Network Management or Reliability
Network Management or Reliability
This domain tests designs that remain observable and recoverable: out-of-band access, AAA, telemetry, configuration backup and control-plane resilience. Reliability is a design property, not a device feature list.
Core rules
- Provide out-of-band management through a dedicated management VRF or VLAN, console servers and a jump host. A branch must be reachable when the production circuit fails, often via LTE or a secondary ISP.
- Centralize AAA with TACACS+ for command authorization and accounting, or RADIUS for 802.1X. Configure local fallback and role-based classes.
- Use SNMPv3 with authPriv, syslog to redundant collectors, authenticated NTP and streaming telemetry where available. Consistent time is required to correlate events.
- Protect configuration: commit confirmed, rescue configuration, archived configurations and scheduled backups through Junos Space or Security Director.
- Build resilience with dual Routing Engines and GRES/NSR, chassis clusters with session sync, MC-LAG, BFD, LACP and redundant power.
Worked example
A 200-site retailer needs management that survives circuit loss. Reasoning: each site gets a management VRF over a secondary LTE link, plus a console server for break-glass access. TACACS+ provides command accounting; SNMPv3 authPriv and TLS syslog feed two collectors; NTP is authenticated. Configurations are archived centrally and commit confirmed is mandatory for remote changes. Failover is tested, not assumed. The design satisfies observability and recovery without depending on the production path.
Traps that cost marks
- In-band-only management on the production path.
- SNMPv1/v2c and unauthenticated NTP.
- No tested failover or no configuration archive.
- Exposing the management plane without filtering.
- Active/active clusters without session synchronization.