Security and Policy Enforcement in the Data Center
Domain 8 tests how you protect the fabric itself and enforce tenant boundaries without breaking forwarding.
Protecting the control plane
A loopback filter applied as set interfaces lo0 unit 0 family inet filter input PROTECT is the single most important control: allow BGP only from fabric loopback addresses, allow SSH/NTP/SNMP from management prefixes, then discard everything else. Add BGP ttl 255 (GTSM) so spoofed off-fabric sessions never form, and prefix-limit so a misbehaving peer cannot fill the RIB.
Link and tenant security
MACsec (802.1AE) with MKA protects fabric links hop by hop; it encrypts the wire between two switches, not end to end. Tenant isolation is enforced primarily by distinct VRFs and route targets, with firewall filters for extra granularity. At the access edge, DHCP snooping, dynamic ARP inspection, and storm control stop rogue servers and broadcast storms. DCI links should carry IPsec when tenant traffic crosses untrusted transport.
Worked example
A PROTECT filter with three terms: ALLOW-BGP matches a source-prefix-list of the four leaf loopbacks and the two spine loopbacks, protocol tcp port bgp, then accept; ALLOW-OPS matches 10.0.0.0/8 protocol tcp port ssh and udp ntp, then accept; DENY has no match condition and discards. Order matters because Junos evaluates top down, and the implicit deny at the end is the backstop if the explicit term is ever reordered.
Traps
Applying a loopback filter without commit confirmed, locking yourself out of the spine; assuming MACsec protects past the next hop; letting route targets overlap so one tenant sees another's prefixes; forgetting that storm control protects the fabric, not the server's own NIC.