I85PREP
⌘ K
JNCIE-SP study materials
JNCIE-SP study resources

JNCIE-SP: High Availability, Security, and Troubleshooting

JNCIE-SP · Work through your exam, one topic at a time.

All guide sections

High Availability, Security, and Troubleshooting

What this domain tests

This domain covers fast failure detection with BFD, Routing Engine redundancy (GRES/NSR), class of service, firewall filters, and structured troubleshooting. Expect questions on timer negotiation, filter default actions, and verification commands.

Core rules

  • BFD is configured per protocol: set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 bfd-liveness-detection minimum-interval 300 multiplier 3. Detection time is approximately interval times multiplier; both ends negotiate.
  • NSR (set routing-options nonstop-routing) keeps routing protocols running through an RE switchover. GRES (set chassis redundancy graceful-switchover) restarts the new RE's protocols while helpers preserve forwarding.
  • CoS uses classifiers to assign forwarding classes, rewrite rules to mark egress, schedulers for bandwidth, and drop profiles for congestion. Apply a scheduler map to the interface.
  • Firewall filters match source-address, destination-port, protocol, dscp, and more; actions include accept, discard, count, log, and policer. The implicit default is discard if no term matches.
  • Apply a filter to the loopback to protect the RE: set interfaces lo0 unit 0 family inet filter input PROTECT.
  • Troubleshooting: show log messages, show interfaces extensive, monitor traffic interface, traceoptions, show route hidden, ping mpls, and traceroute mpls.

Worked example

Protect the RE while allowing SSH only from 192.0.2.0/24:

set firewall family inet filter PROTECT term SSH from source-address 192.0.2.0/24
set firewall family inet filter PROTECT term SSH from protocol tcp
set firewall family inet filter PROTECT term SSH from destination-port ssh
set firewall family inet filter PROTECT term SSH then accept
set firewall family inet filter PROTECT term DENY then discard
set interfaces lo0 unit 0 family inet filter input PROTECT

Reasoning: the SSH term matches all three conditions, and then accept stops evaluation. The explicit DENY term is documentation and makes the implicit discard visible. Without the final discard, unmatched traffic is still dropped by the filter's default action.

Traps

  • BFD timers must be supported by both peers; aggressive values can flap an adjacency.
  • NSR and GR are not the same; GR requires helper support, NSR does not.
  • A filter applied to lo0 without a direction does nothing.
  • then accept ends filter processing; a later term cannot override it.