JNCIP-ENT cheat sheet

OSPFv2 (IPv4) uses 32-bit router IDs; OSPFv3 (IPv6) uses 128-bit router IDs and runs per-link, with authentication handled by IPsec (RFC 4552) rather than the OSPFv2 auth fields.

OSPF area 0 is the backbone; every non-backbone area must connect to area 0 through an ABR, or a virtual link (area 0 transit) must be configured across a transit area.

OSPF LSA types: Type 1 Router, Type 2 Network (DR), Type 3 Summary (ABR), Type 4 ASBR Summary, Type 5 AS External, Type 7 NSSA External. Type 5 LSAs are not flooded into stub or NSSA areas; NSSAs use Type 7 translated to Type 5 at the ABR.

Stub area blocks Type 5 and Type 4 LSAs and injects a default route; totally stubby (Cisco) additionally blocks Type 3 LSAs except the default. NSSA blocks Type 5 but allows Type 7 for external redistribution.

OSPF cost = reference bandwidth / interface bandwidth; default reference bandwidth is 100 Mbps, so any link >= 100 Mbps costs 1 unless reference-bandwidth is changed. Junos: set protocols ospf reference-bandwidth.

IS-IS Level 1 routers form intra-area topology; Level 2 forms the backbone. L1/L2 routers set the ATT bit in L1 LSPs to attract traffic toward L2 when they are attached to the backbone.

IS-IS uses narrow metrics (6-bit, max 63) by default; wide metrics (TLV 22, 24-bit) are required for TE and for metrics above 63. Junos: set protocols isis level 1 wide-metrics-only.

OSPF DR/BDR election is per multi-access segment, non-preemptive, decided by highest priority (0 = never DR) then highest router ID. On Junos, interface priority is set with set protocols ospf area 0 interface ge-0/0/0.0 priority.

OSPF adjacency requirements: same area, same subnet/mask, matching hello and dead intervals (default 10/40 s on broadcast, 30/120 s on NBMA), matching authentication, matching stub/NSSA flags, and matching MTU (unless mtu-ignore).

BGP path selection order (Cisco/Junos aligned): highest weight (Cisco) -> highest local preference -> locally originated (network/aggregate/redistribute) -> shortest AS path -> lowest origin (IGP < EGP < incomplete) -> lowest MED -> eBGP over iBGP -> lowest IGP metric to next hop -> oldest route (eBGP) -> lowest router ID -> lowest peer address.

iBGP requires a full mesh or route reflectors/confederations; a route learned from an iBGP peer is not re-advertised to another iBGP peer unless the router is a route reflector or confederation member.

eBGP default TTL is 1 (multihop needed for non-directly connected peers); iBGP TTL is 255. Junos: set protocols bgp group X multihop ttl N.

Well-known communities: NO_EXPORT (0xFFFFFF01), NO_ADVERTISE (0xFFFFFF02), NO_EXPORT_SUBCONFED (0xFFFFFF03), plus standard NOPEER (0xFFFFFF04).

BGP next-hop handling: on eBGP the next hop is rewritten to the advertising router; on iBGP it is preserved. next-hop-self is used on iBGP edge routers to avoid unreachable next hops.

BGP states: Idle -> Connect -> Active -> OpenSent -> OpenConfirm -> Established. Active means the router is trying to open a TCP connection, not that the session is up.

Route reflection: RR reflects routes from clients to clients and non-clients, but not from non-clients to non-clients. Cluster ID and originator ID prevent loops.

BGP graceful restart (GR) and LLGR preserve forwarding during control-plane restart; BFD can be used for fast failure detection independent of BGP timers.

Junos BGP policy: import policy controls what is accepted into the RIB; export policy controls what is advertised. Default BGP export advertises only routes learned from BGP, not IGP routes, unless explicitly configured.

IPv4 multicast range is 224.0.0.0/4; 224.0.0.0/24 is link-local (not forwarded). SSM range is 232.0.0.0/8 (RFC 4607); GLOP uses 233.0.0.0/8.

PIM-SM builds a shared tree (*,G) rooted at the Rendezvous Point (RP) and may switch to a shortest-path tree (S,G) after the last-hop router sends an (S,G) join toward the source.

PIM-SM RP discovery: static RP, Auto-RP (Cisco, uses 224.0.1.39 and 224.0.1.40), or BSR (RFC 5059, standards-based).

PIM-DM uses flood-and-prune with (S,G) state and Assert messages; PIM-SSM requires IGMPv3 and no RP, using (S,G) joins directly.

IGMP versions: v1 (query/report), v2 (adds leave group), v3 (source-specific joins for SSM). IGMP snooping on switches constrains multicast to interested ports.

Reverse Path Forwarding (RPF) check: a multicast packet is accepted only if it arrives on the interface that the unicast route to the source points to. RPF failure drops the packet; use rpf-check or static mroutes to correct.

PIM hello default interval is 30 s; DR election on a multi-access LAN is highest priority then highest IP. Only the DR sends IGMP queries and registers sources to the RP.

MSDP connects PIM-SM domains by sharing (S,G) source-active messages between RPs; anycast-RP (RFC 4610) provides RP redundancy within a domain.

802.1D STP: root bridge = lowest bridge ID (priority + MAC), default priority 32768. Port roles: root, designated, blocked. Port states: blocking, listening (15 s), learning (15 s), forwarding.

RSTP (802.1w) converges in seconds with edge (PortFast) ports, proposal/agreement handshake, and alternate/backup port roles. Default forward delay 15 s, hello 2 s, max age 20 s.

MSTP (802.1s) maps VLANs to instances; each instance has its own root and topology. Region name, revision, and VLAN-to-instance mapping must match on all switches in a region.

PVST+/Rapid-PVST+ run a separate STP instance per VLAN (Cisco). VSTP on Junos runs per-VLAN spanning tree; Junos also supports RSTP and MSTP.

BPDU Guard disables a port that receives a BPDU (edge ports); BPDU Filter stops sending/receiving BPDUs. Root Guard prevents a port from becoming root; Loop Guard prevents a blocked port from moving to forwarding on BPDU loss.

VLAN tagging: 802.1Q inserts a 4-byte tag with 12-bit VLAN ID (1-4094). Native VLAN is untagged on a trunk; mismatched native VLANs cause CDP/LLDP mismatch and potential VLAN hopping.

MAC learning: switch learns source MAC on ingress port into CAM table; unknown unicast is flooded. Default MAC aging is 300 s (Cisco).

EtherChannel/LAG: LACP (802.3ad) uses active/passive modes; static LAG has no negotiation. All member links must match speed, duplex, VLAN, and trunk configuration.

802.1X roles: supplicant (client), authenticator (switch), authentication server (RADIUS). EAPOL runs between supplicant and authenticator; RADIUS carries EAP between authenticator and server.

EAP methods: EAP-MD5 (no mutual auth), PEAP (server cert + inner MS-CHAPv2), EAP-TLS (mutual cert), EAP-TTLS. PEAP/EAP-TLS are preferred; EAP-MD5 is deprecated.

Port states: unauthorized (only EAPOL allowed), authorized (traffic allowed). MAB (MAC Authentication Bypass) authenticates devices that cannot run 802.1X by MAC address against RADIUS.

Host modes: single-host (one MAC), multi-host (many MACs behind one authenticated port), multi-domain (one voice + one data device).

RADIUS attributes: Tunnel-Type=VLAN (13), Tunnel-Medium-Type=802 (6), Tunnel-Private-Group-ID=VLAN ID for dynamic VLAN assignment; Filter-Id for ACL assignment.

MACsec (802.1AE) provides hop-by-hop encryption and integrity on Ethernet links using MKA (802.1X-2010) for key agreement; distinct from 802.1X port authentication.

Port security limits learned MACs; violation modes are protect (drop), restrict (drop + log/count), shutdown (err-disable). Sticky MACs persist across reloads.

DHCP snooping trusts only uplink ports for DHCP offers; combines with IP Source Guard (validates source IP/MAC) and Dynamic ARP Inspection (validates ARP) to block spoofing.

LLDP-MED (802.1AB extension) and CDP convey voice VLAN information to IP phones; the phone tags voice frames with 802.1Q and can place PC data untagged.

Voice VLAN configuration: access port with voice VLAN (Cisco: switchport voice vlan X) or trunk with native VLAN for voice; QoS trust boundary should be set at the phone or access port.

PoE (802.3af, up to 15.4 W at PSE; 802.3at/PoE+, up to 30 W; 802.3bt up to 60/90 W). Detection uses 25 kOhm signature; class-based power negotiation.

Call signaling: SCCP (Cisco proprietary, TCP 2000) vs SIP (UDP/TCP 5060, TLS 5061). RTP media uses dynamic UDP ports (typically 16384-32767 on Cisco).

Codecs: G.711 (64 kbps, ~80-87 kbps with overhead), G.729 (8 kbps, ~24-31 kbps with overhead). Bandwidth planning must include IP/UDP/RTP headers and possibly tunneling/VPN overhead.

QoS markings for voice: EF (46) for RTP, CS3 (24) for call signaling; trust DSCP or CoS at the phone/access port. Voice should be prioritized in a strict-priority or low-latency queue.

SRTP (RFC 3711) encrypts RTP media; TLS protects SIP signaling. Secure conferencing requires both signaling and media encryption.

Emergency services (E911) require location tracking; switches can use LLDP-MED or CDP to identify the phone's port and location for E911 routing.

L2 CoS: 802.1p 3-bit priority field (0-7) in the 802.1Q tag. L3: IP precedence (3 bits) and DSCP (6 bits, 0-63). MPLS EXP is 3 bits.

DSCP per-hop behaviors: EF (46) for voice, AF classes AF1x-AF4x (class 1-4, drop precedence 1-3), CS0-CS7, default BE (0). AF codepoint = 8class + 2drop.

Classification happens at ingress (trust or mark); policing enforces rate; shaping buffers; queuing schedules (PQ, WRR, DRR, WFQ); WRED drops early to signal congestion.

Trust boundaries: trust DSCP on core/uplink ports; trust CoS on trunk to phones; do not trust PC/edge by default. Untrusted traffic is typically marked to 0 or a scavenger class.

Strict priority queue (PQ) serves voice first and can starve other queues; combine with a policer to bound voice bandwidth. Low-latency queue (LLQ) = PQ + policer.

Junos CoS: classifiers (BA), rewrite rules, schedulers, scheduler maps, and drop profiles. Default classifier for 802.1p is ieee8021p; for DSCP is dscp.

Congestion avoidance: tail drop vs RED/WRED. WRED uses per-DSCP drop profiles; ECN (RFC 3168) marks instead of dropping for TCP-capable flows.

Policing vs shaping: policers drop or remark out-of-profile traffic; shapers delay and buffer. Both use token bucket (CIR, CBS, EBS) parameters.

EVPN (RFC 7432) uses BGP as the control plane for L2/L3 VPNs; MP-BGP address family l2vpn evpn (AFI 25, SAFI 70).

EVPN route types: Type 1 Ethernet Auto-Discovery, Type 2 MAC/IP Advertisement, Type 3 Inclusive Multicast Ethernet Tag, Type 4 Ethernet Segment, Type 5 IP Prefix (for L3).

Type 2 route carries MAC, optional IP, Ethernet tag, MPLS label (or VNI), and extended communities. MAC mobility is signaled with the MAC Mobility extended community (sticky bit for static MACs).

Ethernet Segment (ES) is identified by ESI; multihoming uses All-Active (LAG across PEs) or Single-Active. DF election (Type 4 route) chooses the designated forwarder per ES.

EVPN-VXLAN: VNI in the VXLAN header identifies the L2/L3 instance; Type 2 routes advertise MAC/IP-to-VNI mappings over the underlay (typically IP fabric with BGP).

EVPN-MPLS: Type 2 routes use MPLS labels; Type 5 routes advertise IP prefixes for L3VPN-style routing with symmetric IRB (integrated routing and bridging).

Anycast gateway (distributed IRB): all leafs share the same MAC/IP for the default gateway; avoids tromboning and supports seamless VM mobility.

BUM traffic handling: ingress replication (head-end) or multicast underlay (PIM). Type 3 routes advertise the inclusive multicast Ethernet tag for BUM replication.