JN0-664 Service Provider Professional (JNCIP-SP) Questions and Answers

Class of Service (CoS) in networking is used to manage traffic by classifying, scheduling, and sometimes modifying packets to ensure network performance and Quality of Service (QoS). Different CoS components are used to achieve these goals. Let's analyze each option to determine which CoS component allows you to alter class-of-service values on the outbound interface of an edge router.

1. **Output Policer**:

- Policing is used to control the rate of traffic sent to or from a network interface. It can drop or remark traffic that exceeds a certain rate.

- Policing is not typically used to alter CoS values but to enforce traffic limits.

2. **Scheduler**:

- A scheduler is responsible for managing the order in which packets are transmitted out of an interface based on their CoS markings. It can allocate bandwidth and prioritize traffic.

- The scheduler manages how packets are queued and sent but does not alter the CoS values of packets.

3. **Rewrite Rules**:

- Rewrite rules are used to modify the CoS values of packets, such as DSCP (Differentiated Services Code Point) or 802.1p bits, as they exit an interface.

- Rewrite rules can alter the class-of-service values in the packet headers to match the desired policies of the outbound interface.

- Therefore, rewrite rules are the correct component for altering CoS values on an outbound interface.

4. **Forwarding Classes**:

- Forwarding classes are used to categorize packets into different traffic classes within a router for QoS handling.

- They help in defining how packets should be treated by the scheduler but do not directly modify the CoS values.

**Conclusion**:

To alter class-of-service values in packets on the outbound interface of an edge router, the correct CoS component to use is:

**C. rewrite rules**

**References**:

- Juniper Networks Documentation on CoS: [Class of Service Overview](https://www.juniper.net/documentation/en_US/junos/topics/concept/class-of-service-overview.html)

- Junos OS CoS Configuration Guide: [Rewrite Rules](https://www.juniper.net/documentation/en_US/junos/topics/topic-map/class-of-service-rewrite-rules.html)

To allow Site 1 to access three VLANs that are located in Site 2 and Site 3, you need to configure three L2VPN routing instances on PE-1, one for each VLAN. Each L2VPN routing instance will have a different VLAN ID and a different VNI for VXLAN encapsulation. Each L2VPN routing instance will also have a different vrf-target export value to identify which VPN routes belong to which VLAN. This way, PE-1 can forward traffic from Site 1 to Site 2 and Site 3 based on the VLAN tags and VNIs.

Intermediate System to Intermediate System (IS-IS) is a link-state routing protocol designed to move information efficiently within a computer network, a group of physically connected computers or similar devices. It operates in two levels, Level 1 (L1) and Level 2 (L2), and supports hierarchical routing within a multi-area network.

Let's analyze each statement to determine its correctness in the context of IS-IS multi-area networks.

1. **Statement A: Internal L1 PDUs are flooded to the local area's L2 routers.**

- This statement is correct. L1 PDUs (Protocol Data Units) are flooded within the L1 area and also to the L2 routers that are present in the same area. These L2 routers act as the boundary routers that connect the local L1 area to other L1 areas via L2.

2. **Statement B: External L2 PDUs are flooded to all L2 routers in other areas.**

- This statement is correct. L2 PDUs are flooded throughout the entire L2 backbone, which includes all L2 routers in different areas. This ensures that inter-area routing information is shared across the network.

3. **Statement C: Internal L1 PDUs are flooded to all L1 routers in other areas.**

- This statement is incorrect. Internal L1 PDUs are only flooded within the local L1 area. They do not cross L1 area boundaries; inter-area communication is handled by L2 routers.

4. **Statement D: Internal L1 PDUs are only flooded to the local area's L1 routers.**

- This statement is correct. Internal L1 PDUs are indeed only flooded within their local L1 area, and do not go beyond it.

5. **Statement E: External L2 PDUs are only flooded to the local area's L2 routers.**

- This statement is incorrect. External L2 PDUs are flooded to all L2 routers throughout the IS-IS network, not just to those in the local area. This allows L2 routers to maintain a complete map of the network's topology.

**Conclusion**:

Given the analysis, the correct answers are:

**A. Internal L1 PDUs are flooded to the local area's L2 routers.**

**B. External L2 PDUs are flooded to all L2 routers in other areas.**

**D. Internal L1 PDUs are only flooded to the local area's L1 routers.**

**References**:

- Juniper Networks Documentation on IS-IS: [IS-IS Overview](https://www.juniper.net/documentation/en_US/junos/topics/concept/is-is-routing-overview.html)

- RFC 1195, Use of OSI IS-IS for Routing in TCP/IP and Dual Environments: [RFC 1195](https://tools.ietf.org/html/rfc1195) which details the operation of IS-IS in multi-area networks.

Bootstrap messages are PIM messages that are used to distribute rendezvous point (RP) information dynamically during an RP election. Bootstrap messages are sent by bootstrap routers (BSRs), which are routers that are elected to perform the RP discovery function for a PIM sparse-mode domain. Bootstrap messages contain information about candidate RPs and their multicast groups, as well as BSR priority and hash mask length. Bootstrap messages are forwarded to all routers within a PIM sparse-mode domain using hop-by-hop flooding.

Understanding the Problem in MPLS CoS Classification

How EXP Bits Are Used for CoS in MPLS

Traffic is sent from VPN-A Site-1 → CE-1 → PE-1 → P-1 → PE-2 → CE-2.

The MPLS LSP (Label Switched Path) from PE-1 to PE-2 is expected to carry MPLS EXP bits, which are used for Class of Service (CoS) classification.

PE-2 should classify traffic based on EXP bits received in the MPLS label.

What Happens with PHP (Penultimate Hop Popping)?

By default, the penultimate router (P-1) pops the top MPLS label before sending the packet to PE-2.

Since the EXP bits are in the top MPLS label, they get removed along with the label.

This means that PE-2 no longer sees the correct EXP bits, leading to incorrect traffic classification.

Solution: Configure Explicit-Null on PE-2

Explicit Null (explicit-null) must be configured on PE-2 to ensure that P-1 does NOT remove the MPLS label.

Instead of removing the label, P-1 will send a label of 0 (for IPv4) or 2 (for IPv6) to PE-2.

This preserves the MPLS EXP bits, allowing PE-2 to classify the traffic correctly.

Evaluating the Answer Choices Again

✅ B. Configure the explicit-null statement on PE-2.

Correct, because:

PE-2 is the egress LSR, where Ultimate Hop Popping (UHP) must be enabled.

Configuring explicit-null ensures that P-1 does not remove the label, preserving the EXP bits for CoS classification at PE-2.

Configuration on PE-2:

set protocols mpls explicit-null

Juniper Documentation Reference:

"Explicit-null must be configured on the egress LSR to prevent PHP from removing the top MPLS label, thereby preserving the EXP bits."

❌ A. Configure the explicit-null statement on PE-1.

Incorrect, because:

Explicit-null must be configured on the egress LSR (PE-2), not the ingress LSR (PE-1).

PE-1 only labels the traffic but does not control PHP behavior on P-1.

❌ C. Configure VPN prefix mapping for the PE-1_to_PE-2 LSP.

Incorrect, because:

VPN prefix mapping is used for mapping VPN routes to LSPs but does not solve the EXP bit issue.

The problem here is label removal (PHP), not route mapping.

❌ D. Set a static CoS value for the PE-1_to-PE-2 LSP.

Incorrect, because:

This does not preserve the original EXP bits, it only applies a static CoS value.

It’s a workaround, not a fix.

Final Answer: ✅ B. Configure the explicit-null statement on PE-2.

Key Takeaways

Penultimate Hop Popping (PHP) removes the outer MPLS label at P-1, which also removes the EXP bits used for CoS classification.

To keep EXP bits intact, configure explicit-null on the egress PE (PE-2).

This forces P-1 to send a label (0 for IPv4, 2 for IPv6) to PE-2, preserving the EXP bits for CoS classification.

Official Juniper Documentation Reference

???? Juniper MPLS CoS and PHP Behavior Guide

"To retain CoS EXP bits at the egress LSR, configure explicit-null on the egress PE. This prevents PHP from stripping the MPLS label before reaching the final PE router."

The OSPF cost is carried in the LSAs that are exchanged within an OSPF area. When a router calculates the cost to a destination it uses the cost of the exit interface of each router in the path to the destination.

The Dijkstra algorithm in IS-IS operates as follows:

Tree Database Initialization: The local router (root) is added to the tree database with a cost of 0.

Candidate Database Population: Neighbors of the root (from the LSDB) are placed into the candidate database with their associated costs.

Processing Nodes: The node with the lowest cost in the candidate database is moved to the tree database.

Neighbor Evaluation: For each neighbor of the newly added node (from the LSDB), if the neighbor is not already in the tree or candidate database, it is added to the candidate database. If it exists in the candidate with a higher cost, it is updated with the lower cost.

Termination: The algorithm stops when the candidate database is empty, ensuring all shortest paths are computed.

Analysis of Options:

A. Incorrect. The local router is placed directly into the tree database, not the candidate database.

B. Correct (with context). When a node is added to the tree database, its neighbors (existing in the LSDB) are evaluated. If these neighbors are not already in the tree or candidate database, they are added (not "moved") to the candidate database. The wording "moved" is technically inaccurate, but this option aligns closest with the process of populating the candidate database using LSDB entries during tree database processing.

C. Incorrect. Tuples (nodes) with the lowest cost are moved from the candidate database to the tree database, not from the tree to the LSDB. The LSDB remains static during SPF computation.

D. Incorrect. The algorithm stops when the candidate database is empty, not the tree database. The tree database grows as nodes are processed.

The `vrf-target` statement in a Layer 3 VPN configuration is used to control the import and export of VPN routes by attaching a target community to the routes. This helps in defining which VPN routes should be imported into or exported from a particular VRF (Virtual Routing and Forwarding) instance.

1. **Understanding VRF Target**:

- The `vrf-target` statement specifies the extended community attributes (route targets) that are used to control the import and export of routes in a VRF.

- These attributes help in identifying which routes should be shared between different VRFs, particularly across different PE (Provider Edge) devices.

2. **Statements Analysis**:

- **A. This value is used to identify BGP routes learned from the local CE device.**

- Incorrect. The `vrf-target` attribute is not used to identify routes learned from the local CE device. It is used to manage routes between PE devices and within the provider's MPLS network.

- **B. This value is used to identify BGP routes learned from the remote PE device.**

- Correct. The `vrf-target` value helps in identifying which routes from remote PE devices should be imported into the local VRF. It essentially acts as a filter for importing BGP routes with matching target communities.

- **C. This value is used to add a target community to BGP routes advertised to the local CE device.**

- Incorrect. Routes advertised to the local CE device do not use the `vrf-target` attribute. Instead, these routes are typically managed within the local VRF routing table.

- **D. This value is used to add a target community to BGP routes advertised to the remote PE device.**

- Correct. When advertising routes from the local PE to remote PE devices, the `vrf-target` value is added to these routes. This target community ensures that the correct routes are shared across the VPN.

**Conclusion**:

The correct statements about the `vrf-target` configuration in a Layer 3 VPN scenario are:

**B. This value is used to identify BGP routes learned from the remote PE device.**

**D. This value is used to add a target community to BGP routes advertised to the remote PE device.**

**References**:

- Juniper Networks Documentation on VRF Target: [VRF Target Configuration](https://www.juniper.net/documentation/en_US/junos/topics/topic-map/layer-3-vpns.html)

- MPLS and VPN Architectures by Ivan Pepelnjak and Jim Guichard

To determine the correct answer, let's analyze the BGP path selection process and identify which attribute would be considered next in this scenario.

Background on BGP Path Selection

When multiple paths to the same destination are received via BGP, the router uses a step-by-step process to select the best path. The order of attributes considered is as follows (simplified for this scenario):

Highest Local Preference : The path with the highest local preference is preferred.

Shortest AS Path : The path with the shortest AS path length is preferred.

Lowest Origin Code : Paths with an origin code of IGP are preferred over EGP, and EGP is preferred over Incomplete.

Lowest MED (Multi-Exit Discriminator) : If the first three attributes are identical, the path with the lowest MED value is preferred.

eBGP over iBGP : eBGP paths are preferred over iBGP paths.

IGP Metric to Next Hop : The path with the lowest IGP metric to the next-hop router is preferred.

Router ID : If all else is equal, the path from the router with the lowest Router ID is preferred.

Peer IP Address : As a last tiebreaker, the path from the peer with the lowest IP address is preferred.

Scenario Analysis

In this scenario:

You are receiving the 203.0.113.0/24 network via EBGP from two different autonomous systems (AS 64500 and AS 64501).

Both advertisements have identical local-preference values , AS-path lengths , and BGP origin codes .

Given that the first three attributes in the BGP path selection process are identical, the next attribute to consider is the MED (Multi-Exit Discriminator) value.

Analysis of the Options

Option A: Router ID

Incorrect : The Router ID is considered much later in the BGP path selection process, only after other attributes like MED and IGP metric have been evaluated. Since MED is still relevant here, Router ID is not the next attribute to consider.

Option B: MED value

Correct : The MED value is used to influence inbound traffic from neighboring ASes. When local preference, AS path length, and origin code are identical, the path with the lowest MED value is preferred. This makes MED the next attribute to consider in this scenario.

Option C: Peer IP Address

Incorrect : The peer IP address is a tiebreaker used only at the very end of the BGP path selection process, after all other attributes have been evaluated. It is not relevant here because MED has not yet been considered.

Option D: IGP Metric

Incorrect : The IGP metric to the next-hop router is considered after MED. Since MED is still relevant in this scenario, IGP metric is not the next attribute to evaluate.

Final Answer

The correct answer is:

B. MED value

Summary

When local preference, AS path length, and origin code are identical, the MED value is the next attribute considered in the BGP path selection process.

MED is used to influence how traffic enters your AS from neighboring ASes.

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-route-advertising-protocol.html

In an EVPN (Ethernet Virtual Private Network) environment, MAC address mobility is a critical feature that allows devices to move across different locations while ensuring the network consistently tracks their MAC addresses. Let’s break down the components in the exhibit and analyze the correct statements.

Understanding MAC Mobility and Sequence Numbers in EVPN

In EVPN, MAC mobility is managed through sequence numbers that are included in Type 2 MAC/IP advertisements.

The sequence number tracks MAC movement events and is used to determine the most recent update when a MAC address appears on different PEs (Provider Edge devices).

When a MAC address moves between locations, the EVPN PEs increment the sequence number and advertise it to resolve conflicts and determine which PE has the most up-to-date information.

Now, Let’s Review the Options:

✅ C. It helps the local PE to identify the latest advertisement.

Correct:The sequence number plays a key role in resolving MAC address conflicts. If multiple PEs advertise the same MAC address, the PE compares the sequence numbers to determine which update is the latest.

A higher sequence number indicates a more recent MAC update.

✅ D. It is advertised using a Type 2 message.

Correct:EVPN MAC/IP advertisements use BGP EVPN Type 2 messages to carry MAC addresses, IP addresses (optional), and their associated sequence numbers.

Type 2 advertisements are used to track MAC mobility and IP reachability information in the EVPN.

Why the Other Options Are Incorrect:

❌ A. It identifies MAC addresses that should be discarded.

Incorrect:The sequence number doesn’t identify MAC addresses that need to be discarded.Instead, it resolves conflicts by determining the most recent MAC address advertisement based on the highest sequence number.

❌ B. It resolves conflicting MAC address ownership claims.

Partially true, but misleading:While it’s true that sequence numbers are used in conflict resolution, the sequence number itself doesn’t directly resolve ownership claims. It only helps determine which advertisement is more recent. The actual conflict resolution happens through the comparison of the advertisements and sequence numbers.

Final Answer:

✅ C. It helps the local PE to identify the latest advertisement.

✅ D. It is advertised using a Type 2 message.

Reference from Juniper Documentation:

Juniper EVPN Configuration Guide:

"In EVPN MAC/IP advertisements, sequence numbers track the mobility of MAC addresses and are used to resolve conflicts when the same MAC address is advertised by multiple PEs. The PE with the higher sequence number has the most recent information."

???? Juniper BGP EVPN Mobility Documentation

Layer 2 VPNs don’t support fragmentation in the provider network. It is critical that the provider network supports the largest frame that the CE devices can generate after the MPLS and virtual routing and forwarding (VRF) labels are added by the PE devices. This example leaves the CE devices at the default 1500-byte maximum transmission unit (MTU) while configuring the provider core to support a 4000 byte MTU. This configuration avoids discards by ensuring the CE devices cannot exceed the MTU in the provider’s network.

Understanding the Exhibit and the Problem Statement

The diagram shows a Layer 3 VPN (L3VPN) setup where multiple customers (Customer A, B, and C) are connected across a service provider network using PE (Provider Edge) routers.

PE1 and PE2 exchange VPN routes for all customers using BGP/MPLS Layer 3 VPN (L3VPN) routing.

The question asks how to verify if PE2 is receiving VPN routes for Customer C.

Evaluating the Answer Choices

✅ B. show route table bgp.l3vpn.0 (Correct Answer)

Why?

This command shows all VPN routes stored in the BGP Layer 3 VPN table (bgp.l3vpn.0).

Since PE routers exchange VPN routes using MP-BGP, this table contains the VPN-IPv4 or VPN-IPv6 routes for all customers.

If PE2 is receiving routes from PE1 for Customer C, they will appear in bgp.l3vpn.0.

❌ A. show route table inet.0 (Incorrect)

Why?

The inet.0 table contains global unicast routes for the service provider's network.

VPN routes do not appear here because they are stored in VRF-specific tables.

This command won’t help verify VPN route exchange between PE1 and PE2.

❌ C. show route table customer-c.inet.0 (Incorrect)

Why?

The table customer-c.inet.0 represents the VRF routing table for Customer C on the local PE.

It only shows locally installed routes for Customer C but does not confirm if PE2 is receiving routes from PE1.

This command is useful to check local VPN routing but not BGP route propagation.

❌ D. show route summary (Incorrect)

Why?

This command only provides a summary of route counts per protocol (BGP, OSPF, etc.).

It does not display specific VPN routes.

It is useful for general troubleshooting but doesn’t confirm VPN route receipt.

Final Answer: ✅ show route table bgp.l3vpn.0 (Option B)

Official Juniper Documentation Reference

Junos MPLS VPNs Configuration Guide???? Juniper Documentation

"The show route table bgp.l3vpn.0 command displays all VPN-IPv4 routes learned via MP-BGP for Layer 3 VPNs."

To reduce the impact of suboptimal routing in OSPF and OSPFv3 after devices reboot, you can use the overload feature to prevent a router from being used as a transit router for a specified period of time. This allows the router to stabilize its routing table before forwarding traffic for other routers. To enable the overload feature, you need to do the following:

For OSPF, configure the overload statement under [edit protocols ospf] hierarchy level. You can also specify a timeout value in seconds to indicate how long the router should remain in overload state after it boots up. For example, set protocols ospf overload timeout 900 means that the router will be in overload state for 15 minutes after it boots up.

For OSPFv3, configure the overload statement under [edit protocols ospf3] hierarchy level. You can also specify a realm (ipv4-unicast or ipv6-unicast) and a timeout value in seconds to indicate how long the router should remain in overload state after it boots up for each realm. For example, set protocols ospf3 realm ipv4-unicast overload timeout 900 means that the router will be in overload state for 15 minutes after it boots up for IPv4 unicast routing.

In the exhibit, the PE-to-CE protocol used is OSPF, and there is an OSPF neighborship between CE-1 and CE-2 within the same Area 0. Let's analyze the default OSPF routing behavior in this setup to determine the correct statement.

1. **OSPF Neighborship**:

- CE-1 and CE-2 have an OSPF neighborship directly within Area 0.

- OSPF prefers intra-area routes over inter-area and external routes.

2. **Default Routing Behavior**:

- Since CE-1 and CE-2 are directly connected through an OSPF link within the same area, OSPF will prefer this direct intra-area path over any other paths learned via the PE routers and the L3VPN.

- This is because intra-area routes have a lower metric compared to inter-area or external routes.

3. **Metric Considerations**:

- By default, OSPF will route traffic between Site-1 and Site-2 through the direct link between CE-1 and CE-2, unless the link's metric is artificially increased to make it less preferable.

- There is no need to adjust metrics for the CE-1 to PE-1 link to prefer the CE-1 to CE-2 path, as OSPF already prefers direct intra-area paths.

**Conclusion**:

Given the default behavior of OSPF and the topology shown in the exhibit, the correct statement is:

**B. Hosts at Site-1 will reach hosts at Site-2 through the CE-1 and CE-2 link by default.**

**References**:

- OSPF Design Guide: [Juniper Networks OSPF Design Guide](https://www.juniper.net/documentation/en_US/junos/topics/concept/ospf-design-overview.html)

- Juniper Networks Technical Documentation on OSPF: [Junos OS OSPF Configuration Guide](https://www.juniper.net/documentation/en_US/junos/topics/concept/ospf-routing-overview.html)

The provided configuration is for a routing instance named VPN-A on a Juniper PE (Provider Edge) router. Let’s break it down:

Instance Type: VRF

The instance-type vrf; statement indicates that this is a Layer 3 VPN (L3VPN) using MPLS VPNs (RFC 4364 – BGP/MPLS IP VPNs).

This confirms that Option D (A Layer 3 VPN is configured) is correct ✅.

VRF Target and Interface Association

The vrf-target target:64512:1234; defines the route target (RT) for importing and exporting VPN routes.

The interface ge-0/0/1.0; binds this interface to the VRF.

BGP Configuration for CE (Customer Edge) Peering

The group CE section configures external BGP (EBGP) (type external;).

The neighbor 10.0.0.1 is in AS 64512 (peer-as 64512;).

The as-override; statement is used.

Evaluating the Answer Choices

✅ Option B: "This VPN connects customer sites that use the same AS number."

The as-override; command allows multiple customer sites that use the same AS number (64512) to communicate over the service provider’s MPLS network.

Normally, BGP prevents routes with the same AS in the AS_PATH from being accepted. The as-override feature replaces the customer's AS number with the provider’s AS, ensuring proper route advertisement.

✅ This statement is correct.

❌ Option A: "This VPN connects customer sites that use different AS numbers."

If the customer sites had different AS numbers, there would be no need for as-override.

The as-override feature is specifically used when all customer sites share the same AS number, ensuring that BGP routes are accepted.

❌ This statement is incorrect.

❌ Option C: "A Layer 2 VPN is configured."

A Layer 2 VPN (L2VPN) configuration would typically use instance-type l2vpn; or EVPN/VPLS-related parameters (e.g., protocols l2vpn or protocols vpls).

Since this configuration uses instance-type vrf; and BGP with a VRF target, it is clearly a Layer 3 VPN (L3VPN).

❌ This statement is incorrect.

✅ Option D: "A Layer 3 VPN is configured."

The instance-type vrf; confirms this is an MPLS Layer 3 VPN (L3VPN).

VRFs, BGP, and route targets (vrf-target) are specific to Layer 3 VPNs.

✅ This statement is correct.

Final Answer:

✅ B. This VPN connects customer sites that use the same AS number.

✅ D. A Layer 3 VPN is configured.

Verification from Juniper Documentation:

Juniper BGP/MPLS Layer 3 VPNs Guide confirms that instance-type vrf is used for L3VPNs.

Juniper BGP Configuration Guide states that as-override is applied when customer sites use the same AS number.

RFC 4364 (BGP/MPLS IP VPNs) explains how route targets and VRFs are used in L3VPN deployments.

BGP add-path is a feature that allows the advertisement of multiple paths through the same peering session for the same prefix without the new paths implicitly replacing any previous paths. This behavior promotes path diversity and reduces multi-exit discriminator (MED) oscillations. BGP add-path is implemented by adding a path identifier to each path in the NLRI. The path identifier can be considered as something similar to a route distinguisher in VPNs, except that a path ID can apply to any address family. Path IDs are unique to a peering session and are generated for each network3. In this question, we have a route reflector (RR) that receives two routes for the same prefix (192.168.0.0/16) from an EBGP neighbor. By default, the RR will only advertise its best path to its clients (R1 and R2). However, we want R1 and R2 to receive both routes from the RR. To achieve this, we need to configure BGP add-path on the RR and enable it to send multiple paths for the same prefix to its clients.

AToM (Any Transport over MPLS) is a framework that supports various Layer 2 transport types over an MPLS network core. One of the transport types supported by AToM is LDP Layer 2 circuit, which is a point-to-point Layer 2 connection that uses LDP for signaling and MPLS for forwarding. LDP Layer 2 circuit can support Layer 2 connectivity without using BGP and can be scalable and efficient by using a single MPLS LSP for multiple VPN connections. The customer can maintain all routing for their private network by using their own CE switches.

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/bgp/topics/example/bgp-advertise-peer-as.html