JNCIE-DC flashcards

35 cards. Read the term and the definition here. The deck at the top of this page is optional.

Spine-leaf topology

A two-tier Clos fabric where every leaf connects to every spine. Server-to-server traffic always traverses leaf-spine-leaf, giving predictable latency and uniform ECMP path count.

Oversubscription ratio

The ratio of total host-facing downlink bandwidth to spine-facing uplink bandwidth on a leaf. A 1:1 ratio removes congestion but increases spine port cost.

Underlay loopback address

A /32 IP on each device used as BGP router-id and VXLAN VTEP source. It must be reachable across the fabric for overlay tunnels to form.

VXLAN VNI space

VXLAN network identifiers are 24 bits, allowing about 16.7 million segments, versus 4,096 VLAN IDs. Multiple VLANs can map to one VNI at the edge.

Fabric MTU planning

VXLAN adds 50 bytes of outer IP, UDP, and VXLAN headers. All fabric links must support the resulting frame, typically configured as 9000-byte jumbo MTU.

EVPN Type 2 route

Advertises a MAC address with an optional IP, VNI, and Ethernet tag. It enables MAC learning, ARP/ND suppression, and symmetric IRB across the fabric.

EVPN Type 3 IMET route

Inclusive Multicast Ethernet Tag route advertised per VNI by each VTEP. Remote VTEPs use it to build the ingress replication list for BUM traffic.

Symmetric IRB

Inter-VNI routing using an L2 VNI for bridging and a shared L3 VNI for routing, with a common anycast gateway MAC on all leaves.

Anycast gateway

The same gateway IP and virtual MAC configured on every leaf for a subnet. It lets each host use its local leaf as first hop, avoiding tromboning.

EVPN route target mismatch

When import and export route targets differ between VTEPs, Type 2 and Type 3 routes are not accepted. It is a common cause of missing MAC reachability.

EVPN multihoming ESI

An Ethernet Segment Identifier groups links from a host to multiple leaves. Type 1 and Type 4 routes elect a designated forwarder and enable all-active load sharing.

VTEP encapsulation

The outer header is IP, UDP destination port 4789, and VXLAN. The inner tenant frame is carried unchanged, with the VNI identifying the segment.

Ingress replication

Head-end replication of BUM traffic to every remote VTEP in the VNI, using the list built from Type 3 IMET routes instead of underlay multicast.

ARP and ND suppression

Leaves answer ARP and ND requests from the EVPN database of Type 2 MAC/IP routes, preventing broadcast flooding of the fabric for address resolution.

EVPN Type 5 route

An IP Prefix route advertising a subnet with an optional VNI and route target. It enables inter-VNI and inter-site routing without stretching Layer 2.

Underlay ECMP

Equal-cost multipath across all spine links from a leaf. Hashing on L3/L4 tuples spreads flows; maximum-paths must be configured in BGP.

Layer 3 DCI

Interconnecting data centers by routing with EVPN Type 5 prefixes instead of stretching VLANs. It avoids spanning-tree and broadcast domain extension across sites.

DCI border leaf pair

A redundant pair of leaves that terminates inter-site tunnels or links and acts as the DCI gateway. It confines failures and controls route leaking between sites.

Stretched Layer 2 risks

Extending a VLAN across sites spreads broadcast storms, unknown unicast flooding, and STP domains. EVPN suppression and storm control mitigate the impact.

DCI MTU and DF bit

The WAN path must carry the 50-byte VXLAN overhead. Check DF-bit handling and fragmentation policy on the DCI edge to prevent silent drops.

VRF per tenant

Each tenant gets an isolated routing table mapped to a unique L3 VNI and route targets, preventing prefix leakage between tenants with overlapping IP space.

L3 VNI

A VNI dedicated to routing between VRFs or subnets, carrying routed traffic with a shared anycast gateway MAC. It is central to symmetric IRB designs.

Extranet route leaking

Selectively importing a remote VRF's route target into a local VRF, and vice versa, to permit controlled reachability between tenants without merging tables.

VLAN-to-VNI mapping

A deterministic mapping such as VLAN 10 to VNI 1010 applied consistently on every leaf. Inconsistent mapping is a frequent cause of overlay reachability failures.

NETCONF over SSH

A Junos automation interface on port 830 using a candidate datastore. Operations include get-config, edit-config, commit, and lock, enabling atomic configuration changes.

Commit confirmed

A Junos commit that automatically rolls back after a set number of minutes unless confirmed. It protects remote changes that could sever management access.

Junos PyEZ

A Python library for Junos automation. Device opens a session, Config loads and commits configuration, and rpc runs operational commands programmatically.

Junos telemetry interface

Streaming telemetry that pushes operational data such as interface counters over gRPC at configured intervals, enabling fabric-wide monitoring without polling.

Designated forwarder

The ESI peer elected by Type 4 routes to forward BUM traffic for a segment, preventing duplicate delivery in EVPN multihoming.

BFD failure detection

Bidirectional Forwarding Detection on point-to-point links and LAG members detects failures in milliseconds. The multiplier is tuned to avoid false positives.

Graceful Restart and NSR

GR preserves forwarding during a control-plane restart while protocols reconverge. NSR keeps routing state on the backup RE without any protocol flap.

VXLAN split-horizon

A VTEP never forwards traffic received on a VNI back out the same VNI. This prevents loops in the overlay without relying on spanning tree.

Loopback control-plane filter

A stateless firewall filter applied to the loopback that restricts SSH, NETCONF, and BGP to trusted subnets and rate-limits ICMP and ARP.

MACsec on fabric links

IEEE 802.1AE hop-by-hop encryption on leaf-spine links. VXLAN itself does not encrypt payloads, so IPsec is needed for WAN confidentiality.

DHCP snooping and DAI

Access-edge protections that validate DHCP leases and ARP packets against a trusted binding table, blocking spoofed addresses and rogue DHCP servers.