Free Juniper JN0-650 Practice Exam with Questions & Answers | Set: 2

In an EVPN-VXLAN architecture, the interaction between the control plane (EVPN) and the data plane (VXLAN) is defined by specific functional components:

VTEP (VXLAN Tunnel End Point):These are the entities responsible for theencapsulation and de-encapsulationof Layer 2 Ethernet frames into Layer 3 UDP/IP packets. A VTEP can be a physical switch (like a QFX or EX series) or a software-based entity. When traffic enters the fabric, the ingress VTEP wraps it in a VXLAN header; the egress VTEP removes this header before delivering it to the destination host. (Option B)

VNI (Virtual Network Identifier):The VNI is a 24-bit field in the VXLAN header that allows for up to 16 million unique identifiers. It is used toidentify specific broadcast domains(or VLANs) within the overlay network. Each VNI effectively represents a virtualized Layer 2 segment that is stretched across the Layer 3 underlay. (Option D)

Incorrect statements:Option Ais incorrect because VNIs are identifiers, not the "engine" that performs encapsulation—that is the VTEP's job.Option Cis incorrect because VTEPs identify the endpoints of a tunnel, not the individual broadcast domains themselves.

This question focuses on port security and preventing "rogue switches" or multiple devices from accessing a single physical port simultaneously.

Single-Secure Supplicant Mode (Option A):This is the most restrictive 802.1X mode in Junos OS. It allowsexactly oneMAC address to be authenticated on the port at a time. If a device successfully authenticates, the switch will drop any traffic coming from any other MAC address on that same physical interface. If a user tries to plug in a switch, only the first device that authenticates will have access; all other devices behind that switch will be blocked.

Single Supplicant Mode (Option C):This mode allows the first authenticated user to "open" the port for all other users. This would actuallyallowa rogue switch to function once the first device is authorized.

Multiple Supplicant Mode (Option B):This allows multiple devices to connect, provided each one authenticates individually. While secure, it does not prevent a user from connecting multiple devices to the port, which violates the requirement to allow only one.

MAC-RADIUS (Option D):This is an authenticationmethod, not a port-accessmodethat limits the number of supplicants.

The exhibit shows the MSTP configuration for two switches,switch1andswitch2. MSTP allows you to group multiple VLANs into a single Multiple Spanning Tree Instance (MSTI), enabling different root bridges and topologies for different sets of VLANs.

Root Bridge Election (Option B):For any Spanning Tree instance, the switch with thelowest bridge priorityis elected as the root bridge.

Formsti 2, switch1 has a priority of4k(4096), while switch2 has a priority of8k(8192).

Since 4096 < 8192,switch1 is elected the root bridge for msti 2.

Failover Behavior (Option D):Spanning Tree is designed for redundancy. If a primary root bridge fails, the remaining switches in the network re-elect a new root based on the next lowest priority.

Ifswitch2goes down, switch1 becomes the only switch in the region.

Regardless of its original priority (4k or 8k), switch1 will take over as theroot bridge for both msti 1 and msti 2because there are no other contenders with a better (lower) priority.

Incorrect Statements:Option Ais incorrect because for msti 1, switch2 has the lower priority (4k vs. 8k), making switch2 the root bridge.Option Cis incorrect because it contradicts the fundamental high-availability nature of Spanning Tree.

When integrating a QFX Series switch into an EVPN-VXLAN IP fabric, specific BGP and EVPN hierarchy configurations are required to establish the control and data planes:

EVPN Encapsulation (Option A):In Junos OS, the encapsulation vxlan statement must be explicitly configured under the protocols evpn hierarchy. This defines that the EVPN control plane will use VXLAN as the data plane encapsulation method rather than MPLS.

BGP Address Family (Option C):EVPN uses Multiprotocol BGP (MP-BGP) to distribute reachability information. For the control plane to function, you must enable the EVPN signaling address family under the BGP protocol using the command set protocols bgp group family evpn signaling.

Incorrect Options:Option Bis incorrect because family vpls is used for traditional VPLS signaled by BGP, not for EVPN-VXLAN.Option Dis incorrect because while the loopback interface must be reachable, it is typically advertised via anIGP(like OSPF or IS-IS) to provide the underlay connectivity that BGP then rides upon; BGP itself does not "advertise" the loopback to establish the initial peerings.

Junos OS 24.4 handles multicast traffic using two distinct models based on whether the source is known in advance.

Knowledge and Sources (Option A):PIM-ASM (Any Source Multicast)is designed for "many-to-many" communication where receivers join a group ($*,G$) and rely on a Rendezvous Point (RP) to discover active sources. In contrast,PIM-SSM (Source-Specific Multicast)is for "one-to-many" scenarios where receivers must alreadyknow the exact source IP($S,G$) before joining.

Protocol and RP Logic (Option D):PIM-SSMbypasses the RP entirely. It relies onIGMPv3messages from the host, which explicitly include both the source address and the group address. This allows the last-hop router to build a Shortest Path Tree (SPT) directly toward the source immediately.

Register Process (Option B):While PIM-ASM does use registers, it is the First-Hop Router (Designated Router on the source segment) that sends the register to the RP, not the receiver's DR.

RP Role (Option C):This is exactly backwards; PIM-ASMrequiresan RP for source discovery, whereas PIM-SSM does not use one at all.

OSPF stub areas are used to reduce the size of the Link-State Database (LSDB) in routers with limited resources by restricting the flooding of external routes.

Virtual Links (Option C):According to OSPF standards (both v2 and v3),virtual links cannot pass through stub areas. A virtual link must transit a "transit area," which must be a standard (non-stub) area with a full routing table.

Totally Stubby Areas (Option D):A stub area (which blocks Type 5 External LSAs) can be further restricted into atotally stubby area. In Junos OS, this is done by adding the no-summaries statement to the stub configuration. This blocks both Type 5 and Type 3 (Inter-area) LSAs, replacing them with a single default route.

Incorrect Statements:Option Ais incorrect because standard stub areas cannot contain an ASBR; only Not-So-Stubby Areas (NSSA) allow for an ASBR.Option Bis incorrect because an area is either a Stub or an NSSA; they are mutually exclusive configurations for the same area.

To provide IP phones with geographic location details (such as civic addresses or coordinates) automatically, Juniper EX Series switches utilize theLLDP-MED (Link Layer Discovery Protocol - Media Endpoint Discovery)protocol.

VoIP Specifics:While standard LLDP (C) is for general device discovery,LLDP-MEDis an enhancement specifically designed for network-to-endpoint communication for VoIP devices.

Location Identification:LLDP-MED supportsLocation Identification TLVs(Type-Length-Values). These allow a switch to push geographic or civic location data to an IP phone, which is critical for E911 services and asset tracking.

Junos Implementation:On EX Series switches, this is typically configured under protocols lldp-med to ensure the switch advertises the necessary location information to connected endpoints.

In a three-stage EVPN-VXLAN fabric (Spine-Leaf architecture) where leaf devices perform the gateway services (Edge-Routed Bridging or ERB):

VTEP Functionality (Option B):Leaf devices act asVXLAN Tunnel End Points (VTEPs). They are responsible for encapsulating Ethernet frames from locally connected hosts into VXLAN packets for transport across the IP fabric and de-encapsulating incoming VXLAN packets.

Fabric Support (Option C):In a standard Juniper IP fabric design, both theleaf and spine devicesare typically expected to support VXLAN and EVPN capabilities. While spines in an ERB design might only perform IP forwarding in the underlay, they often participate in the BGP control plane (as Route Reflectors) or provide the ability to transition to Centrally-Routed Bridging (CRB) where spines would act as gateways.

Incorrect Options:Option Ais incorrect because the entire fabric infrastructure must be "VXLAN aware" in terms of MTU settings and routing capability to support the overlay.Option Dis incorrect because in an ERB design, the spine devices are high-speed transit nodes and do not terminate VXLAN tunnels; only the edge (leaf) devices act as VTEPs.

In an EVPN-VXLAN environment, different BGP route types serve distinct purposes in building the control plane. TheEthernet Segment Identifier (ESI)is a unique 10-byte identifier used to represent a multi-homed segment.

Type 1: Ethernet Auto-Discovery (A-D) Route (Option A):This route type is essential for multi-homing scenarios. It carries theESIto support features likefast convergenceandaliasing. By advertising an A-D route per Ethernet Segment, a PE tells other routers that it is connected to that specific ESI. It doesnotcarry individual host MAC addresses; instead, it provides a "mass withdraw" mechanism to quickly update paths if the entire segment goes down.

Type 4: Ethernet Segment Route (Option D):This route is used exclusively forDesignated Forwarder (DF) election. It advertises the existence of anESIand the ES-Import Route Target to all other PE routers. This allows PE routers connected to the same multi-homed segment to discover each other automatically and elect a DF to handle BUM traffic. Like Type 1, it focuses on the segment identity and doesnotinclude MAC addresses.

Type 2: MAC/IP Advertisement Route (Option B):This is the primary route used for host reachability. Itmustinclude a MAC address (and optionally an IP). While it also includes the ESI to indicate which segment the host is behind, its primary function is MAC advertisement.

Type 3: Inclusive Multicast Ethernet Tag Route (Option C):This route is used for VTEP discovery and building the replication list for BUM traffic. It identifies the VTEP's IP and the VNI, but it doesnotcarry the ESI or MAC addresses.