JNCIE-DC study guide
JNCIE-DC · Work through your exam, one topic at a time.
JNCIE-DC is Juniper's expert-level certification for data center engineers, aimed at people who already design, build, and operate EVPN-VXLAN fabrics on Junos and want formal recognition at the highest tier. Unlike a multiple-choice associate or specialist exam, this is a hands-on lab practical: you receive a scenario and a live or simulated topology and must configure, verify, and troubleshoot it against stated requirements within the time allowed. The JNCIE-DC study guide has 8 sections and about 2,719 words.
01Data Center Architecture and Design
Domain 1 tests whether you can choose the topology, addressing plan, and overlay model that every later configuration task assumes. A spine-leaf Clos fabric: every leaf connects to every spine, no leaf-to-leaf links, so any two hosts are a fixed, known number of hops apart and ECMP behaves deterministically.
366 words, about 2 min02EVPN-VXLAN Fabric Configuration
Domain 2 is the configuration core: turning a working underlay into a tenant-carrying VXLAN fabric with BGP EVPN as the control plane. A routing instance of instance-type evpn holding the bridge domains, with route-distinguisher unique per VTEP (commonly loopback:vni) and vrf-target shared by every leaf that must join the same tenant.
342 words, about 2 min03Layer 2 and Layer 3 Underlay and Overlay Networking
Domain 3 covers the two layers beneath every tenant: the IP underlay that makes VTEP loopbacks reachable with ECMP, and the BGP EVPN overlay that distributes MAC/IP and prefix reachability. eBGP leaf-to-spine, one session per link, family inet unicast , loopback /32 advertised through an export policy.
351 words, about 2 min04Data Center Interconnect (DCI)
Domain 4 tests how you connect two independent fabrics without turning them into one fragile failure domain. Routed DCI with EVPN Type 5: each DC advertises tenant prefixes; traffic is VXLAN inside each DC and plain IP (or IPsec) between them.
347 words, about 2 min05Network Virtualization and Multitenancy
Domain 5 is about keeping tenants apart while letting them share one physical fabric, and about mapping the two address spaces correctly: MAC-VRFs (bridge domains, L2 VNIs) and IP-VRFs (routing instances, L3 VNIs). Each tenant gets a unique VNI and a unique route target.
315 words, about 2 min06Automation, Programmability, and Orchestration
Domain 6 tests whether you can change a fabric repeatably and safely: templates, an API, a check step, and a rollback path. NETCONF over SSH on port 830, which must be enabled with set system services netconf ssh ; YANG models and OpenConfig sit on top.
339 words, about 2 min07High Availability, Resiliency, and Troubleshooting
Domain 7 tests whether you can make a dual-homed host survive a leaf failure and then prove, hop by hop, why a flow is broken. ESI-LAG: the same ESI on two leaves, LACP to the server, and multi-homing-mode all-active under protocols evpn interface ae0.0 , so both leaves forward and the server gets an active-active bundle.
330 words, about 2 min08Security and Policy Enforcement in the Data Center
Domain 8 tests how you protect the fabric itself and enforce tenant boundaries without breaking forwarding. A loopback filter applied as set interfaces lo0 unit 0 family inet filter input PROTECT is the single most important control: allow BGP only from fabric loopback addresses, allow SSH/NTP/SNMP from management prefixes, then discard everything else.
329 words, about 2 min