Juniper Data Center Associate (JNCIA-DC) JN0-281 Question # 14 Topic 2 Discussion
JN0-281 Exam Topic 2 Question 14 Discussion:
Question #: 14
Topic #: 2
You want your Junos OS router to drop packets that it receives for a particular destination IP address. You also want to notify the source of the traffic that the destination IP address is unreachable. How would you accomplish this task?
A.
Create a static route for the destination IP address in the inet.3 routing table.
B.
Add the destination IP address to the list of martian IP addresses.
C.
Create a static route for the destination IP address with a next hop of reject.
D.
Create and apply a firewall filter to the ingress interface that discards traffic destined to the IP address.
To intentionally drop traffic to a specific destination while also informing the sender that the destination is unreachable, Junos provides a routing action specifically meant for this behavior: a static route with a next hop of reject. A reject route installs a forwarding entry that causes matching packets to be dropped, and it also triggers generation of an ICMP unreachable message back to the traffic source. This is useful in data center routing for controlled blackholing with feedback, for example when you want to signal misrouted traffic, invalid destinations, or to enforce policy with explicit notification.
A discard route also drops packets, but it does so silently without sending ICMP unreachable messages. That makes discard appropriate for traffic-sink use cases such as safe summarization or DDoS mitigation where you do not want to generate return traffic. Adding addresses to martians is intended to block invalid special-use prefixes from being treated as routable, not to create a targeted unreachable response for an arbitrary destination. Using inet.3 is related to MPLS label-switched forwarding and does not address the requirement. A firewall filter that discards traffic will typically drop silently unless explicitly configured to send rejects in a security context, and it is not the standard routing-table-based method when the requirement is an ICMP unreachable response for a destination prefix.
Therefore, a reject static route is the correct solution.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit