On EX Series switches, aggregated Ethernet (ae) interfaces do not exist by default; before any ae interface can be created, referenced, or brought into service, an administrator must first reserve the desired number of aggregated Ethernet device slots by configuring set chassis aggregated-devices ethernet device-count number at the [edit chassis] hierarchy. This statement allocates the internal resources needed for that many ae interfaces to exist as valid, configurable objects; until it is committed, any interface-level configuration referencing ae0 (such as the aggregated-ether-options and family ethernet-switching stanzas shown in the exhibit) is accepted syntactically by the CLI but never actually instantiates a live ae0 device, which is exactly why show interfaces ae0.0 returns 'device ae0 not found' despite the interface appearing fully configured. Increasing the device-count to at least 1 (or higher, to cover the number of LAG bundles planned) immediately resolves this and allows ae0 to appear as an operational interface once its member links are also associated with it. This is a foundational and frequently overlooked prerequisite step in LAG deployment on Juniper switches. There is no separate licensing requirement for aggregated Ethernet functionality on EX Series switches, a reboot is not needed since the chassis statement takes effect upon commit, and the LACP mode (active versus passive) is unrelated to whether the ae interface object itself exists in the first place. Reference topics: Junos Enterprise Switching – Link Aggregation, Configuring the Aggregated Ethernet Device Count.

Voice VLAN is the Junos feature specifically designed to allow a single access port to simultaneously handle two distinct traffic streams: untagged data traffic from a PC or workstation using the port's normal access VLAN, and separately tagged voice traffic generated by an IP telephone that is typically daisy-chained between the switch port and the connected PC. When voice VLAN is configured on an access interface, the switch instructs the attached IP phone (commonly via LLDP-MED) which VLAN ID to tag its voice traffic with, and the switch is then able to correctly classify and prioritize that tagged voice traffic into its designated voice VLAN while simultaneously continuing to treat any untagged frames arriving on that same physical port as belonging to the port's regular, untagged access VLAN — precisely satisfying the requirement to accept both tagged and untagged traffic together on one access port. Native VLAN, by contrast, is a trunk-port-only concept that designates which VLAN untagged frames on a trunk should be associated with; it has no applicability to an access port and does not enable simultaneous tagged traffic acceptance there. Default VLAN simply refers to the VLAN an interface belongs to absent other configuration and carries no dual-traffic capability. IRB interfaces provide Layer 3 gateway functionality for a VLAN and are unrelated to how tagged versus untagged frames are accepted at Layer 2 on a given physical port. Reference topics: Junos Enterprise Switching – VLANs, Configuring Voice VLAN on Access Interfaces.

A functioning GRE tunnel interface in Junos requires, at minimum, both a tunnel source address and a tunnel destination address configured together under the tunnel statement of the gr- logical unit, since these two values together define the outer, delivery-layer IP header that will encapsulate every passenger packet sent through the tunnel; the source identifies which of the router's own addresses will originate the encapsulated traffic, and the destination identifies the remote tunnel endpoint the encapsulated traffic must be routed toward across the underlying IP network. The first option correctly supplies both required values in a single, complete statement — source 192.168.1.1 (Router A's own address) and destination 192.168.2.1 (Router B's address) — fully defining the tunnel's endpoints and ensuring the encapsulation and route-resolution process can succeed. The fourth option supplies only the destination and omits the source entirely, which is an incomplete configuration; without an explicit source, Junos cannot always reliably determine which local address to use for encapsulation, particularly on multi-address or multi-interface routers, and the tunnel configuration is left non-deterministic or non-functional as shown. The second option enables the IPv6 protocol family on the tunnel's logical unit, which is irrelevant to a scenario explicitly requiring IPv4 passenger traffic support. The third option attempts to assign a family inet address directly using one of the underlying tunnel endpoint addresses, which conflates the tunnel's own transport addressing with logical-unit protocol addressing and does not by itself establish the required source/destination tunnel definition. Reference topics: Junos Enterprise Routing – Tunneling, Configuring GRE Tunnel Source and Destination.

The diagnostic output explicitly states the root cause: the local router has only the inet6-unicast address family configured for this peer, while the remote router advertised inet-unicast and inet-vpn-unicast in its OPEN message, and BGP requires at least one common negotiated address family (NLRI type) between two peers for a session to remain established; with zero overlap between the two sides' configured families, the session is torn down immediately after the OPEN exchange, which is precisely why the peer state shows Active rather than Established. This confirms the mismatched-address-family statement directly and unambiguously from the exhibit's own Down reason and Detail reason fields. The diagnostic tool's own embedded Suggestion text goes further, explicitly advising the administrator to additionally verify that the local-address configured for the peer matches the remote router's configured neighbor address and vice versa — a secondary, commonly encountered condition in which mismatched or effectively duplicated/incorrect address bindings between the two sides' neighbor statements can independently prevent a session from completing correctly, even once the family mismatch is resolved. This is why address-configuration consistency between the peers is flagged as a second concern worth checking in this scenario. Nothing in the exhibit references NTP or time synchronization at all, nor does anything in the output reference authentication, an MD5 mismatch, or any related failure signature; both of those conditions would present through entirely different diagnostic messages than the one shown here. Reference topics: Junos Enterprise Routing – BGP, Address Family Negotiation and the show bgp diagnostics neighbor Command.

The show ethernet-switching table command displays the Layer 2 forwarding database (the bridge or MAC table) that an EX Series switch builds dynamically by inspecting the source MAC address of every frame it receives. Each entry records the learned MAC address, the VLAN it was learned on, the type of entry (dynamic, static, or persistent), and the specific interface through which that address was seen, which is precisely the information needed to confirm whether the switch has learned the host connected to ge-0/0/3. If the host's MAC address is absent from the table, that immediately points to a Layer 1/2 issue — no frames have been received from the host, a cabling or port problem exists, or the interface is administratively down or blocked by spanning tree — rather than a Layer 3 routing or VLAN membership problem. show interfaces terse only reports administrative and link state along with any assigned protocol family addresses, offering no MAC-learning visibility. show vlans lists VLAN definitions and their member interfaces but does not display learned host addresses. show interfaces extensive provides detailed physical-layer counters and error statistics, useful for diagnosing frame loss or interface errors, but it does not expose the switching table. For intra-VLAN reachability troubleshooting, verifying MAC learning is always the first and most direct Layer 2 checkpoint. Reference topics: Junos Enterprise Switching – Layer 2 Switching Fundamentals, Monitoring the Ethernet Switching Table.

Layer 2 MAC learning on an EX Series switch, as on any standard Ethernet bridge, is a passive, frame-driven process rather than an active polling or query-based mechanism. Every time a frame arrives on any interface, the switch inspects the frame's source MAC address field and, if that address is not already present in the Ethernet switching (bridge) table for the associated VLAN, creates a new dynamic entry recording the source MAC address, the VLAN it was learned on, and the specific ingress interface through which the frame arrived. Junos also stamps each learned entry with an aging timestamp, which is refreshed every time a subsequent frame from that same source MAC is received; entries that receive no refreshing traffic within the configured MAC aging interval (300 seconds by default) are eventually purged from the table to keep it current and to reclaim table space from hosts that have moved or gone offline. This source-address-driven, per-frame learning process happens continuously and automatically with no dependency on spanning-tree state changes — although a topology change notification can trigger accelerated aging of the table to flush potentially stale entries faster, learning itself is not gated by or contingent upon such an event occurring. The switch never learns addresses from the destination field of a frame, since the destination address, if already known, is used purely for the forwarding lookup decision, not for populating new table entries. Reference topics: Junos Enterprise Switching – Layer 2 Switching Fundamentals, Source MAC Learning and Table Aging.

A BGP NOTIFICATION message is one of the four core message types defined in RFC 4271, alongside OPEN, UPDATE, and KEEPALIVE, and it serves a very specific and narrow purpose within the protocol: whenever a BGP speaker detects an unrecoverable, fatal condition in the session — such as a malformed OPEN message, an unsupported capability, a hold-timer expiration, a finite-state-machine error, or an administratively initiated reset — it transmits a NOTIFICATION message to its peer immediately before closing the underlying TCP connection and tearing down the session entirely. This confirms that a NOTIFICATION always signals the termination of the session upon a fatal error, never a routine, in-session update. Structurally, every NOTIFICATION message carries a defined error code and error subcode field, which together precisely classify the category and specific nature of the fault that triggered the termination (for example, 'Cease' with a subcode indicating administrative shutdown, or 'Update Message Error' with a subcode indicating a malformed attribute), giving the receiving peer's administrator concrete diagnostic information about exactly why the session was torn down. Updating route attributes while keeping a session alive is the role of the UPDATE message, not NOTIFICATION, and refreshing a neighbor's table without resetting the session describes the optional Route Refresh capability (a separate, distinct BGP mechanism), neither of which describes NOTIFICATION's function. Reference topics: Junos Enterprise Routing – BGP, BGP Message Types and the NOTIFICATION Message.

RSTP, as defined in IEEE 802.1w, introduces explicit, well-defined port roles that go beyond legacy 802.1D STP's simpler root/designated/blocking model, and the alternate port role is one of RSTP's key refinements. An alternate port is a port that receives BPDUs from a bridge other than the one through which the local switch's actual root port reaches the root bridge — in other words, it represents a second, redundant path toward the root bridge learned from a different upstream bridge than the one currently providing the best (root port) path. Because the existing root port already provides the lowest-cost, actively used path to the root, the alternate port is deliberately held in the discarding (non-forwarding) state during normal, stable operation, functioning purely as a pre-computed, ready-to-use backup; critically, RSTP's major performance advantage over legacy STP is that if the current root port fails, the switch can transition its alternate port directly and almost instantly into the forwarding root port role without needing to pass through the lengthy listening and learning timer-based states that classic STP required, since the alternate port's suitability as a backup was already continuously verified through ongoing BPDU reception. It is not simply 'not receiving BPDUs' (an alternate port receives BPDUs continuously, just inferior ones relative to the current root port), it is not itself the least-cost path (that describes the root port), and it does not forward based on designated-port overload, which is not a concept that exists in RSTP's port-role logic at all. Reference topics: Junos Enterprise Switching – Spanning Tree Protocols, RSTP Port Roles: Alternate and Backup Ports.

A GRE tunnel's outer, delivery-layer packets are forwarded using the router's ordinary underlay routing table, meaning the tunnel destination address (192.168.0.1 in this case) must itself be resolvable to a physical, non-tunnel next hop for the encapsulated packets to actually leave the router. Before this configuration change, the default route (or some more specific route) presumably pointed toward a real physical next hop, allowing the router to reach 192.168.0.1 and keep the tunnel operational. When the administrator commits a static default route of 0.0.0.0/0 with a next hop of gr-0/0/0, every destination lookup that previously fell back to the default route — including the lookup for the tunnel's own destination address, 192.168.0.1, since no more specific route exists for it — now recurses through the GRE interface itself. This creates a circular dependency: the router needs to route to 192.168.0.1 to keep the tunnel up, but the only route it has to reach 192.168.0.1 now points back into the tunnel that requires 192.168.0.1 to already be reachable, so the interface's next-hop resolution fails and the tunnel drops. This is an entirely valid and common GRE design pitfall rather than any platform restriction; GRE interfaces can be legitimately used as static route next hops, do not require loopback-sourced encapsulation, and do not require a /32 host route to resolve their destination, provided that route does not recursively point back through the tunnel. Reference topics: Junos Enterprise Routing – Tunneling, Route Recursion and GRE Tunnel Destination Resolution.

The metric that OSPF assigns to a destination is visible from two complementary vantage points in Junos. The show route protocol ospf command displays the main routing table filtered to OSPF-learned prefixes, and each entry shows the computed cost alongside the next hop, exactly as it was installed after SPF calculation. The show ospf route command (which accepts filters such as intra-area, inter-area, and extern) presents the OSPF-specific routing table, organized by route type, and explicitly lists the metric column for every intra-area, inter-area, and external route the local router has calculated. Together these two commands give both the RIB-level and the protocol-level view of route cost. By contrast, show ospf database extensive dumps the raw link-state advertisements, where metrics appear only as link-level values buried inside Router or Network LSAs rather than as a resolved route cost, so it is not the direct tool for viewing a route's metric. show ospf interface reports interface operational state, area, and DR/BDR information but does not present a cost or metric field at all in its standard output. Candidates should be comfortable distinguishing the RIB-oriented and protocol-table-oriented verification commands, since JNCIS-ENT scenarios frequently test whether a candidate reaches for the correct show command layer during troubleshooting. Reference topics: Junos Enterprise Routing – OSPF Operation and Verification, Monitoring OSPF.