Vce JN0-649 Questions Latest

Step 1: Check the error messages in the log.

The log messages indicate:

vbnet

Copy code

Dec 22 19:22:29 router rpd[7394]: bgp_process_open:4185: NOTIFICATION sent to 192.168.1.4 (Internal AS 65000): code 2 (Open Message Error) subcode 2 (bad peer AS number), Reason: peer 192.168.1.4 (Internal AS 65000) claims 65100, 65000 configured

Dec 22 19:22:33 router rpd[7394]: bgp_pp_recv:4788: NOTIFICATION sent to 192.168.1.4+56714 (proto): code 2 (Open Message Error) subcode 2 (bad peer AS number), Reason: no group for 192.168.1.4+56714 (proto) from AS 65100 found (peer as mismatch) in master

Step 2: Interpret the messages.

The first message indicates that a BGP NOTIFICATION was sent to 192.168.1.4 due to an "Open Message Error" with a "bad peer AS number" because peer 192.168.1.4 claims AS 65100, but 65000 is configured.

The second message reiterates that the peer AS number 65100 does not match the configured AS 65000, causing a mismatch.

Step 3: Understand the MD5 key error.

sql

Copy code

Dec 22 19:23:29 router kernel: tcp_auth_ok: Packet from 192.168.1.5:64047 missing MD5 digest

Dec 22 19:23:30 router kernel: tcp_auth_ok: Packet from 192.168.1.6:56201 missing MD5 digest

These lines indicate that packets from 192.168.1.5 and 192.168.1.6 are missing the MD5 digest, suggesting a potential MD5 key misconfiguration.

Step 4: Validate the answers.

Option B: The 192.168.1.5 peer has a misconfigured MD5 key. This is correct because the logs show that packets from 192.168.1.5 are missing the MD5 digest.

Option D: The 192.168.1.4 peer has a misconfigured autonomous system number. This is correct because the logs indicate that 192.168.1.4 claims AS 65100, while the router is configured for AS 65000.

References:

Document on useful Juniper commands for troubleshooting BGP and understanding log messages​​​​.

Commands for checking BGP logs: show log messages | match notification, show bgp summary, show configuration protocols bgp​​​​.

To troubleshoot why ISP peers are not receiving any routes in a multihomed BGP setup, the following steps are essential:

Verify Active BGP Routes: Ensure that the BGP routes are active in the routing table. Only active routes can be advertised to BGP peers.

shell

Copy code

show route protocol bgp

Verify Export Policies: Check the export policies configured on your router. The export policies determine which routes are advertised to BGP peers. If these policies are incorrectly configured or missing, routes will not be advertised.

shell

Copy code

show configuration policy-options policy-statement

show configuration protocols bgp group export

References:

Useful Juniper Commands.txt

Tech Ops Managed Router Juniper Install Guide

Step 1: Identify the problem.

Devices do not support VPN NLRI, and you must prevent these devices from receiving BGP VPN routes.

Step 2: Analyze the possible solutions.

Option A: Configure an import policy on the remote peer to reject the routes when they are received.

This approach would require configuration on the remote peer, which might not always be practical or possible.

Option B: Configure an export policy on the local BGP peer to reject the VPN routes being sent to the remote peer.

This ensures the local BGP peer does not send the VPN routes to the remote peer, directly addressing the problem.

Option C: Configure a route reflector for the VPN NLRI.

This does not solve the issue of preventing the advertisement of VPN routes to non-supporting peers.

Option D: Configure the apply-vpn-export feature on the local BGP peer.

This feature ensures that the VPN export policies are applied, preventing the advertisement of VPN routes to peers that do not support VPN NLRI.

Step 3: Verify the configurations.

Option B and Option D directly address the requirement without needing configurations on the remote peer.

References:

Juniper BGP configuration guide on export policies​​​​​​.

Commands for applying export policies:

shell

Copy code

set policy-options policy-statement term from protocol bgp-vpn

set policy-options policy-statement term then reject

set protocols bgp group export

set protocols bgp apply-vpn-export

B - because only one next hop in forwarding table C- becuse TTL=1 limiting bgp connection to be established only over loopbacks interface https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/multihop-sessions.html Use the multihop statement to alter the default use of the neighbor 's physical address. In addition, you can also specify a time-to-live (TTL) value in the BGP packets to control how far they propagate. We use a TTL value of 1 to ensure that the session cannot be established across any other backdoor links in the network.