[{"content":"Last Updated: 3/17/26\nNote to Test Takers: This document is a Summary Reference, not a replacement for a comprehensive course and hands on experience in a lab. I recommend the CBT Nuggets course because Knox is great at explaining networking concepts with the right amount of enthusiasm.\nTable of Contents\nNetworking Fundamentals Junos OS Fundamentals User Interfaces Configuration Basics Operational Monitoring and Maintenance Routing Fundamentals Routing Policy and Firewall Filters Glossary Lab Recommendations Networking Fundamentals The OSI Model Where it all starts and I\u0026rsquo;m not sure if its really covered in the JNCIA exam. This is an industry standard crafted back in the 1970s. The model has seven layers from physical up through application. The really important bit is the breakdown of the lower layers as you will see L1, L2, L3, L4 all over the place. These are logical separations of the networking stack L1 - Physical layer - Think cabling and electrical or photonic pulses on said cabling L2 - Data-link layer - Think frames, ethernet, and mac addresses L3 - Network layer - Packets, IPs, and routing L4 - Transport layer - Segments, TCP/UDP, and SYN+ACKs Function of routers and switches Routers use L3 information to forward packets between networks Switches use L2 info to forward packets on the lan Ethernet networks Major concept here is Mac addresses Physical address made up of 48 bits and displayed using hexadecimal format Broadcast address is ffff.ffff.ffff Uses mac addresses to forward ethernet frame Ethernet header + trailing checksum Preamble - Tells the receiving side that a frame is coming and allows synchronization SFD - Start Frame Delimiter - Signals the D-MAC is next Dest MAC - MAC address of the frames destination SRC MAC - MAC address of the frame sender Type - Defines the type of protocol found inside the frame. IE v4 vs v6 Data + padding - The frame payload and optional padding to get it to a minimum of 46 bytes in this field. FCS - Frame Check Sequence - Contains a 32 bit CRC which checks for corrupted data Layer 2 addressing, including address resolution Layer 3 / IP addressing including subnet masks ARP - Address resolution protocol acts at layer2 and is a process for mapping mac addresses to IP addresses. IPv4 Fundamentals 32 bit addresses The data unit at layer 3 is called a packet Packet header: IPv6 Fundamentals No broadcast traffic Anycast used instead Made up of 128 bits 8 groups of 4 hex characters For each group you can eliminate leading zeros You can also remove 0 groups that are in order one time using double colon 2001:0FA7:0000:0000:00E2:0000:0000:BEEF Becomes - 2001:FA7::E2:0:0:BEEF Every interface requires a Link local address used for communications on the subnet that the host is connected to will not be forwarded by the router Not guaranteed to be unique DAD - (Deduplicate Address Detection) - check if its unique Assigned from fe80::/10 generally by stateless address autoconfiguration Takes the above prefix, adds some padding and the mac address to automatically configure the link local Routable addresses are assigned from 2000::/3 Fragmentation only happens at the source node Header was designed to be simpler and easier to process. Subnetting and supernetting Subnetting is a skill that requires practice but does not require any special knowledge. Practice, practice, practice Supernetting Radix trees used to evaluate prefixes for route filters (follow up on this) Longest match routing An algorithm used by IP routers to select an entry from a routing table. The router uses the longest match to determine the egress interface and the address of the next device to which to send a packet When routing to 192.168.1.10 and you have 192.168.1.0/28 and 192.168.1.0/24 in the routing table the router will use 192.168.1.0/28 CoS Class of service allows you to divide traffic into classes and offer various levels of throughput and packet loss when congestion occurs. Connection-oriented vs. connectionless protocols TCP - Connection oriented Uses the three-way handshake to set up a session Syn, syn-ack, ack Receiving side responds with acks after receiving segments (AKA tcp data frame) Window size is beyond the scope of JNCIA Guarantees delivery UDP - Connectionless Ideal for real time communication and streaming media Fast which is what is needed If a packet is dropped it ends up being noise in the stream. IE degraded video for streaming but does not cause a failure Junos OS Fundamentals Software architecture Each process operates in its own protected memory space Two benefits of the disaggregated Junos OS Platform drivers and forwarding engine are removed from the control plane to increase performance The Architecture facilitates programmability through provisioning the control plane, the data path, and the platform APIs Junos release types R1 - first widely distributed version R2, R3 - maintenance releases Junos version breakdown M.nZb.s M - major release n - minor release Z - type b - build number s - spin number Control and forwarding planes There’s a rate limiter configured by default between the control and forwarding planes Control traffic is given higher priority than exception traffic if the link is congested fxp1, em1, or similar (vs em0 and fxp0 which are oob mgmt) Routing Engine Maintains Routing table Maintains Forwarding table Control/maintain chassis Manages the PFE Provides CLI or web interface Packet Forwarding Engine Implement services Policing, Stateless FW filters, QOS Uses the L2 and L3 forwarding tables to pass traffic Transit traffic processing When a packet arrives and does not match an entry in the forwarding table the PFE drops the packet and sends a destination unreachable icmp reply Exception traffic Destined for the local system Needs an icmp response User Interfaces CLI modes \u0026gt; user mode % shell mode reached by default when root user connects to the device cli brings the user back to the user mode # configure mode CLI navigation Ctrl + a – beginning of line Ctrl + e – end of line Ctrl + d – delete character under cursor Ctrl + w – delete word left of cursor Ctrl + k – delete everything right of cursor edit “level” -\u0026gt; to go to the specific spot of the config hierarchy up “number” -\u0026gt; to move up in the config hierarchy CLI Help help topic interfaces address -\u0026gt; Written documentation detailing how to configure interface addresses help reference interfaces address -\u0026gt; provides the syntax to configure this help apropos snmp -\u0026gt; all commands with “snmp” in them Filtering output Useful Pipe commands | match - show all lines of output with the given string | find - start output at first instance of string and then everything afterwards | count\t- show how many lines in the given command root@network-hub-1\u0026gt; show interfaces terse | count Count: 49 lines | last\t- display the last X amount of output | except - anything but the specified string Active versus candidate configuration\nActive configuration is the config that the device is using Candidate config is where changes are made while in config mode Once committed it becomes the active configuration Reverting to previous configurations\nroot@network-hub-1# rollback 1 — Loads the previous active config into the candidate config Modifying, managing, and saving configuration files Viewing, comparing, and loading configuration files\nroot@network-hub-1# show | compare rollback 0 Compares current candidate config to current active config J-Web (core/common functionality only)\nSame authentication as cli set system services web management http (or https this required for j-web to work) System identity sub page Configurable: Hostname, root password, dns servers, domain name Configuration Basics Factory-default state Can revert to the factory default with: load factory-default set system root-authentication plain-text-password commit Initial configuration\nUser accounts\nMember of a single login class Login classes\nA named container that groups together a set of one or more permission flags Four predefined classes Super-user - all permissions operator - clear, network, reset, trace, view Read-only - view only unauthorized - no permissions User authentication methods Local database Name and password individually for each user Radius and TACACS+ Can be mapped to locally defined template users Radius uses udp and encrypts the pass TACACS+ uses tcp and encrypts everything show system authentication-order Goes through the order trying one after the other even on rejects If local authentication is not in the authentication order it is only used if there was no response from the other options Interface types and properties fpc - flexible pic concentrator pic - port interface concentrator Port # ge-{{fpc}}/{{pic}}/{{port#}} - ge-0/0/0 When multiple IPs are on an interface belonging to the same subnet you can use preferred to set the ip you want to respond for the interface Configuration groups Use pipe command | display inheritance to show config with any config inherited from config groups included Allows you to separate common config from interface specific config Additional initial configuration elements, such as NTP, SNMP, and syslog\nSNMP: MIB Used to define managed objects on a network device Designed in a hierarchical tree structure Standard or enterprise specific Configuration archival\nLogging and tracing By default messages are saved to /var/log including traceoptions Rescue configuration Recommended to contain the minimal configuration needed to allow connectivity save active config as rescue using: request system configuration rescue save rollback rescue commit Interface Configurations All configuration directly under the ge-0/0/0 hierarchy is considered physical configuration. (MTU, lag interface, speed, duplex, encap, etc) All configuration under the unit # is considered logical configuration family inet, family ethernet-switching, aka the protocol on the interface Operational Monitoring and Maintenance Show commands\nshow chassis routing-engine - shows the RE’s temp, cpu util, memory util, serial, and uptime show system alarms - displays current alarms show interfaces {{ name }} show interfaces terse - shows interfaces and port status along with protocol and IP if it has one show interfaces {{ name }} extensive Shows errors, physical counters Monitor interface {{ name }} Shows realtime info on packet and byte counters Error and alarms monitor interface traffic – to see traffic on all interfaces in real time Interface statistics and errors\nNetwork tools, such as ping, traceroute, telnet, SSH, etc ping sends continues icmp messages to specified destination monitor traffic - captures traffic headed to the RE Can save these using write-file option and then open in wireshark traceroute - Transmits UDP Packets Receives ICMP time-exceeded packets Junos OS installation and upgrades request system software add {{ image name }} – to upgrade Need to reboot the device afterwards Unified in-service software upgrade ISSU Enables you to upgrade between two different Junos OS releases with no disruption on the control plane Only supported on dual RE platforms Require Nonstop active routing (NSR) Basically runs the routing daemons on the backup RE Step 1: Enable GRES and NSR and verify the re’s are synced Step 2: Download the image Step 3: request system software in-service-upgrade - on the primary RE Storage operations\nshow system storage – make sure there’s space for another image request system storage cleanup request system zeroize - clears config along with all logs Add media option to sanitize all storage on the device Powering on and shutting down Junos devices\nRoot password recovery\nRequires a console connection Can be disabled with: set system ports console insecure Steps for password recovery Step 1: Reboot the system Press space bar when prompted Enter boot -s to access single user mode Step 2: Enter recovery when prompted to go into recovery mode Step 3: Configure root password Step 4: commit and-quit and reboot when prompted Routing Fundamentals Traffic forwarding concepts\nRouting tables Common tables inet.0 - used for ipv4 unicast routes inet.1 - used for multicast forwarding cache inet.4 - used for Multicast BGP routes for rpf checking inet.3 - used for mpls path info inet.4 - used for MSDP route entries inet6.0 - used for ipv6 unicast routes Routing versus forwarding tables\nRoute preference Juniper’s way of saying administrative distance Used to differentiate routes learned from different protocols Values Direct\t: 0 Local\t: 0 Static\t: 5 Ospf\t: 10 RIP\t: 100 BGP\t: 170 Routing instances - A collection of routing tables, interfaces, and routing protocol parameters. The set of interfaces belongs to the routing tables, and the routing protocol parameters control the information in the routing tables.\nStatic routing Need a valid next hop Ip address of interface on neighboring router Egress port bit bucket (reject/discard) Qualified next hop function If primary becomes unavailable use defined next hop with a higher preference value Advantages of and use cases for dynamic routing protocols\nLess administrative overhead Dynamically route around failures OSPF Link state protocol Faster reconvergence Support larger networks Less susceptible to insufficient routing info than distant vector Main objectives of a link state protocol Reliably flood link-state info to neighbors Create a complete database of the network Calculate the best path to each destination LSAs (Link State Advertisements)\n* LSDB (Link-State Database) Stores the LSAs as a series of records Areas Uses Areas to incorporate hierarchy and enable scalability Software can summarize routing info from an OSPF area and pass it to the rest of the network Each OSPF router maintains a separate LSDB for each area its a part of LSDB is identical for all participating routers in an area All areas must connect to area 0 All data traffic between areas, must transit the backbone area Neighbor Adjacency States Attempt Down Exchange ExStart Full - up and running Init Loading 2-way Display Commands show route protocol ospf IPv6 routing Enabling on interface using family inet6 Once enabled the link-local ip is configured and the interface will now process IPv6 traffic To configure a v6 static route set routing-options rib inet6.0 static route 2001::0/20 next-hop 2001::1 Need to include the inet6.0 routing table for v6 You can use a link local address as the next-hop but will need to include the interface as well Ospfv3 or Ospf for v6 Fundamentally no different than vanilla ospf Config is the same syntax as vanilla ospf just being done under protocol ospf3 vs protocol ospf Routing Policy and Firewall Filters Default routing policies OSPF Import - Accept all OSPF routes and import into the inet.0 routing table Export - Reject everything. (The protocol uses flooding to announce local routes and any learned routes.) BGP Import - Accept all received BGP IPv4 routes learned from configured neighbors and import into the inet.0 routing table. Accept all received BGP IPv6 routes learned from configured neighbors and import into the inet6.0 routing table. Export - Readvertise all active BGP routes to all BGP speakers, while following protocol-specific rules that prohibit one IBGP speaker from readvertising routes learned from another IBGP speaker, unless it is functioning as a route reflector. Import and export policies\nRouting policy flow\nEffect of policies on routes and routing tables\nPolicy structure and terms\nPolicy match criteria, match types, and actions\nFirewall filter concepts aka acls Stateless filter Does not detect connections Looks at each packet Needs to be applied on egress and ingress Stateful Keeps state Only needs to permit traffic in one direction Filter structure and terms\nDefault action of firewall filters is discard The order of terms in a filter is important Filter match criteria and actions\nMatch Conditions for firewall filters Numeric range, Address, Bit-field Terminating Actions accept - accept the packet and continue the in/out processing discard - silently drop the packet without responding to source reject - Causes the system to discard the packet and send an icmp message back to the source address Other Actions next term - causes junos os to evaluate the next term Can be used to set a policer or dscp value and then continue to evaluate the traffic in the rest of the filter action modifiers - count, log, syslog, policer, forwarding-class Firewall operational commands\nshow firewall counter filter {{filter_name}} {{counter_name}} Policing\nRate limiting Work with firewall filters to stop ddos attacks Unicast reverse-path-forwarding (RPF) Don’t run it on ports where you don’t need it because it eats up control plane resources Strict mode - The packet is not accepted when either: The packet has a source address that does not match a prefix in the routing table. The interface does not expect to receive a packet with this source address prefix. Loose mode - The packet is not accepted when the packet has a source address that does not match a prefix in the routing table. Glossary Junos Architecture \u0026amp; Operations RE (Routing Engine): The \u0026ldquo;brain\u0026rdquo; of the device. It handles the control plane, running the Junos OS, managing routing tables, and controlling the user interface (CLI). PFE (Packet Forwarding Engine): The \u0026ldquo;brawn\u0026rdquo; of the device. It handles the data plane, performing hardware-based packet switching, filtering, and queuing. Transit Traffic: Traffic that enters one port and exits another. This is handled entirely by the PFE. Exception Traffic: Traffic destined for the device itself (e.g., SSH, BGP updates, or ICMP). This is passed from the PFE to the RE for processing. Active vs. Candidate Configuration: Junos uses a \u0026ldquo;check-out\u0026rdquo; system. You edit a Candidate config; it does not take effect until you Commit it to become the Active config. Interface Terminology FPC (Flexible PIC Concentrator): A physical slot or card in a chassis (e.g., ge-0/x/x). MAC: Typically referring to the mac address, the layer 2 address used to for frames in a broadcast domain. Logical Unit: In Junos, you must define a logical unit (usually unit 0) even for physical interfaces to assign an IP address. Family: Defines the protocol stack on an interface. Common types include inet (IPv4), inet6 (IPv6), and mpls. Routing \u0026amp; Protocols RT (Routing Table): The master list of all paths learned by the RE (e.g., inet.0 for IPv4). FT (Forwarding Table): A streamlined version of the RT sent down to the PFE for high-speed lookups. Route Preference: Juniper\u0026rsquo;s term for Administrative Distance. Lower numbers are more preferred (e.g., Direct = 0, OSPF = 10, BGP = 170). Routing Policy: Used to control the flow of routing information into or out of the Routing Table. Lab Recommendations I can\u0026rsquo;t stress enough the importance of having a lab environment to run through these different concepts. Yes you can memorize enough material to pass the exam but then its just a piece of paper. Or, these days, just a digital stamp you can add to your LinkedIn profile. The most important aspect is when you try to build a topology and it doesn\u0026rsquo;t work. Then you\u0026rsquo;re pushing show commands and pouring through the config to find the one little thing you missed. And that there is Network Engineering in a nutshell. My gear When I first passed the JNCIA ages ago I ran a couple of switches and an ancient J series firewall. It got the job done but was far from ideal, takes up too much space, and is far too loud. Now I run an EVE-NG bare metal installation on a Dell Precision 5810 I bought off Craigslist for ~$150. Started with 56GB of ram and thats more than plenty for the JNCIA. With that said, getting access to https://jlabs.juniper.net/vlabs/ is your best bet. There\u0026rsquo;s a ton of great labs already laid out and is a huge resource for learning how things work. Good Luck!\n","permalink":"https://ttl-expired.net/juniper-study-guides/jncia_reference_guide/","summary":"\u003cp\u003e\u003cstrong\u003eLast Updated: 3/17/26\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eNote to Test Takers:\u003c/strong\u003e This document is a \u003cstrong\u003eSummary Reference\u003c/strong\u003e, not a replacement for a comprehensive course and hands on experience in a lab. I recommend the CBT Nuggets course because Knox is great at explaining networking concepts with the right amount of enthusiasm.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eTable of Contents\u003c/strong\u003e\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003ca href=\"#networking-fundamentals\"\u003e\u003cstrong\u003eNetworking Fundamentals\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#junos-os-fundamentals\"\u003e\u003cstrong\u003eJunos OS Fundamentals\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#user-interfaces\"\u003e\u003cstrong\u003eUser Interfaces\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#configuration-basics\"\u003e\u003cstrong\u003eConfiguration Basics\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#operational-monitoring-and-maintenance\"\u003e\u003cstrong\u003eOperational Monitoring and Maintenance\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#routing-fundamentals\"\u003e\u003cstrong\u003eRouting Fundamentals\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#routing-policy-and-firewall-filters\"\u003e\u003cstrong\u003eRouting Policy and Firewall Filters\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#glossary\"\u003e\u003cstrong\u003eGlossary\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#lab-recommendations\"\u003e\u003cstrong\u003eLab Recommendations\u003c/strong\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch3 id=\"networking-fundamentals\"\u003e\u003cstrong\u003eNetworking Fundamentals\u003c/strong\u003e\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003ch4 id=\"the-osi-model\"\u003eThe OSI Model\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eWhere it all starts and I\u0026rsquo;m not sure if its really covered in the JNCIA exam. This is an industry standard crafted back in the 1970s.\u003c/li\u003e\n\u003cli\u003eThe model has seven layers from physical up through application.\u003c/li\u003e\n\u003cli\u003eThe really important bit is the breakdown of the lower layers as you will see L1, L2, L3, L4 all over the place.\u003c/li\u003e\n\u003cli\u003eThese are logical separations of the networking stack\n\u003cul\u003e\n\u003cli\u003eL1 - Physical layer - Think cabling and electrical or photonic pulses on said cabling\u003c/li\u003e\n\u003cli\u003eL2 - Data-link layer - Think frames, ethernet, and mac addresses\u003c/li\u003e\n\u003cli\u003eL3 - Network layer - Packets, IPs, and routing\u003c/li\u003e\n\u003cli\u003eL4 - Transport layer - Segments, TCP/UDP, and SYN+ACKs\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ch4 id=\"function-of-routers-and-switches\"\u003e\u003cstrong\u003eFunction of routers and switches\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eRouters use L3 information to forward packets between networks\u003c/li\u003e\n\u003cli\u003eSwitches use L2 info to forward packets on the lan\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003ch4 id=\"ethernet-networks\"\u003e\u003cstrong\u003eEthernet networks\u003c/strong\u003e\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eMajor concept here is Mac addresses\n\u003cul\u003e\n\u003cli\u003ePhysical address made up of 48 bits and displayed using hexadecimal format\u003c/li\u003e\n\u003cli\u003eBroadcast address is ffff.ffff.ffff\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eUses mac addresses to forward ethernet frame\u003c/li\u003e\n\u003cli\u003eEthernet header + trailing checksum\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cimg loading=\"lazy\" src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACjwAAADwCAYAAAC+eV85AABjkElEQVR4XuzdwatsXXof5m+Q/0BI7aEHHghEe2awgghtywhHEw006DgkkDbEGkh4IERAg0ioM9NEljwIoeMEIVsDDYQt49BqE+LG6o4JiJY8a6lBxrLcYGTsBuMoceBGvyuWvPTed+29q+rcXafqPD94+L57atXeu3ade+uttd7a9cknIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIibzt//jN/+U9/91/4z3/iuz/z/d/8T//C978DAF7GH762/sPv/s++/7/Ma63XX87m9w8Azuf1FwDO5/UXAM7n9RcA9m29XsoNyUmtJxsAeHl5c+/1l3vx+wcA5/P6CwDn8/oLAOfz+gsA++bXS7khOZHjpP7X/80PvfvK//5/vPuXv/XbAMAL+MZv/tN3f+t/+lvvX2P/uIj5wzf68+vvf/FX/9t3f+/X/rd3v/7PvwYv6itf/yfvfuZ/+R/f/46tfv/UfwDwstR/AHC+I+9//6u/+rl3//grf/vd7/6LXwUAXsDXf/vvv/uf/9effv8au3r9Nf8MwFu3mi+u/XtyQXKpzHEyf+In/od3/+Ff/+t37/7tvwUAPoK81o7X3eHHfuon3/2z//ufvfvd//d34aPK71r9/VP/AcDHpf4DgPN173//+8//d+/+4P/5P9/9f//f/wUAfAR5ra2vv+afAeBPmueLfb31DRmXkk4XaT3JAMDLyhv7+ZMbuepAnZSHjyWNFfOVLtR/APDxqf8A4Hz1/W+uOlWbMgCAl5UPFsxXejT/DAAfmueLfbX1Dfnuz3z/P8xJzKUz60kGAF5evrphvOHPVy3VSXn4mPLVmeP3T/0HAOdQ/wHA+eb3v/mqzdqUAQC8vH/8lb9t/hkAdoz54u/+zPd/s/bxycGMgiPfF15PMADw8v7lb/32H7/h/8rX/8kHE/LwMf36P//aH//+qf8A4BzqPwA43/z+9+u//fc/aMgAAF7e7/6LXzX/DAA75vniTz7zmf+k9vLJgYwTmJNZTzAA8PJymerx+pvJ9zohDx9TvtZL/QcA51L/AcD55ve/ab6oDRkAwMvL11qbfwaAbfN88Z//zF/+07WXTw5EwQEA57PgzT2p/wDgfOo/ADifhkcAOJ/5ZwDYp+Hxxig4AOB8Fry5J/UfAJxP/QcA59PwCADnM/8MAPs0PN4YBQcAnM+CN/ek/gOA86n/AOB8Gh4B4HzmnwFgn4bHG6PgAIDzWfDmntR/AHA+9R8AnE/DIwCcz/wzAOzT8HhjFBwAcD4L3tyT+g8Azqf+A4DzaXgEgPOZfwaAfRoeb4yCAwDOZ8Gbe1L/AcD51H8AcD4NjwBwPvPPALBPw+ONUXAAwPkseHNP6j8AOJ/6DwDOp+ERAM5n/hkA9ml4vDEKDgA4nwVv7kn9BwDnU/8BwPk0PALA+cw/A8A+DY83RsEBAOez4M09qf8A4HzqPwA4n4ZHADif+WcA2Kfh8cYoOADgfBa8uSf1HwCcT/0HAOfT8AgA5zP/DAD7NDzeGAUHAJzPgjf3pP4DgPOp/wDgfBoeAeB85p8BYJ+Gxxuj4ACA81nw5p7UfwBwPvUfAJxPwyMAnM/8MwDs0/B4YxQcAHA+C97ck/oPAM6n/gOA82l4BIDzmX8GgH0aHm+MggMAzmfBm3tS/wHA+dR/AHA+DY8AcD7zzwCwT8PjjVFwAMD5LHhzT+o/ADif+g8AzqfhEQDOZ/4ZAPZpeLwxCg4AOJ8Fb+5J/QcA51P/AcD5NDwCwPnMPwPAPg2PN0bBAQDns+DNPan/AOB86j8AOJ+GRwA4n/lnANin4fHGKDgA4HwWvLkn9R8AnE/9BwDn0/AIAOcz/wwA+zQ83hgFBwCcz4I396T+A4Dzqf8A4HwaHgHgfOafAWCfhscbo+AAgPNZ8Oae1H8AcD71HwCcT8MjAJzP/DMA7NPweGMUHABwPgve3JP6DwDOp/4DgPNpeASA85l/BoB9Gh5vjIIDAM5nwZt7Uv8BwPnUfwBwPg2PAHA+888AsE/D441RcADA+Sx4c0/qPwA4n/oPAM6n4REAzmf+GQD2aXi8MQoOADifBW/uSf0HAOdT/wHA+TQ8AsD5zD8DwD4NjzdGwQEA57PgzT2p/wDgfOo/ADifhkcAOJ/5ZwDYp+Hxxig4AOB8Fry5J/UfAJxP/QcA59PwCADnM/8MAPs0PN4YBQcAnM+CN/ek/gOA86n/AOB8Gh4B4HzmnwFgn4bHG6PgAIDzWfDmntR/AHA+9R8AnE/DIwCcz/wzAOzT8HhjFBwAcD4L3tyT+g8Azqf+A4DzaXgEgPOZfwaAfRoeb4yCAwDOZ8Gbe1L/AcD51H8AcD4NjwBwPvPPALBPw+ONUXAAwPkseHNP6j8AOJ/6DwDOp+ERAM5n/hkA9ml4vDEKDgA4nwVv7kn9BwDnU/8BwPk0PALA+cw/A8A+DY83RsEBAOez4M09qf8A4HzqPwA4n4ZHADif+WcA2Kfh8cYoOADgfBa8uSf1HwCcT/0HAOfT8AgA5zP/DAD7NDzeGAUHAJzPgjf3pP4DgPOp/wDgfBoeAeB85p8BYJ+Gxxuj4ACA81nw5p7UfwBwPvUfAJxPwyMAnM/8MwDs0/B4YxQcAHA+C97ck/oPAM6n/gOA82l4BIDzmX8GgH0aHm+MggMAzmfBm3tS//FW/Lvf+70PfvZs3sJjhGeh/gOA82l4BJ7VH/zBV9+rP4fXwPwzAOzT8HhjFBwAcL63tuD91d/66rvf+L3f+ODn3If6j2f3a1/84rs/+13f9e4P3+68+ys/+IPv/tU3vvHBmEeXx/SXPvOZ948xjzWPuY7h9fsPv//7737nN39T4+ob8dbqP9jyO//+d96/R/j6v/n6B7cBvCQNj8Az+smf/Gvv5wM+9alve///9Xa4N/PPcJtHmi/MceZ468+BfRoeb4yCg0fxh7+uu7Lo+9d/6Ife/Z0vfMEL60eQhoF6zuuYo/L81G3leavj4Fk9+4L3l379S+9+4LM/8O7bP/XtH/xd/85Pf+e7H/2JH91c3MziZ73fJeZt1duqHE+O9ed+/ufe/fI/+uX3+67H82zUf8+je22e/anv+I73Y/7mT//0u3/wS7/0/vU3DVZ1O88kjy+Pez4PP/XjP/7BuEdXn/s0PdYxj6irEWdHJ/pGM2gn566O72Rf9b5D/k7V8Ufk9zN/F/OeZTTl1mPLtp/97+lb9ez1H+xJvZ26u/7bF9/zF7/n/e1phKz3A7iFhse36xvf+LsfvN5U3/u9f+7dj/zIZ9/9wi98/t3XvvaL7771rS9/sB0+riPPU3z2s9/3vrEvz9Vre55yTPV487jquKPqtmK+/ctf/sIHt+f3t24H7sn8Mxy3N1+Yec7Mb+/Ni+7Nqw6Zf7ylnyL3yfxlnZ+OHH9+/k+/8pUP7gd8SMPjjVFw8Cg+aV6Q9+TFeu/Fn+O6wqWOOaorujQ88pY864J3ruK4WsTspPGxW9Q8s+Gxk8ew1ZD56NR/z6N7bd6TSYdrJjLuLVc0zHHP6pgxrnvMddxrND4NO1s1vtWmzniGK1l2NeIsk3/1PtVWo2IcbXjMvup9h2t+p/LYuknLTp7f1Mar55/H9Kz1H+zJh6HyIaP6b10nH5hK42PdBsC1NDy+XUcb6ao0r9VtfSz5OuIc5+y1NfN9bI/wPO05u+FxXN3xtZ4PCPPPcMz8LT5HbM0X7s2rrqSZcrXNWcak0bHefyVzsKs5fOCPaHi8MQoOHsUnzQvlEVksfIbF39ega6qoY47qii4Nj7wlz7jgnWbH7oqOez73w5/7YFv3bniMPJaf/3s//8GxPQP13/PoXpuPerSryHWPtY4Z6iTRo9QYOc76GFeTQnVy6WgT32vX1YizI42GW42Kl5yr+ntUXfIeoz5fRx09Vh7DM9Z/sCdXUK//th3xrHU4cD4Nj2/XtY10kSs/fvObH/93pjvGt9a41p2Do/I81e3dw9kNj/ndrLe/tUZZXj/zz7Cvmws+InOW3bz+3rzqlvRTdNscMg969IPclas9wpqGxxuj4OBRfNK8QB6VF/66PS53SaPBnq7oepRmBHgJz7bgnas05mvo6t/ro+pVXF5Dw+Pw+b/x+Q8e76NT/z2P7rX5Eo/UTNU91jpmyBX+Ulfkat+/9sUvfnD7a9VNcq0aHjMBlceW85IGv60JqUfS1YjVXqPhXqPikd/7vatExtGvte6e10s841eyv1XPVv/Bnms/EDXkPUHdJsClNDy+Xbc00g0fu+mxO0YNj5d5Defr7IbHyPZzpcf42L+ncA3zz7At87r13/pLdPOFR+ZVt2QuvW4zMu/cfdvQUS5OBWsaHm+MgoNH8Ul5ccxC5vx1fykM8kJcxw1Hvv6ObZc0Guzpii4Nj7wlz7bgna+pq3+nI82CuS0NkfmK6FyppWuMzFfczdvrGh5zv/z8iHlbdTsxj80x5Ti74xqyWFsf8yNT/z2P7rV5ro9S/+T1tRs3PEqN1D2GOubRdY1xq4bHZ9XViNVWo+GRRsUjDY/dVSLrp5iPXG0yx7OaEMzEZN7DjL+rW42aPgn9HJ6t/oM9qbHrv2fjK6tHzZ46O3/uGiN/9Cd+9INtAlxKw+Pb1TXSpTlsfHX01772i+8b1fKzT3/6z3wwNj72FQS7Y3wNDXxn6s7B/DzFr/zKz7x/Luq44d5XN7xHwyO8duafYW2rgTC9DpknHPOFl/Q+dPOqmX+s6wVb2+waE1ffXJO50cxnZ94ysq86fzqPrdsFNDzeHAUHj+KT8sK4WqhMkdC9mNbx84t7zC/g2cb4eRYp6z6G3JYX8PFi3hUBR2Q/YztRj6czH+MwX9lnXPUnhcveYxjNEHUb1V6jwdhW9rt3/NlX3daRhsfxuDN2LBDXMfAInm3BO4uU9e/0D3z2Bz4YF2l8rGMjPx9juobH1fb21O1EHTOkOTPNl3X8tft+rdR/z2PvtXmW1+auoWrv6ypmed3N6++oG7ZqjJVRt4y6JzXQ1uv5GN8d+6oOmn8etS7Jn+uY+fZRRx2pjzq5zyW13TieTArVxzgmuGI+33uPYSX3u/Q53Ks7Iz8bz+eRba5kO/Uc1AnArQmy1QTcrL4v6NTft+yz2/ZeI2L3dzSPZ3W/1YTn6hPWPJZnq/9gT2ro+u9ZvbL70H31df1Q1Mr4EFPk//NhqzqmynuP+qGp1f32xub/6+3ze5v59tU+Is2feT+Sc5TzsTd+ZRzvvJ06Bt4SDY9vV9dIt2om/IM/+Oq7n/3ZH/tgfKTZro6vcoW97C/bjzRTbjW8pUFvNPLV/c3NfltX7ssxZ8yXv/yF9/vMtvLnj9X8N/Z35Nguccnz1H2V895zNJ/rbDfnK3/O46ljt4zHP57f+bZrGh7zWHIsOa76nNVtxXz7eEyz+njq7XUf+XP2Pc5HPb4tW+ei/p50++ZtMP8Ma90ccOYDV99UtOp9qN9w2c2rrtbeVx8ar+Mzl1zHROYq6/zwkG3U8bE1Pw5vlYbHG6Pg4FF8Ul4UtxYqV1dkObK9uihZX9hj9UIdKUjqJyo6KQKynW5Bcz6mVXHTFS1j8bk+hkjRMxce2W5XHG0twHbbHduqi8J72+qOvzvXQ7bTHe+wVVjBa/RsC97dYmYW1+q4IYuRuc9svopiFuXq9q5tOqzbiTpmlgXC7gozW4/n0aj/nsfqtXlL93rafQXGkMmPbj9DtrfXbDcaCLt9z9vpaoE6bmU+hnpbrRu7x5OfZ9Kluy26Y5vdUtut9lnNx9Ddp253PratT+7u1a9d3TbqzvzudI/52tqs21f3WFc1Zv0d6x53/X2ougm/PM7ss/t5vf/QPZbY+/vSvZfJOa7jeDzPVv/BnvpvWcyNgFWu6FjfI9QxQ947bF2hPc2SaR6s9xu6D2ytGgP3xnbvXXKfNCvWD1PVfWRMdyXMYVwR80jjY95jde9jhuznyHbg2Wh4fLvSaFX/LVw10g1d49qnPvVtHzSTDWkWW10dMnJbmsrq/bv9dD772e/7YJ/ZVpoic1x1/Hy/S5vY9tTz2R3bNep2Y+t56q70mGbVOi7b/ZEf+ewHY4ecv5zHvWa8nO9uO+P+ub17PlfnP42O3e9MHtd43PW2mLdxZH/19rHt/Lfbf35Wt1GN37163/lcXvp88rzMP0Nv1UDYzRnPunnJmD943s1Fbs1pd/Omda6zG1N7Ljp1jja2vrUH3ioNjzdGwcGj+KS8KG4tVHaLlLG3ve6qLXMhsLoyUifjtj6p0BUIK10x0hUt+dnWdkeR0t236haRV4vN9WdVV8B0x9A9ziyUd89LZ+vTL/DaPNuC9+d++HMf/J3cWqDc0y0aXru9up2oY6puUfOZvlJP/fc8utfmOqbqXoPrp0GHvM53zWydOhky645zpdYD9faVWxseV1fWm209xq0arKq1UXc8nWsaHi95DrPN7uqM3e/MXt0Z2e+lTY/dvrpPPXfPRTdh2DUP1t+Hqqs9U2PmsdSfbzUidtvZ2/fQTQp29TmP5dnqP9jTNd+trvB4ia5WX1k1+XXbqM2IR8d2711yn+49Ur1fbYhcybmcPyA2y+PrPoDWyf5W24FnpeHx7bq28aprBusawbqrM67Ur8buGtY6XVNh1/C3kobMev9r1fPZHds16nZj63nKY6rj67GkqXCrIXSWcaurVa6aE2ejUbH+vPud6Y69Wo2Zt3Nkf/X23Ge17a3tzOdi73cvt+eKj/XnW88nz8v8M/S6ucojDYTRzQfP6+LdvGqda5/lvnV8nbust8eROcquf+Do44S3RMPjjVFw8Cg+2XnBnXWLnbG1vdVC8CgEVpeL3rI6xq6Y2VOLh65oOXJ8Rxe9s626QN0VUke2FfVKNt3xd0VXt8C9JcfTLdTDa/NsC97dImDkqitbV1ZZ6RYNz2x4zKJhvc+1+3+N1H/Po3ttrmM63Qc46pjutXpP91reNX3tmT80Um9bubXhsftZp9Y0cWttd3TflzY8XvMcdhNP3Xb2mh2H2ty5p9tXHnetc7tGw+53rXtfUH8fqrqvGPVld95rnT50f89WY3kbnq3+gz2rJrw0Al7bdJerGNbt7ek+uNS9f3nJhsdVI+O43+qq8luyza55c3WeV1bbgWel4fHturSRbugaGetXJq++WnnLfBXCrmGtUxv5Vl+7vaV+5fC16vmsx3atut3Yep66czAfS65CuNeYV6WpsV6FM7LdOrbTNVfWxsFc/bCO6XTbinlb3e9P3V+9PVepXG17lnNRz8Ml56I791vPJ8/L/DP0ujnVl7qYz2petY4bujX4+UPm3fZWF04ArqPh8cYoOHgUn5QX1K2Fyu4Fur4A19urbD8LqaMQyH/rmMi+Uoh0+4z69YDdouvYTwqHbKtbSK2PtysyhizSdgVTtTeuLuh3xzVvK4vMqwbII8dfi65uzNhWzlO3+N3tC16jZ1vwPrJgl4W4LFBufY3d0C0aXttwWLcTdUynezx1zKNS/z2P7rW5jul096tXpu6atfK6m9ffVb3SffCgqw1SM2R/kVqpjpk/eJH9rV7zx20x77eOq7VBd+xDjmXr9tRO87ZeorYbdU03LjXmeIxzbdaNnY8ruucw9uq2ozXZkGNZbSvqcW3p9pXj6ZoZa/Ng/R0ZzZv1fvX3YdY9n3MTaPeeoLvaZLffqH/PeFuerf6DPfngU/13cJZ6O82Pv/yPfvlQA17GdDV65L1CGhvrz4fazLjXxHjJ2O69S5Xjy7GP+3VXf4w0I2Z/qybGXLFyPracuzomsv2c/4zvzlndDjwzDY9v16WNdEfvl8a47qp/acRLc2F0X/sb8z6yzW5cGsty27gi37hPd3W+HEfGZXtpyuyazbKP+hivUc/LvRoeu3M/j1+d05y/cd67xr/aGNpdqXDeXvc117PagLjVMJhj7h7XbN7WNQ2Ps/yebO2vnovuORryuLpzPtt6Pnle5p+h183X1vX4a63mVeu46L7JJub51u5D/lvzqsDlNDzeGAUHj+KTgy+oqysY1oXIenvkfnnxrgv13Vdkd1dA7L4KsV59JgvaWbCdF4brwueqyJjHdEVLzIXL1lUp54KlO+6ozZrdwvrcFDq21S1Ix1ywdcdfi65uf13Rd3QcvCbPuOC9t6A5y5Uf0/xYtzF0i4ZZqMvC3566rbqdqGM63SLjkYXYR6D+ex7da2Ad0+matubaoPs6i9roF91XU8zjuhqqfghl3l8eT+qI1CC1zrrksdZxtW7sthXzp2lz7N0HQ+oVEI/Wdl2tVY+7e15WNU33GOpx1dtzDPNjXNVtGTfXw13dFqmv53HdJFisHkOn21fOS9eIOP+udbePq0vWn9ffh1l3PuarVHb7ifr72u036hjelmes/2BPGuvqv4Uro0mvbmPoGhrzvmJuPsyHq7pmwoybt7XXxHjJ2O69S6R5sWvm7MbnvU72M4/txmWb87a6Zsbu6pndFSePfBANnoGGx7era9I60njVXb1xbu4bTXP52Wgaq1eAjK7BrTalXXKMadhLY9nYbpr2ctXAeUx3FcH6ddrXqsd6dsNjGk27Rr8YDXp5/BmTZsTR/NkdZ7edus+ueTQ/m5/D/H/3PMc8rvudijyf83OY57hrxoy946+/W/X2yPHPX9+d+3SNj/VcdI+xnos8jlUTaN0eb4P5Z+jVfyOj9iVcq5tXzfxtfj6Mizh1c9Uxz3F2c9V1LR+4jYbHG6Pg4FF8Ul5QxxWGhq0X56gLrfX2WL1IdwvGq7HdlR4vLVRWjYrz4nlXtOTx18XWbuG5azTojrs+xm5hvTaSDt0nVObtdcdf91dvrw0GQ9dsUbcFr82zLnhnUa5bTFvJ2G5hsVvcO6puq97ejel0DY/dsT4i9d/z6F6b65jO3mRF1+hXm/iGWrPMdcaq0a/WZUdc8ljruNrg1m2ra+hcNbfVcXuO1HbRPS+rc9U9hvn27jlcfb10d2xzA2xXt0WtO1fbuuRrWbp9jd/Nuu35g0XduRvnt/68/j7M6j5i70qS0T3GOibqGN6WZ63/YE8+6NQ15q2kDu+a8br3GV2DZO5bx8XcTLjXxDjbG7t675Jmx7qt1fbSpFnHxXhPMj78lfuOc9Ptt/v67ui+Cnz1eOHZaHh8u4420nXq/bqmuT1d81dtjLzlGDurxro6bksaC3NcVf2q79HwVs0NdUd052C+yuVoYKxjhtXXUW+pj2Xscx5Tb4965cNYnfO5GbC7OmcaG+u2ovvK7pjHXNvwOF8xdGt/Od972+rORddwG7f8TvO4zD9Dr/4bGXXMtbp51UvUOdNuvtX6O7wsDY83RsHBo/ikeeE9qlvcrWNi1ZjYvaDPXy846xoHVwvVQ/abMbl/jrVbRK3b6YqWrvmwG9cVI0eaBruF9W5xN/aujrN3XN3t2X8930Md250LeE2eecE7C4lZ3OuurLJSr0LSLd4dVY+n3t6N6XQNj/XqLI9K/fc8utfmOqbTvXbOTV31gwvjis6dOrYeQ1cbReqd1AapJWrjX+eSx1rH1cmablurmqary+qY6praLrrnpY4Zusewd3tt3Bu652ivLusaRKOrAedt7en2Ne7fbXv87tTHOz4o0zWt1t+HoRtbr9a+Oo7ufNQxUcfwtjxz/Qd70qSXprtcabH+29hJc2OtveuYqGOGrjlybvDrmg5XDYB7Y7v3LmlQrNsZuvdJq6vf57ytHmP3ddbZdo636q60mZ/XbcIz0vD4dnWNdEcar7oGttoMV40mwTTSZR/d1QG7/V97jEOONdvIfdK41l2tL+r9tnTHdIm9c1Xdur/a6NfJmDT7bTVPzse9atxbNVZ2V2Wcj6trUKxNhcPqq7TnMd326nmot0d3/Hu/75eei+538JLfaZ6H+Wfo1X8jo/tQ+TW6edWjMrdZj6Obq75knhfYp+Hxxig4eBSfNC++R2RBs75Ad9tbLXxGXUC9VPfin6Kju/LOlr2Gx9V+Xmpcdx5WTaJdA+V8jvf2111V8xJbzye8Bm9pwTsLgFlg6xYdh7qg2S0aHlX3X2/vxnS6q9DUMY9K/fc8utfmOqbT3W9uOqy3XWreVtdE1kljWRrvVs2P3THXMavjr3VBt61rGwuHW2u76CaR6pijx1Vvi64mjq7umj88sle3zbrHsBrb2dpX97uUq5nntvrzcfzd9urvw9A1MqahN9uYdVdQj3p+6+2xqp15G95S/QdbUvfnyoy5GmFXcw/zVQ+79wf1a6pn3ddfz02Fe02Ms72x3bHlw1N1O0PX9Fk/AHZEd1yXWF0NEp6Nhse3q2ukO9J4dfR+aQTLVxJ3zW4rdTtH9zVL4173FcNb6ja2dMd0iTMbHusVM4fx9ddd893KfNzdMW19NXh+D+r4uQGxa7LcOvY6NuYx1zQ8bj0vW2Nf4lzs/U7znMw/Q6+7eMBq/vdS3TzoEd2Fo6Kb513NqwLX0fB4YxQcPIpPmhfgLbmqy+oqNt32tl6guwXlS9RF3u4qOkfMBU9XtNT9vPS47jzU7QzdgvQlDY9dEXWpekzwmrzVBe8sBnZXNIm9RcMsDObne+o+63aijqmyCFvvs7Vo+WjUf8/jktfmWTexMm5L01a97VJ1kiYNYt1XW690V1u85LHWcbXO67ZVj3lrbB3zErVddPVPHXP0uOpt3ZUKh64uu6Rum3WPYTW2s7everXMNJl29xnnrbut/j6stn2p+nvb/T3ben/C83ur9R/syZUKuybAGGO69werr4GOrhlwvqJhd3v3XuLI2O7Ytt471LFRxxyxel911NYxwjPR8Ph2dY1aRxqvuq87rs1p3VcUH1H3f8kxphFudeXIPXVbW7pjusRWY13nmv1lH2k4rduKXLHwkibUeZtbx7S6ImPsNSB2Daq1QXHWHf8l+4t6+9bzsjW2Oxdb2+qObfU7zXMz/wy9bk63zileq5sHzXxn9jnU22P1Ae1ue5nvrOOA62l4vDEKDh7FJ80LdBY/q7z4rl6Yt7a3WviM7mo9c3GwZy5UuivHzNvMgnnGdwuk84J3V2R0i8kvOa4rhFZXYequFDSf4739dVeIrEXZnnpM8Jo804J3vmatNh3mZ3XcrFvQnBcgL1003FK3E3VM1S1qPtMVUNR/z6N7ba5jqu41uE5U1NvTLFdfZ7d09UHqszQ+djVONb6OeHbJY63jal3QbevaxsKjtV03ru6zaxasY44eV70tVjVyd8XC13iFx6jncXzd+vyz+fen2179fYjuwzqXqn+P6rFGt+9O9/dEs+Tje6b6D/bkioX1PcLqq5kj7x+6qz2OxsJsr96Wq8TX7QzdFR7TWDlu7+r9VcNjt61bGh6790KrfW/pHkO2nX0fkavw123CM9Lw+HZ1jVpHGq+6qwLOzWSrrxyONCSmMS4Nkl1TZN3/JceYr6yuY4c0oOX27LNriqzb2pKGwWyvqttNU14dM46jbnNLdw6ynZyHWc5pxq6+SjlyW9csOB9vttU9h3tNfvm9qPsbct86fv6dueSqh6uvkJ7HdE2FZzY85lzWbQzduVg9Vp6b+Wfo1XnM6ObCO9188Pj2m+jmQeu8bLeN9EHUfcXqwgir+epZdyxHHye8JRoeb4yCg0fxSXlRPLpYuHLJ9rri49pPW3RXjsn261fgdQXHa2x4nAupWXelo3l7e/vrbp8X3uHRPdOC96ULfJGvk6v3mRsKr9nmSt1O1DGz1WLrvED66NR/z6N7ba5jqq4Wqa+xXbNVrVVuldf6rSs/1uauSx5rHVfrvG5bq4mabux8e3c+u9qua36r++xqzjrm6HF1t6/q1+7DPXt1Wa0Th+4xrMZ29vbVNSbW39f5a1i67dXfh+ien2vMTaXdvmP1nA5dA2rU3ykezzPVf7Cna8abP+DU6a5YONfg9bZYfdAqzZB17NxU2B3fqgGwe29wS8Nj9zhX5ybbznunriEy5+boduAt0/D4dnWNWnuNV93VHdPcNTfZdc1raXKsVxzsmurq/i85xjou0uBYGwC7hrO6rWvUY91qoLtE3e7WOdjTnfM0aubn87jua6Pnx9PdHvU5Huq4mBsQuwbF1fnrGmVjHtNt72M1PHa3Rxpj63ZWY699Pnls5p+h181txmreduguFBR7c5F1XrYbE6v5ym7euJtbrbo589VXZ8NbpuHxxig4eBSfXPFiuuWS7XVXK9z6tEOKju4KOt0nIbr9Zly3+D8XG11BUouWlx7XLZyvzkNXyFz6KZN6e6wWenPOV8UYvEbPtuBd/67GqkEwV3bpFg2zkDfGXLpouKVuJ+qYIfvtFkdzpZQ69pGp/55H99pcxwyZTOnGp+aor6/dRMZq0iWvv1G3MaQmyut0Xuez3Toux1Ub1qLWGN2x120NdVytt7ptreqIbuy47SVru+iaBWvj55Hjiu7DJ7Wxddg7tiN129A9htXYzpF9db8vs/kKo932uueoOwfZT8audPepHwbqnqfcrz73w+p3pf594DE9W/0HW7p6PlYNiqvxubLjGNNdGbF7z5F91HExj+k+gNVdMfJLv/6lD8bFLQ2PXbPlanx9b5I/j3PY7bd7DJH3YDlX8/mEt0LD49t1SSNdGty6JrKoX2fdXemwNh1G13hY998dY3eFxG5cGi/ruCNXB7xWPYbaFHetut2o5+mo7jmsjYCrcfXx1NsjzYh1W93x1/12jZhRtxVdQ20d2x1/fZz19vr4LhnbXTWz+z1dNWte+3zy2Mw/w1o3b5v5wNU8cOYLu3X3+m0z3TxonVeNbu6/my+NVYNmHsNqbr6bH47VfCi8ZRoeb4yCg0fxycEX3qMu2V4W6ruFx1p45IW9LsBmu6P5Mf+t2+j2e6QQOFq0vOS4bsE28vNxbPlvV3TFpZ8y6faXT3/UAqqerzwHq6YMeC2ebcG7W3xMU2OukjIWA7Mwl0W27oomccui4Za6nbGvIYudWXTsHsPwbAuD6r/n0b1W5jV2yOvhaDSs44baoBXdhz3y+l6/qjp/nmuk/P/cmFVfo6P7JGc3rtYF3WPIa36tC6KOq/XW6rzV7azGjtuO1narK/bVfXbjck7red87ruhqrchk1KjJMqbbTm2C7bZVn5/hyHO55ci+uvM01K9G6bZXn6Mjn5DudJOTdaKx+x0Z8nchf9dyjHlM3XMx1PcdPKZnq/9gSxrs6r9lkYa81N+jvs5/8+dVLT5vs2sUzHuO/Hx8XXbeb9QmwajvJbr3G5Grzue2bC/H1W0rbnnv0n0999j33BDaPd76Qazu+OYPkg31a7lzfGnmrOPgGWl4fLu6RrQ0k+XnQxqx8rPua6wjzY11u3Vs1/CYq9/VbUVt/FqNq411q8dSj+1Is9y16jHUprhr1e1GPU9HdV/7Xc9l1Oewezy5amcdE9lHnu/RJNs1A8bcgLhqRM1xjOPLmNXzF/Oxnd3w2J3XGMeffXcNvsO1zyePzfwzrK0+8ByZbxzzhflvNyc+1PnCbh60zqvGar6ybm9YfTNO5kGz/bEWkXGrHoE6Zwr8EQ2PN0bBwaP4pLww1oXKS126vW7xNvLCnRfwFCDdi3i9kk5XwOT+KSKy0FkbJmfzovjRouUlx20twkb3+Id6Ho7sb1Vwje1lfHdMOY6u+QFek2db8O6+Tu0SdeHu0kXDLXU7l1p9td0jU/89j+518BJbEw2rbY+JjEy2dHVNnRjpaptsO9tI7bOatKnNgF0TZuR1P/uYm9PqmFrndY+t7m9r7Hx7dw6uqe1iVftkHzmO+QMde8cVq3Ob7W0dV/3gyJG6behq5tXYzpF9rc5T1Abebnv19+FI42LnaKNkd04uUR8/j+vZ6j/YU5vsLlXr8DQhdg1+kZ+vmiajXlkyf+6uOn/ULQ2PkcdW7zPfd3VstZmx23fk/jn/2U93Xur7L3hmGh7frq6R7lLd1/Z2jXD5WRq/ort96Bq/uua7SAPZuIre6iuWc3seZ65CudpO1H1eo57P2hR3rbrd6M7TEd0VBnNecn6ynzQUrhoU6+NZNSlGtrHazlAbEFdNg7H13A3zts5ueMzv397j3XLt88ljM/8M27Y+0H1EXXePbh50Na/YzYfWD5IPWw2aR+S+db4U+CMaHm+MgoNH8Ul5cawLlZe6ZntbC8Od7qpDXQFx1GtseNxqcpzVQubI/uKaBeLuKkjw2jzjgvfWot2WLMbVKyh2C3d7i4YrdTtHjavF1O09A/Xf8+hem4/qrpo822oqW+mu3rj62ost3YRNbE2szHVSva3Wed15q82HW2Pn21+qthtWTYox10p7xxV5DrfOWaeeqzhat0VXu63Gdo7uq3v8caTmrI+xO0e1cXKlu2/9e5C/Z9f+ntRj5bE9Y/0He7pmuyNyv3HVxtnqK6a3rGr67gqK1WgcrD+/teExj23V1LiyalJcXUF/JfutDaDwzDQ8vl1dI91RubJjbSAbuqa6o7rGrzTj1XHDfIXJ+lXaK11jWt3nNer5rE1x16rbje48HZEmxe7xd+q47vFsXXFx1j039ffnaNNgxnTbm7d1dsNjHPm9z7F35+za55PHZv4Z9q2unLhn9UHtbh60m1eN1dx//SD8kDn+oz0BVTcHDvwRDY83RsHBo/ikvDjeuvh3zfayWLm1CD1bff1gtrFXEKRQ6Yqc19jwWL/KssptXSFzZH9DFpy39jE7ujgN9/asC97dYuCWXIllXiwcrlk0XKnbOSL7euZFQPXf8+hem/ekDulemzt5nT/6gY/VREt0TXAreUyrRsytprG5jqi31TqvO2+rc9KNnW9/qdpuWF3JMubHsXdcwyXP4aoJ9pK6rXuuV2M7R/fVnafud7Db3nwej16lcaX7nVx9Gjr7OlrTZpy69vk8a/0HW1JTp7au/85t2avF815hdaXHWRr76hURZ2k63Du2NFhmG/XntzY8Ht3/sGoAHdu55MNn3fsveGYaHt+urpHuiCPNWVtXcYw0fnWNjN22V1dvHMa4I818aTbrmuHqPq+Rq12mEW4YV5+8Vfc8defpqCONeRlTv4K5a/LLc9M18M1W57w2IEbO4d7VHMd5rj+ft3Nkf/X27vFdOjb7WB1/fjdze3dstzyfPC7zz3BM5i735paHzBd286Tztup9tsZ387jZRzc/HPl5N8e9kjnYo3Os8FZpeLwxCg4exSfNi2Qdc4lbtpfFyozvFizzs7zYb72Ar67ykoImP8/tXZHxGhsex33zmOeCLOchzaGr83Bkf7NsJ9tbFX25rWsagNfqmRe8sziZxsetRcgs7OVrsOt9h2sXDTt1O1UWQrPtLBJmMfMtLACq/55H99pcZUzqi7zO5rVyNWGxJfdd7SuvzWk+29vuqJ/q/efjPPJanmPparB7NTzGS9R2s5yrrua5puFxWD2HOZd75/6Suq17nKuxnaP7yjmt47oGwW5783nsnreucXJl1TDZffApxu/C6r1Efr5qPOXxPXP9B3tSY+dKhKurGubnuf1oLZ4mv7zn6K4gmfch2dZW0+Qs7wHm7eT+2fY4lu69yUs0PM77XzU+5li23jfNctX8rXOcx1SvrA9vgYbHt6trpKtyJb00L6Yh62tf+8X3TYV1OytpaKwNiPlztpemtW7/q8avVZNbmsvmY8r/dw14eRxj213DWd3fa3LJeToq2+yukphznOc5Y+r5XjX5RZ7rur3xNea5vTvntQFxSBNl7js3Dub/87yO+9Rji3kbR/ZXb996fJeMzfHnHOYYMi7/nffdHVvOX90Oz8/8MxyXecDMa2ZecDUnnDnM1Zr70M2DdvOq8367+clujnWW+dAcTzfXnOPPzzOm3g/4kIbHG6PggNukuEgBcW0DQRZDc9+9IuVR5PGc8VjGOT9jX/AxvKUF7yw0ZhEwVlcl4VzqP24xapdVQ9cRt9ZPw633/xheurb7GLXVOMbXdu7eojwHL/n7wuv2luo/2JPGu/Eeod52jZd6v3HvhsDx3unW48h5eKlzAo9OwyMfW5oQ0/CVpsV62zWyvSPbGk2VaUCrt/Ef5RzVZsBbvOQ5P/pcP5KuIfclzz+Pw/wzXO/R5gvHXHP9ObBPw+ONUXAAwPkseHNP6j8AOJ/6DwDOp+ER4HZp8swVLdPQGPX2MeaT0uwYdRxvg/lnANin4fHGKDgA4HwWvLkn9R8AnE/9BwDn0/AIcJuf/dkf+6CJMV/Lna+2TpPjaIbMz+q4fBV43R5vg/lnANin4fHGKDgA4HwWvLkn9R8AnE/9BwDn0/AIcJs0NKZx8ZPm6o17fJ3122X+GQD2aXi8MQoOADifBW/uSf0HAOdT/wHA+TQ8Atzum9/81Xef+tS3fdDQuOVXfuVnPtgOb4f5ZwDYp+Hxxig4AOB8Fry5J/UfAJxP/QcA59PwCPAy0vR45EqPn/3s97myI+afAeAADY83RsEBAOez4M09qf8A4HzqPwA4n4ZHgJf1rW99+f3VG3/hFz7/7id/8q+9l///8pe/8L4pso7nbTL/DAD7NDzeGAUHAJzPgjf3pP4DgPOp/wDgfBoeAeB85p8BYJ+Gxxuj4ACA81nw5p7UfwBwPvUfAJxPwyMAnM/8MwDs0/B4YxQcAHA+C97ck/oPAM6n/gOA82l4BIDzmX8GgH0aHm+MggMAzmfBm3tS/wHA+dR/AHA+DY8AcD7zzwCwT8PjjVFwAMD5LHhzT+o/ADif+g8AzqfhEQDOZ/4ZAPZpeLwxCg4AOJ8Fb+5J/QcA51P/AcD5NDwCwPnMPwPAPg2PN0bBAQDns+DNPan/AOB86j8AOJ+GRwA4n/lnANin4fHGKDgA4HwWvLkn9R8AnE/9BwDn0/AIAOcz/wwA+zQ83hgFBwCcz4I396T+A4Dzqf8A4HwaHgHgfOafAWCfhscbo+AAgPNZ8Oae1H8AcD71HwCcT8MjAJzP/DMA7NPweGMUHABwPgve3JP6DwDOp/4DgPNpeASA85l/BoB9Gh5vjIIDAM5nwZt7Uv8BwPnUfwBwPg2PAHA+888AsE/D441RcADA+Sx4c0/qPwA4n/oPAM6n4REAzmf+GQD2aXi8MQoOADifBW/uSf0HAOdT/wHA+TQ8AsD5zD8DwD4NjzdGwQEA57PgzT2p/wDgfOo/ADifhkcAOJ/5ZwDYp+Hxxig4eHb/6hvfePdXfvAHb1K3ufI3f/qnP7hvJ+P+zhe+8O6ffuUrH2wDeBseYcH7S7/+pXc/8Nkf+MBv/N5vfDB25Zf/0S9/cP/O5374c+9+7ud/7t3P/72ff/f1f/P1D7bDy1L/8RalJkz99dd/6Ife/anv+I53f/hW6N2f/a7vel+b/YNf+qV3/+H3f/+D+xx1tAb8qR//cTUgvGGPUP/BS8t7h9T5qfe//VPf/v719zs//Z3v3wOk9v+df/87H9znqM//jc9/8L6i86M/8aPvjyHvb+o2gOen4ZHhy1/+wrvPfvb7PvCzP/tjH4zt/MEffPXdr/zKz7y/z/d+7597/5oWn/70n3n/s1/4hc+/H1Pv99rk8dZzEHXc1tg93/zm/t+3b3zj774/Zxn/qU992/tzmfP6kz/5196f529968sf3GfPx9jmrD7OlZy3HMfXvvaLH2wD3grzzzyrzCHXOd8h8891/J6jfQyZ0868cuax/93v/d4H2wEek4bHG6Pg4Nn9zm/+5h9PPlyrbnMlBUe9754stP/aF7/4wbY+hhRAOR+zWxb3geu95gXvLDpm8bD+ezV89be++sF9VrKwWO9/RBYlz2p8zOOZXdLQ+ajUf7w1mQyq/85UaYK8tiZ77TVg6r1aA5oYg/O95voPPoYj7wXSBJkPSdX7HpFmxrq9PWm2vHZ/l8r7qvpe46z3OMB/pOGRSCPiaICr0qBWx1dpXlvdf5YxGVvv/xqkCXFu1Kzq+Mi5qeOOSONh3dYsDYj1PlXO5d52PvY2q7q9I3LOb9nnJdLQmX3NHqEJl+dk/plnlQ+013/rh8y51vF7ru1jyHGcNb9b55WvaewEehoeb4yCg2d3baEwq9tcuWaxe8gnMur2Xlq32H9N8QXc7rUueKfZL4uA9d+K2RkNj/E9f/F7brriy1F1v1k4rWOejfqPtyKNfluTUJ1rmhBvqQFTn9XtvbSuHj5jv8Cf9FrrP3hpqeHzAab62rPlmibEaxoeh7xPqdt7aXnfdI/9An+ShkfiR37ksx/8mzzsNTzmypD1PnuOXjXyLLm6YT3Gqt4njjR5dlYNfmm+22q67OTY63Y+9jZX6nYuccbVHtNsW/e7ei7gYzP/zDPq5lhn16y5721zSz5Qf8aFjep+MxdexwDX0fB4YxQcPLtbCoWhbnPllsXu+NifiNDwCK/Ha1zwzlfK1X8jOmc1PEauNFm3+dLqPjU8wvO4tNlxuLQmu7UG/Nhfcd3Vwxoe4Xyvsf6Dj+HSZsfh0iut39LwGB/7K641PMLroOGRNHzVf49nWw2PW/dNM+BWQ+AZDW570gx49CqN9b5Rxxy1arI7eixVmk7rtm7d5uoYt9RtXCK/K7d+pfYeDY+8JuafeTZpLEyDYf13dnbNmns3b3uJfNV13eZLq/vU8AgvR8PjjVFw8Oy6r/Bb+Zs//dMfvGineKnbXOkWu+ftZzE7+1gVRB974VnDI7wer3HBu1swzFfM1Z/d2vCYBdD5a93SaNnte6jbfGl1fxoe4TnkKz3q3+8hE0Gpy9IQma+y7m6v29uyVwOOOnNVA+Y46jZfUvZf9/mx607gQ6+x/oOXlq9srq85w+d++HPvmwzzfqB7n5Hb6/a2dO8h6ldI5wNUqyvY5zjqNl+Shkd4HTQ8vm1p+Pv0p//MB/8ez7YaHnOlxjo+25ubGfP/3RUGc1XJur2zdQ2bqybNet+oY9JQV78yudN9jXJ3LJHzlHOYZsA0NnbHt3qOtraZ267Z5pa6jZgfdx5Hvlq7219ce2XJozQ88pqYf+bZdGvs1TVr7t28beaK53nlfEtk5qvruKFu86XV/Wl4hJej4fHGKDjgP+oWoS+54k632F3HDH/pM5/5YOzHLhC6YuzS4itXPMp9Lr3y0aw2oZ5xuW14bV7jgve8YJgFyCxGdg2LtzY8rhb58jV2dWxceqWXS9X9XdrwmK/sGwuqZ3wF90tQ//EWdFd3TP1Va59uUikuqU8uqQG7yakcVx33krrHeGnDYxpIR+1WbztKDchb9xrrP3hp3dUdv+cvfs8H7yG6ZsC4pJ7uGh7rmCHNlHVsjquOe0ndY1y9F1pJA+l4r1FvO2p+v/JI71ngpWh4fNu6hsXajLbV+NY1MnZXG+wa77KfOu5s9bjyeNIEWI819u4btzTPdVdiTHNgHffNb/7qB8/Rat8fY5tb6v2jjhm6Rtvu2F7SSzQ85lzlPvlvve2oNLzOjaD1dt4G8888k6yJ139fuw/RXzNvesm8bXoW6thr93uJur9L+xnmOeFb5oNHj0Lc0qcAr4mGxxuj4IA/8mtf/OLNL9iXLHZ3+5uvJtQthucTHHU7Q3cVoxRbKRy64+psFVCrbWSB/khTaI4vVzbqCsBIs2n2f0uhA4/kNS54jwXD/DcLa/lZ17B4yWJbd/+tRb7u6iuj4TENmPW2jK/bmHULrrmiZLf4uFK3GVkkzLa7402zaK4k85oXEtV/PLuuLtq6andqkNQ6s0smTbo6qY4Zukms+di6Rs3UUHU7s66+yjnojquzqnlzrLmt235qwNSz9T5Varuc324bkZ/n9hxvvS88m9dY/8FL6q7uuFWv531B3nvMLvmw0yUNj139Px9b974hNX3dzqy7SmXOQXdcndUHrXKsua3bfpo080Gxep8q70VyfrttRH6e28f7PnhmGh7frjRs1X//0iBXm+S2Gh67prU6ZqgNda+t4THNcOPn9TF1j+slGx675yK6K0FGroRYx9bn6WNsc0+9f9QxQ7e/ueGx+93a+hr07vFmG6vj6sy/A7M08da/F0OaZI8872mkzeOr9x9yrNnP6vnh+Zh/5pl0c6zdOv81jYfdXPFqvT66izeNeexVY2bdxqybi87+u+NaqduMzAln293x5phy25GegJzn7vwP6ae45rzDa6Hh8cYoOOCPdC+4l75Adi+4dcyQ5sU6dl407gqlra9X7LY3vh6xO65OLaBGMVLHdXJsq8LkkqJoteAOz+Y1LnhnUa02I3YNix+r4TGLcnVBri6Qdg2GW4uidXsxrpJSf75St5nGy2671bhKZr3/a6D+49l1V7Xe+uDIrbpaq44ZuhpvrsG6ummrWbP7ZO+op7rj6nT1V5os67hO7rtqVswk26rRsUoD5aqWhGfxGus/eEld7Z8PG9VxL6VrLKxjhu5q8vP7ku79QX0vMus+jDUaGLvj6nQNj2myrOM684fUqrw/OvJ+JdJA+Zo/qAUvQcPj21WvzpgGxDRl1cauraa37gqRXfNXd9XEj301vyNyrGk0q1frq8ca9b5pvtsbc1R35cGtr/zuzmfd/8fY5p563637d8c3NzTuNURW3e9ifrY6rk5teEzzYc5ZHdfJsa2aFdPIWMevbD1HPBfzzzyLbv191RB4aV9BdNup6/WzOtda5427foetD/bX7cX4pp/685W6zdy3226VMVsXVTo6tx3XnHt4DTQ83hgFB/QLz93C757uhbeOGbqCY17kzf93xcBqIbj7iuzx4t4dV6cWUEfvN3TnLEVR9zi2fMyGBHgtXuOCd7fQ1S1afqyGxyyG7o3tFgBXV17pFiHzVXa5rVvQXNnb5p6thsx7Uf/x7LorZY8aKvXRuKJjfp4aKh/wOHK1wpWuZqpjtsbWhsGuTqxjhu7DKeOxdPvq1BquO39buq/kXtWyW/auZAmP7jXWf/CSuq+NHu8xUn+PKzrm52m0y1UVj1ytcKVrLKxjtsbWhsHuw1V1zNBdEXI8lm5fndrw2J2/Ld1XcncfItuzej8Fz0LD49vUNZuNZq9LGh67JrmMr41fXdPY1tX6zpLjrMca9VijjunO4fj5fA7TUJnHv/V4u/PTfTX4rDasxtxs+lLbrM2gW+p9o46JnPO9K352v1t1zKy7ImS2sTquTm147La5pWvI7K48uWfrd4XnYf6ZZ9CtcY950K4h8Jqmu247db1+6PoZ6nxqdyGAOmbY+iB9d1wr8zYvud/QnbejH8YfMp++6qGA10zD441RcEC/qNy9uO7pFpWznSGFw+ryzV3xsrWAPdv72sbcZ17Yn2UfuW18GmW+Tx07tpuxXYNl1OPrCquxjdFw0J2PrU+bwDN4lAXvrmHx1obHLA5mG0MaHbNYV8dlwbEuMF7yNXndIuS44mK2k2Prji/bG7fNDZdZPOwWQbOgmH1Ft7jYLUTem/qPZ9fVPPl5V1vNtq5YvaXb31wDRiZpupqnu4J3Vz91HwjpmgrnrykZNWD3uHPMowac67fVpNSo37rHGrWW7WrJ8fXVWzXgNTU4PIpHqf/gWl2jX37e1eWzNPp1H77a0+1vfp8RaebravjxQahZ996gu0Jl11SYP4/b0/iYbXWPe1xVP+Zmz9UHssZ7k+6xRv2AWHcly/H11aPptDsfl7zHg0ej4fHtSRNYbTZLo9u4/ZKGx+ga67L9NH9F3deRbd5bPd6oY2rDYx5n1zA4y7nqGizrOY/uSpmX3Gfv9s4195nV+477D2nkW/1O1GbD6H63umbArqlw/p3Otmsj6pDjGbfPj7U+v/N2c9vqua7nq/sa69w3V7DM2FyFsp6PcbXV+jh5LuafeQbdh8LH3GU3h3rNvGa3nczlzvPKmRfu5mQzt1o/JL/XMzDr5ozHPHG2M+aO65gxTzzM2+zmeyP7ijqXPbZXj62OGdvI8UV37N08O7x2Gh5vjIKDt65bjK1XuTmqKzb25D6rAqgrcroX69XltOu4rijp9t0tnkdtQuw+2TIvskd3Tuo+5687TCNlHuPWJazhGTzKgne36HfJYlh3/z1jQa5ua+iaI7urKG4tQs7qtuqVVobusWQBdV6czf93C5u3XLnmY1D/8ezq38HUGd0kSOeaT4N29c6e1Dy1Jhq6ianuKopdHZvHWcd1NWVXK0Y3KVWPM8dXx+Ucz+etO9/1gzFzzTlqwDoGnsmj1H9wrfrv/vhgUP15J014lzY9rpoAt+S9xOr9TPfhqu7DS11TYR5nHdc1Ma7e5xxpQszx1XE5x/N56853fS8yN2zm8aX5s46BZ6Lh8e3pmr7mq/jV2480J6YJ7cjV8NLItXeVwdegHnfUMV0j2xHd+aznPGrjXNXtf24a7Bry9rbZNRimMa+OW6n3PSKPfdXc130VdHcVxe7rrLvfs66JsTsnXVNw/lyvdpn71u3l78E8pnse6uOdt5PxeYzdcfFczD/z6LqrH85XSuzmW+sc6hHddvaMD5Wv5rC7ueq6xh/dGn+3zbqtVR9F14eQOeK6ze7qjfOH/btz0u1zzD/nuHN7tlv3Ba+dhscbo+DgrauLtXFNQRJdAbFlFCT10xez7vjqi3V3tcVum12h0T3WrpDoFs+jW8yei6bu0y/dFYq644Vn9igL3l2TX11429Ldf08WLrf20S0w1q9hOzJmqONWDY9do2W9AmV0C6XdAug9qf94dvXvYJUarKuxhlUz4MqlNWBkAmar/um2Wcd3dVY3edXVdt1jzH3ruG4yKfbqyq5G7L4+pT4meGaPUv/Bteq/+1Wa7GrD3mzVDLhyTcNj3hN0NfzWNuv47qunuw9gHW14zH3ruNV7ku791fzeqWt47N4H1ccEz0zD49uSxsT672CaxeYxtfmua9CrctXCrumsypjuCodHpElsvlrglmv3MdTjjjqmnqchjXG5basBtDYR1ua62HsMXfPe3PBYb4u6jWpvm3vqfffkcWf7W4+1npvua63ruc6Ybpvd4+saC7tGy/r3ZOiaROfbu4bH7iqVtQmS52f+mUfWXRioNgN2863dmvuebjt7Ml+7deGg7kPydV62a+hc9QLUcav54iPz2dF92H++4FM3R91dpCB/rj+DR6Ph8cYoOHjLuhf81Yv0Ed0L+VHdJxyiW0yer3zTFQWrx9Btqyu+unH5WcZW3dUl5yKrK5hiXO462+geNzy7R1nw3ltQ29Pd/6gsho6voJ7liiR1bL3yytFFyKjjVouL3bj6lXlDXchdbfNe1H88u/r3dUj9MddRqVNW9Vs3GbOy2sYRqQG7JsWuTp0/NJL6qd7eff1HdBNnXcNjV7dlMqzWf7F3fN3EVIwaMPu65BzDM3iU+g+uVf/NH1Ibz1cQTI3fNRbGJY14q20ckcbA7v1B98Gp+Wutu/cieXx1O3G04THno45Lk2J9jxF7x9c1T8b4auzs65JzDM9Aw+PbkQaw2jyWRrHaGFYb+fYaHtMcVhvOtuQYasPfEV2z2krXxHaJur2oY/K40wQ3n6/6uNLYVs9n1Ka9rimuXk2w6s7H3JxYn+vYa6rrmlY/ZsPjkGPNVQ3r72J0V7KcGwa7r7PurgIZ3Tnrfle6cXm+a2NtdGPnbXbNkzG+GvslGnR5TOafeWTdFQhrg2E339qtue/ptnNU5lnrcUXXsFnnjbsPq6+Ov45b9SHUcdlnnVMe6sWc6rcb1duH8bXW3Xw6PCINjzdGwcFb1l3ZZ/VifkS32F1fwPMi3F2NJ7oCoWtonD/l0DUcrr4KsGtk7B5vV+Rcoi6gd+e5ypi9Kx3BM3mUBe+uYfHWhscsLtaFuyzo1SbBoVuI7K5cMhbuukXI2hA5q2O75sTVwuEl6jbvSf3Hs6t//4auzugmgKKrkVZurQHrhM7quOZxew2Hs+y/jq31WnS14iXqJ4VXE1Oz1ICpPS853/CoHqX+g2vVf+OHrsFu/lrl2SXvNbqGx/o+Iw2C3YehonuP0B3XPG6v4XB2tOGxe890iXoFx+7K9FXee433ZfV44NloeHw79hrHhtqgt9Xw2DV7RRog0/wXXTNfrJrSVlb76nRNbJeo24s65qg0GdZtxdbXiB95DN195q9x7m6/Zpt795nV+477z3KM3VURo/ud6Boa56stdk2aq2Pufoe6sd15uMT8PKSZsd7eyd+TPJa9plSeh/lnHlU3jzqvy2+Nu2Z+s9vOmCudZd51td7e7bdb65+bBOu8c22InNXtHO1nuNS8vW7uu5PnZtUXAY9Aw+ONUXDwVnUvlN0L9CW6xe46Zli98HefxKjbTREybqsLyfNtVbeI3RVBdX+XqgvoeUy1cNpSF8vhGT3Kgne3+HbJolh3/26Rb+gWLbNAWcd1V0EZC41bt3Xq2K7hsVusvFTd5j2p/3h2XS2zVed1E0C1ntnS7a+OGborM0bXrNgd12ja7JonV1fN7ibOusfXbfMS9RxnEu2SGnD1tSnwLB6l/oNrdbV8V1sP3YeYtt4rVN3+6pih+1BUdO8TuuMaTZtd82S2XbcR3XuI7vF127xEPcf5sFZt2tySx1uPCZ6Jhse3IU1d9d+3NJ3VcVGbvbYaHrsrO3ZNlF3T2uprh1e6ZrWVrontEnV7Ucdcomvwm89TPedHHsPeffZu71xzn1m9b9QxQ/c7Gd2VLevvWf585Laq+x3qHl93Hi5Rr4qZBsjuipsr9UqhPCfzzzyqbt29+xB9N9/arbnv6bbTzdsO3Xxx92H6brtj/rn7lp9ubnqoY+sc8Gp/l5q3l3nuS+aq07Dpqo88Ig2PN0bBwVvVfQrimkJkdsli92p8V8R0zZnjawDrz7cWio82PHbFUo71qO6TFClM0shYC8UVRQnP7lEWvLuGxY/Z8NgtCkYdF/WKkGOhr1ugXC1CRh1bFwxXx5X9Z+xRdZv3pP7j2XU11takTTch09VkK93+6phZV2t1H/joJp9GnVV/3n3SeDj6+LpaMbVbrfVWuseQGjDn/mgN2H34B57Fo9R/cK2uAbFrKBy6GnvrvULV7a+OmXXvE+rVEaP7ANX4Su768+7DWcPRx9e9Z8pVGuv7iZXuMeT9T879kas9Rh5z3QY8Cw2Pb8OtDVzD3PzYNaxtNZt1xzBfCW9PxmYbR3RNc5eoxxl1zCXSwFa3NzfFdY1481UMq+7ryWO+OmB35cO9bdbxcUlTar1v1DGz2qwYXbNfd/7yHHeNtLXZcNad56MNj/V3bEv3e53nJue/e8wdV3p8fuafeUTdHOq16rZXun1287Zb41f7q70QozGym5vumjqHOjbzwHVM17OQ/df54y11m5G54sx7H/lQ/db8OLxWGh5vjIKDt6hrIFy9kF4i26jbrWNm3aJy92LcfaVhFpS7x7HVKNjtr2t47MZ1TYzXStGTAiX7qcXWsNW4Cc/gURa8u8W3j9nwuLrySvc1eFnYq+Py83o1k70rltRtrJoT67juK/AehfqPZ9fVMl2NNaSuquO3GiSrS2vAroZb1aK1VkqN1DVCbjUKdhNh3cRZd1yXnIc9qWlzLNn3qgFy63mCR/co9R9cq6v9txoCu3p+q0GyurThsfs66lXtXz9clfcUXSPkVqPg0YbH7rguOQ978h4rx5J9rxogt54neHQaHt+GroHrGtnO2Gb3FdlbzWZpAqvj8zW+ddxrUI8z5tvTjJbHOuuubDl052oen/+vt281j3bnMg2Qe2Mu3ebW+E69f9Qxs64ps/sd6r4WPE2QXQPjVqNgN75reOyOqxt3rRxjnvMcz6oBsjsPPBfzzzyibg71WnXbK90+u3nbWR0fXX9AN0ee+dk637w3H1u3sZrHruO2vib7GjlXmavuGjaHrcZNeI00PN4YBQdvUX0hj67x71KXLnZ3x9FdGSfqi3f2VX+2Vzh0hU33uLtF9K1ipyuiZmNxO0VIHZvbugXvra/mhmfwKAve3aLlx2x4zMJeHR91XKQJso7r7r+1CBl1/NFFz+gaMSNfI7d1Vcl7U//x7FJv1L+vsfrK5/rBkuhqpJVLa8Cu9lnVWrUZM/Ve/dle3XR04qwb130lyjy+/mw214B1bG6rtexgYopn9Sj1H1wrNXD9Nz1WdXH9oFJc8l7j0obHrtlv1ehXmzHzXqD+LMdf7zc72vDYjdv6cNXeORoNjnlvVMfmtu5Kl7F6bwOPTsPj23BWw+N8e9WNf9SGx+5qiKuv6D5yNcboGt+6KwVmezlvdWzXINft99Ztbqn3jzpmWJ2X1T7r14Lnz/X3euv3L442PHZXlMzvbx0XeRx7VxTNmOwn+6/P++rcX9psyuMx/8wj6uZGr1W3vdLts5u3HboPrEc3791ddbG7/95Fj+r4VcNjN+dd+wKGHFt3zLPcNz0L3Qfyu8cR3Vh4zTQ83hgFB29N9wK4emG+1JHF7ryA5xi6sbEqKrqCpy7O772I5/a6jRQftaDIMdZtR7f4PC9UjybMMa7bTrdo3hVcewv38OgeZcG7a1isi2Zbuvt3i3xpSswCYrfoubXYVxcta1Ni/lzvU3X7HF9ZN+sWBrurR2ahd2xzfO11t717Uv/xFnS1VpoK50mW1CCrpru6vS3dvuqYUQOu9reayOrqpPqhmdUHZoZVHdlNONXaLbqrR84fpEl9l8c1mhq7Twpnu7XmzJ/rvqLuC57Fo9R/cIuuCTFNhamRx5g01nW1ddTtben2VcdkX6nFV/vr3puM+9Wx9b1G91XSs66RMe8T5nMxdO9Jug9uze+v8l4oj2u8P0szYz3GbLc2nK6uql/3Bc9Cw+PbUBvDrjU3lHVXBIyugaz76uFYNbfdWz3OqGO6JrVcGXBuekxzW9foWa/GGKvzOV8JMtteba9rtuwa/GJ+jnK/2ky4tc0tdRtRx+R3IQ2Fq9/J7vcn6vnpmiW7Zs5Zdz7yPNbH2V1RMvurzYoxn7s8pvwOjHF5rPU4u6bM7uvhX2szMC/H/DOPqJtDvVbd9kq3z26eOOMyB9zN3W5dEKnOW9f7H1mPr/eJrp+hfkg/um90zJz02Ob42ut5e912uvnpbp59r1cCXhsNjzdGwcFbUxdfo15x5lq1aLhUXty7psKhO/ZZXUSuugXzGIvUczHRXQ1yjM24FAzd460NjV1RkvuNK/2smj9XVzmCZ/EoC95dw+KtDY+X2lpI7L7+7eh9h9XiZ+47NzRmYbBbiMzPMnarafOSc3YG9R9vwaruidQrXf0xdJNKW7a2ddRWDdh9OnbWNS5W3cRUflZrwO7DQZFjSP22atpMnTrXol0tObYxasDUe3XMS30QCV6jR6n/4BZdo+CQBr2uSXFYNR+ubG3rqK2rGtYPV1Vd42LVvTfIz/I+Y/5Q1Op9TY4hV2pcNW2mwXFuaOzef41t5D1JtpMG1DpmdZV7eAYaHqlqI1rXoBVp6qrNXEOatdLUFl1j4LB3Zbx7qccZdUzXPDd0Vx+cdY15qyseRn6+tb1V4+jWNnMFwWu2uaVu41J7TZarxzLuW8dXq8bb/I6mkXT+fey+1jpyzvL8rZo269+Xrpl0bCONjqu/I9l/PX6ei/lnnl0393lNv0HX8HiprQ/Dr+Z6j9x36OaCx33nudzMDW/NQadpcdW0OTc0dhdUyp9z34zLOevOfxyZJ4fXRMPjjVFw8JZ0Vzh8yUXVWxe7u09DzFYv3nG0QbBbWB5qUbPXYFl1DZvdFX6OUJDw7B5lwbtbMLukea+7/yW2ru4Yq6uTDFsLmEN35ZXZPLb7yuw9ly7cnkH9x1uxVTutXFMb3loD7n3ydGtiqn7YZGU1MRW1jrzm8XS1216jZqf7tC48i0ep/+BW17wHuKbh7taGx9T2dZuzVRNi7L1PGbomxaF+nfY1j6drutxr1Ox0V5OEZ6Hhkao2cdUGrlm96t4luqa/16Iea9QxUc/VEWmAq9sZrjmf3RUKP/Y2V+p2LrW6uuPQXd1yWH3ldNU1Fw5zk+dWs+hKmkjrebtmOxn/WpuBeTnmn3l23bzzPRoeu29ynK2aEIduTrfKmHq/2bz/rXnsldqfEF1Px546xw2PQMPjjVFw8FasXtCvKT5WrlkcjhzXkSsJbV2p6OjicMbV+w51gT/7u+QxrY7h0mJtr/ETnsGjLHh3i5VnNTxmwe9Iw+JqEfGSRdP61W+z+ngveUyXHMOZ1H+8Jd3k00omRbYmiFYuqZdmR2vA1Vc/x9G6aWtiqn7tyaU14OoYtvbZWW0HnsWj1H/wEi6pmdP4V792+YhrGgQjV1g88qGkrQ9XzVdn3JKGxHrfIe9B5rF573PJY1odw9Y+O6vtwLPQ8EhVm/i2Gh4jDXWXNnS99qvX1eONOibSzFbP15Y05dWGuKr7GuSVI9v7WNvs1G0dlWObv7p7ZXWFxjjaIJgrKtb7DrUZNdvcapCsVseQx1bHbllth+di/pln1805X9NzcOka+izzt0caFlcfhD/6QfrY+mB7fdxpVux6Mjpbx3DJ/PRe4ye8Vhoeb4yCg7eiKzxqg9+tLnnhzQt9xue4LnkB7vaRbdVxW7LPVaFRx8ZeYZJjqsVMldu7Y5+l4KpXiIRn9SgL3t1CZW0A3NLdf0uuRpIFz0v2kauR1O3EJQt32d9qcbG78ksWEVfjYyyiXrNwewb1H2/NXgNfGv5WH9w4Ymvb1agBL617VhNTl9SRaShc1XR1bOScrMZHHsdek2JqwK0rjMel5wIe1aPUf/BS9hr40vB3y5UFt7ZdpT7P+HxY6siHqobVh6suqfPzvqT7auuoYyPnZDU+8jj23uvk/U331dWzS88FPCoNj1S1gW+v4THSIJer42011eW2jMlXYdf7vzb12KOOmaWhLVf3q/cZ0jS3d/XCWc5nmu9W28xzksa9er8tR7Z561U36za3jK/Uzu/EJQ2W3fHnZ3Xcytbv6mo7q/FDzuve85tzW/9uzbL9NAI/wt8PXob5Z55d13ewt1beubThMY19mWu9ZF+rfex969AsjZWrOfDuA/178/HjQgBbc9u5baunITKvvzc/Da+Zhscbo+DgrcgLcV7QZy+9sNrto1Pvd4lc1vmT8mLeXer5iPmYjnwCJIVFxqYASvFwzTnM+Nwv90+R8hLnBB7Royx4ZwEsi2WzSxb3uvt3blloy33rv4tZILzkOOdtXfpY0/yYBcc0OI771TGvjfqPtyw1Txr5Ri1Tb7/GGTVgN4mWRsE67oh6vPX2aq4BI/9/pHac1Rowz0H+vDWpBc/mUeo/+BhSM6eRL3XzS9XL2WZ9X9Gp97tE9wGuNArWcUfU4623V3kvknH5AFbk/7uvsN4y3t+M9yt5DvLnI+9z4FloeKTK1eXSvDVcerW5NJTlfmnwivz/ozVxzY9/qGNW6mOvt19qnM80OL7E9iLbTJNmtnnp87ulnrPOrftLc2GtPS5t/hwuPa78HmdsGiCv/d0ef79y/2xn7L+O4/mZf+bZjbnO2TXznGPedc+l6/F1H/W1Ja453vq4j2xjzMff0hcw7pdtXNujAK+Rhscbo+CAx5EX7u5TDJcuOAP3Z8H75XRXXbl2EfKtUP/BY8nEUVcD3nJVSuB86j94LGkK7K60eMtVKYHzaXgEHsXqK60vuUIkvBbmn+H16C6mlKtE1nHA+TQ83hgFB7xu49MKkctUf6Iggadgwft6WXjM1Uni83/j8x/8uxiXXvnkrVH/wes314Dd13/kZ/U+wOum/oPXL1c/HO81uq/Mzs/qfYDXTcMj8JrlSpS5EmJ0X2edr4Gu94FHYP4Z7mvMK3fNjuFiSvA6aHi8MQoOeN26JschV/o5cqlo4PWx4H29fB1b/fdwlq97q/fhT1L/weuXD7XUf9/mGtBXdsDjUf/B6/e5H/7cB6+7Q672mK+IrvcBXjcNj8Br1jU5DrnN1R15VOaf4X7yrUD1NWWWRsh6H+A+NDzeGAUHvF5ZyP6kKUQGX2MIj8uC9/W6r7AeXHHlGPUfvH7137fZP/ilX/pgPPD6qf/g9auvuTMfrILHpOEReK1WX2E9fOMbf/eD+8CjMP8M9/NTP/7jH7ymDLnQUh0P3I+Gxxuj4IDX69e++MUPCpHIVX18+gIemwXv6+XKKvXfxUizoyuuHKP+g9dt9SlcNSA8NvUfvG5f+vUvffDaG3n/ka+4ruOBx6DhEXit8jXWte6IT33q2959+ctf+GA8PBLzz3A/f/a7vuuD15b4Kz/4g77KGl4ZDY83RsEBr1eu8Pg7v/mb7xe2hyyA+xpreHwWvK/31d/66vuvtc6iY+RKK7/xe7/xwTjW1H/wunU1YD4I42us4bGp/+B1y4en8l5jvM+IvO/woSp4bBoegdfqW9/68vurOKbxcfja137R11jzFMw/w/1kXjlzyWNeOd8WpNERXicNjzdGwQEA57PgzT2p/wDgfOo/ADifhkcAOJ/5ZwDYp+Hxxig4AOB8Fry5J/UfAJxP/QcA59PwCADnM/8MAPs0PN4YBQcAnM+CN/ek/gOA86n/AOB8Gh4B4HzmnwFgn4bHG6PgAIDzWfDmntR/AHA+9R8AnE/DIwCcz/wzAOzT8HhjFBwAcD4L3tyT+g8Azqf+A4DzaXgEgPOZfwaAfRoeb4yCAwDOZ8Gbe1L/AcD51H8AcD4NjwBwPvPPALBPw+ONUXAAwPkseHNP6j8AOJ/6DwDOp+ERAM5n/hkA9ml4vDEKDgA4nwVv7kn9BwDnU/8BwPk0PALA+cw/A8A+DY83RsEBAOez4M09qf8A4HzqPwA4n4ZHADif+WcA2Kfh8cYoOADgfBa8uSf1HwCcT/0HAOfT8AgA5zP/DAD7NDzeGAUHAJzPgjf3pP4DgPOp/wDgfBoeAeB85p8BYJ+Gxxuj4ACA81nw5p7UfwBwPvUfAJxPwyMAnM/8MwDs0/B4YxQcAHA+C97ck/oPAM6n/gOA82l4BIDzmX8GgH0aHm+MggMAzmfBm3tS/wHA+dR/AHA+DY8AcD7zzwCwT8PjjVFwAMD5LHhzT+o/ADif+g8AzqfhEQDOZ/4ZAPZpeLwxCg4AOJ8Fb+5J/QcA51P/AcD5NDwCwPnMPwPAPg2PN0bBAQDns+DNPan/AOB86j8AOJ+GRwA4n/lnANin4fHGKDgA4HwWvLkn9R8AnE/9BwDn0/AIAOcz/wwA+zQ83hgFBwCcz4I396T+A4Dzqf8A4HwaHgHgfOafAWCfhscbo+AAgPNZ8Oae1H8AcD71HwCcT8MjAJzP/DMA7NPweGMUHABwPgve3JP6DwDOp/4DgPNpeASA85l/BoB9Gh5vjIIDAM5nwZt7Uv8BwPnUfwBwPg2PAHA+888AsE/D441RcADA+Sx4c0/qPwA4n/oPAM6n4REAzmf+GQD2aXi8MQoOADifBW/uSf0HAOdT/wHA+TQ8AsD5zD8DwD4NjzdGwQEA57PgzT2p/wDgfOo/ADifhkcAOJ/5ZwDYp+Hxxig4AOB8Fry5J/UfAJxP/QcA59PwCADnM/8MAPs0PN4YBQcAnM+CN/ek/gOA86n/AOB8Gh4B4HzmnwFgn4bHG6PgAIDzWfDmntR/AHA+9R8AnE/DIwCcz/wzAOzT8HhjFBwAcD4L3tyT+g8Azqf+A4DzaXgEgPOZfwaAfRoeb4yCAwDOZ8Gbe1L/AcD51H8AcD4NjwBwPvPPALBPw+ONUXAAwPkseHNP/397d6waRRQFYNgiL7WNjKX7BCIKGhBfQOxcUTsbSxGMNnkBCQgSxCIuphHRbl2LoGKq1CoW6lmYON41O5vs7NnC74P/BYaBc+fu3RnrP0mS8rP+kyQpPwceJUnKz/6zJEntOfC4IAsOSZLy84O3Vpn1nyRJ+Vn/SZKUnwOPkiTlZ/9ZkqT2HHhckAWHJEm5/Tg48IO3Vtbe1z0bTpIkJWf9J0lSfs3nXwceJUnK6dv3V/afJUlqqblf7MDjCVlwSJKU24e37/zgrZU1HO3acJIkKTnrP0mS8ms+/zrwKElSTqPxlv1nSZJaau4Xn6qqtfIsH3PoVf39uIDD5y+mLrAkSeq+jQcbhwuYJy+fTm3IS8vs3qP7h/ef9Z8kSTlZ/0mSlF/z+XdnuDl1IEOSJHXfw8d37T9LktRSvV/cq/rb5Tk+5tQ7c3YQF/HipauTV2aWF1mSJHVbzNz6gf/c+pXJJ5bKTXlpWcU9V99/1n+SJOVk/SdJUn7N598L65cnn9gsD2VIkqRui5lr/1mSpNnV+8W90/3z5Tk+5hTfAq8XHYPBnamLLEmSuike7GPW1nO37tqtm1Ob8lLXxcGKuNfK+8/6T5Kk5WX9J0lSfkc9/964fX3qUIYkSeqm+GNBzNpy/tp/liTpT+V+cZzZK8/xcQxxYrS+mHGKNF6dGd8L948LSZIWK2bpl/fjyacbmm/2iTcsN+dvvHUgPrU0HO164486K+6l1x/fTD6d2XyzRXn/Wf9JktRd1n+SJOU37/NvvHUqPrU5Gm9546MkSQsWs/TT52c/d4abf73ZsZy/9p8lSf9zs/aLy/N7nED9aWtJkrTcmq+mNn+VnftPkqT8zF9JkvIzfyVJys/8lSSpPZ+y7li8KjMuaq/qb5cXW5Iknbzfs3U/Hu7/9Vpq81fLzv0nSVJ+5q8kSfmZv5Ik5Wf+SpLU3qx5SZeqai0usiRJWqyYqeWYPZL5q45z/0mSlJ/5K0lSfuavJEn5mb+SJLV3rHkJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwXwifPnSIgYRjAAAAAElFTkSuQmCC\"\u003e\u003c/p\u003e","title":"JNCIA Reference Guide"},{"content":"IS-IS IS-IS (Intermediate System to Intermediate System) is a link-state routing protocol commonly used in service provider networks and hey, you\u0026rsquo;re studying for the JNCIS-SP, so you\u0026rsquo;re in luck. Like OSPF, it uses the Dijkstra SPF algorithm to compute shortest paths, but it was designed to handle all sorts of traffic. So even though it was designed with CLNP in mind, it can carry things like IPv4, IPv6, and label information for mpls and srv6.\nTerms ES (End System) - A host that sends and receives packets. ES-to-ES communication is host-to-host. A server, a laptop, a IP phone, etc. IS (Intermediate System) - A router that forwards packets. IS-IS describes routing between intermediate systems. CLNP (Connectionless-mode Network Protocol) A competing alternative to IP designed during the early days of networking. ISIS was created to carry CLNP traffic. NSAP (Network Service Access Point) - The addressing scheme IS-IS uses instead of IP addresses. NET (Network Entity Title) - The IS-IS address configured on a router. Format: Area ID . System ID . NSEL Example: 49.0001.1921.6800.1001.00 49 — AFI (Just keep this as 49. And if curious read about AFI as to why) 0001 — Area ID 1921.6800.1001 — System ID (6 bytes, often derived from an IP like 192.168.1.1) 00 — NSEL (always 00 for a router) System ID - similar to a OSPF Router ID L1 router - Routes only within its area; sends traffic to unknown destinations toward the nearest L1/L2 router. L2 router - Routes between areas and toward other ASes. L1/L2 router - Does both; this is the Junos default. Link-State Database Runs the Dijkstra SPF algorithm. L1 and L2 maintain separate LSDBs — SPF is run independently for each level. Each router originates its own LSP and floods it throughout its level. LSDB synchronization is handled by CSNPs (full sync) and PSNPs (fill gaps). More on these below. IS-IS Protocol Data Units (PDUs) IIH (IS-IS Hello) - Used to discover neighbors and maintain adjacencies. Contains the router\u0026rsquo;s identity, capabilities, and configured area. L1 LAN IIH: Sent by Level 1 routers on multi-access networks (like Ethernet). L2 LAN IIH: Sent by Level 2 routers on multi-access networks. P2P IIH: A single format used for point-to-point links, regardless of level. LSP (Link State PDU) - Carries the actual routing information, including connected neighbors, configured prefixes, and metric costs. Each LSP has a sequence number, checksum, and remaining lifetime. L1 LSP: Contains routing information for the local area. L2 LSP: Contains backbone routing information. CSNP (Complete Sequence Number PDU) - Contains a complete list of all LSPs in a router\u0026rsquo;s LSDB. Used to ensure every router in the area has a consistent view of the network. L1 CSNP: Summarizes the Level 1 LSDB. L2 CSNP: Summarizes the Level 2 LSDB. On LAN segments, the DIS sends these periodically. On point-to-point links, they are typically sent only when the link first comes up. PSNP (Partial Sequence Number PDU) - Used to request missing LSPs or acknowledge receipt of specific LSPs. Unlike CSNPs, they only reference a subset of LSPs. L1 PSNP / L2 PSNP: Used to fill gaps after a CSNP reveals a missing LSP, or as an explicit ACK on point-to-point links. Type, Length, Value (TLVs) TLVs are the data structures embedded inside LSPs that carry routing information. Key TLVs to know for JNCIS-SP:\nTLV Type Name Primary Usage 1 Area Addresses Adjacency formation 22 Extended IS Reachability Wide metrics for neighbors 129 Protocols Supported IPv4 / IPv6 capability 135 Extended IP Reachability Wide metrics for IPv4 prefixes 236 IPv6 Reachability IPv6 prefix advertisements 242 Router CAPABILITY Advertising SR/TE features Adjacencies and Neighbors An IS-IS adjacency is formed after a successful IIH exchange. Routers must agree on the following to form an adjacency:\nArea ID (for Level 1) Authentication (if configured) MTU Adjacency states (point-to-point): Down → Init → Up\nOn LAN segments, all routers form a full adjacency with each other. This differs from OSPF, where only the DR and BDR form full adjacencies with other routers.\nDesignated Intermediate System (DIS) The DIS is elected on multi-access (LAN) segments to reduce flooding overhead. It is similar to OSPF\u0026rsquo;s DR but with some important differences.\nElection\nThe router with the highest interface priority wins (default: 64, range: 0–127). Ties are broken by the highest SNPA (MAC address). Election is preemptive — a higher-priority router that joins later immediately takes over (unlike OSPF\u0026rsquo;s DR). There is no backup DIS (no BDR equivalent). Role\nPeriodically floods CSNPs every 10 seconds to keep the LSDB synchronized on the LAN. Creates and maintains a pseudonode LSP that represents the LAN segment itself. All routers on the segment form an adjacency with the pseudonode rather than directly with each other — this simplifies the topology and reduces LSP count. Key differences from OSPF DR\nFeature IS-IS DIS OSPF DR Backup None BDR exists Preemptive Yes No Hello rate 3x more frequently than normal Same as other routers Adjacencies All routers form full adjacencies Only DR/BDR form full adjacencies Identifying the DIS\nThe ! in show isis adjacency output marks the neighbor that is the DIS on that segment.\nset protocols isis interface ge-0/0/1.0 level 2 priority 100 Metrics In IS-IS, metrics are the \u0026ldquo;cost\u0026rdquo; assigned to an interface to influence path selection. Unlike OSPF, which can automatically calculate cost based on bandwidth, IS-IS metrics are traditionally static and require manual configuration. Narrow Metrics - The default. Supports values 0–63 (field is only 6 bits). Wide Metrics - Expands the metrics field to 24 bits. Required for Traffic Engineering (TE) and Segment Routing. set protocols isis level 1 wide-metrics-only set protocols isis level 2 wide-metrics-only Configuration, Monitoring, and Troubleshooting show isis adjacency\nroot@R2-P\u0026gt; show isis adjacency Interface System L State Hold (secs) SNPA ge-0/0/1.0 R4-P ! 2 Up 8 50:0:0:4:0:3 ge-0/0/2.0 R1-PE ! 1 Up 23 50:0:0:1:0:2 Header breakdown:\nInterface: The local interface where the neighbor was discovered. System: The System ID or hostname of the neighbor. If resolvable, you see a name (like R1-PE); otherwise the raw hex ID. L: Level. IS-IS uses Level 1 (intra-area) and Level 2 (inter-area). State: Adjacency status. Up is expected; Down, Initialize, or Reject indicate a problem. Hold: The dead timer. Counts down until the next Hello is expected. If it hits 0, the adjacency drops. SNPA: Subnetwork Point of Attachment. On Ethernet, this is the neighbor\u0026rsquo;s MAC address. !: Indicates the neighbor is the DIS on that segment. Exam Gotcha\nTake a look at the below output. Wait a minute\u0026hellip;. There\u0026rsquo;s nothing about Level 3 adjacencies anywhere in the above notes.\nroot@vRouter1\u0026gt; show isis adjacency Interface System L State Hold (secs) SNPA ge-0/0/1.0 vRouter2 3 Up 24 This is Junos shorthand for a L1/L2 adjacency when the two sides are configured as point-to-point. I might have run into a question that showed something like the above and then a question about what the L3 represented. TMYK!\nQuick Reference PDU Types PDU Type Name Sent By Network Type Purpose IIH IS-IS Hello All Routers LAN or P2P Establishes and maintains adjacencies. P2P hellos cover both levels; LAN hellos are level-specific. LSP Link State PDU All Routers All The IS-IS equivalent of an LSA. Carries routing info (prefixes, neighbors, metrics) in TLVs. Flooded per level. CSNP Complete Sequence Number PDU DIS (on LAN) LAN or P2P Acts as a table of contents for the LSDB. Sent periodically on LANs (default 10s) to keep routers in sync. PSNP Partial Sequence Number PDU Any Router LAN or P2P Requests a missing LSP or acknowledges receipt of an LSP (on P2P links only). TLV Types TLV Type Name Primary Usage 1 Area Addresses Adjacency formation 22 Extended IS Reachability Wide metrics for neighbors 129 Protocols Supported IPv4 / IPv6 capability 135 Extended IP Reachability Wide metrics for IPv4 prefixes 236 IPv6 Reachability IPv6 prefix advertisements 242 Router CAPABILITY Advertising SR/TE features ","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_is-is/","summary":"\u003ch2 id=\"is-is\"\u003eIS-IS\u003c/h2\u003e\n\u003cp\u003eIS-IS (Intermediate System to Intermediate System) is a link-state routing protocol commonly used in service provider networks and hey, you\u0026rsquo;re studying for the JNCIS-SP, so you\u0026rsquo;re in luck. Like OSPF, it uses the Dijkstra SPF algorithm to compute shortest paths, but it was designed to handle all sorts of traffic. So even though it was designed with CLNP in mind, it can carry things like IPv4, IPv6, and label information for mpls and srv6.\u003c/p\u003e","title":"JNCIS-SP IS-IS (Best IGP)"},{"content":"OSPF OSPF Packet Types Type Name Purpose 1 Hello Neighbor discovery, DR/BDR election, keepalive 2 DBD LSDB table of contents exchange 3 LSR Request specific missing LSAs 4 LSU Delivers actual LSAs 5 LSAck Confirms LSU receipt LSA Types Type Name Originated By Scope Blocked By 1 Router Every router Area — 2 Network DR Area — 3 Summary ABR Domain Totally Stubby, Totally NSSA 4 ASBR Summary ABR Domain Totally Stubby, Totally NSSA, NSSA, Stub 5 AS-External ASBR Domain All stub and NSSA areas 7 NSSA External ASBR (NSSA) NSSA only — (translated to Type 5 at ABR) Area Types Area Type 3 Type 4 Type 5 Type 7 Default Route Standard Yes Yes Yes No No Backbone Yes Yes Yes No No Stub Yes No No No Yes (auto) Totally Stubby No No No No Yes (auto) NSSA Yes No No Yes No (configurable) Totally NSSA No No No Yes Yes (auto) Adjacency States Down → Init → 2-Way → ExStart → Exchange → Loading → Full\nIS-IS PDU Types PDU Type Name Sent By Network Type Purpose IIH IS-IS Hello All Routers LAN or P2P Establishes and maintains adjacencies. P2P hellos cover both levels; LAN hellos are level-specific. LSP Link State PDU All Routers All The IS-IS equivalent of an LSA. Carries routing info (prefixes, neighbors, metrics) in TLVs. Flooded per level. CSNP Complete Sequence Number PDU DIS (on LAN) LAN or P2P Acts as a table of contents for the LSDB. Sent periodically on LANs (default 10s) to keep routers in sync. PSNP Partial Sequence Number PDU Any Router LAN or P2P Requests a missing LSP or acknowledges receipt of an LSP (on P2P links only). TLV Types TLV Type Name Primary Usage 1 Area Addresses Adjacency formation 22 Extended IS Reachability Wide metrics for neighbors 129 Protocols Supported IPv4 / IPv6 capability 135 Extended IP Reachability Wide metrics for IPv4 prefixes 236 IPv6 Reachability IPv6 prefix advertisements 242 Router CAPABILITY Advertising SR/TE features MPLS Label Operations Operation Who Does It Description Push Ingress LSR Adds a label to the packet Swap Transit LSR Replaces the top label Pop Egress or penultimate hop Removes the top label Reserved Labels Label Name Meaning 0 IPv4 Explicit Null Signal QoS intent to egress 1 Router Alert Trap to local CPU 2 IPv6 Explicit Null Signal QoS intent for IPv6 3 Implicit Null Trigger PHP at penultimate hop LDP vs RSVP Feature LDP RSVP Traffic Engineering No Yes Explicit paths No Yes (ERO) Bandwidth reservation No Yes Path calculation IGP topology CSPF LSPs created All prefixes (loopbacks by default) Manually configured Soft-state No Yes (requires refresh) Fast Reroute No Yes Use case iBGP next-hop resolution TE, bandwidth guarantees Key Junos Routing Tables Table Contents inet.0 Standard IP routes inet.3 MPLS-signaled routes (BGP next-hop resolution) mpls.0 Label forwarding entries (LFIB) Monitoring Commands Command Purpose show mpls lsp Summary of all LSPs show mpls lsp ingress extensive Detailed ingress LSP info including RRO show rsvp session Active RSVP sessions show rsvp interface RSVP interface state and bandwidth show ldp neighbor LDP neighbor adjacencies show ldp session LDP TCP sessions show ldp database LDP label bindings show ldp interface LDP-enabled interfaces show route table inet.3 MPLS routes used for BGP resolution show route table mpls.0 MPLS forwarding table traceroute mpls ldp \u0026lt;prefix\u0026gt; Trace an LDP LSP path Tunnels IP-IP vs GRE Feature IP-IP GRE Overhead 20 bytes 24 bytes (minimum) IP protocol number 4 47 IPv4 unicast Yes Yes IPv6 No (use 6in4 proto 41) Yes Multicast No Yes MPLS No Yes L2 frames No Yes Keepalives No Yes Junos interface ip-0/0/0 gr-0/0/0 MTU Impact Tunnel Overhead Effective MTU (1500B link) IP-IP 20B 1480 GRE 24B 1476 GRE + 1 MPLS label 28B 1472 Key Commands Command Purpose show interfaces gr-0/0/0 detail Tunnel state, counters show interfaces gr-0/0/0 extensive Includes keepalive stats ping \u0026lt;dest\u0026gt; size 1472 do-not-fragment MTU path test High Availability HA Technology Comparison Feature GR GRES NSR ISSU Protects against Control plane restart RE hardware failure RE hardware failure Software upgrade Requires dual RE No Yes Yes Yes Requires GRES No — Yes Yes Requires NSR No No — Yes Neighbor cooperation needed Yes No No No Forwarding interrupted No No No No Protocol reconvergence No (helpers hold routes) Yes No No Transparent to neighbors No No Yes Yes LACP Modes Mode Behavior Active Initiates LACP — sends PDUs unconditionally Passive Responds only — at least one side must be active BFD Detection Time Detection time = negotiated-interval × multiplier Negotiated interval = max(local min-interval, remote min-interval) Key Commands Command Purpose show lacp status LAG member link states show interfaces ae0 detail AE interface stats and member links show system switchover GRES status show task replication NSR sync status show chassis routing-engine RE status and mastership show bfd session BFD session states and timers Protocol Independent Routing Default Route Preferences Protocol Preference Direct / Local 0 Static 5 OSPF Internal 10 IS-IS L1 Internal 15 IS-IS L2 Internal 18 RIP 100 Aggregate / Generated 130 OSPF External 150 IS-IS L1 External 160 IS-IS L2 External 165 BGP 170 Static Route Next-Hop Options Next-hop Behavior IP address Forward to next-hop reject Drop + ICMP unreachable discard Silent drop next-table Redirect to another routing table Routing Instance Types Type Purpose forwarding FBF — separate forwarding table, no protocols virtual-router Full isolated routing domain with protocols vrf MPLS L3VPN vpls MPLS L2VPN (multipoint) l2vpn MPLS L2VPN (point-to-point) Key Commands Command Purpose show route Show active routing table show route hidden Show inactive / suppressed routes show route martians table inet.0 Show martian prefix list show route instance List all routing instances show route \u0026lt;prefix\u0026gt; exact detail Show a specific route with contributing details show route forwarding-table Show the forwarding table (LFIB) Layer 2 / VLANs 802.1ad Tag Operations Operation Where Description Push Ingress PEB Add S-Tag to customer frame Pop Egress PEB Remove S-Tag Swap Inter-provider handoff Replace S-Tag value STP Port States State BPDUs Learn MACs Forward Data Blocking Rx only No No Listening Yes No No Learning Yes Yes No Forwarding Yes Yes Yes RSTP Port Roles Role Description Root Best path to root Designated Best port on segment toward root Alternate Backup root port — instant failover Backup Backup designated port (same bridge, same segment) STP Timers Timer Default Impact Hello 2s BPDU send interval Forward Delay 15s Time in Listening + Learning states Max Age 20s BPDU expiry Key Commands Command Purpose show bridge mac-table Layer 2 forwarding table show bridge domain Bridge domain summary show spanning-tree bridge detail STP topology and root info show spanning-tree interface Per-port STP state and role IPv6 Address Types Prefix Type Routable 2000::/3 Global Unicast Yes FC00::/7 Unique Local No (private) FE80::/10 Link-Local No (link only) FF00::/8 Multicast Scope-dependent ::1/128 Loopback No NDP Message Types Message ICMPv6 Purpose RS 133 Host solicits router RA 134 Router announces prefix/config NS 135 MAC resolution / DAD NA 136 Response to NS Redirect 137 Better next-hop notification Address Assignment Methods Method RA M flag RA O flag Address Source SLAAC 0 0 Self-generated SLAAC + DHCPv6 0 1 Self-generated + DHCPv6 options DHCPv6 stateful 1 — DHCPv6 server OSPFv2 vs OSPFv3 Feature OSPFv2 OSPFv3 Junos hierarchy protocols ospf protocols ospf3 Addressing in Router LSA Yes No (Type 8/9) Router ID required Auto or manual Manual if no IPv4 Runs over IPv4 IPv6 link-local OSPFv3 LSA Types for IPv6 Type Name Purpose 8 Link LSA Link-local address + prefixes on the link 9 Intra-Area Prefix LSA IPv6 prefix reachability within an area ","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_quick_reference/","summary":"\u003ch2 id=\"ospf\"\u003eOSPF\u003c/h2\u003e\n\u003ch3 id=\"ospf-packet-types\"\u003eOSPF Packet Types\u003c/h3\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003eType\u003c/th\u003e\n          \u003cth\u003eName\u003c/th\u003e\n          \u003cth\u003ePurpose\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e1\u003c/td\u003e\n          \u003ctd\u003eHello\u003c/td\u003e\n          \u003ctd\u003eNeighbor discovery, DR/BDR election, keepalive\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e2\u003c/td\u003e\n          \u003ctd\u003eDBD\u003c/td\u003e\n          \u003ctd\u003eLSDB table of contents exchange\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e3\u003c/td\u003e\n          \u003ctd\u003eLSR\u003c/td\u003e\n          \u003ctd\u003eRequest specific missing LSAs\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e4\u003c/td\u003e\n          \u003ctd\u003eLSU\u003c/td\u003e\n          \u003ctd\u003eDelivers actual LSAs\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e5\u003c/td\u003e\n          \u003ctd\u003eLSAck\u003c/td\u003e\n          \u003ctd\u003eConfirms LSU receipt\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003ch3 id=\"lsa-types\"\u003eLSA Types\u003c/h3\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003eType\u003c/th\u003e\n          \u003cth\u003eName\u003c/th\u003e\n          \u003cth\u003eOriginated By\u003c/th\u003e\n          \u003cth\u003eScope\u003c/th\u003e\n          \u003cth\u003eBlocked By\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e1\u003c/td\u003e\n          \u003ctd\u003eRouter\u003c/td\u003e\n          \u003ctd\u003eEvery router\u003c/td\u003e\n          \u003ctd\u003eArea\u003c/td\u003e\n          \u003ctd\u003e—\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e2\u003c/td\u003e\n          \u003ctd\u003eNetwork\u003c/td\u003e\n          \u003ctd\u003eDR\u003c/td\u003e\n          \u003ctd\u003eArea\u003c/td\u003e\n          \u003ctd\u003e—\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e3\u003c/td\u003e\n          \u003ctd\u003eSummary\u003c/td\u003e\n          \u003ctd\u003eABR\u003c/td\u003e\n          \u003ctd\u003eDomain\u003c/td\u003e\n          \u003ctd\u003eTotally Stubby, Totally NSSA\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e4\u003c/td\u003e\n          \u003ctd\u003eASBR Summary\u003c/td\u003e\n          \u003ctd\u003eABR\u003c/td\u003e\n          \u003ctd\u003eDomain\u003c/td\u003e\n          \u003ctd\u003eTotally Stubby, Totally NSSA, NSSA, Stub\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e5\u003c/td\u003e\n          \u003ctd\u003eAS-External\u003c/td\u003e\n          \u003ctd\u003eASBR\u003c/td\u003e\n          \u003ctd\u003eDomain\u003c/td\u003e\n          \u003ctd\u003eAll stub and NSSA areas\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e7\u003c/td\u003e\n          \u003ctd\u003eNSSA External\u003c/td\u003e\n          \u003ctd\u003eASBR (NSSA)\u003c/td\u003e\n          \u003ctd\u003eNSSA only\u003c/td\u003e\n          \u003ctd\u003e— (translated to Type 5 at ABR)\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003ch3 id=\"area-types\"\u003eArea Types\u003c/h3\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003eArea\u003c/th\u003e\n          \u003cth\u003eType 3\u003c/th\u003e\n          \u003cth\u003eType 4\u003c/th\u003e\n          \u003cth\u003eType 5\u003c/th\u003e\n          \u003cth\u003eType 7\u003c/th\u003e\n          \u003cth\u003eDefault Route\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eStandard\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eBackbone\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eStub\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eYes (auto)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eTotally Stubby\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eYes (auto)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eNSSA\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eNo (configurable)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eTotally NSSA\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eNo\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eYes (auto)\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003ch3 id=\"adjacency-states\"\u003eAdjacency States\u003c/h3\u003e\n\u003cp\u003eDown → Init → 2-Way → ExStart → Exchange → Loading → \u003cstrong\u003eFull\u003c/strong\u003e\u003c/p\u003e","title":"JNCIS-SP Quick Reference"},{"content":"Broadcom Switch Chipset Families Broadcom dominates merchant silicon for data center and carrier switching. Their three main ASIC families, Tomahawk, Trident, and Jericho, each make different tradeoffs between bandwidth, feature depth, and buffer size. Most Arista, Cisco Nexus, and Juniper QFX/PTX platforms run one of these under the hood.\n1. Tomahawk Series Design philosophy: Maximum port density and throughput at the cost of feature depth. These chips use cut-through forwarding, carry shallow on-chip buffers (~50–100 MB), and support little to no L3 routing table depth. The trade-off is intentional; at spine and AI fabric scale, you want wire-rate forwarding with predictable low latency, not a large TCAM.\nTomahawk 5 (TH5) First chip in the family to reach 51.2 Tbps with 64 ports of 800GbE. Notable for introducing credit-based scheduling to manage incast congestion, a problem specific to AI training workloads where hundreds of GPUs complete a collective operation simultaneously and flood the network at the same instant.\nTomahawk 6 (TH6) Reached production volume in early 2026. Doubles capacity to 102.4 Tbps on a single die, using a 3nm process node.\nSupports 512 × 200GbE or 1,024 × 100GbE in breakout configurations. At this density, a two-tier (spine-leaf) fabric can interconnect ~128,000 GPUs without needing a third tier, which reduces total fiber count and hop count significantly. Whether that\u0026rsquo;s worth the cost of deploying TH6-based spines depends heavily on cluster size. 2. Trident Series Design philosophy: Feature richness over raw bandwidth. Trident chips carry larger TCAMs, richer ACL support, and more flexible telemetry pipelines. They\u0026rsquo;re the right choice when you need per-flow visibility, complex policy enforcement, or protocol flexibility at the access or leaf layer.\nTrident 4 (TD4) Introduced a programmable pipeline using NPL, a P4-like language that lets you modify forwarding behavior (add new encapsulations, custom telemetry headers, experimental protocols) without a hardware respin. This was a meaningful shift from fixed-function pipelines.\nTrident 5-X12 (16 Tbps) NetGNT Engine: An on-chip neural network inference block that classifies traffic and detects congestion patterns or anomalous flows (e.g., volumetric DDoS) at line rate. The inference runs in the datapath, not on a separate CPU, so it doesn\u0026rsquo;t add latency. Supports 800G uplinks to spine, which allows a leaf to be physically connected to a TH5/TH6 spine without a speed mismatch at the uplink. 3. Jericho Series Design philosophy: Deep buffers and large routing tables. Where Tomahawk sacrifices buffer depth for speed, Jericho inverts that. It\u0026rsquo;s designed for environments where packets may need to queue for milliseconds (WAN congestion, DCI links with variable RTT) and where the FIB needs to hold full Internet routing tables.\nJericho 3-AI Targeted at lossless AI backend fabrics, the role that InfiniBand has traditionally filled. Provides scheduled fabric support to guarantee in order delivery for RDMA traffic, where a single dropped or reordered packet forces a full retransmit and stalls a GPU collective operation.\nJericho 4 (Sampling, targeting 2026 production) HBM Buffers: Uses High Bandwidth Memory stacked on the package, the same DRAM technology used in GPUs, to provide much deeper buffers than SRAM based designs. This matters at DCI or internet edge roles where link utilization can spike and you need to absorb bursts without dropping. Targets Scale Across use cases: connecting geographically separated AI clusters (up to ~100 km) over a lossless routed fabric, where latency and reorder sensitivity of RDMA traffic otherwise makes Ethernet a poor fit. Comparison Table — Current Flagships Family Latest Model Throughput Buffer Depth Primary Use Case Tomahawk Tomahawk 6 102.4 Tbps Shallow (~50–100 MB SRAM) Spine, AI fabric core Trident Trident 5-X12 16.0 Tbps Moderate ToR, enterprise leaf Jericho Jericho 4 51.2 Tbps Deep (HBM) Internet edge, DCI, lossless AI fabric ","permalink":"https://ttl-expired.net/notes/broadcomchipsets/","summary":"\u003ch1 id=\"broadcom-switch-chipset-families\"\u003eBroadcom Switch Chipset Families\u003c/h1\u003e\n\u003cp\u003eBroadcom dominates merchant silicon for data center and carrier switching. Their three main ASIC families, Tomahawk, Trident, and Jericho, each make different tradeoffs between bandwidth, feature depth, and buffer size. Most Arista, Cisco Nexus, and Juniper QFX/PTX platforms run one of these under the hood.\u003c/p\u003e\n\u003chr\u003e\n\u003ch2 id=\"1-tomahawk-series\"\u003e1. Tomahawk Series\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eDesign philosophy:\u003c/strong\u003e Maximum port density and throughput at the cost of feature depth. These chips use cut-through forwarding, carry shallow on-chip buffers (~50–100 MB), and support little to no L3 routing table depth. The trade-off is intentional; at spine and AI fabric scale, you want wire-rate forwarding with predictable low latency, not a large TCAM.\u003c/p\u003e","title":"Broadcom Switch Chipset Families"},{"content":"I was laid off from Block at the end of February and the reason provided by Jack was AI efficiencies were reshaping how work is done. Bummer. After sitting for a day or so with the existential dread of an AI dominated future, I decided that instead of sitting still and letting that future catch up to me, I needed to grab the bull by the horns and steer where my career is heading.\nRight after the layoff I made a post to appeal to my network to help land a new job. In it I used my best LinkedIn prose and said that its an exciting time to be in network infrastructure with the capabilities that AI is providing. Even though the post was tailored with a singular objective I believed it then and certainly still do.\nNot to be doom and gloom, but AI is coming and it is going to reshape how work is done. Jack is not wrong about that. Maybe his timing was off and maybe the way it was approached could have been done with a more deft hand, but the premise is not wrong.\nI decided to stop sitting still and build something. If AI is reshaping the work, I want to be in front of the change as opposed to reacting to it. As network engineers without robust software development skills, we need to figure out how to utilize these tools to deliver value. Because if we don\u0026rsquo;t, someone else will.\nWhat I built with Claude atlas-trace A means of programatically interacting with RIPE Atlas. Provide a destination IP with different options and get traces back. Future improvement is to add more intelligence to the results. Find common hops or ASNs that indicate where the potential issue might live. maintenance-bot Scrapes a gmail account searching for provider maintenances and adds them to a gcalendar. netaudit Definitely a work in progress. The idea is provide the tool a yaml file detailing a topology, it spins up the infra in container lab, and then uses a mcp to provide natural language queries about the behavior of the container lab. In order to actually make it more useful, need to flesh out getting actual config added to devices, and then importantly, allow for config changes to be pushed so we can test what those changes did. dailyfeed Scrapes a series of network focused websites for articles that match particular areas of interest and produces a curated list of interesting articles daily. blogger The framework and data for this site. Workflow is Obsidian as the editor of .md files, commit the files directly to the Git repo, and then using Hugo and a Cloudflare integration, push the updated content to a Cloudflare page (Also, Cloudflare is pretty awesome with how easy they make this. But should put in some work to make their UI more intuitive) Now, theres nothing revolutionary here. These are already solved problems with open source solutions that are much more robust and full featured. But that wasn\u0026rsquo;t the point. The point was seeing if I could do it with an eye toward the future.\nThe issue with open source tools is that they were created to solve someone else\u0026rsquo;s problems. Maybe those problems align closely with mine but they\u0026rsquo;re not going to solve 100% of what I\u0026rsquo;m looking for. What the above tools represent is the ability to quickly customize a solution to your exact environment and remove the particular pain points that you have with your current tooling.\nThe folks that will thrive during the upcoming uncertainty and period of change will be the engineers that have a deep understanding of the technical stack and also lean into AI to build the tools that solve the issues in their environment.\nAnd if you can\u0026rsquo;t beat em\u0026rsquo;, join em\u0026rsquo;. More on that later.\nTTL Expired\n","permalink":"https://ttl-expired.net/posts/laid-off-and-learning-ai-tools/","summary":"\u003cp\u003eI was laid off from Block at the end of February and the reason provided by Jack was AI efficiencies were reshaping how work is done. Bummer. After sitting for a day or so with the existential dread of an AI dominated future, I decided that instead of sitting still and letting that future catch up to me, I needed to grab the bull by the horns and steer where my career is heading.\u003c/p\u003e","title":"Laid off and learning AI tools"},{"content":" Form Factor Speed Lanes (Elec) Modulation Connector Types Approx. Intro SFP+ 10 Gbps 1 x 10G NRZ LC Duplex, RJ45 2006 SFP28 25 Gbps 1 x 25G NRZ LC Duplex 2014 SFP56 50 Gbps 1 x 50G PAM4 LC Duplex 2019 SFP-DD 100 Gbps 2 x 50G PAM4 LC Duplex 2019/20 QSFP+ 40 Gbps 4 x 10G NRZ MPO-12, LC 2012 QSFP28 100 Gbps 4 x 25G NRZ MPO-12, LC 2014 QSFP56 200 Gbps 4 x 50G PAM4 MPO-12, LC 2019 QSFP-DD 400G / 800G 8 x 50/100G PAM4 MPO-16, LC, CS 2017/21 OSFP 400G / 800G 8 x 50/100G PAM4 MPO-12/16, LC 2019 OSFP1600 1.6 Tbps 8 x 200G PAM4 MPO, Dual LC 2024/25 ","permalink":"https://ttl-expired.net/notes/opticaltransceivers/","summary":"\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003eForm Factor\u003c/th\u003e\n          \u003cth\u003eSpeed\u003c/th\u003e\n          \u003cth\u003eLanes (Elec)\u003c/th\u003e\n          \u003cth\u003eModulation\u003c/th\u003e\n          \u003cth\u003eConnector Types\u003c/th\u003e\n          \u003cth\u003eApprox. Intro\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eSFP+\u003c/td\u003e\n          \u003ctd\u003e10 Gbps\u003c/td\u003e\n          \u003ctd\u003e1 x 10G\u003c/td\u003e\n          \u003ctd\u003eNRZ\u003c/td\u003e\n          \u003ctd\u003eLC Duplex, RJ45\u003c/td\u003e\n          \u003ctd\u003e2006\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eSFP28\u003c/td\u003e\n          \u003ctd\u003e25 Gbps\u003c/td\u003e\n          \u003ctd\u003e1 x 25G\u003c/td\u003e\n          \u003ctd\u003eNRZ\u003c/td\u003e\n          \u003ctd\u003eLC Duplex\u003c/td\u003e\n          \u003ctd\u003e2014\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eSFP56\u003c/td\u003e\n          \u003ctd\u003e50 Gbps\u003c/td\u003e\n          \u003ctd\u003e1 x 50G\u003c/td\u003e\n          \u003ctd\u003ePAM4\u003c/td\u003e\n          \u003ctd\u003eLC Duplex\u003c/td\u003e\n          \u003ctd\u003e2019\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eSFP-DD\u003c/td\u003e\n          \u003ctd\u003e100 Gbps\u003c/td\u003e\n          \u003ctd\u003e2 x 50G\u003c/td\u003e\n          \u003ctd\u003ePAM4\u003c/td\u003e\n          \u003ctd\u003eLC Duplex\u003c/td\u003e\n          \u003ctd\u003e2019/20\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eQSFP+\u003c/td\u003e\n          \u003ctd\u003e40 Gbps\u003c/td\u003e\n          \u003ctd\u003e4 x 10G\u003c/td\u003e\n          \u003ctd\u003eNRZ\u003c/td\u003e\n          \u003ctd\u003eMPO-12, LC\u003c/td\u003e\n          \u003ctd\u003e2012\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eQSFP28\u003c/td\u003e\n          \u003ctd\u003e100 Gbps\u003c/td\u003e\n          \u003ctd\u003e4 x 25G\u003c/td\u003e\n          \u003ctd\u003eNRZ\u003c/td\u003e\n          \u003ctd\u003eMPO-12, LC\u003c/td\u003e\n          \u003ctd\u003e2014\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eQSFP56\u003c/td\u003e\n          \u003ctd\u003e200 Gbps\u003c/td\u003e\n          \u003ctd\u003e4 x 50G\u003c/td\u003e\n          \u003ctd\u003ePAM4\u003c/td\u003e\n          \u003ctd\u003eMPO-12, LC\u003c/td\u003e\n          \u003ctd\u003e2019\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eQSFP-DD\u003c/td\u003e\n          \u003ctd\u003e400G / 800G\u003c/td\u003e\n          \u003ctd\u003e8 x 50/100G\u003c/td\u003e\n          \u003ctd\u003ePAM4\u003c/td\u003e\n          \u003ctd\u003eMPO-16, LC, CS\u003c/td\u003e\n          \u003ctd\u003e2017/21\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eOSFP\u003c/td\u003e\n          \u003ctd\u003e400G / 800G\u003c/td\u003e\n          \u003ctd\u003e8 x 50/100G\u003c/td\u003e\n          \u003ctd\u003ePAM4\u003c/td\u003e\n          \u003ctd\u003eMPO-12/16, LC\u003c/td\u003e\n          \u003ctd\u003e2019\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eOSFP1600\u003c/td\u003e\n          \u003ctd\u003e1.6 Tbps\u003c/td\u003e\n          \u003ctd\u003e8 x 200G\u003c/td\u003e\n          \u003ctd\u003ePAM4\u003c/td\u003e\n          \u003ctd\u003eMPO, Dual LC\u003c/td\u003e\n          \u003ctd\u003e2024/25\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e","title":"Optical Transceiver Reference"},{"content":"OSPF (Open Shortest Path First) OSPF is a link-state interior gateway protocol (IGP). Each router floods Link-State Advertisements (LSAs) describing its interfaces and neighbors. Every router builds an identical Link-State Database (LSDB) and runs the Dijkstra SPF algorithm to compute the shortest path tree. OSPF runs directly over IP (protocol 89) and uses multicast for efficiency.\nDefault route preferences in Junos:\nOSPF Internal routes: 10 OSPF AS External routes: 150 Terms LSDB (Link-State Database) - The topological database. Within a single area, all routers must have an identical LSDB. SPF (Shortest Path First) - The Dijkstra algorithm each router runs against the LSDB to compute best paths. Router ID (RID) - A 32-bit identifier unique to each OSPF router. Junos selects the RID in this order: explicitly configured → highest active loopback IP → highest physical interface IP. Best practice is to configure it explicitly. ABR (Area Border Router) - A router with interfaces in multiple OSPF areas. Generates Type 3 (Summary) LSAs between areas. ASBR (AS Boundary Router) - A router that redistributes routes from outside OSPF into the OSPF domain. Generates Type 5 LSAs. Backbone Router - Any router with at least one interface in Area 0. Internal Router - All interfaces are in the same single area. Remember, best practice to explicitly configure the router-id. See below:\nset routing-options router-id 4.4.4.4 OSPF Packet Types OSPF has five packet types. All run directly over IP (protocol 89) — no TCP/UDP — so reliability is handled by LSAcks.\nType Name Purpose Key Detail 1 Hello Discovers neighbors, elects DR/BDR, maintains adjacencies. Hello: 10s (broadcast/P2P), 30s (NBMA). Dead: 4× Hello. 2 Database Description (DBD) Exchanges a summary (table of contents) of each router\u0026rsquo;s LSDB. Uses interface MTU. MTU mismatch causes ExStart stall. 3 Link-State Request (LSR) Requests specific LSAs missing from the local LSDB. Sent during the Loading state after comparing DBDs. 4 Link-State Update (LSU) The workhorse — carries the actual LSAs. Sent in response to an LSR or proactively on topology changes. 5 Link-State Ack (LSAck) Confirms receipt of an LSU. Required because OSPF runs over IP, not TCP. Multicast addresses:\n224.0.0.5 — AllSPFRouters. Every OSPF router listens here. 224.0.0.6 — AllDRouters. Used by DROther routers to send LSUs/LSAcks to the DR and BDR only. OSPFv3 equivalents: FF02::5 and FF02::6 Adjacency States OSPF adjacencies progress through seven states. Understanding where a session stalls tells you what\u0026rsquo;s broken.\nState What\u0026rsquo;s Happening Troubleshooting Note Down No Hellos received from this neighbor. Check physical layer, interface status, firewall filters. Init A Hello was received but this router\u0026rsquo;s RID is not yet in the neighbor\u0026rsquo;s Hello. One-way communication — likely a filter blocking return Hellos. 2-Way Bidirectional Hellos confirmed. Both routers see each other. DR/BDR election occurs here. DROther↔DROther relationships stop here permanently. ExStart Master/slave negotiation before database exchange. MTU mismatch is the most common cause of stalling here. Exchange DBD packets (LSDB table of contents) are exchanged. MTU or corrupt packets can also appear here. Loading Missing LSAs identified from DBD comparison; LSRs sent, LSUs received. Hangs here indicate memory/CPU exhaustion or packet loss. Full LSDBs are fully synchronized. SPF can now run. This is the healthy end state. Exam tip — the 2-Way ceiling: On a broadcast segment (e.g., Ethernet), DROther routers only reach Full with the DR and BDR. DROther-to-DROther relationships stay at 2-Way permanently — this is normal and expected. Don\u0026rsquo;t mistake it for a problem.\nDesignated Router (DR) and Backup Designated Router (BDR) On multi-access (broadcast) segments, every router forms a full adjacency only with the DR and BDR — not with every other router. This reduces the O(n²) adjacency and flooding problem.\nElection:\nBased on interface priority (0–255, default 128). Higher wins. Ties broken by highest Router ID. Election is non-preemptive — the DR/BDR holds their role even when a higher-priority router joins. Election re-runs only when the OSPF process restarts. Priority 0 = ineligible for DR/BDR. set protocols ospf area 0 interface ge-0/0/0 priority 0 BDR role: Takes over as DR immediately when the DR fails, without re-running a full election.\nAvoiding DR election (P2P): Configuring a link as point-to-point skips the DR/BDR election and the 2-Way state entirely, taking adjacency to Full faster (saves up to 40 seconds). It also suppresses Type 2 LSA generation. The interface type needs to match on both sides of the link otherwise the adjacency won\u0026rsquo;t come up.\nset protocols ospf area 0 interface ge-0/0/0 interface-type p2p Metrics and Cost OSPF uses cost as its metric. Lower cost is preferred.\ncost = reference-bandwidth / interface-bandwidth Default reference bandwidth: 100 Mbps On a 1 Gbps interface with the default reference, cost = 100/1000 = 0.1, which rounds to 1 — same as a 100 Mbps link. This is a well-known scaling problem. Best practice: Raise the reference bandwidth to match your fastest links.\nset protocols ospf reference-bandwidth 100g You can also set cost manually per interface:\nset protocols ospf area 0 interface ge-0/0/0.0 metric 10 Adjacency Requirements The following Hello packet fields must match between two routers to form an adjacency:\nSubnet mask of the link Hello interval Dead interval Options field (includes area type bits: E-bit and N-bit) Authentication E-bit and N-bit: These are carried in Hello packets to signal area type. E-bit = 1 for standard/backbone areas (external routes allowed), E-bit = 0 for stub areas. N-bit = 1 for NSSA routers. Routers with mismatched bits will not form an adjacency — this is how all routers in a stub/NSSA area are forced to agree on the area type.\nOSPF Areas Areas limit the scope of LSA flooding and allow route summarization at area borders. All non-backbone areas must connect to Area 0 either physically or via a virtual link — this prevents routing loops.\nSplit Horizon Rule: An ABR only accepts and re-floods a Type 3 LSA if it received it via a backbone (Area 0) interface. This is why discontiguous areas cause routing problems and why all areas must connect to Area 0.\nArea types:\nArea Type Type 3 (Inter-area) Type 4 Type 5 (External) Notes Standard Yes Yes Yes Full LSA support. Backbone (0) Yes Yes Yes All areas connect here. Stub Yes No No ABR injects a default. No ASBRs allowed. Totally Stubby No No No ABR blocks Type 3/4/5. Only default route enters. NSSA Yes No No (Type 7 allowed) Local ASBR can inject Type 7. No Type 5 from outside. Totally NSSA No No No (Type 7 allowed) Type 3/4/5 blocked. Local ASBR Type 7 still allowed. A default route using an LSA type 3 can be added to nssa and stub areas. For the totally areas it\u0026rsquo;d be the only Type 3 thats flooded in the area. The default needs to be configured using the following:\nset protocols ospf area 0 interface ge-0/0/0.0 metric 10 \u0026ldquo;Totally\u0026rdquo; areas are not separate area types. Totally Stubby and Totally NSSA are just Stub/NSSA areas where no-summaries is added to the ABR config only. All other routers in the area still think they are in a plain Stub or NSSA. The ABR is the only one doing the filtering.\nConfiguration:\n# Stub set protocols ospf area 0.0.0.1 stub # Totally Stubby (no-summaries on the ABR only) set protocols ospf area 0.0.0.1 stub no-summaries # NSSA set protocols ospf area 0.0.0.1 nssa # NSSA with default route set protocols ospf area 0.0.0.1 nssa default-lsa type-7 # Totally NSSA (no-summaries on ABR only) set protocols ospf area 0.0.0.1 nssa no-summaries LSA Types LSAs are the data structures flooded inside LSUs. Each type has a defined originator and flooding scope.\nType Name Originated By Flooding Scope Purpose 1 Router Every router Local area only Describes the router\u0026rsquo;s interfaces and connected neighbors. B-bit = ABR, E-bit = ASBR. 2 Network DR Local area only Represents a multi-access segment and lists all attached routers. Not generated on P2P links. 3 Summary ABR Inter-area (domain) Carries prefix info from one area to another. Re-generated by every ABR it passes through. 4 ASBR Summary ABR Inter-area (domain) Tells routers in other areas how to reach an ASBR. 5 AS-External ASBR Domain-wide Carries externally redistributed prefixes. Blocked by all stub and NSSA areas. 7 NSSA External ASBR (in NSSA) NSSA area only External routes within an NSSA. Translated to Type 5 by the ABR. Type 4 only needed across areas: If you are in the same area as the ASBR, you already have its Type 1 LSA and can reach it directly. Type 4 only exists so routers in other areas can find the ASBR. The ABR is essentially saying: \u0026ldquo;I know you can\u0026rsquo;t see the ASBR — let me advertise a route to it for you.\u0026rdquo;\nType 3 re-generation: Unlike a Type 5 (which is flooded as-is across the entire domain), a Type 3 LSA is re-originated by every ABR it crosses. Each ABR rewrites the LSA with its own Router ID as the advertising router.\nNSSA P-bit: When an ASBR in an NSSA originates a Type 7, it sets a Propagate (P) bit. When the NSSA ABR sees P-bit = 1, it translates the Type 7 to a Type 5 and floods it into the rest of the domain. P-bit = 0 means the Type 7 stays local.\nForwarding Address (FA): Type 5 and Type 7 LSAs carry a Forwarding Address. If FA = 0.0.0.0, route traffic toward the ASBR\u0026rsquo;s Router ID (using a Type 1 or Type 4 LSA). If FA is a specific IP, traffic is forwarded to that address instead — useful when the ASBR is reachable through a different next-hop.\nExternal Routes — E1 vs E2 When an ASBR redistributes external routes into OSPF, each route is tagged with a metric type:\nE2 (default in Junos): The external metric stays constant across the entire domain. Every router sees the same cost that the ASBR set. Simple but ignores internal topology. E1: The external metric is cumulative. Each router adds its own internal cost to reach the ASBR on top of the original metric. More accurate but more work for the ASBR. E1 always beats E2 for the same prefix. OSPF prefers E1 over E2 regardless of the numeric metric values. E1 is considered more precise because it accounts for internal topology cost.\nOpaque LSAs (Types 9, 10, 11) Opaque LSAs are extension containers — OSPF carries them without caring about the payload. They enable new features without changing the core protocol.\nType Scope Common Use SP Relevance 9 Link-local Graceful Restart signaling Used to maintain adjacency state during hitless restarts. 10 Area-local Traffic Engineering (TE) Carries link bandwidth, delay, and admin group info for RSVP-TE CSPF. Enabled with set protocols ospf traffic-engineering. 11 AS-wide AS-wide data Rarely used compared to Type 10. Security Authentication:\nOSPF supports MD5 authentication on a per-interface basis. Disabled by default in Junos.\nset protocols ospf area 0.0.0.0 interface ge-0/0/0.0 authentication md5 1 key \u0026#34;s3cr3t\u0026#34; Passive interfaces:\nA passive interface is advertised into OSPF (so the prefix appears in the LSDB) but does not send Hellos and does not form adjacencies. Best practice is to make all interfaces passive by default and explicitly activate only the interfaces that should peer.\nset protocols ospf area 0.0.0.0 interface lo0.0 passive Miscellaneous Options BFD — Enables sub-second failure detection independent of OSPF Hello/Dead timers. set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 bfd-liveness-detection minimum-interval 300 Overload — Pumps all ospf interface metrics to the moon. This pushes all transit traffic to any other available path. set protocols ospf overload prefix-export-limit — Caps the number of external routes accepted into the OSPF domain to protect against route table explosion. set protocols ospf prefix-export-limit 1000 Monitoring and Troubleshooting Common adjacency problems:\nProblem What to Check No neighbor detected Physical/datalink connectivity, IP subnet/mask match, area ID match, area type match, authentication, Hello/Dead timers, network type. Stuck in ExStart MTU mismatch between neighbors. Stuck in 2-Way Normal for DROther↔DROther on a broadcast segment. If unexpected, check DR/BDR election. Stuck in Loading Memory/CPU exhaustion, packet loss dropping LSUs. Useful show commands:\nshow ospf neighbor show ospf neighbor detail show ospf interface show ospf interface lo0.0 extensive show ospf database show ospf database detail show ospf database external show ospf route show ospf statistics show ospf overview show ospf overview — sample output:\nroot@ABR\u0026gt; show ospf overview Instance: master Router ID: 2.2.2.2 Route table index: 0 Area border router LSA refresh time: 50 minutes Area: 0.0.0.0 Stub type: Not Stub Authentication Type: None Area border routers: 0, AS boundary routers: 1 Neighbors Up (in full state): 1 Area: 0.0.0.1 Stub type: Stub, Stub cost: 10 Authentication Type: None Area border routers: 0, AS boundary routers: 0 Neighbors Up (in full state): 1 Topology: default (ID 0) Full SPF runs: 6 SPF delay: 0.200000 sec, SPF holddown: 5 sec, SPF rapid runs: 3 show ospf interface lo0.0 extensive — passive interface:\nroot@ABR\u0026gt; show ospf interface lo0.0 extensive Interface State Area DR ID BDR ID Nbrs lo0.0 DRother 0.0.0.0 0.0.0.0 0.0.0.0 0 Type: LAN, Address: 2.2.2.2, Mask: 255.255.255.255, MTU: 65535, Cost: 0 Adj count: 0, Passive Hello: 10, Dead: 40, ReXmit: 5, Not Stub Auth type: None Topology default (ID 0) -\u0026gt; Passive, Cost: 0 show ospf statistics — packet counters:\nroot@ABR\u0026gt; show ospf statistics Packet type Total Last 5 seconds Sent Received Sent Received Hello 450 1853 0 2 DbD 5 5 0 0 LSReq 2 2 0 0 LSUpdate 18 10 0 0 LSAck 9 18 0 0 LSAs flooded : 16, last 5 seconds : 0 LSAs retransmitted : 0, last 5 seconds : 0 show ospf database — List of LSAs:\nroot@Stubby\u0026gt; show ospf database OSPF database, Area 0.0.0.1 Type ID Adv Rtr Seq Age Opt Cksum Len Router *1.1.1.1 1.1.1.1 0x80000006 2595 0x20 0x46f8 48 Router 2.2.2.2 2.2.2.2 0x80000008 50 0x20 0x42a1 36 Network *192.168.1.0 1.1.1.1 0x80000005 2595 0x20 0x5b63 32 Summary 2.2.2.2 2.2.2.2 0x80000006 1091 0x20 0x525 28 Summary 3.3.3.3 2.2.2.2 0x80000001 32 0x20 0xccf9 28 Summary 192.168.1.2 2.2.2.2 0x80000006 1214 0x20 0x76eb 28 And for good measure, heres the database after no-summaries default-metric 1 was added to the ABR\nroot@Stubby\u0026gt; show ospf database OSPF database, Area 0.0.0.1 Type ID Adv Rtr Seq Age Opt Cksum Len Router *1.1.1.1 1.1.1.1 0x80000008 217 0x20 0x42fa 48 Router 2.2.2.2 2.2.2.2 0x8000000a 218 0x20 0x3ea3 36 Network *192.168.1.0 1.1.1.1 0x80000008 217 0x20 0x5566 32 Summary 0.0.0.0 2.2.2.2 0x80000001 3 0x20 0xcf5d 28 Quick Reference OSPF Packet Types Type Name Purpose 1 Hello Neighbor discovery, DR/BDR election, keepalive 2 DBD LSDB table of contents exchange 3 LSR Request specific missing LSAs 4 LSU Delivers actual LSAs 5 LSAck Confirms LSU receipt LSA Types Type Name Originated By Scope Blocked By 1 Router Every router Area — 2 Network DR Area — 3 Summary ABR Domain Totally Stubby, Totally NSSA 4 ASBR Summary ABR Domain Totally Stubby, Totally NSSA, NSSA, Stub 5 AS-External ASBR Domain All stub and NSSA areas 7 NSSA External ASBR (NSSA) NSSA only — (translated to Type 5 at ABR) Area Types Area Type 3 Type 4 Type 5 Type 7 Default Route Standard Yes Yes Yes No No Backbone Yes Yes Yes No No Stub Yes No No No Yes (auto) Totally Stubby No No No No Yes (auto) NSSA Yes No No Yes No (configurable) Totally NSSA No No No Yes Yes (auto) Adjacency States Down → Init → 2-Way → ExStart → Exchange → Loading → Full\n","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_ospf/","summary":"\u003ch2 id=\"ospf-open-shortest-path-first\"\u003eOSPF (Open Shortest Path First)\u003c/h2\u003e\n\u003cp\u003eOSPF is a link-state interior gateway protocol (IGP). Each router floods Link-State Advertisements (LSAs) describing its interfaces and neighbors. Every router builds an identical Link-State Database (LSDB) and runs the Dijkstra SPF algorithm to compute the shortest path tree. OSPF runs directly over IP (protocol 89) and uses multicast for efficiency.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eDefault route preferences in Junos:\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eOSPF Internal routes: \u003cstrong\u003e10\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003eOSPF AS External routes: \u003cstrong\u003e150\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e\n\u003ch3 id=\"terms\"\u003eTerms\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eLSDB\u003c/strong\u003e (Link-State Database) - The topological database. Within a single area, all routers must have an identical LSDB.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSPF\u003c/strong\u003e (Shortest Path First) - The Dijkstra algorithm each router runs against the LSDB to compute best paths.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRouter ID (RID)\u003c/strong\u003e - A 32-bit identifier unique to each OSPF router. Junos selects the RID in this order: explicitly configured → highest active loopback IP → highest physical interface IP. Best practice is to configure it explicitly.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eABR\u003c/strong\u003e (Area Border Router) - A router with interfaces in multiple OSPF areas. Generates Type 3 (Summary) LSAs between areas.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eASBR\u003c/strong\u003e (AS Boundary Router) - A router that redistributes routes from outside OSPF into the OSPF domain. Generates Type 5 LSAs.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBackbone Router\u003c/strong\u003e - Any router with at least one interface in Area 0.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInternal Router\u003c/strong\u003e - All interfaces are in the same single area.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eRemember, best practice to explicitly configure the router-id. See below:\u003c/p\u003e","title":"JNCIS-SP OSPF Concepts"},{"content":"Well I\u0026rsquo;ve tried it before and the site languished in the forgotten corners of the internet after I lost interest. The domain lapsed. Its now an orphaned Wordpress instance participating in some botnet. I\u0026rsquo;ll eventually put the droplet out of its misery but thats for another day.\nThe deployment toil for blogs has dropped considerably since the last time I gave it a go. I\u0026rsquo;m writing this in Obsidian which is backed by a local git repo. When I\u0026rsquo;m finished I\u0026rsquo;ll run a commit and push right here in Obsidian. The push sends it to a Github repo thats tied to Cloudflare Pages. After merge, the Cloudflare plugin runs the deployment to Pages. And we\u0026rsquo;re done. I could automate it more using the auto commit/push functionality in the Obsidian git plugin but we\u0026rsquo;ll get to that when I\u0026rsquo;m more confident in my ability to write coherently.\nThis is an awful first post but we need to start somewhere and I need to figure out a theme. Going to spend twice as much time on that than the rest of the setup.\nTTL Expired - End post\n","permalink":"https://ttl-expired.net/posts/trying-out-this-whole-blogging-thing./","summary":"\u003cp\u003eWell I\u0026rsquo;ve tried it before and the site languished in the forgotten corners of the internet after I lost interest. The domain lapsed. Its now an orphaned Wordpress instance participating in some botnet. I\u0026rsquo;ll eventually put the droplet out of its misery but thats for another day.\u003c/p\u003e\n\u003cp\u003eThe deployment toil for blogs has dropped considerably since the last time I gave it a go. I\u0026rsquo;m writing this in Obsidian which is backed by a local git repo. When I\u0026rsquo;m finished I\u0026rsquo;ll run a commit and push right here in Obsidian. The push sends it to a Github repo thats tied to Cloudflare Pages. After merge, the Cloudflare plugin runs the deployment to Pages. And we\u0026rsquo;re done. I could automate it more using the auto commit/push functionality in the Obsidian git plugin but we\u0026rsquo;ll get to that when I\u0026rsquo;m more confident in my ability to write coherently.\u003c/p\u003e","title":"Trying out this whole blogging thing."},{"content":"IP Tunnels Tunnels encapsulate one protocol inside another, creating a virtual point-to-point link across a network that wouldn\u0026rsquo;t otherwise carry that traffic. The encapsulating network is called the underlay; the encapsulated traffic and the logical topology it creates is called the overlay. Both GRE and IP-IP are stateless — they hold no session state and provide no encryption or reliability guarantees.\nCommon use cases:\nCarry IPv6 traffic across an IPv4-only core (6in4) Carry IPv4 traffic across an IPv6-only core (4in6) Extend IGP adjacencies across a WAN that doesn\u0026rsquo;t support multicast Tunnel MPLS across a non-MPLS network Bridge Layer 2 domains across a routed network Tunnel Concepts Underlay vs Overlay:\nThe underlay is the physical network that actually carries the encapsulated packets. The tunnel endpoints must be reachable via the underlay. The overlay is the logical network seen by the encapsulated traffic — it has no visibility into the underlay topology. Tunnel endpoints:\nEvery tunnel has a source IP and a destination IP that identify the two endpoints in the outer header The source IP should be reachable from the remote end — using loopback addresses is best practice (stable, unaffected by individual link failures) The underlay route to the tunnel destination must exist before the tunnel can come up Recursive routing (important gotcha):\nIf the tunnel itself is used to carry the route to the tunnel endpoint, the router enters an infinite lookup loop and the tunnel never comes up. The route to the tunnel destination must be resolved via a path that does not go through the tunnel — typically a directly connected route, static route, or a different routing table.\nIP-IP Tunnels IP-IP encapsulation prepends a new 20-byte IP header to the original packet. It is the simplest and lowest-overhead tunnel type.\nPacket structure:\n[ Outer IP Header (20B) | Original IP Header | Payload ] Field Value Overhead 20 bytes IP Protocol number 4 (IP-in-IP) Can encapsulate IP unicast only Multicast No L2 frames No Junos interface ip-0/0/0 TTL behavior: The outer IP header carries its own TTL (default 64). The inner IP header TTL is decremented normally at each logical hop — from the tunnel source\u0026rsquo;s perspective, the tunnel is one hop.\nGRE Tunnels GRE (Generic Routing Encapsulation) adds a 4-byte shim header between the outer IP header and the encapsulated payload. The shim\u0026rsquo;s Protocol Type field (2 bytes) identifies what is inside, allowing GRE to carry almost any network-layer protocol.\nPacket structure:\n[ Outer IP Header (20B) | GRE Header (4B+) | Inner Packet ] GRE header fields:\nField Bits Description C (Checksum present) 1 If set, a 2-byte checksum and 2-byte reserved field follow Reserved 12 Must be zero Version 3 Always 0 for standard GRE Protocol Type 16 Identifies the encapsulated protocol (e.g., 0x0800 = IPv4, 0x86DD = IPv6, 0x8847 = MPLS) Minimum GRE overhead = 24 bytes (20B outer IP + 4B GRE header). Optional fields (checksum, key, sequence number) can add more.\nField Value Minimum overhead 24 bytes IP Protocol number 47 Can encapsulate IPv4, IPv6, MPLS, L2 frames, multicast Multicast Yes L2 frames Yes (with virtual-switch instance) Junos interface gr-0/0/0 GRE advantages over IP-IP:\nCarries multicast → enables IGP neighbor discovery across WAN links that don\u0026rsquo;t support multicast Carries MPLS → extends MPLS networks across non-MPLS infrastructure Carries L2 frames → bridges VLANs across routed networks Carries IPv6 over IPv4 and IPv4 over IPv6 6in4 — IPv6 over IPv4 6in4 tunnels carry IPv6 packets inside IPv4. The outer header uses IP protocol 41. This is used to connect IPv6 islands across an IPv4-only underlay.\nConfigured identically to IP-IP but with family inet6 on the tunnel interface unit The tunnel source and destination are IPv4 addresses Junos uses the ip-0/0/0 interface for 6in4 as well # VMX 1 set interfaces ip-0/0/0 unit 0 tunnel source 100.1.1.1 set interfaces ip-0/0/0 unit 0 tunnel destination 200.2.2.2 set interfaces ip-0/0/0 unit 0 family inet6 address 2001:db8:1::1/64 # IPv6 route pointing into the tunnel set routing-options rib inet6.0 static route 2001:db8::/32 next-hop ip-0/0/0.0 MTU Considerations Tunnel headers add overhead, which reduces the effective MTU available to the inner payload. This is one of the most operationally important aspects of tunnel deployment.\nTunnel Type Header Overhead Effective MTU (on 1500B link) IP-IP 20 bytes 1480 bytes GRE (no options) 24 bytes 1476 bytes GRE + MPLS label 28 bytes 1472 bytes Problems caused by MTU mismatch:\nLarge packets are dropped silently if they exceed the tunnel MTU ICMP \u0026ldquo;Fragmentation Needed\u0026rdquo; / \u0026ldquo;Packet Too Big\u0026rdquo; messages may be filtered by firewalls, preventing Path MTU Discovery from working TCP sessions may hang while UDP and ICMP work fine (since TCP uses MSS negotiation) Solutions:\nSet tunnel interface MTU explicitly to prevent oversized packets from entering the tunnel: set interfaces gr-0/0/0 unit 0 family inet mtu 1476 TCP MSS clamping — rewrite the TCP MSS option in SYN packets to a safe value, so TCP sessions never try to send packets larger than the tunnel can handle: set interfaces gr-0/0/0 unit 0 family inet tcp-mss 1436 Increase physical MTU (jumbo frames) on the underlay so the tunnel overhead fits within the physical MTU without reducing the effective payload size. Exam tip: If a tunnel is up but large transfers fail while pings work, MTU is almost always the cause. Pings use small packets by default; TCP bulk transfers hit the MTU ceiling.\nGRE Keepalives GRE tunnels are stateless by nature — neither endpoint knows if the other end is still alive. Keepalives add a lightweight liveness check.\nJunos sends GRE keepalive packets through the tunnel; the remote endpoint loops them back If the configured number of keepalives go unacknowledged, the tunnel interface goes down and the routing protocol removes the route set protocols oam gre-tunnel interface gr-0/0/0.0 keepalive-time 10 set protocols oam gre-tunnel interface gr-0/0/0.0 hold-time 30 interval — how often keepalives are sent (seconds) holdtime — how long to wait before declaring the tunnel down (seconds) Configuration Enable tunnel services on the PIC (required on some platforms/line cards):\nset chassis fpc 0 pic 0 tunnel-services bandwidth 1g Complete GRE tunnel (IPv4 over IPv4):\n# Router A # use loopback set interfaces gr-0/0/0 unit 0 tunnel source 10.0.0.1 set interfaces gr-0/0/0 unit 0 tunnel destination 10.0.0.2 set interfaces gr-0/0/0 unit 0 family inet address 172.16.0.1/30 set interfaces gr-0/0/0 unit 0 family inet mtu 1476 # Router B set interfaces gr-0/0/0 unit 0 tunnel source 10.0.0.2 set interfaces gr-0/0/0 unit 0 tunnel destination 10.0.0.1 set interfaces gr-0/0/0 unit 0 family inet address 172.16.0.2/30 set interfaces gr-0/0/0 unit 0 family inet mtu 1476 Complete IP-IP tunnel (IPv4 over IPv4):\n# Router A set interfaces ip-0/0/0 unit 0 tunnel source 10.0.0.1 set interfaces ip-0/0/0 unit 0 tunnel destination 10.0.0.2 set interfaces ip-0/0/0 unit 0 family inet address 172.16.1.1/30 set interfaces ip-0/0/0 unit 0 family inet mtu 1480 # Router B set interfaces ip-0/0/0 unit 0 tunnel source 10.0.0.2 set interfaces ip-0/0/0 unit 0 tunnel destination 10.0.0.1 set interfaces ip-0/0/0 unit 0 family inet address 172.16.1.2/30 set interfaces ip-0/0/0 unit 0 family inet mtu 1480 GRE tunnel bridging L2 over L3 (requires virtual-switch routing instance):\nset interfaces gr-0/0/0 unit 0 tunnel source 10.0.0.1 set interfaces gr-0/0/0 unit 0 tunnel destination 10.0.0.2 set interfaces gr-0/0/0 unit 0 family bridge interface-mode trunk set interfaces gr-0/0/0 unit 0 family bridge vlan-id-list 100 set interfaces gr-0/0/0 unit 0 family bridge core-facing Monitoring and Troubleshooting show interfaces gr-0/0/0 detail show interfaces ip-0/0/0 detail show interfaces gr-0/0/0 extensive # includes keepalive stats show route table inet.0 ping 172.16.0.2 source 172.16.0.1 # ping across the tunnel ping 172.16.0.2 source 172.16.0.1 size 1472 do-not-fragment # MTU test traceroute 172.16.0.2 source 172.16.0.1 Troubleshooting checklist:\nSymptom Likely Cause Tunnel interface stays Down Underlay route to tunnel destination missing; recursive routing loop; tunnel services PIC not configured Tunnel up but no traffic flows MTU mismatch; firewall filter blocking encapsulated traffic; routing issue in overlay Pings work, large transfers fail MTU — set tunnel MTU or enable TCP MSS clamping Tunnel flaps Keepalive failures; underlay instability Quick Reference IP-IP vs GRE Feature IP-IP GRE Overhead 20 bytes 24 bytes (minimum) IP protocol number 4 47 IPv4 unicast Yes Yes IPv6 No (use 6in4 proto 41) Yes Multicast No Yes MPLS No Yes L2 frames No Yes Keepalives No Yes Junos interface ip-0/0/0 gr-0/0/0 MTU Impact Tunnel Overhead Effective MTU (1500B link) IP-IP 20B 1480 GRE 24B 1476 GRE + 1 MPLS label 28B 1472 Key Commands Command Purpose show interfaces gr-0/0/0 detail Tunnel state, counters show interfaces gr-0/0/0 extensive Includes keepalive stats ping \u0026lt;dest\u0026gt; size 1472 do-not-fragment MTU path test ","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_tunnels/","summary":"\u003ch2 id=\"ip-tunnels\"\u003eIP Tunnels\u003c/h2\u003e\n\u003cp\u003eTunnels encapsulate one protocol inside another, creating a virtual point-to-point link across a network that wouldn\u0026rsquo;t otherwise carry that traffic. The encapsulating network is called the \u003cstrong\u003eunderlay\u003c/strong\u003e; the encapsulated traffic and the logical topology it creates is called the \u003cstrong\u003eoverlay\u003c/strong\u003e. Both GRE and IP-IP are \u003cstrong\u003estateless\u003c/strong\u003e — they hold no session state and provide no encryption or reliability guarantees.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eCommon use cases:\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCarry IPv6 traffic across an IPv4-only core (6in4)\u003c/li\u003e\n\u003cli\u003eCarry IPv4 traffic across an IPv6-only core (4in6)\u003c/li\u003e\n\u003cli\u003eExtend IGP adjacencies across a WAN that doesn\u0026rsquo;t support multicast\u003c/li\u003e\n\u003cli\u003eTunnel MPLS across a non-MPLS network\u003c/li\u003e\n\u003cli\u003eBridge Layer 2 domains across a routed network\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e\n\u003ch3 id=\"tunnel-concepts\"\u003eTunnel Concepts\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eUnderlay vs Overlay:\u003c/strong\u003e\u003c/p\u003e","title":"JNCIS-SP - IP Tunnels"},{"content":"High Availability Junos provides a layered HA architecture. Link aggregation handles physical link redundancy. Graceful Restart, GRES, and NSR handle control plane failures at increasing levels of sophistication. BFD accelerates failure detection for all routing protocols. Understanding which technology does what — and what each one requires — is the core exam objective for this topic.\nLink Aggregation Groups (LAG / LACP) LAG bundles multiple physical interfaces into a single logical ae (aggregated Ethernet) interface, providing both redundancy and increased bandwidth. IEEE standard 802.3ad — not to be confused with 802.1ad (Q-in-Q).\nLACP (Link Aggregation Control Protocol) negotiates and maintains the bundle. It exchanges LACPDUs between peers to verify link health and membership.\nLACP modes:\nMode Behavior Active Initiates LACP negotiation. Sends LACPDUs unconditionally. Passive Only responds to LACPDUs — does not initiate. At least one side of a LAG must be in active mode. Passive/passive means neither side initiates and the bundle never forms.\nLACP timers:\nRate Interval Detection Time (3× missed) Fast (default) 1 second 3 seconds Slow 30 seconds 90 seconds LACP port states:\nCollecting — the port is receiving valid LACPDUs from the peer Distributing — the port is sending traffic into the bundle Both must be active on a port before it passes traffic Hashing: flows are assigned to member links using a hash of the 5-tuple (src/dst IP, protocol, src/dst port) at L3, or src/dst MAC at L2. This keeps individual flows on the same link to prevent reordering.\nConfiguration:\n# Step 1: reserve AE interface slots in the chassis set chassis aggregated-devices ethernet device-count 2 # Step 2: assign member interfaces to the bundle set interfaces ge-0/0/0 gigether-options 802.3ad ae0 set interfaces ge-0/0/1 gigether-options 802.3ad ae0 # Step 3: configure the AE interface set interfaces ae0 aggregated-ether-options lacp active set interfaces ae0 aggregated-ether-options minimum-links 1 set interfaces ae0 unit 0 family inet address 10.0.0.1/30 minimum-links sets the number of active member links required before the AE interface stays up. If active links drop below this threshold, the whole AE goes down — useful for forcing a failover rather than forwarding on a degraded bundle.\nMonitoring:\nshow lacp interfaces ae0 show lacp statistics interfaces ae0 show interfaces ae0 detail Multichassis LAG (MC-LAG) MC-LAG extends a LAG across two separate physical chassis, allowing a downstream device to dual-home to two upstream switches/routers while appearing as a single logical bundle.\nAn ICL (Inter-Chassis Link) connects the two MC-LAG peers and carries control traffic and flooded frames Both chassis present the same LACP system ID to the downstream device so it sees one logical peer Provides chassis-level redundancy — the downstream device stays connected if one MC-LAG peer fails Commonly used in access/aggregation designs where a server or CE needs redundant uplinks to two PE/aggregation switches Key protocols and concepts:\nICCP (Inter-Chassis Control Protocol) — the control plane between MC-LAG peers. Runs over TCP, synchronizes LACP state, link state, and MAC/ARP tables between chassis. Must be reachable between peers (typically via the ICL or a dedicated management path). ICL — the physical or LAG link between the two MC-LAG peers. Carries ICCP control traffic and, in active-active mode, BUM (broadcast/unknown-unicast/multicast) frames that must reach both peers. mc-ae-id — a numeric ID that ties the MC-LAG bundle together across the two peers. Must match on both. chassis-id — differentiates the two peers: 0 on one, 1 on the other. status-control — one peer is designated active for LACP control purposes; the other is standby. MC-LAG modes:\nMode Behavior active-active Both peers forward traffic simultaneously. Load-balanced across both uplinks from the downstream device. active-standby Only the active peer forwards. Standby takes over on failure. Configuration (both peers — differences noted inline):\n# Step 1: ICCP peering — configure on both peers with the other peer\u0026#39;s address # Peer 1 set protocols iccp local-ip-addr 10.0.0.1 set protocols iccp peer 10.0.0.2 session-establishment-hold-time 50 set protocols iccp peer 10.0.0.2 redundancy-group-id-list 1 set protocols iccp peer 10.0.0.2 liveness-detection minimum-interval 500 multiplier 3 # Peer 2 (mirror with addresses swapped) set protocols iccp local-ip-addr 10.0.0.2 set protocols iccp peer 10.0.0.1 session-establishment-hold-time 50 set protocols iccp peer 10.0.0.1 redundancy-group-id-list 1 set protocols iccp peer 10.0.0.1 liveness-detection minimum-interval 500 multiplier 3 # Step 2: ICL between the two MC-LAG peers (shown as ae1) set interfaces ge-0/0/2 gigether-options 802.3ad ae1 set interfaces ae1 aggregated-ether-options minimum-links 1 set interfaces ae1 unit 0 family inet address 10.0.0.1/30 # peer 2 uses 10.0.0.2/30 # Step 3: MC-LAG bundle toward the downstream device (ae0) # Both peers — same system-id and admin-key so downstream sees one logical peer set interfaces ge-0/0/0 gigether-options 802.3ad ae0 set interfaces ae0 aggregated-ether-options lacp active set interfaces ae0 aggregated-ether-options lacp system-id 00:01:02:03:04:05 set interfaces ae0 aggregated-ether-options lacp admin-key 100 # mc-ae options — mc-ae-id and redundancy-group must match; chassis-id differs set interfaces ae0 aggregated-ether-options mc-ae mc-ae-id 1 set interfaces ae0 aggregated-ether-options mc-ae redundancy-group 1 set interfaces ae0 aggregated-ether-options mc-ae mode active-standby set interfaces ae0 aggregated-ether-options mc-ae chassis-id 0 # peer 2 uses chassis-id 1 set interfaces ae0 aggregated-ether-options mc-ae status-control active # peer 2 uses standby set interfaces ae0 multi-chassis-protection 10.0.0.2 interface ae1 exit status-control active on one peer means it originates LACP PDUs. Only one peer should be active; the other must be standby.\nMonitoring:\nshow iccp show interfaces mc-ae id 1 extensive Graceful Restart (GR) Graceful Restart allows a router\u0026rsquo;s routing protocols to restart without withdrawing routes or dropping adjacencies. Neighboring routers (helpers) are notified and told to maintain their forwarding state and hold the restarting router\u0026rsquo;s routes for a grace period.\nRoles:\nRestarting router — the router whose control plane is restarting. Sends a GR notification before restarting. Helper router — a neighbor that receives the GR notification and agrees to maintain routes and adjacencies during the grace period. Key behaviors:\nForwarding continues on the restarting router (PFE is unaffected) Helpers hold stale routes and do not reconverge during the grace period After restart, the protocols re-sync and stale routes are cleaned up Requires both sides to support GR — if a neighbor doesn\u0026rsquo;t support GR, it will reconverge normally set routing-options graceful-restart show ospf overview # shows GR status show bgp neighbor # shows GR capability negotiated Graceful Routing Engine Switchover (GRES) GRES provides hardware redundancy for platforms with two Routing Engines (re0 and re1). If the primary RE fails, the backup takes over the control plane.\nWhat GRES does:\nContinuously syncs interface state and kernel/forwarding state between master and backup RE On failover, the backup RE takes over and the Packet Forwarding Engine (PFE) continues forwarding without interruption — no traffic drop during the switchover The backup RE becomes the new master in ~2 seconds What GRES does NOT do (without NSR):\nRouting protocol adjacencies and tables are not synced Routing protocols restart on the new master and must reconverge from scratch set chassis redundancy graceful-switchover show chassis routing-engine Nonstop Active Routing (NSR) NSR extends GRES by also replicating routing protocol state to the backup RE. When the backup takes over, routing protocols are already in sync — no reconvergence occurs and neighbors never know a switchover happened.\nNSR vs Graceful Restart:\nGR requires neighbor cooperation (neighbors must support and honor the GR capability) NSR is fully transparent to neighbors — they see no event at all Requirements:\nGRES must be configured and working before enabling NSR Both commands are required: set routing-options nonstop-routing set system commit synchronize show task replication # verify protocol state is syncing to backup RE show system switchover # verify GRES is healthy Nonstop Bridging (NSB) NSB is the Layer 2 equivalent of NSR. It replicates Layer 2 protocol state (STP, LACP, LLDP, IGMP snooping) to the backup RE so that bridging protocols survive an RE switchover without reconvergence.\nRequired for ISSU on platforms running Layer 2 protocols Enabled alongside GRES set protocols layer2-control nonstop-bridging Unified In-Service Software Upgrade (ISSU) ISSU performs a software upgrade with minimal traffic disruption by upgrading one RE at a time while the other continues forwarding.\nPrerequisites (all must be in place before starting):\nDual REs installed and healthy GRES configured and verified NSR configured and verified (show task replication shows in-sync) NSB configured if running L2 protocols Software image staged on the router High-level process:\nBackup RE upgrades to the new software and reboots Mastership switches to the newly upgraded RE (GRES handles this hitlessly) Old master RE (now backup) upgrades and reboots Normal dual-RE operation resumes request system software in-service-upgrade /var/tmp/junos-image.tgz reboot ISSU is not universally supported. Check platform and release notes — some Junos versions and hardware combinations do not support ISSU.\nBidirectional Forwarding Detection (BFD) BFD is a lightweight hello protocol designed for one purpose: fast failure detection. It runs independently of any routing protocol and notifies the protocol immediately when a path goes down.\nWhy it\u0026rsquo;s needed: OSPF Dead timers default to 40 seconds. BGP hold timers default to 90 seconds. BFD can detect failures in under a second.\nHow it works:\nTwo BFD peers exchange control packets at the negotiated interval If multiplier consecutive packets are missed, the session is declared Down The routing protocol (OSPF, IS-IS, BGP, etc.) is notified immediately and reconverges Detection time formula:\nDetection time = negotiated-interval × multiplier The negotiated interval is the maximum of the local minimum-interval and the remote\u0026rsquo;s minimum-interval (both sides agree on the slower rate). Example: local = 300ms, remote = 500ms → negotiated = 500ms. With multiplier 3 → detection time = 1500ms.\nBFD modes:\nAsynchronous (default) — both peers send BFD packets at the negotiated interval. Standard mode. Echo mode — the local router sends echo packets that loop back through the remote\u0026rsquo;s forwarding plane. Tests the forwarding path rather than the control plane. Can achieve faster detection because it uses the PFE, not the RE. Configuration:\n# OSPF set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 bfd-liveness-detection minimum-interval 300 multiplier 3 # IS-IS set protocols isis interface ge-0/0/0.0 bfd-liveness-detection minimum-interval 300 multiplier 3 # BGP (multi-hop — for non-directly connected peers) set protocols bgp group IBGP neighbor 10.0.0.2 bfd-liveness-detection minimum-interval 300 multiplier 3 BFD parameters:\nminimum-interval — minimum time between BFD packets (ms). Actual rate is negotiated with peer. minimum-receive-interval — minimum rate at which this router is willing to receive packets (if different from send rate) multiplier — number of missed packets before declaring the session down Monitoring:\nshow bfd session show bfd session detail show bfd session extensive Sample show bfd session output:\nDetect Transmit Address State Interface Time Interval Multiplier 10.0.0.2 Up ge-0/0/0.0 0.900 0.300 3 Quick Reference HA Technology Comparison Feature GR GRES NSR ISSU Protects against Control plane restart RE hardware failure RE hardware failure Software upgrade Requires dual RE No Yes Yes Yes Requires GRES No — Yes Yes Requires NSR No No — Yes Neighbor cooperation needed Yes No No No Forwarding interrupted No No No No Protocol reconvergence No (helpers hold routes) Yes No No Transparent to neighbors No No Yes Yes LACP Modes Mode Behavior Active Initiates LACP — sends PDUs unconditionally Passive Responds only — at least one side must be active BFD Detection Time Detection time = negotiated-interval × multiplier Negotiated interval = max(local min-interval, remote min-interval) Key Commands Command Purpose show lacp status LAG member link states show interfaces ae0 detail AE interface stats and member links show system switchover GRES status show task replication NSR sync status show chassis routing-engine RE status and mastership show bfd session BFD session states and timers ","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_high_availability/","summary":"\u003ch2 id=\"high-availability\"\u003eHigh Availability\u003c/h2\u003e\n\u003cp\u003eJunos provides a layered HA architecture. Link aggregation handles physical link redundancy. Graceful Restart, GRES, and NSR handle control plane failures at increasing levels of sophistication. BFD accelerates failure detection for all routing protocols. Understanding which technology does what — and what each one requires — is the core exam objective for this topic.\u003c/p\u003e\n\u003chr\u003e\n\u003ch3 id=\"link-aggregation-groups-lag--lacp\"\u003eLink Aggregation Groups (LAG / LACP)\u003c/h3\u003e\n\u003cp\u003eLAG bundles multiple physical interfaces into a single logical \u003ccode\u003eae\u003c/code\u003e (aggregated Ethernet) interface, providing both redundancy and increased bandwidth. IEEE standard \u003cstrong\u003e802.3ad\u003c/strong\u003e — not to be confused with 802.1ad (Q-in-Q).\u003c/p\u003e","title":"JNCIS-SP High Availability"},{"content":"IPv6 IPv6 was designed to solve IPv4 address exhaustion while simplifying the protocol. The header is fixed-length and streamlined, broadcast is eliminated in favor of multicast, and address configuration can be fully automatic. For service providers, the most exam-relevant areas are address types, NDP, autoconfiguration, and how routing protocols (OSPF, IS-IS) extend to support IPv6.\nIPv4 vs IPv6 Key Differences Feature IPv4 IPv6 Address size 32 bits 128 bits Header size Variable (20–60 bytes) Fixed 40 bytes Header checksum Yes No (relies on L4) Fragmentation Routers and source Source only Broadcast Yes No — replaced by multicast Address resolution ARP NDP (ICMPv6) Autoconfiguration DHCP only SLAAC + DHCPv6 IPsec Optional Built into extension header framework IPv6 Header The base IPv6 header is always exactly 40 bytes. It is simpler than IPv4 — no checksum, no options field, and no fragmentation fields (those are handled by extension headers when needed).\nField Size Description Version 4 bits Always 6 Traffic Class 8 bits QoS / DSCP marking (equivalent to IPv4 ToS) Flow Label 20 bits Identifies a specific flow for QoS treatment Payload Length 16 bits Length of the payload (excluding the 40-byte header) Next Header 8 bits Identifies what follows: an extension header or an upper-layer protocol (TCP=6, UDP=17, ICMPv6=58) Hop Limit 8 bits Equivalent to IPv4 TTL — decremented at each hop Source Address 128 bits Destination Address 128 bits Extension Headers are chained after the base header using the Next Header field. Each extension header identifies the next via its own Next Header field. Common extension headers:\nType Next Header Value Purpose Hop-by-Hop Options 0 Must be processed by every router along the path Routing Header 43 Source routing (used by SRv6) Fragment Header 44 Fragmentation — used only by the source ESP 50 IPsec encryption AH 51 IPsec authentication No router fragmentation: If an IPv6 packet is too large, the router drops it and sends an ICMPv6 \u0026ldquo;Packet Too Big\u0026rdquo; back to the source. The source is responsible for fragmenting. This is why Path MTU Discovery is critical in IPv6 networks.\nAddress Format 128 bits written as 8 groups of 4 hex digits (hextets) separated by colons Leading zeros within a hextet can be omitted: 0001 → 1 One contiguous run of all-zero hextets can be replaced with :: — only once per address Full: 2001:0db8:0000:0000:0000:0000:0000:0001 Compressed: 2001:db8::1 Address Types and Ranges Prefix Type Notes 2000::/3 Global Unicast Publicly routable. Equivalent to public IPv4. Current allocations are under 2000::/4 and 3000::/4. FC00::/7 Unique Local (ULA) Private addresses. Range FCxx–FDxx. Equivalent to RFC 1918. Not routed on the public internet. FE80::/10 Link-Local Automatically assigned to every IPv6 interface. Never routed beyond the local link. Used by NDP and routing protocols. FF00::/8 Multicast Replaces broadcast. Scope is encoded in the address. ::1/128 Loopback Equivalent to 127.0.0.1. 2002::/16 6to4 Transition mechanism embedding an IPv4 address in IPv6. FEC0::/10 (site-local) is deprecated. Do not use. Replaced by Unique Local (FC00::/7).\nAnycast: An anycast address is assigned to multiple interfaces (typically on different routers). Traffic is routed to the topologically nearest one. Indistinguishable from a unicast address in format — the anycast behavior is configured, not derived from the prefix.\nMulticast Scopes and Key Addresses IPv6 multicast addresses encode a scope in bits 12–15 of the address.\nScope Value Scope Name Reach 1 Node-local Same device only 2 Link-local Same link (FF02::) 5 Site-local Within a site E Global Internet-wide Well-known link-local multicast addresses (FF02::):\nAddress Group FF02::1 All nodes FF02::2 All routers FF02::5 OSPFv3 all routers FF02::6 OSPFv3 all DRs FF02::9 RIPng routers FF02::1:2 All DHCPv6 servers/relays Solicited-Node Multicast:\nEvery unicast/anycast address has a corresponding solicited-node multicast address used by NDP for neighbor resolution (replacing ARP). Format:\nFF02::1:FF00:0/104 + last 24 bits of the interface address Example: interface address 2001:db8::1 → solicited-node group FF02::1:FF00:0001\nNeighbor Discovery Protocol (NDP) NDP replaces ARP and ICMP Router Discovery. All NDP messages are ICMPv6.\nMessage ICMPv6 Type Purpose Router Solicitation (RS) 133 Host asks \u0026ldquo;is there a router on this link?\u0026rdquo; Router Advertisement (RA) 134 Router announces its presence, prefix info, and flags for autoconfiguration Neighbor Solicitation (NS) 135 Resolves a neighbor\u0026rsquo;s MAC address (like ARP Request) or performs DAD Neighbor Advertisement (NA) 136 Response to NS — provides MAC address (like ARP Reply) Redirect 137 Router tells a host about a better first-hop for a destination Boot sequence:\nInterface auto-assigns a link-local address: FE80::/10 + EUI-64 derived from MAC DAD (Duplicate Address Detection) — sends an NS for the tentative address to verify no one else is using it. If no NA is received, the address is confirmed unique. Host sends RS to FF02::2 (all routers) Router responds with RA containing prefix, default gateway, and M/O flags Host uses prefix to generate a global unicast address (SLAAC) and performs DAD again RA flags:\nM flag (Managed) — tells hosts to use DHCPv6 for address assignment O flag (Other) — tells hosts to use DHCPv6 for other configuration (DNS) but not the address itself EUI-64 Interface ID Generation EUI-64 derives a 64-bit interface ID from a 48-bit MAC address:\nSplit the MAC in half: XX:XX:XX | YY:YY:YY Insert FF:FE in the middle: XX:XX:XX:FF:FE:YY:YY:YY Flip the 7th bit (U/L bit) of the first byte: if it was 0, set it to 1 (and vice versa) Example:\nMAC: 00:50:56:AB:CD:EF Step 1: 00:50:56 | AB:CD:EF Step 2: 00:50:56:FF:FE:AB:CD:EF Step 3: Flip bit 7 of 0x00 → 0x02 EUI-64: 0250:56FF:FEAB:CDEF Full link-local: FE80::250:56FF:FEAB:CDEF Address Assignment Methods Method Address From Options (DNS etc.) Notes SLAAC Self-generated (EUI-64 or random) No Stateless — no server needed. RA M=0, O=0. SLAAC + DHCPv6 (hybrid) Self-generated DHCPv6 RA M=0, O=1. Address from SLAAC, DNS from DHCPv6. DHCPv6 stateful DHCPv6 server DHCPv6 RA M=1. Full address and options from server. Static Manual config Manual Used on infrastructure (routers, switches). Junos IPv6 Configuration Static address:\nset interfaces ge-0/0/0 unit 0 family inet6 address 2001:db8:1::1/64 EUI-64 (auto-generated host bits):\nset interfaces ge-0/0/0 unit 0 family inet6 address 2001:db8:1::/64 eui-64 DHCPv6 client:\nset interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client client-identifier duid-type duid-ll set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client client-ia-type ia-na set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client req-option dns-server ia-na — Identity Association for Non-temporary Address (permanent address) duid-ll — use the interface\u0026rsquo;s link-local address as the DHCP client identifier IPv6 static routes (go in inet6.0):\nset routing-options rib inet6.0 static route ::/0 next-hop 2001:db8::1 Junos routing tables:\nTable Contents inet6.0 IPv6 unicast routes inet6.2 IPv6 multicast routes (used for RPF checks) OSPFv3 OSPFv3 is a redesigned version of OSPF for IPv6. It is a separate protocol instance from OSPFv2 (protocols ospf3 in Junos).\nKey differences from OSPFv2:\nFeature OSPFv2 OSPFv3 Addressing info in LSAs Yes (in Router and Network LSAs) No — separated into Type 8/9 LSAs Runs over IPv4 IPv6 link-local addresses Router ID 32-bit (can auto-select from IPv4) 32-bit — must be configured manually if no IPv4 addresses exist Authentication In OSPF header Uses IPv6 IPsec extension headers Multiple instances per link No Yes (instance ID in header) OSPFv3 LSA Types unique to IPv6:\nType Name Purpose 8 Link LSA Each router originates one per interface. Contains the link-local address and all IPv6 prefixes on that link. 9 Intra-Area Prefix LSA Originated per router or per transit network. Carries IPv6 prefix reachability within the area. Replaces the addressing role of Type 1 and 2 LSAs. OSPFv3 separates topology (who\u0026rsquo;s connected to whom) from addressing (what prefixes exist). Types 1 and 2 LSAs still describe the topology, but they carry no IP addressing info — that\u0026rsquo;s handled entirely by Types 8 and 9.\nConfiguration:\nset protocols ospf3 area 0.0.0.0 interface ge-0/0/0.0 set protocols ospf3 area 0.0.0.0 interface lo0.0 set routing-options router-id 1.1.1.1 # required if no IPv4 addresses show ospf3 neighbor show ospf3 database show ospf3 interface show ospf3 route IS-IS with IPv6 IS-IS supports IPv6 through TLV extensions without requiring a separate protocol version. The same IS-IS process advertises both IPv4 and IPv6 prefixes simultaneously — a significant operational advantage over OSPFv2/v3.\nIPv6-specific TLVs:\nTLV Name IPv4 Equivalent 232 IPv6 Interface Address TLV 132 (IPv4 Interface Address) 236 IPv6 Reachability TLV 135 (Extended IP Reachability) Multi-Topology IS-IS (MT-ISIS):\nBy default IS-IS runs a single topology for both IPv4 and IPv6. If the IPv4 and IPv6 topologies differ (e.g., some links only run one protocol), multi-topology mode can be enabled to run separate SPF calculations.\nset protocols isis interface ge-0/0/0.0 set protocols isis interface lo0.0 # TLV 236 is advertised automatically when inet6 is configured on interfaces show isis adjacency show isis database detail # shows TLV 236 entries for IPv6 prefixes show route table inet6.0 protocol isis Monitoring and Troubleshooting show interfaces ge-0/0/0 detail # IPv6 addresses and NDP state show ipv6 neighbors # NDP neighbor cache (like ARP table) show route table inet6.0 # IPv6 routing table show route table inet6.0 protocol static show ospf3 neighbor show ospf3 database show ospf3 interface detail show isis database detail # look for TLV 236 entries Quick Reference Address Types Prefix Type Routable 2000::/3 Global Unicast Yes FC00::/7 Unique Local No (private) FE80::/10 Link-Local No (link only) FF00::/8 Multicast Scope-dependent ::1/128 Loopback No NDP Message Types Message ICMPv6 Purpose RS 133 Host solicits router RA 134 Router announces prefix/config NS 135 MAC resolution / DAD NA 136 Response to NS Redirect 137 Better next-hop notification Address Assignment Methods Method RA M flag RA O flag Address Source SLAAC 0 0 Self-generated SLAAC + DHCPv6 0 1 Self-generated + DHCPv6 options DHCPv6 stateful 1 — DHCPv6 server OSPFv2 vs OSPFv3 Feature OSPFv2 OSPFv3 Junos hierarchy protocols ospf protocols ospf3 Addressing in Router LSA Yes No (Type 8/9) Router ID required Auto or manual Manual if no IPv4 Runs over IPv4 IPv6 link-local OSPFv3 LSA Types for IPv6 Type Name Purpose 8 Link LSA Link-local address + prefixes on the link 9 Intra-Area Prefix LSA IPv6 prefix reachability within an area ","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_ipv6/","summary":"\u003ch2 id=\"ipv6\"\u003eIPv6\u003c/h2\u003e\n\u003cp\u003eIPv6 was designed to solve IPv4 address exhaustion while simplifying the protocol. The header is fixed-length and streamlined, broadcast is eliminated in favor of multicast, and address configuration can be fully automatic. For service providers, the most exam-relevant areas are address types, NDP, autoconfiguration, and how routing protocols (OSPF, IS-IS) extend to support IPv6.\u003c/p\u003e\n\u003chr\u003e\n\u003ch3 id=\"ipv4-vs-ipv6-key-differences\"\u003eIPv4 vs IPv6 Key Differences\u003c/h3\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003eFeature\u003c/th\u003e\n          \u003cth\u003eIPv4\u003c/th\u003e\n          \u003cth\u003eIPv6\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eAddress size\u003c/td\u003e\n          \u003ctd\u003e32 bits\u003c/td\u003e\n          \u003ctd\u003e128 bits\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eHeader size\u003c/td\u003e\n          \u003ctd\u003eVariable (20–60 bytes)\u003c/td\u003e\n          \u003ctd\u003eFixed 40 bytes\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eHeader checksum\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eNo (relies on L4)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eFragmentation\u003c/td\u003e\n          \u003ctd\u003eRouters and source\u003c/td\u003e\n          \u003ctd\u003eSource only\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eBroadcast\u003c/td\u003e\n          \u003ctd\u003eYes\u003c/td\u003e\n          \u003ctd\u003eNo — replaced by multicast\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eAddress resolution\u003c/td\u003e\n          \u003ctd\u003eARP\u003c/td\u003e\n          \u003ctd\u003eNDP (ICMPv6)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eAutoconfiguration\u003c/td\u003e\n          \u003ctd\u003eDHCP only\u003c/td\u003e\n          \u003ctd\u003eSLAAC + DHCPv6\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eIPsec\u003c/td\u003e\n          \u003ctd\u003eOptional\u003c/td\u003e\n          \u003ctd\u003eBuilt into extension header framework\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003chr\u003e\n\u003ch3 id=\"ipv6-header\"\u003eIPv6 Header\u003c/h3\u003e\n\u003cp\u003eThe base IPv6 header is always exactly \u003cstrong\u003e40 bytes\u003c/strong\u003e. It is simpler than IPv4 — no checksum, no options field, and no fragmentation fields (those are handled by extension headers when needed).\u003c/p\u003e","title":"JNCIS-SP IPv6 Concepts"},{"content":"Layer 2 Bridging and VLANs Service provider networks often need to deliver Layer 2 connectivity between geographically separated customer sites. Junos implements this using bridge domains, which define the L2 forwarding boundaries, and 802.1ad (Q-in-Q) to tunnel customer VLAN spaces across the provider network without overlap.\nTerms Bridge Domain — a Layer 2 forwarding domain. Like a VLAN. It defines which interfaces share the same broadcast domain and MAC table. EVC (Ethernet Virtual Connection) — the L2 service sold by a SP to a customer. It defines the endpoints of a Layer 2 circuit. C-Tag (Customer Tag) — the inner 802.1q tag. Any VLAN 1–4094 from the customer\u0026rsquo;s space. S-Tag (Service Tag) — the outer 802.1ad tag. Assigned by the SP to identify the customer. Encapsulates all of that customer\u0026rsquo;s C-Tags. PBN (Provider Bridge Network) — the entire SP Layer 2 fabric. PEB (Provider Edge Bridge) — the SP edge device. Pushes/pops S-Tags on customer-facing ports. S-VLAN Bridge — an interior SP device that only examines and switches based on the S-Tag. Customer ports — PEB ports facing the customer. S-Tags are applied or removed here. Network ports — interior SP ports that carry double-tagged frames without modification. IRB (Integrated Routing and Bridging) — a logical interface that gives a bridge domain an IP address, enabling the router to act as the default gateway for hosts in that domain. 802.1q The standard VLAN tagging protocol. Inserts a 4-byte tag into the Ethernet frame.\nVLAN ID field is 12 bits → only 4094 usable VLANs (0 and 4095 are reserved) This creates problems for service providers: Not enough vlans to support all customers, issues with vlan overlap, STP compatibility issues while incorporating multiple domains, and needing to learn all customer MAC addresses 802.1ad — Q-in-Q (Provider Bridging) 802.1ad stacks a second VLAN tag (S-Tag) on top of the customer\u0026rsquo;s existing tag (C-Tag). The SP assigns each customer a unique S-Tag, so customer VLAN spaces are fully isolated and can overlap without conflict.\nThe SP core devices only need to learn and switch on the S-Tag — they are never exposed to customer C-Tags TPID reference:\nTPID (Tag Protocol Identifier) — A 16-bit field in an Ethernet frame header that identifies the frame as being VLAN-tagged and indicates the location of the tag information. TPID Standard Tag Type 0x8100 802.1q Customer (C-Tag) or single-tagged 0x88A8 802.1ad Provider (S-Tag) Tag operations:\nOperation Description Push Add S-Tag to the frame (ingress PEB, customer-facing port) Pop Remove S-Tag from the frame (egress PEB, customer-facing port) Swap Replace one S-Tag with another (inter-provider handoff) Compound operations for multi-provider scenarios: pop-pop, pop-swap, swap-swap, push-push\nProvider Bridge Configuration IVL (Independent VLAN Learning) is the simplest Q-in-Q deployment. The PEB uses access ports on the customer-facing side and the S-Tag as the bridge VLAN on network-facing ports. Each customer MAC address is learned and associated with their S-Tag VLAN.\nPEB interface config:\n# customer-facing (access) set interfaces ae1 unit 0 family bridge interface-mode access set interfaces ae1 unit 0 family bridge vlan-id 1001 # network-facing (trunk) set interfaces ge-0/0/3 unit 0 family bridge interface-mode trunk set interfaces ge-0/0/3 unit 0 family bridge vlan-id 1001 set bridge-domains Cust1 vlan-id 1001 Tunneling specific customer VLANs through the core using inner-vlan-id-list:\nge-0/0/4 { flexible-vlan-tagging; encapsulation flexible-ethernet-services; unit 0 { vlan-id 2002; family bridge { interface-mode trunk; inner-vlan-id-list 200-201; } } } Virtual Switching When multiple customers need to tunnel the same C-Tag VLANs across the provider core, IVL breaks down — the MAC tables from different customers would collide. Virtual switching solves this by giving each customer their own isolated L2 forwarding domain, similar to how VRFs partition routing tables.\nEach customer gets a virtual-switch routing instance with its own bridge domains and MAC table.\nrouting-instances { customer1 { instance-type virtual-switch; interface ge-0/0/1.0; bridge-domains { bd-100 { vlan-id 100; interface ge-0/0/1.0; } bd-200 { vlan-id 200; interface ge-0/0/1.0; } } } customer2 { instance-type virtual-switch; interface ge-0/0/2.0; bridge-domains { bd-100 { vlan-id 100; # same VLAN ID, isolated from customer1 interface ge-0/0/2.0; } } } } Integrated Routing and Bridging (IRB) An IRB interface is a logical Layer 3 interface attached to a bridge domain. It allows the router to participate in the bridged domain as a default gateway — the router can both bridge between ports in the domain and route traffic in and out of it.\nIRB interfaces are numbered to match their bridge domain (e.g., irb.10 for VLAN 10) Configured under interfaces irb Associated with a bridge domain via routing-interface interfaces { irb { unit 10 { family inet { address 192.168.10.1/24; } } } } bridge-domains { customer-vlan10 { vlan-id 10; routing-interface irb.10; } } Hosts in the bridge domain use 192.168.10.1 as their default gateway. Traffic destined for other subnets is routed by the IRB.\nS-Tag Rewrite (VLAN Translation) When two providers collaborate on a cross-provider EVC, S-Tag values must be translated at the handoff point — each provider uses their own S-Tag numbering and the tags must be swapped at the interconnect.\nThis operation is bidirectional — configured once, applies in both directions.\nge-0/0/1 { flexible-vlan-tagging; encapsulation flexible-ethernet-services; unit 0 { family bridge { interface-mode trunk; vlan-id-list 2002; # must use vlan-id-list, not vlan-id vlan-rewrite { translate 3001 2002; # translate their S-Tag to ours } } } } Note: S-Tag rewrite requires vlan-id-list on the interface, not vlan-id. Using vlan-id will cause the config to silently not work.\nMonitoring and Troubleshooting show bridge mac-table show bridge mac-table instance \u0026lt;name\u0026gt; show bridge statistics show bridge domain show interfaces ge-0/0/0 detail Sample show bridge mac-table output:\nroot@Core\u0026gt; show bridge mac-table MAC flags (S -static MAC, D -dynamic MAC, L -locally learned, R -Remote PE MAC) Routing instance : default-switch Bridging domain : customer1, VLAN : 1001 MAC MAC Logical address flags interface 00:50:00:00:0a:00 D ge-0/0/3.0 00:50:00:00:0b:00 D ge-0/0/2.0 Spanning-Tree Protocol (STP) STP prevents Layer 2 loops and broadcast storms by building a loop-free logical topology across a bridged network. It does this by electing a root bridge and then selectively blocking redundant paths.\nTerms BPDU (Bridge Protocol Data Unit) — the control frames STP uses to exchange topology information Configuration BPDU — used for normal root bridge election and topology maintenance TCN BPDU (Topology Change Notification) — sent when a port transitions to notify the fabric to flush MAC tables Bridge ID — the unique identifier for a bridge: priority (2 bytes) + MAC address (6 bytes). Lower = more preferred. Root Bridge — the bridge with the lowest Bridge ID. All other bridges calculate their shortest path to it. Root Port — the single port on each non-root bridge that provides the best path to the root bridge. Designated Port — the port on each network segment that is closest to the root. Responsible for forwarding toward the root on that segment. Port Cost — metric used to find the lowest-cost path to the root, based on link speed. Default port costs (802.1D):\nLink Speed STP Cost 10 Mbps 100 100 Mbps 19 1 Gbps 4 10 Gbps 2 Junos uses different default costs (e.g., 1 GE = 20,000) under 802.1w (RSTP). The values differ by revision — know that higher speed = lower cost.\nSTP Port States Classic STP transitions through five states. The Forward Delay timer (default 15 seconds) controls how long a port spends in Listening and Learning.\nState Sends/Receives BPDUs Learns MACs Forwards Data Notes Disabled No No No Interface is admin down Blocking Receives only No No Initial state; listening for a better path Listening Yes No No Participates in election; not yet forwarding Learning Yes Yes No Building MAC table before forwarding Forwarding Yes Yes Yes Normal operation Transition path: Blocking → Listening → Learning → Forwarding (each step takes ~15 seconds with default timers)\nSTP Timers Timer Default Purpose Hello 2 seconds How often the root bridge sends Configuration BPDUs Forward Delay 15 seconds Time spent in Listening and Learning states each Max Age 20 seconds How long a BPDU is kept before being considered stale Total worst-case convergence time with defaults: ~50 seconds (20s Max Age + 15s Listening + 15s Learning). This is why RSTP was developed.\nSTP Topology Election Step 1 — Elect the Root Bridge:\nLowest Bridge ID wins (default priority: 32768) Best practice: manually set the intended root to priority 4096 and the backup to 8192 Step 2 — Select Root Ports:\nEach non-root bridge selects the port with the lowest path cost to the root Tiebreakers (in order): lowest upstream Bridge ID → lowest upstream port priority → lowest upstream port number Step 3 — Select Designated Ports:\nOn each segment, the bridge with the lowest path cost to the root wins the designated port Tiebreaker: lowest Bridge ID Step 4 — Block all other ports:\nPorts that are neither root ports nor designated ports are placed in Blocking state RSTP (Rapid Spanning Tree — 802.1w) Junos uses RSTP by default. RSTP dramatically improves convergence by replacing the timer-based state machine with an explicit proposal/agreement handshake between adjacent bridges.\nRSTP port states (simplified from five to three):\nRSTP State Equivalent STP States Discarding Disabled + Blocking + Listening Learning Learning Forwarding Forwarding RSTP port roles (new roles not in classic STP):\nRole Description Root Best path to root bridge. Same as STP root port. Designated Best port on the segment toward root. Same as STP designated port. Alternate Backup to the root port. Immediately takes over if the root port fails (no waiting). Backup Backup to a designated port on the same shared segment (same bridge, two ports on same LAN). Rare. Disabled Port is administratively or operationally down. Key RSTP improvement: Alternate ports provide near-instant failover — they are pre-computed backup paths held in Discarding state. When the root port fails, the alternate port transitions to Forwarding without waiting for timers.\nEdge ports: Ports connected to end hosts (not switches) are configured as edge ports. They skip the STP election entirely and immediately enter Forwarding state — no 30-second wait. If an edge port receives a BPDU, it automatically loses its edge status and begins participating in STP normally.\nSTP Security BPDU Guard — if an edge port receives a BPDU, the port is immediately disabled. Protects against someone plugging a rogue switch into an access port. Root Guard — prevents a port from ever becoming a root port, even if a superior BPDU is received. Protects the current root bridge from being displaced. Loop Guard — if a non-designated port stops receiving BPDUs (due to a unidirectional link failure), Loop Guard puts the port in a loop-inconsistent state instead of transitioning to Forwarding. STP Configuration # Set bridge priority (must be a multiple of 4096) set protocols rstp bridge-priority 4096 # Configure an edge port (connected to an end host) set protocols rstp interface ge-0/0/10 edge # Block BPDUs on all edge ports set protocols rstp bpdu-block-on-edge # Enable root guard on a port set protocols rstp interface ge-0/0/1 no-root-port Operational Commands show spanning-tree bridge show spanning-tree bridge detail show spanning-tree interface show spanning-tree interface detail show spanning-tree statistics show spanning-tree statistics interface ge-0/0/1 Sample show spanning-tree bridge output:\nSTP bridge parameters: Routing instance name: default Context ID: 0 Enabled protocol: RSTP Root ID: 32768.50:00:00:01:00:00 Hello time: 2, Maximum age: 20, Forward delay: 15 This bridge is the root Port Interface State Role 128:1 ge-0/0/1.0 Forwarding Designated 128:2 ge-0/0/2.0 Forwarding Designated 128:3 ge-0/0/3.0 Discarding Alternate Quick Reference 802.1ad Tag Operations Operation Where Description Push Ingress PEB Add S-Tag to customer frame Pop Egress PEB Remove S-Tag Swap Inter-provider handoff Replace S-Tag value STP Port States State BPDUs Learn MACs Forward Data Blocking Rx only No No Listening Yes No No Learning Yes Yes No Forwarding Yes Yes Yes RSTP Port Roles Role Description Root Best path to root Designated Best port on segment toward root Alternate Backup root port — instant failover Backup Backup designated port (same bridge, same segment) STP Timers Timer Default Impact Hello 2s BPDU send interval Forward Delay 15s Time in Listening + Learning states Max Age 20s BPDU expiry Key Commands Command Purpose show bridge mac-table Layer 2 forwarding table show bridge domain Bridge domain summary show spanning-tree bridge detail STP topology and root info show spanning-tree interface Per-port STP state and role ","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_layer2_vlans/","summary":"\u003ch2 id=\"layer-2-bridging-and-vlans\"\u003eLayer 2 Bridging and VLANs\u003c/h2\u003e\n\u003cp\u003eService provider networks often need to deliver Layer 2 connectivity between geographically separated customer sites. Junos implements this using bridge domains, which define the L2 forwarding boundaries, and 802.1ad (Q-in-Q) to tunnel customer VLAN spaces across the provider network without overlap.\u003c/p\u003e\n\u003chr\u003e\n\u003ch3 id=\"terms\"\u003eTerms\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eBridge Domain\u003c/strong\u003e — a Layer 2 forwarding domain. Like a VLAN. It defines which interfaces share the same broadcast domain and MAC table.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEVC\u003c/strong\u003e (Ethernet Virtual Connection) — the L2 service sold by a SP to a customer. It defines the endpoints of a Layer 2 circuit.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eC-Tag\u003c/strong\u003e (Customer Tag) — the inner 802.1q tag. Any VLAN 1–4094 from the customer\u0026rsquo;s space.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eS-Tag\u003c/strong\u003e (Service Tag) — the outer 802.1ad tag. Assigned by the SP to identify the customer. Encapsulates all of that customer\u0026rsquo;s C-Tags.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePBN\u003c/strong\u003e (Provider Bridge Network) — the entire SP Layer 2 fabric.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePEB\u003c/strong\u003e (Provider Edge Bridge) — the SP edge device. Pushes/pops S-Tags on customer-facing ports.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eS-VLAN Bridge\u003c/strong\u003e — an interior SP device that only examines and switches based on the S-Tag.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCustomer ports\u003c/strong\u003e — PEB ports facing the customer. S-Tags are applied or removed here.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eNetwork ports\u003c/strong\u003e — interior SP ports that carry double-tagged frames without modification.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eIRB\u003c/strong\u003e (Integrated Routing and Bridging) — a logical interface that gives a bridge domain an IP address, enabling the router to act as the default gateway for hosts in that domain.\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e\n\u003ch3 id=\"8021q\"\u003e802.1q\u003c/h3\u003e\n\u003cp\u003eThe standard VLAN tagging protocol. Inserts a 4-byte tag into the Ethernet frame.\u003c/p\u003e","title":"JNCIS-SP Layer 2 Bridging, VLANs, and STP"},{"content":"MPLS (Multiprotocol Label Switching) MPLS is a forwarding mechanism that uses short, fixed-length labels to make packet-forwarding decisions instead of performing a full IP lookup at every hop. Labels are applied at the ingress of an MPLS domain and stripped at the egress, with each transit router performing only a label swap — making forwarding fast and enabling traffic engineering, VPNs, and QoS capabilities.\nTerms LSR (Label Switching Router) - Any router participating in MPLS forwarding. Performs label actions push, swap, or pop. LSP (Label Switched Path) - The unidirectional path a labeled packet takes from ingress to egress LSR. FEC (Forwarding Equivalence Class) - A group of packets that receive identical forwarding treatment and are assigned the same label at ingress. The ingress router decides the FEC assignment; downstream routers just label-switch. Ingress LSR - The first router in an LSP. Classifies traffic into FECs and pushes labels. Egress LSR - The last router in an LSP. Removes the label and forwards the original packet. Transit LSR (P router) - An interior provider router. Swaps labels and forwards without examining the inner IP header. PE (Provider Edge) - ISP router at the edge of the MPLS domain that interfaces with customer equipment. Performs label push/pop for customer traffic. CE (Customer Edge) - Customer device that connects to the PE. Not aware of MPLS. LIB (Label Information Base) - The full table of all label bindings a router has received. Not all entries are actively used for forwarding. LFIB (Label Forwarding Information Base) - The active subset of the LIB used for actual forwarding decisions. This is what the data plane uses. TED (Traffic Engineering Database) - Populated by IGP TE extensions; stores link-state info (bandwidth, admin groups) used by CSPF to calculate constrained paths. MBB (Make-before-Break) - Default Junos behavior where the new LSP is fully signaled and verified before traffic is switched over from the old path. Label Operations Operation Description Push Add a new label to the top of the label stack. Done by the ingress LSR. Swap Replace the top label with a new one. Done by transit LSRs. Pop Remove the top label from the stack. Done by the egress LSR or the penultimate hop. MPLS Label Structure Each MPLS label is a 32-bit field inserted between the Layer 2 and Layer 3 headers (sometimes called a \u0026ldquo;shim header\u0026rdquo;). Multiple labels can be stacked.\nField Bits Description Label 20 The forwarding label value (0–1,048,575). TC (Traffic Class) 3 Formerly called EXP. Used for QoS/DiffServ marking. S (Bottom of Stack) 1 1 = this is the last label in the stack; 0 = more labels below. TTL 8 Time to Live. Decremented at each hop, similar to IP TTL. Reserved Labels Labels 0–15 are reserved and have fixed meanings:\nLabel Name Purpose 0 IPv4 Explicit Null Signals the egress to apply IPv4 QoS processing before popping. 1 Router Alert Causes the receiving router to process the packet locally. 2 IPv6 Explicit Null Same as label 0 but for IPv6. 3 Implicit Null Used by the egress to signal PHP to the penultimate hop. Never actually appears in a packet. Penultimate Hop Popping (PHP) PHP is the default behavior in MPLS. The egress LSR advertises label 3 (Implicit Null) to its upstream neighbor, signaling that neighbor (the penultimate hop router) to pop the label before forwarding. This way the egress LSR receives a plain IP packet and performs only one lookup (IP) instead of two (label + IP).\nDefault behavior: PHP is enabled by default in Junos. Ultimate Hop Popping: Disables PHP, forcing the egress router to do both the label pop and the IP lookup. Required when the egress needs the label for VPN or QoS decisions. set protocols mpls label-switched-path ToR4 ultimate-hop-popping MPLS Routing Tables in Junos Table Purpose inet.0 Standard IPv4 routing table. Does not contain MPLS paths. inet.3 Populated by MPLS signaling protocols (LDP/RSVP). BGP uses this table to resolve next-hops for VPNs and labeled unicast routes. mpls.0 The MPLS forwarding table. Contains label-to-label swap/pop entries used by the LFIB. LDP — Label Distribution Protocol LDP is a standards-based signaling protocol that automatically distributes labels for IGP-learned prefixes. It does not support traffic engineering — it simply mirrors the IGP topology and creates one LSP per prefix.\nKey characteristics:\nBuilds a full mesh of label bindings between all LDP-speaking routers. Every potential LSP is created — one for each reachable loopback prefix by default. Relies entirely on the IGP for loop prevention and route failover. Primarily used to enable iBGP next-hop resolution in service provider cores. Discovery and Session Establishment\nHello packets are sent to multicast 224.0.0.2 on UDP port 646 — this discovers neighbors on directly connected links. Once a neighbor is discovered, a TCP session is established to port 646 using the router\u0026rsquo;s loopback (transport address) as the source. After the TCP session is up, label bindings are exchanged. Label advertisement behavior:\nDownstream Unsolicited (DU): Default. Labels are advertised to all neighbors without being requested. Liberal Label Retention: Default in Junos. The LIB stores all received label bindings, even from non-best-path neighbors. This speeds up convergence if the IGP path changes. By default, only /32 loopback addresses generate LDP LSPs. Configuration\nset protocols ldp interface ge-0/0/0.0 set protocols ldp interface ge-0/0/1.0 set protocols ldp interface lo0.0 Monitoring and Troubleshooting\nshow ldp neighbor show ldp interface show ldp session show ldp database show ldp database session 192.168.101.1 traceroute mpls ldp 192.168.101.3 no-resolve RSVP — Resource Reservation Protocol RSVP is a signaling protocol used to establish explicitly routed, traffic-engineered LSPs with bandwidth reservations. Unlike LDP, RSVP LSPs are manually or CSPF-calculated rather than IGP-driven.\nKey characteristics:\nRelies on an IGP to be running (OSPF or IS-IS). Supports explicit routing via EROs (Explicit Route Objects). Supports bandwidth reservation per LSP. Uses soft-state — RSVP state must be refreshed periodically or it times out. Default action is penultimate hop popping. RSVP path configuration\nset protocols mpls label-switched-path ToR4 from 1.1.1.1 set protocols mpls label-switched-path ToR4 to 4.4.4.4 RSVP requires traffic engineering enabled and you need to ensure the IGP is configured for it\nFor OSPF set protocols ospf traffic-engineering For ISIS set protocols isis level 2 wide-metrics-only set protocols isis traffic-engineering RSVP Message Flow\nPATH message — Sent ingress → egress. Carries the ERO (the desired path), requested bandwidth, and PHOP (previous hop). Installs path state on each router along the way. RESV message — Sent egress → ingress. Allocates resources and distributes labels hop-by-hop back to the ingress. RRO (Record Route Object) — Populated in the RESV message as it travels back. Records each hop that was traversed, useful for verifying the active path. LSP Priority\nRSVP uses setup and hold priorities (0 = highest, 7 = lowest) to control which LSPs can preempt others when bandwidth is constrained.\nset protocols mpls label-switched-path ToR4 priority 4 4 Fast Reroute (FRR)\nFRR pre-computes and pre-signals backup paths so that traffic can be rerouted in under 50ms when a link or node failure is detected.\nLink protection: Protects against failure of the next-hop link. Node protection: Protects against failure of the next-hop router. set protocols mpls label-switched-path ToR4 fast-reroute Primary and Secondary Paths\nLSPs can have a primary path (preferred) and one or more secondary paths (standby). If the primary fails, traffic switches to the secondary.\nset protocols mpls label-switched-path ToCust1nyc to 172.16.0.5 set protocols mpls label-switched-path ToCust1nyc primary via-dallas set protocols mpls label-switched-path ToCust1nyc secondary via-chicago set protocols mpls path via-dallas 10.1.2.2 strict set protocols mpls path via-dallas 10.2.3.3 strict set protocols rsvp interface ge-0/0/0.0 Monitoring and Troubleshooting\nshow mpls lsp show mpls lsp ingress extensive show rsvp session show rsvp interface show route table inet.3 show route table mpls.0 Sample show mpls lsp output:\nroot@vRouter1\u0026gt; show mpls lsp Ingress LSP: 1 sessions To From State Rt P ActivePath LSPname 4.4.4.4 1.1.1.1 Up 0 * ToR4 Total 1 displayed, Up 1, Down 0 Egress LSP: 1 sessions To From State Rt Style Labelin Labelout LSPname 1.1.1.1 4.4.4.4 Up 0 1 FF 3 - ToR1 Total 1 displayed, Up 1, Down 0 Transit LSP: 0 sessions Total 0 displayed, Up 0, Down 0 Sample show rsvp interface output:\nroot@vRouter1\u0026gt; show rsvp interface RSVP interface: 5 active Active Subscr- Static Available Reserved Highwater Interface State resv iption BW BW BW mark ge-0/0/0.0 Up 1 100% 1000Mbps 1000Mbps 0bps 0bps ge-0/0/1.0 Up 0 100% 1000Mbps 1000Mbps 0bps 0bps ge-0/0/5.0 Up 0 100% 1000Mbps 1000Mbps 0bps 0bps ge-0/0/6.0 Up 1 100% 1000Mbps 1000Mbps 0bps 0bps lo0.0 Up 0 100% 0bps 0bps 0bps 0bps Sample show mpls lsp ingress extensive output:\nroot@lumen-sf-pe1\u0026gt; show mpls lsp ingress name ToCust1nyc extensive Ingress LSP: 1 sessions 172.16.0.5 From: 172.16.0.1, State: Up, ActiveRoute: 0, LSPname: ToCust1nyc, LSPid: 2 ActivePath: via-dallas (primary) LSPtype: Static Configured, Penultimate hop popping LoadBalance: Random Encoding type: Packet, Switching type: Packet, GPID: IPv4 *Primary via-dallas State: Up Priorities: 7 0 Bandwidth: 100Mbps Flap Count: 2 Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt 20=Node-ID): 10.1.3.3(Label=299872) 10.3.5.5(Label=3) CSPF — Constrained Shortest Path First CSPF is the path calculation algorithm used by RSVP to find a path that satisfies configured constraints. It runs SPF on the TED rather than on the standard IGP topology.\nHow it works:\nThe TED is populated by IGP TE extensions — links that do not meet constraints are pruned first. Dijkstra SPF is run on the pruned topology to find the shortest path. The result is encoded as an ERO and placed in the RSVP PATH message. CSPF runs locally on the ingress LSR only. TED population by IGP:\nIGP TE Extension Configuration IS-IS Extra TLVs in LSPs (enabled with wide-metrics) set protocols isis level 2 wide-metrics-only OSPF Type 10 (Opaque) LSAs set protocols ospf traffic-engineering TED scope limitations:\nIS-IS: TED is only populated from routers at the same level. Level 1 TE info does not cross into Level 2. OSPF: Type 10 LSAs do not cross area boundaries by default. TED is limited to the local area. CSPF constraints:\nBandwidth: Path must have sufficient available bandwidth on every link. Admin Groups (Colors): 32-bit bitmask allowing interfaces to be grouped. LSPs can include or exclude groups. Hop limit: Maximum number of hops allowed in the path. Bandwidth tie-breakers (when multiple equal-cost paths exist):\nleast-fill — Prefer the path with the most available bandwidth (spread load). most-fill — Prefer the path with the least available bandwidth (pack links before using new ones). random — Choose randomly among equal-cost paths. Admin Groups configuration:\nset protocols mpls admin-groups red 0 set protocols mpls admin-groups blue 1 set protocols mpls interface ge-0/0/0.0 admin-group red set protocols mpls label-switched-path ToR4 admin-group include-any red MPLS Fragmentation By default, MPLS does not allow fragmentation. If a labeled packet exceeds the MTU, it is dropped. There are two options to address this:\nset protocols mpls path-mtu allow-fragmentation set protocols mpls path-mtu rsvp mtu-signaling Segment Routing (SR) Segment Routing is a source-routing paradigm where the ingress node encodes the entire forwarding path as an ordered list of instructions — called segments — directly in the packet header. Transit nodes execute each instruction in sequence. There is no per-flow state required in the network core.\nWhy it matters: SR replaces the need for LDP (and in many cases RSVP-TE) by using only the IGP to signal forwarding paths. Simpler control plane, same capabilities.\nSR-MPLS In SR-MPLS, each Segment ID (SID) is represented as an MPLS label. The segment list becomes a label stack. Transit routers perform standard MPLS label operations — they don\u0026rsquo;t need to understand SR at all, only the ingress node needs to build the stack.\nAdvantages over LDP:\nNo separate signaling protocol — just the IGP Explicit paths without per-hop RSVP state Inherently ECMP-aware Simpler control plane SID Types SID Type Significance Description Prefix SID Global Advertised by the IGP. Tied to a prefix (usually a loopback). All routers in the domain allocate the same label for this SID. Node SID Global A special prefix SID representing the router itself (its loopback). The most common SID type in practice. Adjacency SID Local Represents a specific link between two nodes. Locally assigned (not globally unique). Used to steer traffic over a particular interface, bypassing normal SPF. Label Ranges — SRGB and SRLB SRGB (Segment Routing Global Block) — the label range reserved for globally significant SIDs. Every router allocates labels from its SRGB for prefix/node SIDs. The actual label value = SRGB base + SID index. Junos default SRGB: 800000–900000 Example: SID index 100 → label 800100 SRLB (Segment Routing Local Block) — the label range reserved for locally significant SIDs such as adjacency SIDs. Locally assigned by each router. Exam tip: Junos SRGB starts at 800,000. If the exam gives you a SID index, add it to 800,000 to get the label value.\nIGP Extensions for SR SR requires the IGP to advertise SID information alongside normal topology data. No additional signaling protocol is needed.\nIGP Extension Notes IS-IS New TLVs in existing LSPs Wide metrics required (wide-metrics-only) OSPF Type 10 (Opaque) LSAs Enable with set protocols ospf traffic-engineering Basic Configuration IS-IS SR:\nset chassis network-services enhanced-ip set protocols isis level 2 wide-metrics-only set protocols isis source-packet-routing srgb start-label 800000 index-range 1000 set protocols isis source-packet-routing node-segment ipv4-index 1 OSPF SR:\nset chassis network-services enhanced-ip set protocols ospf traffic-engineering set protocols ospf source-packet-routing node-segment ipv4-index 11 set protocols ospf source-packet-routing srgb start-label 800000 index-range 1000 Segment Lists and Explicit Paths A segment list is an ordered stack of SIDs that defines an explicit path. The ingress node pushes the full stack; each node pops the top label and forwards.\nNode SIDs only: traffic follows IGP shortest path between each node in the list Adjacency SID included: forces traffic over a specific link, regardless of IGP metric This provides RSVP-TE-like traffic engineering without the signaling overhead.\nSRv6 (Brief Overview) SRv6 uses IPv6 as the data plane instead of MPLS. SIDs are encoded as IPv6 addresses in a Segment Routing Header (SRH) — an IPv6 extension header (type 4).\nTransit nodes that don\u0026rsquo;t understand SRv6 simply forward the packet based on the IPv6 destination address The active SR node pops the current SID from the SRH and updates the IPv6 destination with the next SID Allows seamless tunneling through non-SRv6 infrastructure Monitoring show ospf spring sid-database show route protocol spring-te show route table inet.3 Quick Reference Label Operations Operation Who Does It Description Push Ingress LSR Adds a label to the packet Swap Transit LSR Replaces the top label Pop Egress or penultimate hop Removes the top label Reserved Labels Label Name Meaning 0 IPv4 Explicit Null Signal QoS intent to egress 1 Router Alert Trap to local CPU 2 IPv6 Explicit Null Signal QoS intent for IPv6 3 Implicit Null Trigger PHP at penultimate hop LDP vs RSVP Feature LDP RSVP Traffic Engineering No Yes Explicit paths No Yes (ERO) Bandwidth reservation No Yes Path calculation IGP topology CSPF LSPs created All prefixes (loopbacks by default) Manually configured Soft-state No Yes (requires refresh) Fast Reroute No Yes Use case iBGP next-hop resolution TE, bandwidth guarantees Key Junos Routing Tables Table Contents inet.0 Standard IP routes inet.3 MPLS-signaled routes (BGP next-hop resolution) mpls.0 Label forwarding entries (LFIB) Monitoring Commands Command Purpose show mpls lsp Summary of all LSPs show mpls lsp ingress extensive Detailed ingress LSP info including RRO show rsvp session Active RSVP sessions show rsvp interface RSVP interface state and bandwidth show ldp neighbor LDP neighbor adjacencies show ldp session LDP TCP sessions show ldp database LDP label bindings show ldp interface LDP-enabled interfaces show route table inet.3 MPLS routes used for BGP resolution show route table mpls.0 MPLS forwarding table traceroute mpls ldp \u0026lt;prefix\u0026gt; Trace an LDP LSP path ","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_mpls/","summary":"\u003ch2 id=\"mpls-multiprotocol-label-switching\"\u003eMPLS (Multiprotocol Label Switching)\u003c/h2\u003e\n\u003cp\u003eMPLS is a forwarding mechanism that uses short, fixed-length labels to make packet-forwarding decisions instead of performing a full IP lookup at every hop. Labels are applied at the ingress of an MPLS domain and stripped at the egress, with each transit router performing only a label swap — making forwarding fast and enabling traffic engineering, VPNs, and QoS capabilities.\u003c/p\u003e\n\u003chr\u003e\n\u003ch3 id=\"terms\"\u003eTerms\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eLSR\u003c/strong\u003e (Label Switching Router) - Any router participating in MPLS forwarding. Performs label actions push, swap, or pop.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLSP\u003c/strong\u003e (Label Switched Path) - The unidirectional path a labeled packet takes from ingress to egress LSR.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFEC\u003c/strong\u003e (Forwarding Equivalence Class) - A group of packets that receive identical forwarding treatment and are assigned the same label at ingress. The ingress router decides the FEC assignment; downstream routers just label-switch.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eIngress LSR\u003c/strong\u003e - The first router in an LSP. Classifies traffic into FECs and pushes labels.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEgress LSR\u003c/strong\u003e - The last router in an LSP. Removes the label and forwards the original packet.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTransit LSR\u003c/strong\u003e (P router) - An interior provider router. Swaps labels and forwards without examining the inner IP header.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePE\u003c/strong\u003e (Provider Edge) - ISP router at the edge of the MPLS domain that interfaces with customer equipment. Performs label push/pop for customer traffic.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCE\u003c/strong\u003e (Customer Edge) - Customer device that connects to the PE. Not aware of MPLS.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLIB\u003c/strong\u003e (Label Information Base) - The full table of all label bindings a router has received. Not all entries are actively used for forwarding.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLFIB\u003c/strong\u003e (Label Forwarding Information Base) - The active subset of the LIB used for actual forwarding decisions. This is what the data plane uses.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTED\u003c/strong\u003e (Traffic Engineering Database) - Populated by IGP TE extensions; stores link-state info (bandwidth, admin groups) used by CSPF to calculate constrained paths.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMBB\u003c/strong\u003e (Make-before-Break) - Default Junos behavior where the new LSP is fully signaled and verified before traffic is switched over from the old path.\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e\n\u003ch3 id=\"label-operations\"\u003eLabel Operations\u003c/h3\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003eOperation\u003c/th\u003e\n          \u003cth\u003eDescription\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e\u003cstrong\u003ePush\u003c/strong\u003e\u003c/td\u003e\n          \u003ctd\u003eAdd a new label to the top of the label stack. Done by the ingress LSR.\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e\u003cstrong\u003eSwap\u003c/strong\u003e\u003c/td\u003e\n          \u003ctd\u003eReplace the top label with a new one. Done by transit LSRs.\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003e\u003cstrong\u003ePop\u003c/strong\u003e\u003c/td\u003e\n          \u003ctd\u003eRemove the top label from the stack. Done by the egress LSR or the penultimate hop.\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003chr\u003e\n\u003ch3 id=\"mpls-label-structure\"\u003eMPLS Label Structure\u003c/h3\u003e\n\u003cp\u003eEach MPLS label is a 32-bit field inserted between the Layer 2 and Layer 3 headers (sometimes called a \u0026ldquo;shim header\u0026rdquo;). Multiple labels can be stacked.\u003c/p\u003e","title":"JNCIS-SP MPLS Concepts"},{"content":"Protocol-Independent Routing Protocol-independent routing features work regardless of which dynamic routing protocol is running. This covers how Junos selects routes when multiple sources compete, how to define static and summary routes, how to filter unwanted prefixes, and how to carve the routing table into separate instances for policy-based forwarding and VPNs.\nRoute Preferences When multiple protocols learn a route to the same destination, Junos uses preference (administrative distance) to pick the winner. Lower value wins.\nProtocol / Route Type Default Preference Direct (connected) 0 Local 0 Static 5 OSPF Internal 10 IS-IS Level 1 Internal 15 IS-IS Level 2 Internal 18 RIP 100 Aggregate / Generated 130 OSPF AS External 150 IS-IS Level 1 External 160 IS-IS Level 2 External 165 BGP (internal and external) 170 Preference can be manually overridden on static routes and via routing policy on dynamic routes.\nExam tip: Static routes (preference 5) beat all dynamic protocols by default. If you want a static to act as a backup to an OSPF route (preference 10), set the static preference to something higher than 10.\nStatic Routes All static route configuration lives under routing-options. A valid next-hop is required.\nNext-hop types:\nNext-hop Behavior IP address Forward to the specified next-hop reject Drop packet and send ICMP unreachable to source discard Drop packet silently — no ICMP next-table Pass lookup to another routing table Key options:\nqualified-next-hop — define multiple next-hops for the same prefix, each with its own preference. Used for floating static routes (primary + backup). no-readvertise — prevents the route from being picked up by routing protocols via redistribution. preference — override the default preference of 5. resolve — allow the next-hop to be resolved recursively through the routing table (useful when the next-hop is not directly connected). routing-options { static { route 0.0.0.0/0 { next-hop 192.168.1.1; no-readvertise; } route 10.0.0.0/8 { next-hop 10.1.1.1; qualified-next-hop 10.2.2.2 { preference 10; } } } rib inet6.0 { static { route ::/0 next-hop 2001:db8::1; } } } Floating static route: The primary next-hop uses default preference 5. The qualified-next-hop uses a higher preference value, so it only becomes active if the primary disappears. Useful for backup paths behind a dynamic protocol.\nAggregate Routes Aggregate routes are manually defined summary prefixes that become active when at least one contributing route (a more specific prefix within the aggregate) is active in the routing table.\nDefault preference: 130 Default next-hop: reject (drop + ICMP unreachable) Used to reduce the number of routes advertised to peers and to hide internal instability The aggregate prefix itself is what gets advertised — contributing routes are not routing-options { aggregate { defaults { community 1:888; } route 172.29.0.0/22; route 172.25.0.0/16 { community 1:999; discard; } } } show route 172.29.0.0/22 exact detail Shows the aggregate route and which contributing prefixes are making it active.\ndiscard vs reject on aggregate routes: reject (the default) sends ICMP unreachable back to the source when a packet hits the aggregate but no more-specific route exists. discard silently drops it. Use discard when you don\u0026rsquo;t want to reveal to senders that the destination doesn\u0026rsquo;t exist.\nGenerated Routes Generated routes are nearly identical to aggregate routes with one key difference: instead of defaulting to a reject next-hop, a generated route inherits the next-hop of its primary contributing route.\nPrimary contributing route = the active contributing route with the lowest preference value; ties broken by lowest prefix length, then numerically lowest prefix Commonly used as a route of last resort — a generated default (0.0.0.0/0) that only activates when a specific condition (a contributing route) is present in the table routing-options { generate { route 0.0.0.0/0 { policy contrib-routes-exist; } } } Both aggregate and generated routes are matched in routing policy with:\nfrom protocol aggregate show route hidden Shows routes that exist in the table but are inactive (e.g., a generated route whose contributing route disappeared).\nMartian Addresses Martian addresses are prefixes that Junos silently ignores and never installs in the RIB, regardless of the source. They represent invalid or reserved address space.\nDefault IPv4 martians: 0.0.0.0/8, 127.0.0.0/8, 192.0.0.0/24, 240.0.0.0/4 (plus their more-specifics)\nDefault IPv6 martians: loopback, link-local, and RFC 2373 reserved space\nAdditional prefixes can be added — useful for blocking bogons or RFC 1918 space from being installed via a routing protocol:\nrouting-options { martians { 192.168.0.0/16 orlonger allow; } } Note the allow keyword — you can also use martians to permit a prefix that would otherwise be blocked by default.\nshow route martians table inet.0 Routing Instances By default, Junos creates the master routing instance, which contains inet.0 (IPv4), inet6.0 (IPv6), and related tables. User-defined routing instances partition the router into separate forwarding domains — each with its own RIB, interfaces, and protocol configuration.\nInstance types:\nType Use Case forwarding Filter-based forwarding (FBF). No routing protocol support. Lightweight — just a separate forwarding table. virtual-router Full independent routing instance. Runs its own protocols. Similar to a VRF but for the router itself. vrf Layer 3 VPN. Used in MPLS L3VPN deployments. Has import/export route distinguishers and route targets. vpls Virtual Private LAN Service — L2VPN over MPLS. l2vpn Layer 2 VPN circuits (point-to-point). show route instance show route instance \u0026lt;name\u0026gt; detail ping 172.26.25.1 routing-instances my-instance RIB Groups allow routes from one routing table to be shared into another. Commonly used with FBF so that forwarding instances have access to the interface routes from inet.0 (so they have valid next-hops):\nrouting-options { interface-routes { rib-group inet my-rib-group; } rib-groups { my-rib-group { import-rib [ inet.0 ISP-A.inet.0 ISP-B.inet.0 ]; } } } import-rib — the list of tables that will receive the shared routes (first entry is the primary/source table) import-policy — optional filter to control which routes are shared Load Balancing Junos supports two load balancing modes for equal-cost paths:\nPer-flow (default) — traffic flows (identified by the 5-tuple) are consistently forwarded out the same interface. Prevents packet reordering. Preferred for most deployments. Per-packet — round-robin across all equal-cost interfaces regardless of flow. Can cause out-of-order delivery but maximizes link utilization. Default hash (5-tuple): source IP, destination IP, IP protocol, source port, destination port.\nLoad balancing requires a routing policy applied to the forwarding table:\npolicy-options { policy-statement lb-policy { then { load-balance per-packet; } } } routing-options { forwarding-table { export lb-policy; } } BGP load balancing: By default, BGP installs only a single best path per prefix. To load-balance across multiple equal-cost iBGP paths, you must also configure multipath under BGP:\nset protocols bgp multipath Filter-Based Forwarding (FBF) FBF makes forwarding decisions based on criteria other than destination address — source IP, protocol, ingress interface, DSCP, etc. It uses a firewall filter to classify traffic and steer matching packets into a specific routing instance, effectively doing policy-based routing.\nFour-step configuration:\n1. Create a firewall filter that matches traffic and assigns a routing instance:\nfirewall { family inet { filter FBF-FILTER { term match-subnet-A { from { source-address { 172.25.0.0/24; } } then { routing-instance ISP-A; } } term match-subnet-B { from { source-address { 172.20.20.0/24; } } then { routing-instance ISP-B; } } term default { then accept; } } } } 2. Apply the filter to the ingress interface (traffic is classified as it enters the router):\nset interfaces ge-0/0/0 unit 0 family inet filter input fbf-filter 3. Create forwarding routing instances with the desired exit paths:\nrouting-instances { ISP-A { instance-type forwarding; routing-options { static { route 0.0.0.0/0 next-hop 172.20.0.2; } } } ISP-B { instance-type forwarding; routing-options { static { route 0.0.0.0/0 next-hop 172.20.10.2; } } } } 4. Create a RIB group to share interface routes from inet.0 into the forwarding instances (so they can resolve next-hops):\nrouting-options { interface-routes { rib-group inet fbf-rib-group; } rib-groups { fbf-rib-group { import-rib [ inet.0 ISP-A.inet.0 ISP-B.inet.0 ]; } } } Why the RIB group is required: Forwarding instances don\u0026rsquo;t automatically inherit interface routes from inet.0. Without the RIB group, the forwarding instances have no next-hops and traffic blackholes.\nQuick Reference Default Route Preferences Protocol Preference Direct / Local 0 Static 5 OSPF Internal 10 IS-IS L1 Internal 15 IS-IS L2 Internal 18 RIP 100 Aggregate / Generated 130 OSPF External 150 IS-IS L1 External 160 IS-IS L2 External 165 BGP 170 Static Route Next-Hop Options Next-hop Behavior IP address Forward to next-hop reject Drop + ICMP unreachable discard Silent drop next-table Redirect to another routing table Routing Instance Types Type Purpose forwarding FBF — separate forwarding table, no protocols virtual-router Full isolated routing domain with protocols vrf MPLS L3VPN vpls MPLS L2VPN (multipoint) l2vpn MPLS L2VPN (point-to-point) Key Commands Command Purpose show route Show active routing table show route hidden Show inactive / suppressed routes show route martians table inet.0 Show martian prefix list show route instance List all routing instances show route \u0026lt;prefix\u0026gt; exact detail Show a specific route with contributing details show route forwarding-table Show the forwarding table (LFIB) ","permalink":"https://ttl-expired.net/juniper-study-guides/jncis_sp_protocol_independent_routing/","summary":"\u003ch2 id=\"protocol-independent-routing\"\u003eProtocol-Independent Routing\u003c/h2\u003e\n\u003cp\u003eProtocol-independent routing features work regardless of which dynamic routing protocol is running. This covers how Junos selects routes when multiple sources compete, how to define static and summary routes, how to filter unwanted prefixes, and how to carve the routing table into separate instances for policy-based forwarding and VPNs.\u003c/p\u003e\n\u003chr\u003e\n\u003ch3 id=\"route-preferences\"\u003eRoute Preferences\u003c/h3\u003e\n\u003cp\u003eWhen multiple protocols learn a route to the same destination, Junos uses \u003cstrong\u003epreference\u003c/strong\u003e (administrative distance) to pick the winner. Lower value wins.\u003c/p\u003e","title":"JNCIS-SP Protocol-Independent Routing"},{"content":"I\u0026rsquo;m a network engineer with 10+ years of experience, focused on backbone infrastructure and the layer where fiber meets routing. I\u0026rsquo;m sarcastic to a fault, always learning, and passionate about building solutions that actually work for the problem at hand. Even if that problem is finding a way to control a Duplo train without a screen, which is the whole reason I bought the darn thing. If you want to talk network engineering, infrastructure tooling, duplo trains, or just argue about something, reach out.\nGet in Touch tim@ttl-expired.net LinkedIn GitHub ","permalink":"https://ttl-expired.net/about/","summary":"about","title":"About"}]