JNCIS-ENT cheat sheet

Junos VLAN IDs range from 1 to 4094; VLAN 0 and 4095 are reserved and cannot be configured as user VLANs.

An access interface carries one untagged VLAN; a trunk carries tagged VLANs and optionally one untagged native VLAN.

Assign an access port with: set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access vlan members VLAN10.

Configure trunk mode with interface-mode trunk and list allowed VLANs with vlan members; set native-vlan-id for untagged traffic.

An IRB interface provides Layer 3 routing for a VLAN; bind it with set vlans VLAN10 l3-interface irb.10.

The default VLAN has VLAN ID 1 and is named default; switch ports are members until changed.

MAC limiting per interface uses interface-mac-limit; violations can drop or log packets.

Q-in-Q tunneling uses dot1q-tunneling with customer-vlans; the outer S-VLAN tag encapsulates customer C-VLAN tags.

show ethernet-switching table displays learned MAC addresses, VLANs, and port types.

STP bridge priority is configurable in increments of 4096; the lowest priority, then lowest MAC address, wins root election.

RSTP defines discarding, learning, and forwarding states and root, designated, alternate, and backup port roles.

An RSTP edge port connects to an end host and skips learning; enable with set protocols rstp interface ge-0/0/1 edge.

BPDU guard blocks edge ports that receive BPDUs; on Junos use bpdu-block-on-edge or bpdu-timeout-action.

MSTP maps VLANs to instances; all switches in a region must share the same region name, revision level, and VLAN-to-instance mapping.

VSTP runs a separate spanning-tree instance per VLAN and is configured under protocols vstp vlan.

Path cost is based on link speed; lower cumulative root path cost is preferred toward the root.

show spanning-tree bridge shows bridge priority, root ID, and timers; show spanning-tree interface shows port roles and states.

no-root-port on an interface prevents it from becoming the root port.

DHCP snooping classifies ports as trusted or untrusted; untrusted ports allow DHCP client messages only, and bindings record IP-to-MAC leases.

Dynamic ARP inspection validates ARP packets against DHCP snooping bindings; it requires DHCP snooping to be enabled.

IP source guard filters traffic by source IP and MAC using DHCP snooping bindings.

MAC limiting restricts the number of learned MAC addresses per interface and can drop or log violating frames.

Storm control limits broadcast, multicast, or unknown-unicast traffic by bandwidth level or packets per second.

802.1X authenticates supplicants through an authenticator port and a RADIUS server before granting network access.

A MAC move limit detects loops or spoofing when the same MAC address moves repeatedly between interfaces.

show dhcp snooping binding displays learned IP-MAC-VLAN-interface bindings.

Secure access ports can restrict which MAC addresses are allowed on an interface.

Junos default route preferences: direct 0, static 5, OSPF internal 10, IS-IS 15, RIP 100, OSPF external 150, BGP 170.

Lower route preference is preferred; if preferences tie, the route with the lower metric is selected.

A route-filter match type exact matches one prefix; longer matches more-specific prefixes; orlonger includes the prefix itself.

Routing policy terms are evaluated top to bottom; the first matching term's action is applied.

A policy with no matching term falls through; when applied as import/export the implicit final action is reject.

aggregate routes create a summary only when contributing routes exist; generate routes create unconditional summaries.

Filter-based forwarding uses a firewall filter action routing-instance to direct matching packets to a VRF.

RIB groups use instance-import and instance-export policies to leak routes between routing instances.

show route forwarding-table displays the hardware forwarding next-hop entries.

OSPF hello intervals are 10 seconds on broadcast and point-to-point links and 30 seconds on NBMA; dead interval is 4 times hello.

OSPF neighbors must agree on area ID, hello/dead timers, authentication, and stub flags.

LSA types: 1 router, 2 network, 3 summary, 4 ASBR summary, 5 external, 7 NSSA external.

A stub area blocks type 5 LSAs; a totally stubby area blocks types 3, 4, and 5.

An NSSA blocks type 5 LSAs but allows type 7 LSAs, which the ABR translates to type 5.

DR/BDR election uses highest interface priority, then highest router ID; priority 0 means never DR or BDR.

OSPF cost equals reference bandwidth divided by interface bandwidth; Junos default reference bandwidth is 100 Mbps.

A virtual link traverses a transit area to connect a discontiguous area to the backbone area 0.

show ospf neighbor displays state, dead timer, and priority; show ospf database displays LSAs.

IS-IS NET addresses combine an area ID, a 6-byte system ID, and an NSEL byte that is 00 for routers.

IS-IS levels: L1 routers route within an area; L2 routers form the backbone; L1/L2 routers connect both.

The DIS is elected by highest interface priority, then highest MAC address on the LAN.

IS-IS uses IIH, LSP, CSNP, and PSNP PDUs; CSNP describes the complete link-state database.

Narrow metrics max out at 63; wide metrics support larger values and are used for TE.

An L1 router uses the nearest L1/L2 router as its default route toward other areas.

Default IS-IS preference is 15, preferred over OSPF external and BGP but less than OSPF internal.

show isis adjacency displays neighbor state, hold time, and interface; show isis database displays LSPs.

eBGP peers are typically directly connected and use TTL 1 by default; multihop is needed for non-direct peering.

iBGP does not change the next hop by default; next-hop-self changes it to the local peering address.

BGP best-path order includes weight, local preference, locally originated, AS path length, origin, MED, eBGP over iBGP, IGP cost, router ID.

Weight is local to the router and is not advertised; higher weight is preferred.

Local preference is advertised within an AS; higher local preference is preferred.

MED is advertised to neighboring ASes and suggests an entry point; lower MED is preferred.

Well-known communities include no-export, no-advertise, and no-export-subconfed.

A route reflector reflects iBGP routes to clients and uses cluster ID and originator ID to prevent loops.

show bgp summary displays peer state and prefix counts; show route protocol bgp displays BGP routes.

A GRE tunnel uses a gr- interface with tunnel source and destination addresses.

An IP-IP tunnel uses an ip- interface and encapsulates packets in an outer IP header.

GRE adds 4 bytes of GRE header plus an outer IP header, reducing usable MTU; IPv4 outer overhead totals 24 bytes.

Tunnel interfaces require an address and family configuration, for example set interfaces gr-0/0/0 unit 0 family inet address.

clear-dont-fragment-bit allows large packets to be fragmented before tunneling.

Tunnel keepalives can be enabled to detect remote endpoint failure.

VXLAN uses a VXLAN interface and VNI to extend Layer 2 segments over an IP network.

show interfaces gr-0/0/0 detail displays tunnel source, destination, and traffic statistics.

VRRP elects a master by highest priority; the virtual IP is shared by master and backups.

VRRP preempt allows a higher-priority backup to take over the master role when it comes online.

BFD provides fast failure detection with minimum-interval and multiplier; a session fails after multiplier missed intervals.

LACP bundles links using active or passive mode; active initiates LACP PDUs.

Graceful Restart preserves forwarding while a routing protocol restarts; NSR keeps routing state synchronized across Routing Engines.

Redundant Ethernet interfaces (reth) provide active/passive or active/active HA on SRX devices.

show vrrp displays VR state, priority, and virtual IP; show bfd session displays session state and timers.

GRES synchronizes kernel and forwarding state during Routing Engine switchover.