JN0-351

JN0-351 JNCIS-ENT Exam Details

Domain Weight Breakdown

Certification Path & Exam Preparation

The JNCIS-ENT is the specialist-level certification in the Juniper Enterprise Routing and Switching track. It sits above JNCIA-Junos and below JNCIP-ENT. This exam validates intermediate-level knowledge of enterprise networking technologies on Juniper platforms, including advanced Layer 2 switching, OSPF and IS-IS interior gateway protocols, BGP exterior gateway protocol, and routing policy manipulation. Candidates are expected to understand not just basic configuration but also advanced features such as OSPF multi-area design, BGP path selection, and complex routing policy chains.

Recommended study resources include the Juniper Open Learning JNCIS-ENT course material, Junos documentation on TechLibrary, and hands-on practice with vMX, vSRX, or vQFX virtual devices in lab environments such as Juniper vLabs or EVE-NG. The exam heavily tests your ability to interpret show command outputs and understand the operational impact of configuration changes. Focus your preparation on understanding the interaction between routing protocols, policy frameworks, and forwarding behavior. The exam also tests knowledge of EX Series and QFX Series switching features relevant to enterprise campus and data center environments.

Tip: The JNCIS-ENT exam frequently presents scenario-based questions requiring you to analyze show command outputs. Practice reading show ospf neighbor, show bgp summary, and show route outputs until you can quickly identify issues.

VLAN Configuration on EX Series

Junos EX and QFX Series switches use the vlans configuration hierarchy along with the family ethernet-switching interface configuration. VLANs provide Layer 2 broadcast domain segmentation. Each VLAN is defined with a name and VLAN ID (1-4094). Interfaces are placed in either access mode (single VLAN, untagged) or trunk mode (multiple VLANs, tagged with 802.1Q). Understanding the difference between enhanced Layer 2 software (ELS) and legacy configuration syntax is essential, as the exam uses ELS syntax exclusively for modern EX platforms.

IRB (Integrated Routing and Bridging)

IRB interfaces provide Layer 3 gateway functionality for VLANs, equivalent to Cisco SVIs. When you need inter-VLAN routing on a Juniper switch, you create an IRB interface and associate it with the VLAN. Each IRB unit number corresponds to the VLAN it serves. The switch then performs routing between VLANs using the IRB interfaces as gateways.

Tip: The IRB unit number does not have to match the VLAN ID, but it is best practice to use matching numbers (e.g., irb.10 for VLAN 10) to maintain clarity. On the exam, always check the IRB unit-to-VLAN mapping.

Link Aggregation (LAG / ae Interfaces)

Link Aggregation Groups bundle multiple physical links into one logical link for increased bandwidth and redundancy. Junos uses aggregated Ethernet (ae) interfaces. LACP (Link Aggregation Control Protocol) is recommended for dynamic negotiation. You must first define the maximum number of ae devices on the chassis before creating ae interfaces.

Spanning Tree Protocols

Spanning Tree prevents Layer 2 loops by blocking redundant paths while maintaining a loop-free topology. Junos supports multiple STP variants. RSTP is the default on EX Series switches and provides significantly faster convergence than legacy STP. MSTP allows mapping multiple VLANs to STP instances for efficient use of redundant links. VSTP provides per-VLAN spanning tree behavior similar to Cisco PVST+.

Tip: Bridge priority in Junos must be set in increments of 4096 (0, 4096, 8192, etc.). The default bridge priority is 32768. The lowest bridge priority wins the root bridge election. Enable bpdu-block-on-edge globally to protect edge ports from rogue switches.

Storm Control & Port Security

Storm control limits broadcast, multicast, and unknown unicast traffic on switch ports to prevent traffic storms from consuming bandwidth. Port security features such as MAC limiting and DHCP snooping protect the network from unauthorized devices and attacks. Junos provides ethernet-switching-options for these features, including persistent MAC learning and allowed MAC configurations.

OSPF Overview & Multi-Area Design

OSPF is a link-state interior gateway protocol that uses Dijkstra's SPF algorithm to calculate the shortest path to every destination. Junos supports both OSPFv2 (IPv4) and OSPFv3 (IPv6). The JNCIS-ENT exam tests advanced OSPF concepts including multi-area design, LSA types, area types, route summarization, and virtual links. OSPF uses cost as its metric, calculated from reference bandwidth divided by interface bandwidth. The default reference bandwidth in Junos is 100 Mbps, so a 1 Gbps link has a cost of 0.1, which Junos rounds to 1.

OSPF LSA Types

Link-State Advertisements are the fundamental data units of OSPF. Each LSA type carries specific routing information and has defined flooding scope. Understanding LSA types is critical for the exam.

OSPF Area Types

Tip: All routers in a stub or NSSA area must agree on the area type. The no-summaries keyword is configured only on the ABR. In Junos, use default-lsa default-metric to inject a default route into an NSSA area.

OSPF Route Summarization & Virtual Links

Route summarization reduces the size of routing tables and LSA flooding. In OSPF, summarization can only occur at ABRs (inter-area) and ASBRs (external). Virtual links provide a logical connection through a transit area to connect a disconnected area to the backbone (area 0). Virtual links are configured between two ABRs using their router IDs.

OSPF Verification Commands

IS-IS (Intermediate System to Intermediate System)

IS-IS is a link-state IGP that operates directly on the data link layer (not over IP). It uses a two-level hierarchy: Level 1 (intra-area) and Level 2 (inter-area/backbone). IS-IS uses CLNS (Connectionless Network Service) addressing with NET (Network Entity Title) addresses for router identification. IS-IS is widely used in service provider and large enterprise networks due to its scalability and fast convergence. Unlike OSPF, IS-IS does not require area 0 and supports both IPv4 and IPv6 natively through TLV extensions.

IS-IS NET Address Format

The NET (Network Entity Title) identifies an IS-IS router and its area. The format is: Area ID + System ID (6 bytes) + SEL (1 byte, always 00 for NET).

Tip: To derive System ID from an IP address like 10.1.1.1, pad to three groups: 010.001.001.001 then regroup as 0100.0100.1001. The exam frequently tests NET address construction and interpretation.

BGP (Border Gateway Protocol) Fundamentals

BGP is the path-vector exterior gateway protocol used for inter-AS routing. Junos supports both EBGP (external BGP, between different autonomous systems) and IBGP (internal BGP, within the same AS). BGP uses TCP port 179 for peer communication. Unlike IGPs, BGP does not discover neighbors automatically; peerings must be explicitly configured. BGP is incremental, sending only updates when routes change rather than periodic full table exchanges.

BGP Configuration in Junos

Tip: In Junos, BGP does not advertise any routes by default. You MUST configure an export policy to advertise routes to BGP peers. This is a critical difference from Cisco IOS where network statements are used. Also, IBGP peers should use loopback addresses for resilience.

BGP Path Selection Algorithm

When BGP receives multiple paths to the same destination, it uses the following selection criteria in order (Junos default):

Route Reflectors & AS Confederations

IBGP requires a full mesh between all peers in an AS, which does not scale. Route reflectors (RR) solve this by allowing a single router to reflect IBGP routes to its clients, eliminating the full-mesh requirement. Confederations divide an AS into sub-autonomous systems to reduce IBGP peering. The exam tests both concepts and their configuration in Junos.

Routing Policy Framework

Junos routing policies control route advertisement, acceptance, and attribute manipulation. Policies are defined under policy-options and applied as import or export policies to routing protocols. Each policy contains one or more terms evaluated sequentially. A term has a from clause (match conditions) and a then clause (actions). If no term matches, the protocol's default policy applies. Understanding the policy evaluation chain and default behaviors is essential for the JNCIS-ENT exam.

Tip: The OSPF export policy controls route redistribution INTO OSPF (generating Type 5 LSAs), not the flooding of OSPF LSAs themselves. BGP requires an explicit export policy to advertise non-BGP routes. Know these defaults thoroughly for the exam.

Policy Structure & Match Conditions

Route Filter Match Types

Policy Actions (then clause)

Firewall Filters (Stateless Packet Filters)

Junos firewall filters are stateless ACLs applied to interfaces. They control packet forwarding at the data plane level. Filters use terms with match conditions and actions. Firewall filters operate on the PFE for high-speed processing. They can be applied in the input or output direction on any interface, including lo0 for control plane protection. Unlike routing policies, firewall filters act on individual packets rather than routes.

Tip: Firewall filter actions: accept allows the packet, discard silently drops it, reject drops and sends an ICMP error. There is an implicit discard at the end of every filter. Always include terms for necessary management and routing protocol traffic when applying filters to lo0.

Policers & Rate Limiting

Policers in firewall filters provide rate limiting at the interface level. They can be single-rate two-color or three-color policers. Policers are defined under the firewall hierarchy and referenced within filter terms. Traffic exceeding the configured rate can be discarded, marked down, or forwarded with a different forwarding class.

OSPF vs IS-IS Comparison

EBGP vs IBGP Key Differences

Routing Policy vs Firewall Filter

Essential Verification Commands

Exam Day Tips

Tip: The JNCIS-ENT exam is heavily scenario-based. You will be shown network diagrams and configuration snippets and asked to identify issues or predict behavior. Practice reading Junos show command outputs extensively.

Tip: Remember that Junos BGP does NOT advertise routes without an explicit export policy. If a question shows BGP peers are established but routes are not being advertised, the first thing to check is the export policy.

Tip: For OSPF questions, always check: (1) area configuration matches on both sides, (2) interface types match (broadcast vs point-to-point), (3) authentication matches, (4) MTU matches. Mismatched parameters prevent adjacency formation.

Tip: When evaluating routing policy questions, trace through each term sequentially. A from clause with multiple conditions is an AND operation. Multiple terms provide OR logic. If a term has no from clause, it matches everything.

Tip: Know the difference between discard (silent drop) and reject (drop with ICMP unreachable) in firewall filters. Also understand that there is an implicit discard at the end of every firewall filter, unlike routing policies which fall through to default behavior.

Tip: For IS-IS questions, remember that the default router type is L1/L2. An L1-only router forwards all non-local traffic to the nearest L1/L2 router. The NET address must be configured on the loopback interface with family iso.