JNCIP-DC cheat sheet

Collapsed core (spine-leaf) topologies scale horizontally: each leaf uplinks to every spine, giving an equal-cost path count equal to the number of spines; oversubscription = (leaf downlink bandwidth) / (leaf uplink bandwidth).

Junos EVPN-VXLAN reference designs: single POD (small), edge-routed bridging (ERB) multi-POD, and centrally routed bridging (CRB); ERB places the L3 gateway on the leaf, CRB places it on the spine.

Underlay MTU must accommodate outer IP (20) + UDP (8) + VXLAN (8) + inner Ethernet header (14) + original payload; a 9000-byte underlay MTU supports inner frames up to ~8950 bytes.

MC-LAG (multichassis LAG) requires an ICCP connection over an ICL link plus a management link for control traffic; only one peer is active for a given LAG.

ESI-LAG replaces MC-LAG in EVPN fabrics: a shared Ethernet Segment Identifier is configured identically on both leaves, and DF election chooses the designated forwarder per ESI.

QFX5100/QFX5120/QFX10000 series support Virtual Chassis Fabric; QFX5120 and QFX5220 support EVPN-VXLAN leaf/spine roles; confirm platform feature support before design sign-off.

Junos Fusion Enterprise/Provider Edge uses satellite devices managed by a single aggregation device; satellite ports are configured as extended ports in the aggregation device's configuration.

Fabric capacity planning: leaf-to-spine uplinks should be sized for peak east-west traffic plus overlay overhead; a 3:1 oversubscription ratio means 3 Gbps of downlink capacity per 1 Gbps of uplink.

VLAN ID range 1-4094; VLAN 0 and 4095 are reserved. On QFX, VLANs are configured under the bridge-domains or vlans stanza depending on ELS vs non-ELS syntax.

VXLAN VNI is 24 bits (up to 16,777,215); the 802.1Q VLAN tag is 12 bits (4094 usable). VNI-to-VLAN mapping is configured per bridge domain.

EVPN route types: Type 1 (Ethernet Auto-Discovery), Type 2 (MAC/IP Advertisement), Type 3 (Inclusive Multicast), Type 4 (Ethernet Segment), Type 5 (IP Prefix).

Anycast gateway uses the same MAC and IP on every leaf VTEP for a given IRB; configure the same virtual-gateway-address and virtual-gateway-v4-mac on all leaves.

Storm control thresholds on Junos are configured as a percentage of link bandwidth or in packets/bytes per second; broadcast, multicast, and unknown-unicast are controlled separately.

LLDP is enabled per interface with 'set protocols lldp interface all'; LLDP-MED extends it for voice; LLDP is the discovery basis for Junos Fusion and some automation tools.

LACP LAG requires matching speed, duplex, and MTU on member links; configure 'lacp active' on at least one side; LACP system priority and port priority determine which links are selected.

Spanning tree: RSTP (802.1w) converges faster than STP (802.1D); MSTP (802.1s) maps VLANs to instances. In EVPN fabrics, STP is typically unnecessary on the overlay.

EVPN Type 2 routes carry MAC and optionally IP; Type 5 routes carry IP prefixes for inter-subnet routing without an IRB on every leaf.

BGP EVPN uses MP-BGP with address family evpn signaling; the underlay typically runs eBGP or OSPF, and the overlay runs iBGP with route reflectors or eBGP between leaves and spines.

VXLAN VTEP source is the loopback address; ensure loopbacks are reachable via the underlay IGP/BGP and that the VTEP address is configured under 'set switch-options vtep-source-interface lo0.0'.

Anycast gateway ARP/ND suppression reduces flooding: 'set protocols evpn arp-suppression' and 'nd-suppression' on the IRB.

DF election for multihoming uses the ESI and a modulo-based algorithm; the DF forwards broadcast, unknown unicast, and multicast for the segment.

Route distinguisher (RD) makes routes unique per VTEP; route target (RT) controls import/export; both are 64-bit values typically formatted as ASN:number.

Underlay BGP design: eBGP between leaf and spine with unique ASNs per device; use 'set protocols bgp group underlay type external peer-as' and advertise loopbacks via a network statement or export policy.

MAC mobility: EVPN detects a MAC moving between VTEPs via sequence numbers in Type 2 routes; a higher sequence number wins, preventing duplicate MAC entries.

Junos firewall filters are stateless; stateful inspection requires a security device or services offload. Filters are applied with 'set interfaces xe-0/0/0 unit 0 family ethernet-switching filter input '.

Filter match conditions include source/destination address, port, protocol, DSCP, and interface; actions include accept, discard, reject, count, log, policer, and next term.

Policers enforce bandwidth limits in bits per second with burst size in bytes; configure as a two-color or three-color policer and reference it from a filter action.

Control-plane protection: apply a loopback filter to protect against DoS; use 'set interfaces lo0 unit 0 family inet filter input protect-re'.

DHCP snooping and dynamic ARP inspection prevent rogue DHCP servers and ARP spoofing; trusted ports are configured explicitly and untrusted ports are filtered.

MACsec (802.1AE) provides hop-by-hop encryption on supported QFX interfaces; configure with 'set security macsec connectivity-association' and apply to the interface.

Port security limits the number of MAC addresses learned per interface; violations can shut down the port or drop traffic.

ZTP (Zero Touch Provisioning) security: use signed images and configuration, and restrict DHCP options to trusted servers; ZTP can be disabled with 'set system ztp' controls.

Junos PyEZ uses the Junos Device class to connect over NETCONF (port 830) or Telnet/SSH; load configuration with Config() and commit via commit_check() then commit().

NETCONF over SSH is the standard programmatic interface; enable with 'set system services netconf ssh'. REST API is enabled with 'set system services rest http' or 'https'.

Junos YANG modules are available for configuration and operational state; 'show system schema' lists supported models; use 'yang' CLI mode to view structure.

Junos commit scripts, event scripts, and op scripts extend automation; commit scripts run during commit and can enforce configuration policy.

SaltStack and Ansible are common orchestration tools for Junos; Ansible uses the junos modules with connection: netconf or network_cli.

NAPALM and Junos PyEZ are libraries; Terraform providers exist for Junos but are less mature than CLI-based automation.

Configuration groups and apply-groups reduce duplication; interface-range simplifies repeated interface configuration.

ZTP workflow: DHCP provides the image and config URL, the device downloads and installs the image, then loads the configuration; the DHCP server must serve option 43 or vendor-specific options.

'show ethernet-switching table' displays MAC learning; 'show evpn mac-table' displays EVPN MAC entries; 'show evpn arp-table' shows ARP suppression entries.

'show route table bgp.evpn.0' displays EVPN routes; filter by route type using 'show route table bgp.evpn.0 match-prefix 2:*' for Type 2.

'show interfaces extensive' includes error counters, queue statistics, and MAC statistics; watch for CRC, alignment, and FCS errors indicating cabling or optics issues.

'show chassis alarms' and 'show system alarms' list hardware and software alarms; 'show log messages' contains syslog entries for troubleshooting.

Packet capture: 'monitor traffic interface xe-0/0/0' on the CLI; 'set forwarding-options port-mirroring' configures port mirroring to a destination port.

'traceroute' and 'ping' with 'no-frag' and varying sizes test MTU paths; VXLAN issues often stem from underlay MTU mismatches.

'show bgp summary' and 'show bgp neighbor' verify BGP session state; 'show ospf neighbor' verifies OSPF adjacency; 'show lldp neighbors' verifies physical topology.

'request support information' collects a comprehensive diagnostic bundle; 'show system core-dumps' lists crash files for support cases.

Junos device family roles: QFX5100/QFX5120 as leaf, QFX10000/QFX5220 as spine; EX series can serve as collapsed core in smaller designs.

Virtual Chassis (VC) and Virtual Chassis Fabric (VCF) provide a single management plane; VC uses a ring topology, VCF uses a spine-leaf internal topology.

Fabric deployment order: configure underlay (loopbacks, IGP/BGP), then overlay (EVPN, VXLAN, VTEP), then services (anycast gateway, ARP suppression).

Junos upgrade path: use 'request system software add' with the appropriate package; validate with 'request system snapshot' before upgrade.

High availability: graceful Routing Engine switchover (GRES), nonstop active routing (NSR), and nonstop bridging (NSB) reduce downtime; configure 'set chassis redundancy graceful-switchover'.

Power and cooling: QFX5100 uses front-to-back or back-to-front airflow; match PSU and fan direction to the rack airflow design.

Licensing: some features require advanced licenses; verify with 'show system license' before enabling EVPN or other advanced features.

Cabling: use DAC for short runs, AOC for medium, and fiber for long; verify optics compatibility with 'show chassis hardware' and 'show interfaces diagnostics optics'.

Junos ELS (Enhanced Layer 2 Software) syntax uses 'set interfaces xe-0/0/0 unit 0 family ethernet-switching interface-mode trunk vlan members'; non-ELS uses 'set interfaces xe-0/0/0 unit 0 family ethernet-switching port-mode trunk vlan members'.

IRB interface configuration: 'set interfaces irb unit 10 family inet address 10.0.10.1/24' and associate with a VLAN via 'set vlans v10 l3-interface irb.10'.

VXLAN encapsulation: outer UDP destination port 4789; the VTEP performs encapsulation and decapsulation.

Multicast underlay for VXLAN uses PIM; alternatively use ingress replication (head-end replication) configured with 'set protocols evpn multicast-mode ingress-replication'.

Q-in-Q tunneling uses S-VLAN and C-VLAN; configure with 'set interfaces xe-0/0/0 unit 0 family ethernet-switching vlan members svlan' and 'set vlans svlan vlan-id 100'.

Storm control: 'set interfaces xe-0/0/0 unit 0 family ethernet-switching storm-control '; profiles define bandwidth percentage.

MAC aging: default 300 seconds; configure with 'set protocols l2-learning global-mac-table-aging-time '.

Link aggregation: 'set interfaces ae0 aggregated-ether-options lacp active' and add member links with 'set interfaces xe-0/0/0 ether-options 802.3ad ae0'.

BGP route reflection: configure 'set protocols bgp group overlay type internal local-address lo0.0 cluster '; spines act as route reflectors for leaf-originated EVPN routes.

EVPN Type 3 (Inclusive Multicast) routes advertise the VTEP's multicast group or ingress-replication capability per VNI; required for BUM traffic delivery.

Anycast gateway configuration: 'set interfaces irb unit 10 family inet address 10.0.10.1/24 virtual-gateway-address 10.0.10.1' and 'set interfaces irb unit 10 virtual-gateway-v4-mac 00:00:5e:00:01:01'.

Route target assignment: typically one RT per VNI; import and export policies must match between VTEPs for the same VNI.

Underlay OSPF: 'set protocols ospf area 0.0.0.0 interface lo0.0 passive' and 'set protocols ospf area 0.0.0.0 interface xe-0/0/0.0'; use point-to-point links where possible.

BGP policy: use 'set policy-options policy-statement term from route-filter exact' to control advertised prefixes; apply with 'set protocols bgp group export '.

EVPN multihoming: configure 'set interfaces ae0 esi 00:11:22:33:44:55:66:77:88:99' and 'set interfaces ae0 esi all-active' for active-active multihoming.

MAC-VRF and IP-VRF: MAC-VRF corresponds to a bridge domain (VLAN); IP-VRF corresponds to a routing instance for inter-subnet routing.

Junos firewall filter evaluation is top-down; the first matching term is applied; an implicit deny exists at the end of the filter if no term matches.

Policer configuration: 'set firewall policer if-exceeding bandwidth-limit 100m burst-size-limit 10k' and 'set firewall policer then discard'.

Apply a filter to the loopback: 'set interfaces lo0 unit 0 family inet filter input '; this protects the control plane.

DHCP snooping: 'set protocols dhcp snooping vlan ' and 'set protocols dhcp snooping trusted-port ' for trusted uplinks.

Dynamic ARP inspection: 'set protocols arp inspection vlan ' and configure trusted interfaces; DAI validates ARP packets against the DHCP snooping table.

MACsec: configure a connectivity association with 'set security macsec connectivity-association ', set the CAK and cipher suite, and apply to the interface with 'set security macsec interfaces xe-0/0/0 connectivity-association '.

Port security: 'set interfaces xe-0/0/0 unit 0 family ethernet-switching interface-mode access' and 'set protocols l2-learning interface-mac-limit' to limit MACs.

ZTP: configure 'set system commit synchronize' and signed configuration; disable ZTP with 'set chassis auto-image-upgrade' controls or by setting a non-ZTP DHCP option.

Junos PyEZ example: 'from jnpr.junos import Device; dev = Device(host="x", user="u", password="p"); dev.open(); dev.cli("show version")'.

NETCONF operations: , , , , ; use candidate datastore for atomic changes.

Junos REST API: enable with 'set system services rest http port 8080'; use HTTP GET/POST with Accept: application/json headers.

Junos YANG: 'show system schema module ' displays the module; 'show system schema module output-directory ' exports it.

Ansible Junos modules: junos_command, junos_config, junos_facts; connection: netconf requires NETCONF enabled.

SaltStack: junos proxy minion connects via NETCONF; state files use the junos execution module.

Commit scripts: 'set system commit scripts .slax' enables a commit script; scripts can generate warnings or errors via xnm:warning and xnm:error.

Event scripts: 'set event-options policy events then execute-commands' runs commands on events; useful for automated remediation.

'show evpn instance' displays EVPN instance state, VTEPs, and route targets; 'show evpn database' lists MAC/IP entries per EVPN instance.

'show route table bgp.evpn.0 detail' shows route details including RD, RT, and next-hop; verify Type 2 and Type 5 routes.

'show interfaces xe-0/0/0 statistics' shows input/output packet and error counts; 'show interfaces diagnostics optics' shows optical power levels.

'show chassis routing-engine' shows CPU and memory utilization; 'show system processes extensive' shows per-process resource usage.

'show log messages | match ' filters syslog; 'show log ' displays a specific log file.

Port mirroring: 'set forwarding-options port-mirroring input rate 1' and 'set forwarding-options port-mirroring input run-length 0' then 'set forwarding-options port-mirroring input destination-interface xe-0/0/1'.

MTU testing: 'ping size do-not-fragment' to verify path MTU; VXLAN requires underlay MTU of at least 1600 bytes, typically 9000.

'show ethernet-switching interface' shows per-interface VLAN and MAC learning state; 'show ethernet-switching table detail' shows MAC details.

Junos device models for DC: QFX5100 (leaf/spine, 10/40G), QFX5120 (leaf, 25/100G), QFX5220 (spine, 100/400G), QFX10000 (spine, 100G).

Virtual Chassis: 'set virtual-chassis member role routing-engine' and 'set virtual-chassis member serial-number '; VC uses a ring topology with up to 10 members.

VCF: 'set virtual-chassis member role routing-engine' and 'set virtual-chassis member role line-card' plus 'set virtual-chassis member role fpc' for spine roles.

GRES: 'set chassis redundancy graceful-switchover'; NSR: 'set routing-options nonstop-routing'; NSB: 'set protocols layer2-control nonstop-bridging'.

ZTP: 'set system autoinstallation' controls; DHCP option 43 provides the image and config URL.

Power: QFX5100 PSUs are hot-swappable; verify airflow direction with 'show chassis environment' and 'show chassis hardware'.

Licensing: 'show system license' displays installed licenses; EVPN requires an advanced license on some platforms.

Cabling: 'show interfaces diagnostics optics' displays Tx/Rx power; 'show chassis hardware' displays transceiver part numbers.

VLAN configuration (ELS): 'set vlans v10 vlan-id 10'; 'set interfaces xe-0/0/0 unit 0 family ethernet-switching interface-mode access vlan members v10'.

Trunk configuration (ELS): 'set interfaces xe-0/0/0 unit 0 family ethernet-switching interface-mode trunk vlan members [v10 v20]'.

IRB: 'set interfaces irb unit 10 family inet address 10.0.10.1/24'; 'set vlans v10 l3-interface irb.10'.

VXLAN: 'set switch-options vtep-source-interface lo0.0'; 'set switch-options vxlan-vni vlan '.

EVPN: 'set protocols evpn encapsulation vxlan'; 'set protocols evpn extended-vni-list all'.

Storm control profile: 'set forwarding-options storm-control-profiles all bandwidth-percentage 5'.

MAC aging: 'set protocols l2-learning global-mac-table-aging-time 300'.

LAG: 'set interfaces ae0 aggregated-ether-options lacp active'; 'set interfaces xe-0/0/0 ether-options 802.3ad ae0'.

BGP EVPN: 'set protocols bgp group overlay type internal local-address lo0.0'; 'set protocols bgp group overlay family evpn signaling'; 'set protocols bgp group overlay neighbor '.

Route reflector: 'set protocols bgp group overlay cluster '; spines reflect EVPN routes between leaves.

EVPN Type 2: 'show route table bgp.evpn.0 match-prefix 2:*' displays MAC/IP routes.

EVPN Type 5: 'show route table bgp.evpn.0 match-prefix 5:*' displays IP prefix routes.

Anycast gateway: 'set interfaces irb unit 10 family inet address 10.0.10.1/24 virtual-gateway-address 10.0.10.1'; 'set interfaces irb unit 10 virtual-gateway-v4-mac 00:00:5e:00:01:01'.

ARP suppression: 'set protocols evpn arp-suppression'; 'set protocols evpn nd-suppression'.

ESI: 'set interfaces ae0 esi 00:11:22:33:44:55:66:77:88:99'; 'set interfaces ae0 esi all-active'.

Underlay BGP: 'set protocols bgp group underlay type external peer-as '; advertise loopbacks via 'set protocols bgp group underlay export '.

Firewall filter: 'set firewall family inet filter term from source-address '; 'set firewall family inet filter term then accept'.

Policer: 'set firewall policer if-exceeding bandwidth-limit 100m burst-size-limit 10k'; 'set firewall policer then discard'.

Loopback filter: 'set interfaces lo0 unit 0 family inet filter input '.

DHCP snooping: 'set protocols dhcp snooping vlan '; 'set protocols dhcp snooping trusted-port '.

DAI: 'set protocols arp inspection vlan '; trusted interfaces configured with 'set protocols arp inspection trusted-port '.

MACsec: 'set security macsec connectivity-association '; 'set security macsec interfaces xe-0/0/0 connectivity-association '.

Port security: 'set protocols l2-learning interface-mac-limit '.

ZTP: 'set system autoinstallation' controls; disable with 'set chassis auto-image-upgrade' or by removing DHCP options.

PyEZ: 'from jnpr.junos import Device'; 'dev = Device(host="x", user="u", password="p")'; 'dev.open()'; 'dev.cli("show version")'.

NETCONF: enable with 'set system services netconf ssh'; use port 830.

REST API: 'set system services rest http port 8080'; use HTTP GET/POST with JSON.

YANG: 'show system schema module '; 'show system schema module output-directory '.

Ansible: junos_command, junos_config, junos_facts; connection: netconf requires NETCONF enabled.

SaltStack: junos proxy minion connects via NETCONF; state files use the junos execution module.

Commit scripts: 'set system commit scripts .slax'; scripts can generate warnings or errors.

Event scripts: 'set event-options policy events then execute-commands'.

'show evpn instance' displays EVPN instance state, VTEPs, and route targets; 'show evpn database' lists MAC/IP entries per EVPN instance.

'show route table bgp.evpn.0 detail' shows route details including RD, RT, and next-hop.

'show interfaces xe-0/0/0 statistics' shows input/output packet and error counts; 'show interfaces diagnostics optics' shows optical power levels.

'show chassis routing-engine' shows CPU and memory utilization; 'show system processes extensive' shows per-process resource usage.

'show log messages | match ' filters syslog; 'show log ' displays a specific log file.

Port mirroring: 'set forwarding-options port-mirroring input rate 1'; 'set forwarding-options port-mirroring input destination-interface xe-0/0/1'.

MTU testing: 'ping size do-not-fragment' to verify path MTU; VXLAN requires underlay MTU of at least 1600 bytes, typically 9000.

'show ethernet-switching interface' shows per-interface VLAN and MAC learning state; 'show ethernet-switching table detail' shows MAC details.