration Example:

set firewall family ethernet-switching filter VLAN-assignment term VLAN100 from source-mac-address xx:xx:xx:xx:xx:xx

set firewall family ethernet-switching filter VLAN-assignment term VLAN100 then vlan-assignment vlan 100

set firewall family ethernet-switching filter VLAN-assignment term VLAN200 from source-mac-address yy:yy:yy:yy:yy:yy

set firewall family ethernet-switching filter VLAN-assignment term VLAN200 then vlan-assignment vlan 200

set firewall family ethernet-switching filter VLAN-assignment term VLAN300 from source-mac-address zz:zz:zz:zz:zz:zz

set firewall family ethernet-switching filter VLAN-assignment term VLAN300 then vlan-assignment vlan 300

set interfaces ge-0/0/3 unit 0 family ethernet-switching filter input VLAN-assignment

References:

The command references from "Useful Juniper Commands.txt" and network configuration guides provide details on firewall filters and VLAN assignments​​.

Step 1: Check the error messages in the log.

The log messages indicate:

vbnet

Copy code

Dec 22 19:22:29 router rpd[7394]: bgp_process_open:4185: NOTIFICATION sent to 192.168.1.4 (Internal AS 65000): code 2 (Open Message Error) subcode 2 (bad peer AS number), Reason: peer 192.168.1.4 (Internal AS 65000) claims 65100, 65000 configured

Dec 22 19:22:33 router rpd[7394]: bgp_pp_recv:4788: NOTIFICATION sent to 192.168.1.4+56714 (proto): code 2 (Open Message Error) subcode 2 (bad peer AS number), Reason: no group for 192.168.1.4+56714 (proto) from AS 65100 found (peer as mismatch) in master

Step 2: Interpret the messages.

The first message indicates that a BGP NOTIFICATION was sent to 192.168.1.4 due to an "Open Message Error" with a "bad peer AS number" because peer 192.168.1.4 claims AS 65100, but 65000 is configured.

The second message reiterates that the peer AS number 65100 does not match the configured AS 65000, causing a mismatch.

Step 3: Understand the MD5 key error.

sql

Copy code

Dec 22 19:23:29 router kernel: tcp_auth_ok: Packet from 192.168.1.5:64047 missing MD5 digest

Dec 22 19:23:30 router kernel: tcp_auth_ok: Packet from 192.168.1.6:56201 missing MD5 digest

These lines indicate that packets from 192.168.1.5 and 192.168.1.6 are missing the MD5 digest, suggesting a potential MD5 key misconfiguration.

Step 4: Validate the answers.

Option B: The 192.168.1.5 peer has a misconfigured MD5 key. This is correct because the logs show that packets from 192.168.1.5 are missing the MD5 digest.

Option D: The 192.168.1.4 peer has a misconfigured autonomous system number. This is correct because the logs indicate that 192.168.1.4 claims AS 65100, while the router is configured for AS 65000.

References:

Document on useful Juniper commands for troubleshooting BGP and understanding log messages​​​​.

Commands for checking BGP logs: show log messages | match notification, show bgp summary, show configuration protocols bgp​​​​.

Step 1: Identify the requirement.

You need an OSPF area that only contains intra-area route information in the form of Type 1 and Type 2 LSAs.

Step 2: Analyze the possible OSPF area types.

Option A: Totally non-to-stubby area.

Option B: Totally stubby area.

Option C: Stub area.

Option D: Non-to-stubby area.

Step 3: Understand OSPF area types.

Totally Stubby Area (Option B): Only allows Type 1 and Type 2 LSAs and blocks Type 3, 4, and 5 LSAs. It uses a default route to represent external routes.

This fits the requirement of containing only intra-area routes.

References:

Juniper OSPF configuration guide on area types​​​​.

Commands for configuring a totally stubby area:

shell

Copy code

set protocols ospf area stub no-summaries

Single supplicant mode authenticates only the first end device that connects to an authenticator port. All other end devices connecting to the authenticator port after the first has connected successfully, whether they are 802.1X-enabled or not, are permitted access to the port without further authentication. If the first authenticated end device logs out, all other end devices are locked out until an end device authenticates. Single-secure supplicant mode authenticates only one end device to connect to an authenticator port. No other end device can connect to the authenticator port until the first logs out

To implement fault-tolerant RPs (Rendezvous Points) in a multicast network, the following two solutions are appropriate:

Use MSDP with statically defined RPs:

MSDP (Multicast Source Discovery Protocol) is used to share multicast source information between multiple RPs in different domains or within the same domain. It allows for RP redundancy by ensuring that if one RP fails, another RP can take over the role and continue to manage multicast group memberships.

LLDP-MED (Link Layer Discovery Protocol-Media Endpoint Discovery) is an extension of LLDP (Link Layer Discovery Protocol) that provides additional functionalities specifically for voice over IP (VoIP) devices, including automatic negotiation of power requirements. This protocol is essential for automatically negotiating power with IP phones when they are connected to EX Series switches.

Steps:

Enable LLDP-MED:

set protocols lldp-med

Configure LLDP-MED on the interfaces:

set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode access

set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access

set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members default

set interfaces ge-0/0/0 unit 0 family ethernet-switching storm-control default

Commit the configuration:

References:

Useful Juniper Commands.txt

Tech Ops Managed Router Juniper Install Guide