According to the Juniper documentation1, EVPN route Type-3 is used to advertise the IP address of the VTEP and the VNIs that it supports. This allows the VTEPs to discover each other and form VXLAN tunnels for the VNIs that they have in common. EVPN route Type-2 is used to advertise the MAC and IP addresses of the hosts connected to the VTEPs. This allows the VTEPs to learn the MAC-to-IP bindings and the MAC-to-VTEP mappings for the hosts in the same VNI. Therefore, these two types of VXLAN tunnels will be automatically created by the EVPN control plane when using Juniper Apstra with the ERB design blueprint and two virtual networks in a common routing zone. References: Example: Configure an EVPN-VXLAN Centrally-Routed Bridging Fabric

To answer this question, we need to understand the concept of ESI values in EVPN LAGs. An ESI is a 10-byte value that identifies an Ethernet segment, which is a set of links that connect a multihomed device (such as a server) to one or more PE devices (such as leaf switches) in an EVPN network. The same ESI value must be configured on all the PE devices that connect to the same Ethernet segment. This allows the PE devices to form an EVPN LAG, which supports active-active or active-standby multihoming for the device. The ESI value can be manually configured (type 0) or automatically derived from LACP (type 1) or other methods. In the exhibit, Server A is connected to two leaf switches (QFX 5210) using a LAG with LACP enabled. Server B is connected to three leaf switches (QFX 5120) using a LAG with LACP enabled. Based on this information, the following statements are correct about ESI values for the server connections to the fabric:

• C. A valid ESI value for Server A is 0x00.10.10.10.10.10.10.10.10.10. This is true because this ESI value can be automatically derived from the LACP configuration on the QFX 5210 devices. The LACP system ID is usually based on the MAC address of the device, and the LACP administrative key is a 2-byte value that identifies the LAG. For example, if the MAC address of the QFX 5210 device is 00:10:10:10:10:10 and the LAG ID is 10, then the LACP system ID is 00:10:10:10:10:10 and the LACP administrative key is 00:0A. The ESI value is then derived by concatenating the LACP system ID and the LACP administrative key, resulting in 00:10:10:10:10:10:00:0A. This ESI value can be represented in hexadecimal notation as 0x00.10.10.10.10.10.00.0A, or padded with zeros as 0x00.10.10.10.10.10.00.0A.00.00. This ESI value must be configured on both QFX 5210 devices that connect to Server A.
• D. A valid ESI value for Server B is 0x00.00.00.00.00.00.00.00.00.00. This is true because this ESI value is a reserved value that indicates a single-homed device. Server B is connected to three leaf switches (QFX 5120) using a LAG, but it is not multihomed to any of them. This means that Server B does not need an ESI value to form an EVPN LAG with any of the leaf switches. Instead, Server B can use the reserved ESI value of 0x00.00.00.00.00.00.00.00.00.00, which indicates that it is a single-homed device and does not participate in any EVPN LAG. This ESI value must be configured on all three QFX 5120 devices that connect to Server B. Thefollowing statements are incorrect about ESI values for the server connections to the fabric:
• A. A valid ESI value for Server A is 0x00.00.00.00.00.00.00.00.00.00. This is false because this ESI value is a reserved value that indicates a single-homed device. Server A is connected to two leaf switches (QFX 5210) using a LAG with LACP enabled, which means that it is multihomed to both of them. This means that Server A needs an ESI value to form an EVPN LAG with the leaf switches. The ESI value must be unique and non-zero for each Ethernet segment, so the reserved ESI value of 0x00.00.00.00.00.00.00.00.00.00 is not valid for Server A.
• B. A valid ESI value for Server B is 0x00.20.20.20.20.20.20.20.20.20. This is false because this ESI value is not derived from the LACP configuration on the QFX 5120 devices. Server B is connected to three leaf switches (QFX 5120) using a LAG with LACP enabled, but it is not multihomed to any of them. This means that Server B does not need an ESI value to form an EVPN LAG with any of the leaf switches. Instead, Server B can use the reserved ESI value of 0x00.00.00.00.00.00.00.00.00.00, which indicates that it is a single-homed device and does not participate in any EVPN LAG. The ESI value of 0x00.20.20.20.20.20.20.20.20.20 is not valid for Server B, and it may cause conflicts with other Ethernet segments that use the same ESI value. References:
• Ethernet Segment Identifiers, ESI Types, and LACP in EVPN LAGs
• Understanding Automatically Generated ESIs in EVPN Networks
• Ethernet Segment in EVPN: All You Need to Know

The deploy phase is the final step in the Juniper Apstra data center fabric design and deployment process. In this phase, you apply the Apstra-rendered configuration to the devices and verify the intent of the blueprint. Based on the web search results, we can infer the following actions are required during the deploy phase12:

• Assign device profiles to the blueprint. This action associates a specific vendor model to each logical device in the blueprint. Device profiles contain extensive hardware model details, such as form factor, ASIC, CPU, RAM, ECMP limit, and supported features. Device profiles also define how configuration is generated, how telemetry commands are rendered, and how configuration is deployed on a device. Device profiles enable the Apstra system to render and deploy the configuration according to the Apstra Reference Design34.
• Assign resources to the blueprint. This action allocates the physical devices, IP addresses, VLANs, and ASNs to the logical devices, networks, and routing zones in the blueprint. Resources can be assigned manually or automatically by the Apstra system. Assigning resources ensures that the blueprint has all the necessary elements to generate the configuration and deploy the fabric5 .
• Assign user roles to the blueprint. This action is not required during the deploy phase. User roles are defined at the system level, not at the blueprint level. User roles determine the permissions and access levels of different users in the Apstra system. User roles can be system-defined or custom-defined .
• Assign interface maps to the blueprint. This action is not required during the deploy phase. Interface maps are defined at the design phase, not at the deploy phase. Interface maps are objects that map the logical interfaces of a logical device to the physical interfaces of a device profile. Interface maps enable the Apstra system to generate the correct interface configuration for each device in the fabric . References:
• Deploy
• Deploy Device
• Device Profiles
• Juniper Device Profiles
• Resources

Intent-based analytics (IBA) is a feature of Juniper Apstra that allows you to combine intent from the network design with current and historic data from devices to reason about the network at-large1. IBA has the following characteristics:

• It is a real-time information processing pipeline. This means that IBA can ingest, process, and analyze large amounts of data from devices in real time, using agents and probes. Agents are software components that collect data from devices and send them to the Apstra server. Probes are user-defined queries that aggregate data across devices and generate advanced data that can be more easily reasoned about1.
• It is used to establish network performance baselines. This means that IBA can use the advanced data to measure and monitor the network performance against the expected outcomes and service levels. IBA can also use the historic data to create baselines that represent the normal behavior and state of the network2.
• It alerts the network operator when network performance moves away from the baseline. This means that IBA can detect and report any anomalies or deviations from the baseline or the intent in the network. IBA can also provide insights and recommendations for troubleshooting and resolving the issues2.

The following two statements are incorrect in this scenario:

• It indicates when device operating versions require updating. This is not true, because IBA does not provide any information or guidance about the device operating versions or updates. IBA is focused on the network performance and compliance, not on the device maintenance or upgrade1.
• It collects information from vendor websites. This is not true, because IBA does not collect any information from vendor websites or external sources. IBA only collects information from the devices in the network, using agents and probes1.

References:

• Intent-Based Analytics — Apstra 3.3.0 documentation
• What is Intent Based Networking? | Juniper Networks US

When working with logical devices, you specify where each port group is connected by selecting the port group layout and the port speed and role (s) for each port group. The Juniper Apstra UI offers two options to the operator for the port group role: unused and generic1.

• Unused: This option means that the port group is not configured or used by Apstra. This can be useful for ports that are faulty, reserved, or not part of the data center fabric1.
• Generic: This option means that the port group is configured with a generic role that is not specific to any device type or function. This can be useful for ports that are used for testing, troubleshooting, or custom purposes1. References:
• Logical Devices

 Probes are the basic unit of abstraction in Intent-Based Analytics (IBA). They are used to collect, process, and analyze data from the network and raise anomalies based on specified conditions. Probes are composed of processors and stages that form a directed acyclic graph (DAG) of data flow. The following statements are correct about probes:

• A. Default probes can be cloned, modified, and saved. This is true because Apstra provides a set of default probes that cover common use cases and scenarios. These probes can be cloned and modified to suit the specific needs of the user. The modified probes can be saved as new probes with different names and descriptions. This allows the user to customize and extend the functionality of the default probes.
• D. Default probes are enabled, based on the intent for a blueprint. This is true because Apstra enables or disables the default probes automatically based on the intent of the blueprint. The intent of the blueprint is the high-level description of the desired state and behavior of the network. Apstra uses the intent to determine which default probes are relevant and applicable for the blueprint and enables them accordingly. For example, if the intent of the blueprint is to deployan EVPN-VXLAN fabric, Apstra will enable the default probes related to EVPN-VXLAN, such as EVPN-VXLAN Anomaly Detection, EVPN-VXLAN Fabric Health, and EVPN-VXLAN Fabric Validation. The following statements are incorrect about probes:
• B. Only the variable parameters for default probes can be edited and saved. This is false because the user can edit and save any parameters for the default probes, not just the variable ones. The variable parameters are the ones that depend on the network topology, devices, or configuration, such as device names, interface names, IP addresses, VLAN IDs, etc. The user can also edit and save the fixed parameters, such as the duration, threshold, condition, etc. However, the user cannot edit and save the default probes directly. The user must clone the default probes first and then edit and save the cloned probes as new probes.
• C. All default probes are enabled for all blueprints. This is false because Apstra does not enable all default probes for all blueprints. Apstra enables the default probes based on the intent of the blueprint, as explained above. This means that only the default probes that are relevant and applicable for the blueprint are enabled. For example, if the intent of the blueprint is to deploy a BGP IP fabric, Apstra will not enable the default probes related to EVPN-VXLAN, since they are not relevant for the blueprint. The user can also manually enable or disable the default probes as needed. References:
• Probes
• Create Probe
• Intent-Based Analytics Overview

According to the Juniper documentation1, an ESI-LAG is a link aggregation group (LAG) that spans two or more devices and is identified by an Ethernet segment identifier (ESI). An ESI-LAG provides redundancy and load balancing for a multihomed server in an EVPN-VXLAN network. To configure an ESI-LAG, you need to ensure that the following requirements are met:

• The LACP system ID on both devices must be the same. This ensures that the LACP protocol can negotiate the LAG parameters and form a single logical interface for the server.
• The ESI ID on both devices must be the same. This ensures that the EVPN control plane can advertise the ESI-LAG as a single Ethernet segment and synchronize the MAC and IP addresses of the server across the devices.
• The VLAN ID and VNI on both devices must be the same. This ensures that the server can communicate with other hosts in the same virtual network and that the VXLAN encapsulation and decapsulation can work properly.

In the exhibit, the LACP system ID and the ESI ID on both devices are different, which prevents the ESI-LAG from coming up as multihomed. Therefore, the correct answer is B and D. The LACP system ID on both devices must be the same and the ESI ID on both devices must be the same. References: ESI-LAG Made Easier with EZ-LAG, Example: Configuring an ESI on a Logical Interface With EVPN-MPLS Multihoming, Introduction to EVPN LAG Multihoming

In the EVPN-VXLAN data center fabric bridged overlay architecture shown in the exhibit, the servers are connected to Leaf1 and Leaf6 using the same virtual network identifier (VNI). This means that the servers belong to the same Layer 2 domain and can communicate with each other using VXLAN tunnels across the fabric. The underlay network provides the IP connectivity between the leaf and spine devices, and it uses EBGP as the routing protocol. Therefore, the following two statements are correct in this scenario:

• Loopback IPv4 addresses must be advertised into the EBGP underlay from leaf and spine devices. This is because the loopback addresses are used as the source and destination IP addresses for the VXLAN tunnels, and they must be reachable by all the devices in the fabric. The loopback addresses are also used as the router IDs and the BGP peer addresses for the EBGP sessions.
• The underlay EBGP peering’s must be established between leaf and spine devices. This is because the EBGP sessions are used to exchange the underlay routing information and the EVPN routes for the overlay network. The EBGPsessions are established using the loopback addresses of the devices, and they follow a spine-and-leaf topology, where each leaf device peers with all the spine devices, and each spine device peers with all the leaf devices.

The following two statements are incorrect in this scenario:

• The underlay must use IRB interfaces. This is not true, because the underlay network does not provide any Layer 3 gateway functionality for the overlay network. The IRB interfaces are used to provide inter-VXLAN routing within the fabric, which is not the case in the bridged overlay architecture. The IRB interfaces are used in the edge-routed bridging (ERB) or the centrally-routed bridging (CRB) architectures, which are different from the bridged overlay architecture.
• The underlay must be provisioned with PIMv2. This is not true, because the underlay network does not use multicast for the VXLAN tunnels. The VXLAN tunnels are established using EVPN, which uses BGP to distribute the MAC and IP addresses of the end hosts and the VTEP information of the devices. EVPN eliminates the need for multicast in the underlay network, and it provides optimal forwarding and fast convergence for the overlay network.

References:

• Exploring EVPN-VXLAN Overlay Architectures – Bridged Overlay
• EVPN LAGs in EVPN-VXLAN Reference Architectures
• EVPN-VXLAN Configuration Guide

The graph query output shown in the exhibit is a JSON representation of an interface node and its properties in the Apstra graph database. Based on the output, we can infer the following statements:

• The output shows a LAG connection. This is true because the interface node has a property called lag_mode which is set to lacp_active, indicating that the interface is part of a link aggregation group (LAG) that uses the Link Aggregation Control Protocol (LACP) to negotiate the link state and parameters12.
• The switch in the output is a Juniper device. This is true because the interface node has a property called if_name which is set to ae2, indicating that the interface name follows the Juniper naming convention for aggregated Ethernet interfaces34.
• The interface has an IP address assigned to it. This is false because the interface node has properties called ipv4_addr and ipv6_addr which are both set to null, indicating that the interface does not have any IPv4 or IPv6 address configured2.
• The interface has tags assigned to it. This is false because the interface node has a property called tags which is set to null, indicating that the interface does not have any tags associated with it2. References:
• Link Aggregation Overview
• Processor: Generic Graph Collector
• Understanding Aggregated Ethernet Interfaces and LACP
• Graph

To keep virtual networks isolated from each other within the Juniper Apstra system, you can use one or more of the following methods:

• Enable Security Policy for virtual networks in the same Routing Zone. This allows you to define rules that control the traffic flow between different virtual networks within the same routing zone. You can specify the source and destination virtual networks, the protocol, the port, and the action (allow or deny) for each rule. The security policy is applied on the ingress interface of the leaf devices1.
• Use Connectivity Templates to block access within the same Routing Zone. This allows you to customize the connectivity between different racks within the same routing zone. You can create templates that define the link type, the routing protocol, and the access control list(ACL) for each rack pair. The ACL can be used to filter the traffic based on the source and destination IP addresses, the protocol, and the port2.
• Put each network in different Routing Zones. This allows you to create logical boundaries between different virtual networks based on the route target (RT) values. A routing zone is a collection of virtual networks that share the same RT for importing and exporting routes. Virtual networks in different routing zones do not exchange routes with each other, unless you configure remote EVPN gateways to connect them3. References:
• Security Policy
• Connectivity Templates
• Routing Zones