The IS-IS Shortest Path First (SPF) or Dijkstra algorithm calculates the shortest path from the local router to all other destinations. The algorithm maintains a 'tree' database for nodes with a confirmed shortest path and a 'candidate' database for nodes whose paths are being evaluated. The process iteratively selects the lowest-cost node from the candidate database and moves it to the tree database. Subsequently, it examines the neighbors of this newly added node (using the Link-State Database or LSDB) and adds them to the candidate database for future evaluation. Option B, despite its slightly imprecise wording, correctly describes this core iterative step of adding a neighbor of a node in the tree to the candidate list.

A. According to specific Juniper reference implementations, the algorithm is seeded by placing the local router directly into the tree database, not the candidate database.

C. Tuples are moved from the candidate database to the tree database, not the other way around. The LSDB is the input for the calculation and is not modified by it.

D. The algorithm terminates when the candidate database is empty, signifying that all reachable nodes have been processed and moved to the tree database.

1. Southwick

P.

Reynolds

H. (2010). Junos Enterprise Routing

2nd Edition. O'Reilly Media

Inc. Chapter 6

"The IS-IS Engine

" p. 258.

Quote: "The algorithm is seeded by adding the local router to the tree database with a cost of 0. The algorithm then examines the LSPs of the node just added to the tree and adds all of its neighbors to the candidate database... The algorithm then selects the entry in the candidate database with the lowest cost and moves it to the tree database. This process is repeated until the candidate database is empty." This source directly refutes option A and supports the logic of option B.

2. Juniper Networks. (2009). OSPF and IS-IS: Choosing an IGP [White paper].

Reference: Page 5 describes the SPF algorithm maintaining two lists: TENT (candidate list) and PATHS (tree list). It states

"TENT is the list of candidate nodes that are not yet on the SPF tree but are adjacent to it. PATHS is the list of nodes that are already on the SPF tree." This confirms the terminology used in the explanation.

3. Moy

J. (1991). RFC 1195: Use of OSI IS-IS for routing in TCP/IP and dual environments. IETF. Section 4.2.3

"The Decision Process."

Reference: This RFC provides the authoritative description of the SPF algorithm for IS-IS. Steps 3 through 5 detail the process of examining neighbors of a node just added to the tree (PATHS) and adding/updating them in the tentative list (TENT/candidate)

which aligns with the logic in option B.

In an OSPF-based Layer 3 VPN, routes learned from a CE router are advertised across the MPLS backbone and presented to the remote CE router as OSPF inter-area routes (Type 3 LSAs). This is a default loop-prevention mechanism. A direct, physical link between two customer sites, known as a "back door" link, is seen as an intra-area path. According to OSPF path selection rules, an intra-area path is always preferred over an inter-area path, regardless of the metric.

A sham link is a logical, unnumbered point-to-point intra-area link configured between the PE routers within the VPN routing instance. This makes the path over the MPLS backbone appear as an intra-area link to the CE routers. With both the backbone and the back door link now appearing as intra-area paths, OSPF will use the metric to determine the best route, allowing the VPN backbone to be preferred by configuring it with a lower cost.

A. Rejecting routes via policy would completely block the backup path, preventing failover if the primary VPN link fails, which is not the desired outcome.

B. OSPF traffic engineering (OSPF-TE) is used to advertise link attributes for MPLS-TE path calculation and does not change the fundamental OSPF preference for intra-area over inter-area routes.

C. The OSPF metric is only considered when comparing paths of the same type. An intra-area path will always be chosen over an inter-area path, irrespective of the metric.

1. Juniper Networks TechLibrary

"Understanding OSPF Sham Links": "If there is a backdoor link that connects two of the OSPF sites

the backdoor link is always preferred over the BGP/MPLS VPN backbone link. This is because OSPF prefers an intra-area link over an interarea link. To make the BGP/MPLS VPN backbone the preferred link

you can configure an OSPF sham link between the PE routers that are connected to the OSPF sites."

2. RFC 4577: OSPF as the Provider/Customer Edge Protocol for BGP/MPLS IP Virtual Private Networks (VPNs)

Section 4.2.8. The Sham Link: "If there is a "backdoor" link between two CE routers that are in the same OSPF area

the path over that link will always be preferred to the path over the BGP/MPLS IP VPN backbone. This is because OSPF prefers intra-area paths to inter-area paths. To make the path over the backbone preferable to the backdoor path

one may create a "sham link" between the PEs."

3. Juniper Networks TechLibrary

"Example: Configuring an OSPF Sham Link for a VPN": This document provides a configuration example explicitly designed to "direct traffic between two customer sites across a VPN backbone rather than a backdoor OSPF link

" confirming the sham link's purpose.

The vrf-target is a BGP extended community attribute that controls the import and export policies for routes within a VRF. In the provided configuration, both vrf-a and vrf-b share the same vrf-target value of target:100:1. When a single target is configured this way, it is used for both import and export policies. Consequently, routes learned from CE-1 in vrf-a are exported with target:100:1, and vrf-b is configured to import routes with this same target. This reciprocal relationship allows routes to be shared between the two VRFs, enabling communication between CE-1 and CE-2.

B. A shared vrf-target is the mechanism that enables route sharing between VRFs, it does not prevent it.

C. The route-distinguisher's function is to make IPv4 prefixes globally unique within the BGP table, not to control route sharing policy.

D. The route-distinguisher ensures route uniqueness for overlapping address spaces but does not influence the route sharing policy between VRFs.

1. Juniper Networks TechLibrary

Junos OS VPNs Library for Routing Devices

"Configuring Routing Instances on PE Routers in VPNs": This document explains that the vrf-target statement specifies the route target extended community. When a single target: is configured

it is used for both import and export policies

controlling which routes are accepted into and advertised from the VRF. The shared target target:100:1 in the exhibit explicitly creates a policy for route exchange between the two VRFs.

2. Juniper Networks TechLibrary

Junos OS VPNs Library for Routing Devices

"Route Distinguishers in VPNs Overview": This source clarifies the role of the route distinguisher (RD). It states

"The main purpose of the route distinguisher is to create unique VPN-IPv4 addresses for use in the service provider’s network." This confirms that the RD's function is to ensure uniqueness

not to control route distribution policy

which is the role of the route target.

3. Juniper Networks TechLibrary

Junos OS VPNs Library for Routing Devices

"Understanding VRF Import and Export Policies in L3VPNs": This document details how route targets function. It specifies that for a route to be accepted into a VRF's routing table (e.g.

vrf-b.inet.0)

the route must have a route target community that matches one of the communities listed in the vrf-import policy of that VRF. The configuration in the exhibit establishes this matching condition between vrf-a and vrf-b.

The exhibit shows that the egress router, PE-2, is advertising label 3 (Implicit Null) to the penultimate hop router (P). This instructs the P router to perform Penultimate Hop Popping (PHP), removing the outer MPLS label before forwarding the packet to PE-2. When the outer label is removed, the associated MPLS EXP bits, which carry the Class of Service (CoS) information, are also lost. Consequently, PE-2 receives a plain IP packet (with the inner VPN label) and cannot classify it based on the outer label's EXP bits. To resolve this, the explicit-null option must be configured on the egress router, PE-2. This causes PE-2 to advertise the Explicit Null label (label 0), preventing PHP and ensuring the MPLS header with the EXP bits is preserved until it reaches PE-2 for proper CoS classification.

A. Configure the explicit-null statement on PE-1.

Configuring explicit-null on the ingress router (PE-1) affects LSPs terminating on PE-1, not those originating from it. This will not solve the PHP issue at the egress (PE-2).

C. Configure VPN prefix mapping for the PE-1toPE-2 LSP.

VPN prefix mapping is used to direct specific VPN prefixes into a particular traffic-engineered LSP. It does not influence the label advertisement behavior (PHP vs. explicit-null).

D. Set a static CoS value for the PE-1toPE-2 LSP.

This would override any differentiated CoS markings with a single static value for all traffic in the LSP, which is contrary to the goal of preserving and acting upon the original CoS markings.

1. Juniper Networks TechLibrary

MPLS Applications User Guide

"Configuring Explicit Null Labels for LSPs": "By default

penultimate-hop popping is enabled. When PHP is enabled

the quality-of-service (QoS) information is lost because the MPLS header is removed by the penultimate-hop router. The egress router is unable to examine the EXP bits in the MPLS header. To preserve the QoS information for a packet

you can disable PHP. The MPLS header and the QoS information are then available on the egress router for processing." This is achieved by configuring explicit-null on the egress router.

2. Juniper Networks TechLibrary

Junos OS CoS for Routers

"CoS on MPLS LSPs Overview": "For the egress PE router to classify a packet based on the EXP value

the packet must arrive at the egress PE router with the MPLS label stack intact. By default

the penultimate router pops the outer label. To prevent the penultimate router from popping the outer label

you must configure the explicit null label on the egress PE router."

3. Juniper Networks Day One: Deploying MPLS

Chapter 5: Class of Service

Page 65: "The problem with PHP is that the EXP bits are lost when the label is popped... To solve this problem

you can configure the egress PE router to advertise an explicit NULL label (label value 0) instead of an implicit NULL label (label value 3). This forces the penultimate router to send the labeled packet to the egress PE router

thus preserving the EXP bits."

On point-to-point links, an IS-IS router configured for both Level 1 and Level 2 sends a single, combined Point-to-Point Hello (P2P IIH) packet. A field within this single PDU indicates the router's capabilities (L1, L2, or both), allowing it to form both types of adjacencies efficiently.

Conversely, on broadcast network segments like Ethernet, an L1/L2 router must send two distinct types of Hello packets: an L1 LAN IIH to discover and maintain adjacencies with L1 neighbors, and a separate L2 LAN IIH for its L2 neighbors. This separation is necessary to manage different adjacencies on a shared, multi-access medium.

A. On point-to-point links, a single P2P Hello PDU is used to establish both L1 and L2 adjacencies, not separate ones.

D. On broadcast networks, separate L1 and L2 LAN Hello PDUs are required; a single combined message is not used for this network type.

1. Juniper Networks TechLibrary

"Understanding IS-IS Adjacencies": "On a broadcast subnetwork

a Level 1/Level 2 router sends separate hello packets for Level 1 and Level 2 adjacencies. On a point-to-point subnetwork

a Level 1/Level 2 router sends a single hello packet for both Level 1 and Level 2 adjacencies."

2. RFC 1195

"Use of OSI IS-IS for routing in TCP/IP and dual environments"

Section 3.7.2

LAN IIH PDU: This section states

"A router which is operating as both a Level 1 and Level 2 router shall transmit both Level 1 and Level 2 LAN Hellos." This directly supports the behavior on broadcast interfaces.

3. RFC 1195

"Use of OSI IS-IS for routing in TCP/IP and dual environments"

Section 3.7.1

Point to point IIH PDU: This section describes a single PDU type for point-to-point links where the "Circuit type field indicates whether the sender is a Level 1 router

a Level 2 router

or both

" confirming a single

combined message is used.