CloudLabBox
Try the free demo

JNCIS-ENT lab 10 of 17

Load balancing and filter-based forwarding

A branch with two links to one ISP and one link to a cheaper second ISP. You make Junos actually use both equal-cost links, then send guest traffic to the cheaper ISP with filter-based forwarding, while staff traffic stays on the main ISP.

Run this lab

It needs Standard: its 3 nodes are set to 12 vCPU and 15,360 MB in total.

In your workspace: Shared, then JNCIS-ENT JN0-352 guided labs, then 10 - Load balancing and filter-based forwarding

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 12 vCPU and 15,360 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
12 vCPU, 15,360 MB
Smallest plan
Standard

The scenario

The Ashby Freight branch office has two links to its main ISP, ISP-A, and a single link to a cheaper ISP, ISP-B. The default route already points at ISP-A over both links, but the network team suspects only one link ever carries traffic. The guest Wi-Fi should also stop using the expensive ISP: guest traffic must leave through ISP-B, while staff traffic stays on ISP-A.

To give you real "PCs" without more devices, BRANCH's ge-0/0/3 is patched to its own ge-0/0/4. The router side (ge-0/0/3) carries the staff LAN (VLAN 10, 10.10.10.1/24) and the guest LAN (VLAN 20, 10.10.20.1/24). The PC side (ge-0/0/4) belongs to two routing instances that act as PCs: STAFF-PC (10.10.10.10) and GUEST-PC (10.10.20.10), each with a default route to BRANCH. Traffic from the PCs crosses the cable and enters BRANCH's main routing table on ge-0/0/3, exactly like traffic from a real LAN.

Each ISP drops anything that is not its own (a discard default route), and drops it silently: not even traceroute gets an answer from it. Two tools show where traffic goes instead:

  • Which ISP: each ISP's loopback answers only through that ISP. ISP-A is 192.0.2.1 and ISP-B is 192.0.2.2, so a ping that reaches 192.0.2.2 went through ISP-B.
  • Which link: BRANCH's output counters. clear interfaces statistics all, send some traffic, then show interfaces ge-0/0/0 extensive | match "Output packets" and the same for ge-0/0/1.

What you’ll practise

  • Compare the routing table and the forwarding table for a route with several next hops
  • Enable per-flow load balancing with a forwarding-table export policy
  • Explain how flows are hashed across equal-cost next hops
  • Build filter-based forwarding with a forwarding instance, a firewall filter and a RIB group
  • Prove the path each class of traffic takes

The tasks

  1. Two next hops in the routing table, one in the forwarding table
  2. Per-flow load balancing
  3. Filter-based forwarding for the guests
  4. Prove both paths

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Load balancing and filter-based forwarding3 nodes, 4 links. Every link is listed as text below the diagram.BRANCHISP-AISP-Bge-0/0/3ge-0/0/4ge-0/0/0ge-0/0/0ge-0/0/1ge-0/0/1ge-0/0/2ge-0/0/0
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • BRANCH ge-0/0/0 to ISP-A ge-0/0/0
  • BRANCH ge-0/0/1 to ISP-A ge-0/0/1
  • BRANCH ge-0/0/2 to ISP-B ge-0/0/0
  • BRANCH ge-0/0/3 to BRANCH ge-0/0/4
Nodes in Load balancing and filter-based forwarding, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
BRANCHJuniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB
ISP-AJuniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB
ISP-BJuniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIS-ENT JN0-352 guided labs.

  3. Open 10 - Load balancing and filter-based forwarding and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More JNCIS-ENT labs

All JNCIS-ENT labs

Related labs in other courses

CloudLabBox is independent of Juniper Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.