JNCIE-SP cheat sheet

Junos configuration is hierarchical and commit-based: commit check validates syntax, commit confirmed <minutes> auto-rolls back unless confirmed with commit, protecting remote changes.

User classes (super-user, operator, read-only, unauthorized) map to permission bits; allow-configuration/deny-configuration regexes scope login classes to specific hierarchy paths.

set system syslog file <name> any info logs all facilities at info; facility/severity pairs are any, authorization, daemon, firewall, interactive-commands, kernel, pfe, user.

NTP: set system ntp server <ip> prefer, set system ntp authentication-key, and set system ntp trusted-key; verify with show ntp status and show ntp associations.

SNMPv3 requires set snmp v3 usm local-engine user <u> authentication-sha authentication-key plus vacm access and community/trap-group for traps; v2c uses set snmp community <name> authorization read-only.

Software upgrade: request system software add <pkg> no-validate reboot; dual-root partitioning uses request system snapshot to sync alternate root, and request system reboot media disk to boot it.

Interface config: set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.1/30; commit applies, but show interfaces terse confirms link state; mtu, speed, link-mode are physical-level.

Rescue configuration: request system configuration rescue save stores a known-good config; rollback rescue restores it, useful before risky commits.

show system uptime, show chassis alarms, and show chassis hardware verify platform health; show log messages is the primary syslog file for faults.

OSPF areas: area 0 is backbone; all non-backbone areas must connect to area 0 via virtual link (set protocols ospf area <n> virtual-link <rtr-id>) or ABR.

IS-IS levels: L1 intra-area, L2 inter-area/backbone; set protocols isis level 1 disable makes a pure L2 router; wide-metrics-only enables TE extensions.

Junos routing policy is a list of terms evaluated top-down; first match wins, and an implicit deny follows unless an accept term exists.

from match conditions include protocol, neighbor, route-filter <prefix> exact|longer|orlonger|upto, community, as-path, and prefix-list; then actions include accept, reject, next term, metric, local-preference, community add.

Redistribution: export <policy> under protocols ospf/isis controls what enters the IGP; import filters what is accepted from the protocol.

BGP-IGP interaction: set protocols bgp group <g> family inet unicast plus set routing-options router-id; IGP provides next-hop reachability, so next-hop-self on iBGP is required when the IGP does not carry the next hop.

Route filtering: route-filter 10.0.0.0/8 orlonger matches more-specifics; prefix-list is a reusable named list; policy-statement chains via next policy.

show route protocol ospf, show isis adjacency, and show route policy <name> verify IGP and policy behavior; test policy <name> <prefix> simulates policy evaluation.

iBGP requires a full mesh or route reflector/confederation; set protocols bgp group <g> type internal and local-address define the session; eBGP uses type external with peer-as.

Route reflection: set protocols bgp group <g> cluster <id>; the RR reflects client routes to other clients and non-clients, and no-client-reflect disables client-to-client reflection.

Confederations: set routing-options confederation <as> members <as-list>; external confederation peers use confederation in the group, and the AS path shows the confederation AS.

BGP attributes: local-preference (default 100, iBGP only), MED (default 0, compared across eBGP), AS-path (length is tiebreaker), next-hop, origin, community.

Best-path order: weight, local-preference, locally originated, AS-path length, origin, MED, eBGP over iBGP, IGP metric to next hop, router ID, cluster list length.

Scaling: set protocols bgp group <g> family inet unicast plus multipath enables ECMP; add-path advertises multiple paths; damping suppresses flapping routes with half-life, reuse, suppress, max-suppress.

Graceful restart: set protocols bgp graceful-restart and set routing-options graceful-restart; long-lived-graceful-restart extends the stale timer for control-plane restarts.

show bgp summary, show route advertising-protocol bgp <peer>, and show route receive-protocol bgp <peer> verify session state and advertised/received routes.

LDP: set protocols ldp interface <if> and set protocols ldp interface lo0.0; labels are advertised for IGP routes and the loopback; verify with show ldp neighbor and show ldp database.

RSVP-TE: set protocols rsvp interface <if> and set mpls lsp <name> to <ip> ...; LSPs signal with bandwidth, priority, setup-priority, hold-priority.

MPLS forwarding: show route table inet.3 holds the label-switched routes; show mpls lsp and show mpls lsp statistics verify LSP state and traffic.

Label stacking: an outer transport label (LDP/RSVP) pushes over an inner service label (VPN/VC); show route table mpls.0 shows the label operations (swap, pop, push).

Traffic engineering: set protocols mpls traffic-engineering bgp-igp (or bgp-igp-both-ribs) makes BGP next hops resolve over RSVP LSPs; set protocols mpls label-switched-path <n> primary <path>.

Constrained-path LSPs: set protocols mpls path <name> <hop> strict|loose; set protocols mpls label-switched-path <n> primary <path> standby <path> for protection.

show mpls interface, show rsvp session, and show mpls lsp detail verify interface, session, and LSP state; traceroute mpls ldp/traceroute mpls rsvp trace label paths.

VRF config: set routing-instances <vrf> instance-type vrf, route-distinguisher <rd>, vrf-target target:<as>:<n>, vrf-table-label, interface <if>, route-target export/import.

MP-BGP: set protocols bgp group <g> family inet-vpn unicast; PE routers exchange VPN-IPv4 routes with RD+prefix and extended communities (route targets).

Route targets: vrf-target sets both import and export; vrf-import/vrf-export policies allow selective leaking; vrf-target export target:... import target:... separates them.

VRF route leaking: set routing-instances <vrf> routing-options auto-export or vrf-import/vrf-export policies with from community and then accept.

Hub-and-spoke: hub VRF exports its RT, spokes import hub RT; spokes export a distinct RT the hub imports; hub uses next-hop-self or vrf-table-label.

Inter-AS options: Option A (back-to-back VRF subinterfaces), Option B (MP-eBGP between ASBRs with family inet-vpn), Option C (MP-eBGP between PEs with family inet labeled-unicast).

Carrier-of-carriers: set routing-instances <vrf> instance-type vrf with vrf-target and vrf-table-label; customer routes are carried as VPN routes, and the carrier does not import customer RTs.

show route table <vrf>.inet.0, show bgp summary, and show route table bgp.l3vpn.0 verify VRF routes and VPN NLRIs.

VPLS: set routing-instances <vpls> instance-type vpls, protocols vpls site <s> site-identifier <n>, interface <if>; vpls-id and route-distinguisher are required for BGP-signaled VPLS.

L2VPN: set routing-instances <l2vpn> instance-type l2vpn, protocols l2vpn site <s> site-identifier <n> interface <if>; encapsulation-type ethernet and control-word are optional.

EVPN-MPLS: set protocols evpn encapsulation mpls, set routing-instances <evpn> instance-type evpn, vlan-id, route-distinguisher, vrf-target, protocols evpn interface <if>.

EVPN-VXLAN: set protocols evpn encapsulation vxlan, set switch-options vtep-source-interface lo0.0, set routing-instances <evpn> vxlan vni <n>; VTEP is the loopback.

Multihoming: set protocols evpn multihoming encapsulation mpls, set interfaces <if> esi <id>; EVPN advertises Ethernet Segment routes and Designated Forwarder election.

MAC learning and mobility: set protocols evpn mac-learning, set protocols evpn mac-ip; MAC mobility uses the MAC Mobility extended community with a sequence number.

show evpn instance, show evpn mac-table, and show evpn database verify EVPN state, MAC entries, and designated forwarder status.

IGMP: set protocols igmp interface <if>; IGMPv3 supports SSM; show igmp group and show igmp interface verify membership.

PIM-SM: set protocols pim rp static address <ip>, set protocols pim interface <if> mode sparse; RP is required for shared tree; set protocols pim rp local address makes a router the RP.

PIM-SSM: set protocols pim rp static address <ip> plus set protocols pim ssm; SSM uses (S,G) with IGMPv3 and does not require an RP.

MSDP: set protocols msdp peer <ip> and set protocols msdp local-address <ip>; MSDP connects RPs across PIM domains and advertises active sources.

Multicast VPN: set routing-instances <mvpn> instance-type mvpn, protocols mvpn, provider-tunnel rsvp-te or ldp-p2mp; control plane uses PIM/MLDP.

mLDP: set protocols mldp interface <if>, set protocols mldp p2mp; set protocols rsvp p2mp for RSVP-TE P2MP; show mldp verifies tree state.

PIM over MPLS: set protocols pim interface <if> mode sparse and set protocols pim rp; PIM can run over MPLS LSPs when set protocols pim interface lo0.0 and set protocols pim rp are configured.

show pim neighbors, show pim join, show multicast route, and show msdp summary verify multicast state and source discovery.

BFD: set protocols bfd min-interval <ms>, multiplier <n>, and set protocols ospf/isis/bgp ... bfd-liveness-detection; BFD detects sub-second failures.

NSR/NSB: set routing-options nonstop-routing (NSR) and set protocols bgp graceful-restart; NSB is enabled per-protocol with set protocols ospf nonstop-routing for stateful switchover.

GRES: set chassis redundancy graceful-switchover; set routing-options graceful-restart; set protocols bgp graceful-restart; show system switchover verifies RE state.

CoS: set class-of-service classifiers, forwarding-classes, schedulers, scheduler-maps, and drop-profiles; set class-of-service interfaces <if> scheduler-map <name>.

Firewall filters: set firewall family inet filter <name> term <t> from <match> then <action>; actions include accept, discard, reject, count, policer, log.

show firewall, show firewall filter <name>, and show class-of-service interface <if> verify filter counters and CoS mapping.

Troubleshooting: show log messages, show interfaces <if> extensive, show route <prefix> detail, monitor traffic interface <if>, and show system alarms isolate faults.

Graceful restart for routing protocols: set routing-options graceful-restart and set protocols <proto> graceful-restart; helper mode is enabled by default on peers.

BFD timers: min-interval (default 1000 ms), min-receive-interval, multiplier (default 3); set protocols bfd applies globally and per-protocol overrides.

CoS hierarchy: classifier → forwarding class → scheduler → drop profile; set class-of-service classifiers inet-precedence <name> forwarding-classes maps DSCP/IP precedence.

Firewall filter match conditions: source-address, destination-address, protocol, destination-port, source-port, tcp-flags, dscp, icmp-type; then count <name> for counters.

show system switchover shows RE role and NSR state; show chassis routing-engine shows hardware state; show system core-dumps for crash analysis.

monitor traffic interface <if> matching <filter> captures packets; show log messages | match <pattern> filters syslog; show route <prefix> detail shows attributes.

request support information and show tech-support collect diagnostic data for TAC; show system uptime and show chassis alarms for platform health.

Junos commit model: commit check validates, commit applies, commit confirmed <min> auto-rolls back unless confirmed; rollback <n> restores prior config.

Login classes: set system login class <name> permissions <list>; allow-configuration/deny-configuration regexes scope hierarchy access.

Syslog: set system syslog file <name> <facility> <severity>; facilities include any, authorization, daemon, firewall, kernel, pfe, user.

NTP: set system ntp server <ip> prefer, set system ntp authentication-key <n> type md5 value <key>, set system ntp trusted-key <n>; verify with show ntp status.

SNMPv3: set snmp v3 usm local-engine user <u> authentication-sha authentication-key <key> plus set snmp v3 vacm access group <g> ...; v2c uses set snmp community <name> authorization read-only.

Software upgrade: request system software add <pkg> no-validate reboot; request system snapshot syncs alternate root; request system reboot media disk boots it.

Interface config: set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.1/30; show interfaces terse confirms link state; mtu, speed, link-mode are physical-level.

Rescue config: request system configuration rescue save and rollback rescue; useful before risky commits.

show system uptime, show chassis alarms, show chassis hardware, and show log messages verify platform health.

OSPF areas: area 0 is backbone; non-backbone areas connect via ABR or set protocols ospf area <n> virtual-link <rtr-id>.

IS-IS levels: L1 intra-area, L2 inter-area/backbone; set protocols isis level 1 disable makes a pure L2 router; wide-metrics-only enables TE extensions.

Junos policy: list of terms evaluated top-down; first match wins; implicit deny follows unless an accept term exists.

from matches: protocol, neighbor, route-filter <prefix> exact|longer|orlonger|upto, community, as-path, prefix-list; then actions: accept, reject, next term, metric, local-preference, community add.

Redistribution: export <policy> under protocols ospf/isis controls what enters the IGP; import filters what is accepted.

BGP-IGP interaction: IGP provides next-hop reachability; next-hop-self on iBGP is required when the IGP does not carry the next hop.

Route filtering: route-filter 10.0.0.0/8 orlonger matches more-specifics; prefix-list is a reusable named list; policy-statement chains via next policy.

show route protocol ospf, show isis adjacency, show route policy <name>, and test policy <name> <prefix> verify IGP and policy behavior.

iBGP requires full mesh or RR/confederation; set protocols bgp group <g> type internal and local-address define the session; eBGP uses type external with peer-as.

Route reflection: set protocols bgp group <g> cluster <id>; RR reflects client routes to other clients and non-clients; no-client-reflect disables client-to-client reflection.

Confederations: set routing-options confederation <as> members <as-list>; external confederation peers use confederation in the group.

BGP attributes: local-preference (default 100, iBGP only), MED (default 0, compared across eBGP), AS-path length, next-hop, origin, community.

Best-path order: weight, local-preference, locally originated, AS-path length, origin, MED, eBGP over iBGP, IGP metric to next hop, router ID, cluster list length.

Scaling: multipath enables ECMP; add-path advertises multiple paths; damping suppresses flapping routes with half-life, reuse, suppress, max-suppress.

Graceful restart: set protocols bgp graceful-restart and set routing-options graceful-restart; long-lived-graceful-restart extends the stale timer.

show bgp summary, show route advertising-protocol bgp <peer>, and show route receive-protocol bgp <peer> verify session state and advertised/received routes.

LDP: set protocols ldp interface <if> and set protocols ldp interface lo0.0; labels are advertised for IGP routes and the loopback; verify with show ldp neighbor and show ldp database.

RSVP-TE: set protocols rsvp interface <if> and set mpls lsp <name> to <ip>; LSPs signal with bandwidth, priority, setup-priority, hold-priority.

MPLS forwarding: show route table inet.3 holds label-switched routes; show mpls lsp and show mpls lsp statistics verify LSP state and traffic.

Label stacking: outer transport label (LDP/RSVP) over inner service label (VPN/VC); show route table mpls.0 shows label operations (swap, pop, push).

Traffic engineering: set protocols mpls traffic-engineering bgp-igp (or bgp-igp-both-ribs) makes BGP next hops resolve over RSVP LSPs; set protocols mpls label-switched-path <n> primary <path>.

Constrained-path LSPs: set protocols mpls path <name> <hop> strict|loose; set protocols mpls label-switched-path <n> primary <path> standby <path> for protection.

show mpls interface, show rsvp session, and show mpls lsp detail verify interface, session, and LSP state; traceroute mpls ldp/traceroute mpls rsvp trace label paths.

VRF config: set routing-instances <vrf> instance-type vrf, route-distinguisher <rd>, vrf-target target:<as>:<n>, vrf-table-label, interface <if>, route-target export/import.

MP-BGP: set protocols bgp group <g> family inet-vpn unicast; PE routers exchange VPN-IPv4 routes with RD+prefix and extended communities (route targets).

Route targets: vrf-target sets both import and export; vrf-import/vrf-export policies allow selective leaking; vrf-target export target:... import target:... separates them.

VRF route leaking: set routing-instances <vrf> routing-options auto-export or vrf-import/vrf-export policies with from community and then accept.

Hub-and-spoke: hub VRF exports its RT, spokes import hub RT; spokes export a distinct RT the hub imports; hub uses next-hop-self or vrf-table-label.

Inter-AS options: Option A (back-to-back VRF subinterfaces), Option B (MP-eBGP between ASBRs with family inet-vpn), Option C (MP-eBGP between PEs with family inet labeled-unicast).

Carrier-of-carriers: set routing-instances <vrf> instance-type vrf with vrf-target and vrf-table-label; customer routes are carried as VPN routes; the carrier does not import customer RTs.

show route table <vrf>.inet.0, show bgp summary, and show route table bgp.l3vpn.0 verify VRF routes and VPN NLRIs.

VPLS: set routing-instances <vpls> instance-type vpls, protocols vpls site <s> site-identifier <n>, interface <if>; vpls-id and route-distinguisher are required for BGP-signaled VPLS.

L2VPN: set routing-instances <l2vpn> instance-type l2vpn, protocols l2vpn site <s> site-identifier <n> interface <if>; encapsulation-type ethernet and control-word are optional.

EVPN-MPLS: set protocols evpn encapsulation mpls, set routing-instances <evpn> instance-type evpn, vlan-id, route-distinguisher, vrf-target, protocols evpn interface <if>.

EVPN-VXLAN: set protocols evpn encapsulation vxlan, set switch-options vtep-source-interface lo0.0, set routing-instances <evpn> vxlan vni <n>; VTEP is the loopback.

Multihoming: set protocols evpn multihoming encapsulation mpls, set interfaces <if> esi <id>; EVPN advertises Ethernet Segment routes and Designated Forwarder election.

MAC learning and mobility: set protocols evpn mac-learning, set protocols evpn mac-ip; MAC mobility uses the MAC Mobility extended community with a sequence number.

show evpn instance, show evpn mac-table, and show evpn database verify EVPN state, MAC entries, and designated forwarder status.

IGMP: set protocols igmp interface <if>; IGMPv3 supports SSM; show igmp group and show igmp interface verify membership.

PIM-SM: set protocols pim rp static address <ip>, set protocols pim interface <if> mode sparse; RP is required for shared tree; set protocols pim rp local address makes a router the RP.

PIM-SSM: set protocols pim rp static address <ip> plus set protocols pim ssm; SSM uses (S,G) with IGMPv3 and does not require an RP.

MSDP: set protocols msdp peer <ip> and set protocols msdp local-address <ip>; MSDP connects RPs across PIM domains and advertises active sources.

Multicast VPN: set routing-instances <mvpn> instance-type mvpn, protocols mvpn, provider-tunnel rsvp-te or ldp-p2mp; control plane uses PIM/MLDP.

mLDP: set protocols mldp interface <if>, set protocols mldp p2mp; set protocols rsvp p2mp for RSVP-TE P2MP; show mldp verifies tree state.

PIM over MPLS: set protocols pim interface <if> mode sparse and set protocols pim rp; PIM can run over MPLS LSPs when set protocols pim interface lo0.0 and set protocols pim rp are configured.

show pim neighbors, show pim join, show multicast route, and show msdp summary verify multicast state and source discovery.

BFD: set protocols bfd min-interval <ms>, multiplier <n>, and set protocols ospf/isis/bgp ... bfd-liveness-detection; BFD detects sub-second failures.

NSR/NSB: set routing-options nonstop-routing (NSR) and set protocols bgp graceful-restart; NSB is enabled per-protocol with set protocols ospf nonstop-routing for stateful switchover.

GRES: set chassis redundancy graceful-switchover; set routing-options graceful-restart; set protocols bgp graceful-restart; show system switchover verifies RE state.

CoS: set class-of-service classifiers, forwarding-classes, schedulers, scheduler-maps, and drop-profiles; set class-of-service interfaces <if> scheduler-map <name>.

Firewall filters: set firewall family inet filter <name> term <t> from <match> then <action>; actions include accept, discard, reject, count, policer, log.

show firewall, show firewall filter <name>, and show class-of-service interface <if> verify filter counters and CoS mapping.

Troubleshooting: show log messages, show interfaces <if> extensive, show route <prefix> detail, monitor traffic interface <if>, and show system alarms isolate faults.

Graceful restart for routing protocols: set routing-options graceful-restart and set protocols <proto> graceful-restart; helper mode is enabled by default on peers.

BFD timers: min-interval (default 1000 ms), min-receive-interval, multiplier (default 3); set protocols bfd applies globally and per-protocol overrides.

CoS hierarchy: classifier → forwarding class → scheduler → drop profile; set class-of-service classifiers inet-precedence <name> forwarding-classes maps DSCP/IP precedence.

Firewall filter match conditions: source-address, destination-address, protocol, destination-port, source-port, tcp-flags, dscp, icmp-type; then count <name> for counters.

show system switchover shows RE role and NSR state; show chassis routing-engine shows hardware state; show system core-dumps for crash analysis.

monitor traffic interface <if> matching <filter> captures packets; show log messages | match <pattern> filters syslog; show route <prefix> detail shows attributes.

request support information and show tech-support collect diagnostic data for TAC; show system uptime and show chassis alarms for platform health.

Junos commit model: commit check validates, commit applies, commit confirmed <min> auto-rolls back unless confirmed; rollback <n> restores prior config.

Login classes: set system login class <name> permissions <list>; allow-configuration/deny-configuration regexes scope hierarchy access.

Syslog: set system syslog file <name> <facility> <severity>; facilities include any, authorization, daemon, firewall, kernel, pfe, user.

NTP: set system ntp server <ip> prefer, set system ntp authentication-key <n> type md5 value <key>, set system ntp trusted-key <n>; verify with show ntp status.

SNMPv3: set snmp v3 usm local-engine user <u> authentication-sha authentication-key <key> plus set snmp v3 vacm access group <g> ...; v2c uses set snmp community <name> authorization read-only.

Software upgrade: request system software add <pkg> no-validate reboot; request system snapshot syncs alternate root; request system reboot media disk boots it.

Interface config: set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.1/30; show interfaces terse confirms link state; mtu, speed, link-mode are physical-level.

Rescue config: request system configuration rescue save and rollback rescue; useful before risky commits.

show system uptime, show chassis alarms, show chassis hardware, and show log messages verify platform health.

OSPF areas: area 0 is backbone; non-backbone areas connect via ABR or set protocols ospf area <n> virtual-link <rtr-id>.

IS-IS levels: L1 intra-area, L2 inter-area/backbone; set protocols isis level 1 disable makes a pure L2 router; wide-metrics-only enables TE extensions.

Junos policy: list of terms evaluated top-down; first match wins; implicit deny follows unless an accept term exists.

from matches: protocol, neighbor, route-filter <prefix> exact|longer|orlonger|upto, community, as-path, prefix-list; then actions: accept, reject, next term, metric, local-preference, community add.

Redistribution: export <policy> under protocols ospf/isis controls what enters the IGP; import filters what is accepted.

BGP-IGP interaction: IGP provides next-hop reachability; next-hop-self on iBGP is required when the IGP does not carry the next hop.

Route filtering: route-filter 10.0.0.0/8 orlonger matches more-specifics; prefix-list is a reusable named list; policy-statement chains via next policy.

show route protocol ospf, show isis adjacency, show route policy <name>, and test policy <name> <prefix> verify IGP and policy behavior.

iBGP requires full mesh or RR/confederation; set protocols bgp group <g> type internal and local-address define the session; eBGP uses type external with peer-as.

Route reflection: set protocols bgp group <g> cluster <id>; RR reflects client routes to other clients and non-clients; no-client-reflect disables client-to-client reflection.

Confederations: set routing-options confederation <as> members <as-list>; external confederation peers use confederation in the group.

BGP attributes: local-preference (default 100, iBGP only), MED (default 0, compared across eBGP), AS-path length, next-hop, origin, community.

Best-path order: weight, local-preference, locally originated, AS-path length, origin, MED, eBGP over iBGP, IGP metric to next hop, router ID, cluster list length.

Scaling: multipath enables ECMP; add-path advertises multiple paths; damping suppresses flapping routes with half-life, reuse, suppress, max-suppress.

Graceful restart: set protocols bgp graceful-restart and set routing-options graceful-restart; long-lived-graceful-restart extends the stale timer.

show bgp summary, show route advertising-protocol bgp <peer>, and show route receive-protocol bgp <peer> verify session state and advertised/received routes.

LDP: set protocols ldp interface <if> and set protocols ldp interface lo0.0; labels are advertised for IGP routes and the loopback; verify with show ldp neighbor and show ldp database.

RSVP-TE: set protocols rsvp interface <if> and set mpls lsp <name> to <ip>; LSPs signal with bandwidth, priority, setup-priority, hold-priority.

MPLS forwarding: show route table inet.3 holds label-switched routes; show mpls lsp and show mpls lsp statistics verify LSP state and traffic.

Label stacking: outer transport label (LDP/RSVP) over inner service label (VPN/VC); show route table mpls.0 shows label operations (swap, pop, push).

Traffic engineering: set protocols mpls traffic-engineering bgp-igp (or bgp-igp-both-ribs) makes BGP next hops resolve over RSVP LSPs; set protocols mpls label-switched-path <n> primary <path>.

Constrained-path LSPs: set protocols mpls path <name> <hop> strict|loose; set protocols mpls label-switched-path <n> primary <path> standby <path> for protection.

show mpls interface, show rsvp session, and show mpls lsp detail verify interface, session, and LSP state; traceroute mpls ldp/traceroute mpls rsvp trace label paths.

VRF config: set routing-instances <vrf> instance-type vrf, route-distinguisher <rd>, vrf-target target:<as>:<n>, vrf-table-label, interface <if>, route-target export/import.

MP-BGP: set protocols bgp group <g> family inet-vpn unicast; PE routers exchange VPN-IPv4 routes with RD+prefix and extended communities (route targets).

Route targets: vrf-target sets both import and export; vrf-import/vrf-export policies allow selective leaking; vrf-target export target:... import target:... separates them.

VRF route leaking: set routing-instances <vrf> routing-options auto-export or vrf-import/vrf-export policies with from community and then accept.

Hub-and-spoke: hub VRF exports its RT, spokes import hub RT; spokes export a distinct RT the hub imports; hub uses next-hop-self or vrf-table-label.

Inter-AS options: Option A (back-to-back VRF subinterfaces), Option B (MP-eBGP between ASBRs with family inet-vpn), Option C (MP-eBGP between PEs with family inet labeled-unicast).

Carrier-of-carriers: set routing-instances <vrf> instance-type vrf with vrf-target and vrf-table-label; customer routes are carried as VPN routes; the carrier does not import customer RTs.

show route table <vrf>.inet.0, show bgp summary, and show route table bgp.l3vpn.0 verify VRF routes and VPN NLRIs.

VPLS: set routing-instances <vpls> instance-type vpls, protocols vpls site <s> site-identifier <n>, interface <if>; vpls-id and route-distinguisher are required for BGP-signaled VPLS.

L2VPN: set routing-instances <l2vpn> instance-type l2vpn, protocols l2vpn site <s> site-identifier <n> interface <if>; encapsulation-type ethernet and control-word are optional.

EVPN-MPLS: set protocols evpn encapsulation mpls, set routing-instances <evpn> instance-type evpn, vlan-id, route-distinguisher, vrf-target, protocols evpn interface <if>.

EVPN-VXLAN: set protocols evpn encapsulation vxlan, set switch-options vtep-source-interface lo0.0, set routing-instances <evpn> vxlan vni <n>; VTEP is the loopback.

Multihoming: set protocols evpn multihoming encapsulation mpls, set interfaces <if> esi <id>; EVPN advertises Ethernet Segment routes and Designated Forwarder election.

MAC learning and mobility: set protocols evpn mac-learning, set protocols evpn mac-ip; MAC mobility uses the MAC Mobility extended community with a sequence number.

show evpn instance, show evpn mac-table, and show evpn database verify EVPN state, MAC entries, and designated forwarder status.

IGMP: set protocols igmp interface <if>; IGMPv3 supports SSM; show igmp group and show igmp interface verify membership.

PIM-SM: set protocols pim rp static address <ip>, set protocols pim interface <if> mode sparse; RP is required for shared tree; set protocols pim rp local address makes a router the RP.

PIM-SSM: set protocols pim rp static address <ip> plus set protocols pim ssm; SSM uses (S,G) with IGMPv3 and does not require an RP.

MSDP: set protocols msdp peer <ip> and set protocols msdp local-address <ip>; MSDP connects RPs across PIM domains and advertises active sources.

Multicast VPN: set routing-instances <mvpn> instance-type mvpn, protocols mvpn, provider-tunnel rsvp-te or ldp-p2mp; control plane uses PIM/MLDP.

mLDP: set protocols mldp interface <if>, set protocols mldp p2mp; set protocols rsvp p2mp for RSVP-TE P2MP; show mldp verifies tree state.

PIM over MPLS: set protocols pim interface <if> mode sparse and set protocols pim rp; PIM can run over MPLS LSPs when set protocols pim interface lo0.0 and set protocols pim rp are configured.

show pim neighbors, show pim join, show multicast route, and show msdp summary verify multicast state and source discovery.

BFD: set protocols bfd min-interval <ms>, multiplier <n>, and set protocols ospf/isis/bgp ... bfd-liveness-detection; BFD detects sub-second failures.

NSR/NSB: set routing-options nonstop-routing (NSR) and set protocols bgp graceful-restart; NSB is enabled per-protocol with set protocols ospf nonstop-routing for stateful switchover.

GRES: set chassis redundancy graceful-switchover; set routing-options graceful-restart; set protocols bgp graceful-restart; show system switchover verifies RE state.

CoS: set class-of-service classifiers, forwarding-classes, schedulers, scheduler-maps, and drop-profiles; set class-of-service interfaces <if> scheduler-map <name>.

Firewall filters: set firewall family inet filter <name> term <t> from <match> then <action>; actions include accept, discard, reject, count, policer, log.

show firewall, show firewall filter <name>, and show class-of-service interface <if> verify filter counters and CoS mapping.

Troubleshooting: show log messages, show interfaces <if> extensive, show route <prefix> detail, monitor traffic interface <if>, and show system alarms isolate faults.

Graceful restart for routing protocols: set routing-options graceful-restart and set protocols <proto> graceful-restart; helper mode is enabled by default on peers.

BFD timers: min-interval (default 1000 ms), min-receive-interval, multiplier (default 3); set protocols bfd applies globally and per-protocol overrides.

CoS hierarchy: classifier → forwarding class → scheduler → drop profile; set class-of-service classifiers inet-precedence <name> forwarding-classes maps DSCP/IP precedence.

Firewall filter match conditions: source-address, destination-address, protocol, destination-port, source-port, tcp-flags, dscp, icmp-type; then count <name> for counters.

show system switchover shows RE role and NSR state; show chassis routing-engine shows hardware state; show system core-dumps for crash analysis.

monitor traffic interface <if> matching <filter> captures packets; show log messages | match <pattern> filters syslog; show route <prefix> detail shows attributes.

request support information and show tech-support collect diagnostic data for TAC; show system uptime and show chassis alarms for platform health.