JNCIE-ENT cheat sheet

Junos commit model: candidate configuration is edited, then verified with commit check; commit confirmed rolls back automatically after 10 minutes unless confirmed again, protecting remote changes.

Configuration groups apply shared statements to multiple interfaces or routing instances; apply-groups inherits values, and explicit statements at the lower level override inherited ones.

Rescue configuration: request system configuration rescue save stores a known-good config; rollback rescue restores it; rollback 0 returns to the active config after a rollback.

Junos OS commit history keeps the last 50 commits by default; rollback N loads revision N, and show system commit lists each revision with user and timestamp.

Traceoptions: file name, flag, and match conditions under edit protocols or edit routing-options capture control-plane events; the file lands in /var/log with a configurable size and world-readable option.

Syslog hosts are configured under system syslog with facility, level, and any|none match; class and severity filtering determines which messages leave the device.

SNMPv3 uses security-name, security-model usm, and authentication/privacy protocols; communities are v2c only and should be paired with ACLs on loopback.

NETCONF and YANG: set system services netconf ssh enables port 830; operational state is retrieved with get or get-config, and commit is atomic per session.

Monitoring commands: show chassis alarms, show system uptime, show log messages | last, monitor interface traffic, and show task accounting reveal device health and active processes.

VLAN membership: access ports carry one untagged VLAN; trunk (tagged) ports carry multiple VLANs with 802.1Q tags; native-vlan-id sets the untagged VLAN on a trunk.

RSTP (802.1w) converges in sub-second to seconds and replaces STP; configure protocol rstp under edit protocols. MSTP (802.1s) maps VLANs to instances for load sharing.

Edge ports with BPDU protection: set protocols rstp interface ge-0/0/1 edge; bpdu-block-on-edge shuts the port if a BPDU arrives, preventing loops from user devices.

Loop protection: set protocols layer2-control mac-rewrite or use nonstop-bridging; root protection marks a port so it never becomes root; loop-protect detects and blocks loops on access ports.

Q-in-Q tunneling: set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk with vlan-id 100 and inner-vlan-id-list; the outer tag identifies the service provider VLAN.

MAC limiting and learning: set interface-mac-limit limit N plus packet-action drop|shutdown; persistent MAC learning saves the table across restarts.

Storm control: set storm-control level percentage under the interface; separate broadcast, multicast, and unknown-unicast thresholds prevent flooding the fabric.

LACP (802.3ad) aggregates links: set interfaces ae0 aggregated-ether-options lacp active; LACP fast (1s) versus slow (30s) timers affect failover detection.

LLDP and 802.1X: LLDP advertises neighbor info; 802.1X with a RADIUS server authenticates supplicants, with guest-vlan and server-reject-vlan fallback behavior.

IRB interfaces provide Layer 3 routing for a VLAN: set interfaces irb unit 10 family inet address 10.0.0.1/24 and set vlans v10 l3-interface irb.10.

VRRP: master holds the virtual IP; priority 1-254, preempt enables takeover; authentication and advertise-interval tune failover; track interfaces or routes to fail over on upstream loss.

OSPF: area 0 is the backbone; stub areas block Type 5 LSAs, NSSA blocks Type 5 but allows Type 7; hello/dead timers must match; default-metric influences redistribution.

BGP: eBGP sets next-hop to the peer address; iBGP requires next-hop-self or an IGP route to the next hop; multihop and local-address are needed for loopback peering.

Route preference (Junos default): direct 0, static 5, OSPF internal 10, OSPF external 150, RIP 100, eBGP 170, iBGP 170; lower value wins.

Filter-based forwarding and policy: firewall filters with routing-instance actions steer traffic; routing policies match on prefix-list, community, or as-path and set local-preference or metric.

DHCP relay: set forwarding-options helpers bootp interface irb.10 server 10.1.1.1; the relay must have a route to the server and the server a route back to the subnet.

IPv6: family inet6 on IRB, neighbor discovery, and RA guard; dual-stack routing uses separate inet and inet6 RIBs; filter ICMPv6 carefully to keep ND working.

Bidirectional forwarding detection (BFD) accelerates OSPF/BGP failure detection: minimum-interval and multiplier tune detection time, typically 3x interval.

EVPN uses MP-BGP AFI 25 (L2VPN) with EVPN NLRI; route types: Type 2 MAC/IP, Type 3 inclusive multicast, Type 4 ethernet segment, Type 5 IP prefix.

VXLAN encapsulation: VTEPs are loopback addresses; VNI maps to a VLAN via vxlan vni under the vlan; the underlay carries only IP, so no STP is needed.

Type 2 routes advertise MAC and optionally IP; MAC mobility uses a sequence number to resolve duplicate MACs across VTEPs; sticky MACs pin a MAC to one VTEP.

Type 3 inclusive multicast routes build the ingress replication list for BUM traffic; PIM in the underlay or static replication is required for multicast transport.

EVPN multihoming: Ethernet segments (ESI) with all-active mode provide per-flow load sharing; designated forwarder election prevents duplicate BUM delivery.

Layer 3 EVPN: Type 5 IP-prefix routes or Type 2 with IP carry host routes; symmetric IRB uses L3 VNI and a shared router MAC for inter-VNI routing.

MAC-VRF and IP-VRF: instance-type evpn with vlan-id and vrf-target defines the Layer 2 domain; route-distinguisher must be unique per instance.

Pseudowires: l2circuit (Martini) or VPLS with a full mesh of labeled paths; BGP auto-discovery with LDP signaling is common for VPLS.

Troubleshooting EVPN: show evpn database, show route table bgp.evpn.0, and show ethernet-switching table confirm MAC learning across VTEPs.

CoS pipeline order: classification, policing, marking, queuing/scheduling, then rewrite; classification happens on ingress at the interface or code point.

Behavior aggregate (BA) classification maps DSCP/IP precedence or 802.1p to a forwarding class and loss priority via classifiers; multifield (MF) classification uses firewall filter match terms.

Forwarding classes default to best-effort, expedited-forwarding, assured-forwarding, and network-control; custom classes are defined with set class-of-service forwarding-classes.

Schedulers set transmit-rate, buffer-size, priority (low|strict-high), and drop profile; strict-high priority can starve other queues, so shape it with a rate limit.

Drop profiles: RED (random early detection) drops probabilistically as the queue fills; drop-profile-map assigns profiles per loss priority (low/high).

Rewrite rules mark egress CoS bits (DSCP or 802.1p) per forwarding class; without a rewrite rule, incoming markings pass unchanged.

Policing: a two-color policer with bandwidth-limit and burst-size-limit marks or drops; three-color (tricolor) marking uses committed and peak rates.

CoS on VLAN-tagged interfaces uses ieee-802.1 classifiers and rewrite rules; on routed interfaces use dscp or inet-precedence classifiers.

Congestion verification: show class-of-service interface, show class-of-service scheduler-map, and show interfaces queue display queue drops and transmit statistics.