Layer 3 Switching and Features
This domain tests routed services on a switch: IRB interfaces, first-hop redundancy, dynamic routing, filtering, and fast failure detection. The focus is on correct forwarding and predictable failover, not just bringing up an adjacency.
Core rules
- An IRB interface provides Layer 3 service for a VLAN:
set interfaces irb unit 10 family inet address 10.0.10.2/24andset vlans v10 l3-interface irb.10. The VLAN must exist before the IRB is useful. - VRRP shares a virtual IP and virtual MAC. Priority decides master; tracking lowers priority when an uplink fails. The virtual address must be in the same subnet as the physical interface address and must not duplicate it.
- OSPF, IS-IS, and BGP run over IRB or routed ports. Use BFD for sub-second failure detection and a policy for ECMP load balancing when multiple equal paths exist.
- Firewall filters enforce stateless policy; remember that they are applied in the forwarding path and need both directions where appropriate.
- DHCP relay needs a reachable server and the correct
server-groupor helper address on the client-facing IRB.
Worked example
A VRRP group uses physical address 10.0.10.2/24, virtual 10.0.10.1, priority 200, and tracks ge-0/0/1 with cost 60. If the uplink fails, priority becomes 140. A backup at 100 still loses, so this router stays master. To force failover, set the cost above 100 (for example 120), producing priority 80. Verify with show vrrp that the intended router is master and that the virtual MAC is installed.
Traps
Putting the virtual IP on the wrong subnet, reusing the physical address as the virtual address, or mismatching VRRP group IDs breaks election. Tracking without enough priority cost does not fail over. A filter that blocks VRRP protocol 112 breaks mastership. BFD timers must be supported by both neighbors.