JNCIS-DC cheat sheet

EVPN-VXLAN is the dominant DC overlay: EVPN (RFC 7432) carries MAC/IP reachability in MP-BGP, VXLAN (RFC 7348) provides the data-plane encapsulation with a 24-bit VNI allowing ~16 million segments.

EVPN route types: Type 1 Ethernet Auto-Discovery (mass withdrawal, aliasing), Type 2 MAC/IP Advertisement, Type 3 Inclusive Multicast Ethernet Tag (BUM traffic), Type 4 Ethernet Segment, Type 5 IP Prefix.

Junos EVPN config lives under protocols evpn with switch-options vtep-source-interface lo0.0 and vlan-id / vxlan vni mapping at the VLAN level; verify with show evpn database and show ethernet-switching table.

ESI (Ethernet Segment Identifier) is a 10-byte value; identical ESI on two leafs signals a multihomed CE, enabling all-active multihoming and DF (designated forwarder) election per VLAN.

Underlay options: eBGP-unnumbered with IPv6 link-local addresses, OSPF, or IS-IS; BGP is preferred because it scales and gives per-link failure isolation without flooding.

Juniper Apstra is intent-based DC fabric management: blueprints define the logical topology, the graph datastore models the network, and IBA (Intent-Based Analytics) probes continuously validate against intent.

ZTP on Juniper switches uses DHCP options (option 43 or boot-file-name) to fetch an image plus a config, then auto-installs; commit scripts and on-box Python/YANG (PyEZ, Junos PyEZ) automate post-boot state.

MC-LAG (multichassis LAG) uses ICCP over an ICL link plus a backup liveness link to present two devices as one LAG peer; in EVPN fabrics, ESI multihoming is preferred over MC-LAG.

Q-in-Q (802.1ad) and VXLAN both solve L2 stretch; VXLAN avoids STP scale limits because the overlay uses a control plane (EVPN) and ECMP underlay rather than a looped L2 topology.

Junos commit workflow: candidate config → commit check (syntax) → commit (sanity checks, apply, rollback timer) → commit confirmed N (auto-rollback in N minutes unless confirmed) → rollback 1 to restore the prior commit.

Configuration hierarchy for a VLAN-to-VNI binding on Junos: set vlans V100 vlan-id 100; set vlans V100 vxlan vni 10100; set switch-options vtep-source-interface lo0.0; set protocols evpn encapsulation vxlan.

BGP EVPN on Junos requires family evpn signaling on the iBGP peering; the route reflector reflects Type 2/3/5 routes; use set protocols bgp group OVERLAY type internal and family evpn signaling.

VXLAN VTEP source must be the loopback; if the loopback is unreachable, tunnels fail - check with show route and show interfaces vtep.

Multihoming config: set interfaces ae0 esi 00:11:22:33:44:55:66:77:88:99; set interfaces ae0 esi all-active; set protocols evpn multicast-mode ingress-replication (or PIM underlay for multicast).

Troubleshooting sequence for missing MAC in EVPN: verify local MAC in show ethernet-switching table, then show evpn database, then BGP EVPN route presence (show route table bgp.evpn.0), then VTEP reachability.

Apstra workflow: build blueprint from templates → commit blueprint → deploy (renders device configs) → run IBA probes; anomalies appear in the blueprint dashboard with a probe-specific severity.

Interface ranges and apply-groups reduce repetition: set interfaces interface-range LEAF member ge-0/0/[0-23] then apply unit config once; apply-groups inherit common config to all members.

Junos telemetry: set services analytics streaming-server with gRPC/ UDP export; native sensors push interface counters and queue stats for DC observability.

Collapsed core vs spine-leaf: spine-leaf gives predictable any-to-any latency (max 2 hops east-west) and ECMP; collapsed core is cheaper for small DCs but adds oversubscription and STP dependence.

Oversubscription ratio = southbound bandwidth / northbound bandwidth; 3:1 is typical for access-to-spine, 1:1 for spine-to-super-spine in large fabrics.

ECMP hashing on Junos: set forwarding-options hash-key family inet layer-3; layer-4 hashing uses src/dst port; test with show route forwarding-table and traceroute with varying ports.

Jumbo frames: set interfaces xe-0/0/0 mtu 9216 and set protocols lldp interface all; must be consistent end-to-end or large packets silently drop.

Storm control: set interfaces xe-0/0/0 ether-options ethernet-switch-profile storm-control; bandwidth-percent limits broadcast/multicast/unknown-unicast per port.

Redundancy design: dual-homed servers via LAG to two leafs with ESI; dual power feeds; redundant supervisors (RE0/RE1) and graceful routing engine switchover (GRES) plus NSR for control-plane resilience.

Junos high availability: GRES preserves forwarding during RE switchover; NSR keeps routing protocol state; nonstop bridging (NSB) preserves L2 protocols; verify with show chassis routing-engine.

Cabling and optics: DAC for short intra-rack, AOC/optics for longer runs; check DOM with show interfaces diagnostics optics; mismatch of FEC (RS-FEC vs none) on 100G links causes link-down.

Virtual Chassis / Virtual Chassis Fabric vs EVPN: VC is a single management domain with shared control plane; EVPN keeps independent control planes and scales beyond VC member limits.

The DCIM/automation stack: Apstra for intent and fabric lifecycle, Junos PyEZ (Python) for device-level automation, YANG/OpenConfig models for structured config, and gRPC telemetry for streaming state.

Junos PyEZ: from jnpr.junos import Device; dev = Device(host='x', user='u', password='p'); dev.open(); dev.rpc.get_interface_information(); dev.close() - RPCs map to show commands.

Junos config in text vs XML: load merge/load replace/load override control how a snippet is applied; load override replaces the entire config, load merge adds to existing hierarchy.

REST API on Junos: enable with set system services rest http; endpoints like /rpc/get-interface-information return XML/JSON; used for controller integration.

Apstra IBA probes consume telemetry from devices via collectors; probe results show anomalies; a probe is defined in the blueprint with a graph query and an expectation.

Zero Touch Provisioning flow: DHCP → option 43/boot-file-name → image download → config fetch (HTTP/HTTPS/TFTP) → commit; verify with show system autoinstallation status.

Configuration versioning: commit history is viewable with show system commit; rollback N reverts N commits; archive sites push configs to a remote server with set system archival configuration.

YANG modeling: Junos supports native YANG and OpenConfig models; NETCONF over SSH (port 830) with and is the standard programmatic path.

Role-based access: login classes with permissions (e.g., configure, view, all) and allow-commands/deny-commands restrict automation accounts; set system login user auto class read-only.