Juniper Updated JN0-650 Exam Questions and Answers by odin

In an EVPN-VXLAN Edge-Routed Bridging (ERB) architecture, also known as a collapsed fabric, the Layer 3 default gateway functionality is moved from the core/spine layer down to the edge (the leaf or distribution layer).

Anycast Gateways: To support seamless host mobility and redundancy, multiple distribution/leaf switches are configured with the same anycast IP address and MAC address on their IRB interfaces for a given VLAN. This allows a host to move between different switches without needing to update its default gateway configuration or ARP cache.

Distributed Routing: Routing occurs locally at the edge (distribution layer). Traffic destined for a different subnet is routed by the first switch it hits (the ingress leaf), rather than being backhauled to a central core router.

Symmetric vs. Asymmetric IRB: Junos OS 24.4 supports both models, but the ERB design typically utilizes symmetric routing for better scalability, where each leaf only needs to know the routes for its locally connected VNIs and uses a transit VNI for inter-subnet communication.

Option A is incorrect because while unique IPs can be used (Method 1 in some docs), the defining characteristic of an efficient ERB design is the use of shared Anycast IPs for the gateway. Option C describes a Centrally-Routed Bridging (CRB) design, not ERB.

The exhibit shows the output of the command show route protocol bgp on router R1 for the prefix 172.16.10.1/32. To determine the correct characteristics of this route, we analyze the specific BGP attributes and next-hop information provided in the routing table entry:

Multipath Parameter (Option B): The routing table shows two distinct paths for the prefix 172.16.10.1/32. The first path has two next hops (192.168.10.1 and 192.168.20.1) and is marked with the plus symbol (+) and the asterisk (*), indicating it is both an active and the best route. The presence of multiple next hops being used simultaneously for a single BGP path is a clear indication that the multipath parameter is enabled in the BGP configuration. In Junos OS, BGP multipath allows the installation of multiple equal-cost BGP paths into the forwarding table to facilitate load balancing.

Available Next Hops (Option C): The output explicitly lists two functional next hops for the active path: 192.168.10.1 via ge-1/0/0.2 and 192.168.20.1 via ge-1/0/1.3. Both show an outgoing interface, confirming that this route has two next hops available for traffic forwarding.

IBGP vs. EBGP (Option A): The BGP routes shown have an AS path of 200 I. This indicates the routes were learned from an external Autonomous System (AS 200). Furthermore, the protocol preference is 170. In Junos OS, the default preference for External BGP (EBGP) is 170, whereas the default preference for Internal BGP (IBGP) is 200. Therefore, this configuration is for EBGP, not IBGP.

Hidden Next Hops (Option D): The summary line at the top of the exhibit mentions that there are "2 hidden" routes in the inet.0 table. However, these hidden routes are not the next hops for the 172.16.10.1/32 prefix. A hidden route is a prefix that was rejected by policy or has an unreachable next hop; it is not a "hidden next hop" belonging to an active route.

Private VLANs (PVLANs) provide Layer 2 isolation between ports within the same broadcast domain. When a PVLAN spans multiple switches, a special type of trunk configuration is required to maintain the isolation and community logic across the inter-switch links.

Isolated VLAN Trunking (Option D): To extend an isolated VLAN across multiple switches, you must configure the trunk port on each switch to allow the isolated VLAN ID. In Junos OS, this is specifically achieved by configuring the interface as a trunk and associating it with the primary VLAN and the specific isolated VLAN. The correct syntax for enabling this inter-switch communication is to configure trunk ports that recognize the isolated VLAN tag (e.g., set interfaces unit 0 family ethernet-switching vlan members [ primary-vlan isolated-vlan ]).

Forwarding Rules: Traffic from an isolated port on Switch A must reach a promiscuous port (often on Switch B) to exit the PVLAN. The inter-switch trunk carries this traffic using the secondary (isolated) VLAN ID, ensuring that it remains isolated from other host ports on the remote switch.

Option A (inter-switch-link): In standard Junos switching, the inter-switch-link statement is used in Virtual Chassis or specific fabric designs, but for standard PVLAN extension, standard 802.1Q trunking with secondary VLAN IDs is the mechanism used.

Options B and C: These describe specific port roles (isolated vs. community) rather than the method used to enable trunking between switches.

In Junos OS 24.4, Captive Portal is used as a web-based authentication method for Layer 2 network access control, often in environments where 802.1X is not feasible for all users.

Fallback Mechanism (Option D): On EX Series switches, Juniper supports a flexible authentication order. By default, the switch attempts authentication in the order of 802.1X, then MAC RADIUS, and finally Captive Portal. If a client fails both 802.1X and MAC RADIUS, the switch can fall back to Captive Portal to redirect the user to a login page.

MAC Allowlist (Option B): Captive Portal relies on intercepting HTTP/HTTPS traffic to redirect users. However, "headless" devices like printers or cameras lack web browsers and cannot interact with the portal. To accommodate these, Junos allows administrators to configure an authentication allowlist (or whitelist), which identifies these devices by their MAC addresses and permits them to bypass the portal entirely.

Precedence (Option A): This is incorrect because Captive Portal is generally the last method in the default sequence, not the first.

Layer 2 Participation (Option C): While Captive Portal requires a Layer 3 interface (RVI/IRB) for the redirection process, it is explicitly used to control Layer 2 access on EX Series switches.