← Interview Prep
Juniper Junos — Switching Troubleshooting
Troubleshooting Layer 2 on Junos EX: the ethernet-switching table, VLANs/trunks/IRB, MAC-learning & loops, spanning tree (STP/RSTP/MSTP/VSTP) with root/loop/BPDU protection, LAG/LACP, Virtual Chassis, and L2 security (storm-control, DHCP snooping, 802.1X).
Layer-2 troubleshooting on Junos EX is about the ethernet-switching table, VLAN
membership, the spanning-tree topology, and the redundancy mechanisms (LAG, Virtual
Chassis). Same architecture as routing — control plane on the RE (l2cpd/eswd), forwarding on
the PFE — but the failure modes are loops, black-holed VLANs, and blocked ports. Original, vendor-neutral notes
aligned to the enterprise-switching troubleshooting scope.
Work L2 bottom-up: is the link up and in the right VLAN, is the
MAC learned, is spanning tree forwarding on the port you expect, and — for L3 — is
the IRB up?
The toolbox
| Tool | Use |
|---|
show ethernet-switching table | The MAC table — is the address learned, on which port/VLAN? Flapping = a loop. |
show vlans [detail] | VLAN-to-interface membership, tags, associated IRB. |
show spanning-tree bridge / interface | Root bridge, this bridge's ID, port roles/states (who's blocking). |
show interfaces [extensive] | Link, errors/CRC, flaps, trunk vs access, native VLAN. |
show lacp interfaces | LAG member state, LACP up/down, why a member won't bundle. |
show virtual-chassis [status] | Member roles, VCP links, split detection. |
monitor traffic interface, traceoptions (eswd/l2cpd) | Capture / debug the L2 control plane. |
VLANs & trunks
- No connectivity in a VLAN: the interface isn't a member, the VLAN isn't on the trunk
(
members list), or a native-VLAN mismatch across a trunk merges/breaks domains.
- Access vs trunk: tagged frames on an access port (or untagged on a trunk expecting tags) get
dropped or land in the wrong VLAN. Check
show vlans + show interfaces.
- Inter-VLAN routing uses an IRB (routed VLAN interface). No inter-VLAN traffic
→ is the IRB configured, up, in the VLAN, and is the host's gateway that IRB?
MAC learning problems
- MAC flapping between two ports = a Layer-2 loop (or a misconfigured LAG /
dual-homing) — the number-one L2 incident. Confirm with the ethernet-switching table + spanning-tree state.
- Table full / churn: MAC-limit hit, or a broadcast storm flooding unknown-unicast. Apply
mac-limit and storm-control.
- Unknown-unicast flooding everywhere → a MAC that never gets learned (asymmetric path, unidirectional link).
Spanning tree on Junos
Junos supports STP, RSTP (default), MSTP, and VSTP (per-VLAN, for Cisco PVST interop). Most L2
incidents are "traffic takes the wrong path" or "a loop formed."
- Root in the wrong place → set bridge priority; verify with
show spanning-tree
bridge. An unexpected root often means a rogue/low-priority switch — use root-protect.
- Unexpected blocking →
show spanning-tree interface shows role/state; a higher
path cost or a better BPDU elsewhere is diverting the tree.
- Loop despite STP → BPDUs not being received (filtered, unidirectional). Use
loop-protect and bpdu-block/BPDU protect on edge ports; enable edge on host
ports so they come up fast without waiting.
- Interop RSTP↔PVST: use VSTP for the overlapping VLANs; watch native-VLAN and per-VLAN root
consistency. See STP / RSTP / MSTP.
Redundancy: LAG & Virtual Chassis
- LAG / LACP: a member won't bundle if speed/duplex, MTU, or LACP mode (active/passive — both
passive never forms) mismatch, or
minimum-links isn't met. Traffic uneven → hashing is
flow-based; a few large flows don't spread. show lacp interfaces.
- Virtual Chassis: members have roles (master / backup / linecard) joined by VCP
links. Watch for a broken VCP (member goes missing), split-brain (fix with split-detection /
no-split-detection as designed), and mastership changes. show virtual-chassis +
show virtual-chassis vc-port.
- Redundant Trunk Group (RTG) gives fast L2 failover without STP on dual uplinks — verify the
active/standby link.
L2 security & the edge
- Storm-control caps broadcast/unknown-unicast/multicast; a port shut for storm-control looks
like a "dead" port — check logs.
- Port security: MAC limiting, DHCP snooping, dynamic ARP
inspection, IP source guard — a client with no address may be tripping snooping (untrusted port, no
binding). 802.1X: supplicant/authenticator/RADIUS — check the auth session and the guest/server-fail VLAN.
Likely interview questions
- A host can't reach its VLAN gateway — walk your L2-up checks. (link → VLAN membership → MAC → STP → IRB)
- MAC address flapping between two ports — what does that mean? (a loop)
- Junos spanning-tree flavors, and when do you use VSTP? (STP/RSTP/MSTP/VSTP; PVST interop)
- Root bridge ended up on the wrong switch — how do you fix and prevent it? (priority; root-protect)
- A loop formed even with RSTP enabled — how? (BPDUs not received; use loop-protect/UDLD-equivalent)
- A LAG member won't bundle — what do you check? (speed/MTU/LACP mode/min-links)
- What is a Virtual Chassis split, and how is it handled?
- Client gets no IP on a secured port — which features could block it? (DHCP snooping / DAI / 802.1X)