Junos devices support various types of tunnels for different purposes 1 2 .

Option B is correct.  Generic Routing Encapsulation (GRE) is a tunneling protocol that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network 1 .  Junos devices support GRE tunnels 1 .

Option D is correct.  IPsec (Internet Protocol Security) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session 1 .  Junos devices support IPsec tunnels 1 .

Option A is incorrect. Spanning Tree Protocol (STP) is not a type of tunnel.  It’s a network protocol designed to prevent loops in a bridged Ethernet local area network 2 .

Option C is incorrect.  While Junos devices do support IP-IP (also known as IP tunneling), it’s not supported on all Junos devices 1 .

According to the Juniper documentation1, a native VLAN is a VLAN that carries untagged traffic on a trunk port. A Wi-Fi access point may need a native VLAN to associate untagged traffic with a specific VLAN, such as the management VLAN. On Juniper EX Series switches, you can enable a native VLAN on a switch port by setting the interface-mode to trunk and specifying a native-vlan-id. For example, the following configuration enables a native VLAN with ID 1 on the switch port ge-0/0/12:

set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk

set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members all

set interfaces ge-0/0/1 unit 0 family ethernet-switching native-vlan-id 1

The other options are not correct because they do not address the requirement of untagged traffic. VLAN tagging is the process of adding a VLAN identifier to a frame, which is not needed for untagged traffic. Flexible VLAN tagging is a feature that allows multiple VLAN tags on a single interface, which is not relevant for this scenario. Voice VLAN is a feature that allows voice traffic to be separated from data traffic on a switch port, which is not related to untagged traffic or Wi-Fi access points. References: Understanding Native VLANs on Trunks | Junos OS, Configuring a Native VLAN on a Trunk Port | Junos OS

A firewall filter is a configuration that defines the rules that determine whether to forward or discard packets at specific processing points in the packet flow. A firewall filter can also modify the attributes of the packets, such as priority, marking, or logging.  A firewall filter can be applied to various interfaces, protocols, or routing instances on a Juniper device 1 .

A firewall filter has a family attribute, which specifies the type of traffic that the filter can evaluate.  The family attribute can be one of the following: inet, inet6, mpls, vpls, iso, or ethernet-switching 2 . The family inet firewall filter is used to evaluate IPv4 traffic, which is the most common type of Layer 3 traffic on a network.

To create a family inet firewall filter, you need to specify the appropriate match criteria and actions for each term in the filter. The match criteria can include various fields in the IPv4 header, such as source address, destination address, protocol, port number, or DSCP value.  The actions can include accept, discard, reject, count, log, policer, or next term 3 .

To apply a firewall filter to Layer 3 traffic that is being sent between VLANs, you need to apply the filter to the appropriate IRB interface. An IRB interface is an integrated routing and bridging interface that provides Layer 3 functionality for a VLAN on a Juniper device. An IRB interface has an IP address that acts as the default gateway for the hosts in the VLAN.  An IRB interface can also participate in routing protocols and forward packets to other VLANs or networks 4 .

Therefore, option C is correct, because you should create a family inet firewall filter with the appropriate match criteria and actions. Option D is correct, because you should apply the firewall filter to the appropriate IRB interface.

Option A is incorrect, because you should not create a family ethernet-switching firewall filter with the appropriate match criteria and actions. A family ethernet-switching firewall filter is used to evaluate Layer 2 traffic on a Juniper device.  A family ethernet-switching firewall filter can only match on MAC addresses or VLAN IDs, not on IP addresses or protocols 5 .

Option B is incorrect, because you should not apply the firewall filter to the appropriate VLAN. A VLAN is a logical grouping of hosts that share the same broadcast domain on a Layer 2 network. A VLAN does not have an IP address or routing capability.  A firewall filter cannot be applied directly to a VLAN; it must be applied to an interface that belongs to or connects to the VLAN 6 .