I85PREP
⌘ K
JNCIE-ENT study materials
JNCIE-ENT study resources

JNCIE-ENT: Layer 2 Switching and Features

JNCIE-ENT · Work through your exam, one topic at a time.

All guide sections

Layer 2 Switching and Features

This domain covers Junos Ethernet switching: VLAN membership, trunking, spanning tree, link aggregation, loop protection, and Layer 2 security. The exam tests whether you can keep a switched topology stable while adding services and multi-vendor attachments.

Core rules

  • ELS interfaces use family ethernet-switching with interface-mode access or trunk; VLANs are referenced by name or ID. A trunk carries tagged VLANs and optionally one native-vlan-id untagged VLAN.
  • RSTP/MSTP provide loop prevention. edge marks host ports; bpdu-guard err-disables an edge port that receives BPDUs; root-guard prevents a downstream switch from becoming root; loop-protect blocks a looped access port.
  • MSTP regions require identical configuration-name, revision-level, and VLAN-to-MSTI mapping. A mismatch creates a separate region and can produce unexpected blocking.
  • LAG uses 802.3ad with LACP active or passive; at least one side must be active. periodic fast detects failure faster, and link-protection keeps a minimum link.
  • Q-in-Q uses dot1q-tunneling, customer-vlans, and the provider ether-type; DHCP snooping and dynamic ARP inspection bind client MAC/IP assignments to trusted ports.

Worked example

To make a switch the root for MSTI 1 (VLANs 10-20): set protocols mstp configuration-name ENT set protocols mstp revision-level 1 set protocols mstp msti 1 vlan 10-20 set protocols mstp msti 1 bridge-priority 4096 set protocols mstp interface ge-0/0/1 edge set protocols mstp interface ge-0/0/1 bpdu-guard The low priority wins the root election; the edge/bpdu-guard pair protects host-facing ports. All region members need the same name, revision, and mapping.

Traps

Mismatched native VLANs cause untagged traffic to land in the wrong VLAN. Two passive LACP peers never form a bundle. Enabling edge on a switch-to-switch link bypasses BPDU protection expectations. MSTP mapping differences are easy to miss because the region still appears to run.