Juniper JN0-650 Practice Test Questions Answers

In enterprise networks utilizing Junos OS, IBGP (Internal BGP) route flapping is frequently caused by recursive routing failures within the underlying IGP (Interior Gateway Protocol) , such as OSPF or IS-IS.

Recursive Next-Hop Resolution: Unlike EBGP, where the neighbor is typically directly connected, IBGP neighbors are often several hops away. Consequently, an IBGP route ' s protocol next-hop is usually a loopback IP address that requires a recursive lookup to resolve. The router must consult its unicast routing table (typically inet.0 or inet.3) to find a physical path to that next-hop.

The Flapping Mechanism: A " flap " occurs when a route is repeatedly withdrawn and readvertised. If the IGP path used to resolve the BGP next-hop becomes unstable or if the BGP route itself is inadvertently used to resolve its own next-hop (a recursive loop), the BGP next-hop becomes unreachable.

Impact on Routing Table: When the next-hop cannot be resolved, the BGP route is considered invalid and is withdrawn from the routing table. Once the route is withdrawn, the original IGP path to the next-hop often becomes valid again, causing the BGP route to be readvertised . This cycle of withdrawal and readvertisement creates the instability known as flapping.

Why other options are incorrect: Packet misordering (Option A) and community tagging (Option B) may affect performance or policy but do not cause a route to be withdrawn and readvertised in this cyclical manner. While update intervals (Option C) control how quickly changes are sent, they are not the root cause of the reachability failure that triggers the flap itself.

OSPF stub areas are used to reduce the size of the Link-State Database (LSDB) in routers with limited resources by restricting the flooding of external routes.

Virtual Links (Option C): According to OSPF standards (both v2 and v3), virtual links cannot pass through stub areas. A virtual link must transit a " transit area, " which must be a standard (non-stub) area with a full routing table.

Totally Stubby Areas (Option D): A stub area (which blocks Type 5 External LSAs) can be further restricted into a totally stubby area. In Junos OS, this is done by adding the no-summaries statement to the stub configuration. This blocks both Type 5 and Type 3 (Inter-area) LSAs, replacing them with a single default route.

Incorrect Statements: Option A is incorrect because standard stub areas cannot contain an ASBR; only Not-So-Stubby Areas (NSSA) allow for an ASBR. Option B is incorrect because an area is either a Stub or an NSSA; they are mutually exclusive configurations for the same area.

The behavior described is the fundamental operational principle of OSPF ' s hierarchical area structure.

LSA Flooding Scope: In OSPFv2, Type-1 (Router) and Type-2 (Network) Link-State Advertisements (LSAs) are restricted to a local area flooding scope . They contain detailed topology information (such as which routers are connected to which links) that is only relevant for calculating the Shortest Path First (SPF) tree within that specific area.

ABR Functionality: Area Border Routers (ABRs), such as R1 in this scenario, act as the gateway between areas. The ABR does not forward Type-1 or Type-2 LSAs from one area to another. Instead, it extracts the prefix information (the network address and mask) from those LSAs and generates a Type-3 (Summary) LSA .

Interarea Reachability: This Type-3 LSA is then flooded into the backbone (Area 0) and subsequently into other non-backbone areas, such as Area 2. This explains why R2 sees an " interarea route " to R3’s network in its routing table and has the corresponding Type-3 LSA in its database, but cannot see the original Type-1 or Type-2 LSAs from Area 1.

Why other options are incorrect: Option A is incorrect because this is standard protocol behavior, not the result of a manual filter. Option B is incorrect as there is no such " disable " feature; the protocol design inherently prevents these LSAs from crossing boundaries. Option C is incorrect because OSPFv3 still uses Type-1 and Type-2 LSAs (renamed but functionally similar for topology), and the prompt specifically identifies the deployment as OSPFv2 .

Private VLANs (PVLANs) allow for granular port isolation within a single broadcast domain. When extending a PVLAN across multiple switches (S1 to S2), the secondary VLANs (Community or Isolated) must be preserved across the trunk links.

802.1Q Tagging (Option B): For traffic from a Community VLAN (RND) to reach members on a different switch, the Community VLAN must have its own 802.1Q VLAN tag (VLAN ID) associated with it. When a frame from a community port on S1 traverses the trunk to S2, it is tagged with this specific secondary VLAN ID. S2 receives the tagged frame, identifies it as belonging to the RND community, and forwards it to the appropriate community or promiscuous ports.

Why it fails without a tag: If the RND community is only defined locally on S1 without a global VLAN ID, the trunk port will not know how to distinguish that traffic from the Primary VLAN or other communities.

Incorrect Options: Option A is incorrect because the community VLAN must have a different tag than the parent (Primary) VLAN to maintain the internal PVLAN logic. Option C is incorrect because stripping tags would lead to the traffic being merged into the native VLAN or dropped. Option D is incorrect because RND is a community VLAN; changing it to an isolated VLAN would change its behavior (preventing communication between members of that same group).

In Junos OS 24.4, Captive Portal is used as a web-based authentication method for Layer 2 network access control, often in environments where 802.1X is not feasible for all users.

Fallback Mechanism (Option D): On EX Series switches, Juniper supports a flexible authentication order. By default, the switch attempts authentication in the order of 802.1X, then MAC RADIUS, and finally Captive Portal. If a client fails both 802.1X and MAC RADIUS, the switch can fall back to Captive Portal to redirect the user to a login page.

MAC Allowlist (Option B): Captive Portal relies on intercepting HTTP/HTTPS traffic to redirect users. However, " headless " devices like printers or cameras lack web browsers and cannot interact with the portal. To accommodate these, Junos allows administrators to configure an authentication allowlist (or whitelist), which identifies these devices by their MAC addresses and permits them to bypass the portal entirely.

Precedence (Option A): This is incorrect because Captive Portal is generally the last method in the default sequence, not the first.

Layer 2 Participation (Option C): While Captive Portal requires a Layer 3 interface (RVI/IRB) for the redirection process, it is explicitly used to control Layer 2 access on EX Series switches.