Layer 2 switching: VLANs, trunks and IRB

What you will learn in this module. You will learn how an EX switch running Junos moves Ethernet frames inside a campus: how it learns MAC addresses, how VLANs cut one switch into several separate networks, how trunks carry many VLANs between switches, what the native VLAN does, and how IRB interfaces route between VLANs. This is the Layer 2 Switching and VLANs part of the JNCIS-ENT exam (JN0-352). By the last chapter you will be able to build, verify and troubleshoot all of it on the same lab devices you will use in the simulator.

Prerequisites. This module assumes you finished the JNCIA-Junos modules. In particular you should be comfortable with the CLI from JNCIA CLI: configure, set, show | compare, commit, rollback and operational show commands. We will not re-teach them, we will simply use them. You should also know what an IP address, a subnet mask and a default gateway are.

Analogy: an office building with locked floors

Think of a switch as the lift lobby and corridors of an office building. A frame is a letter addressed to a desk. The switch is the clerk who remembers which corridor each desk is on, so most letters go straight to the right door instead of being shouted down every corridor. A VLAN is a locked floor: Finance people can walk their own floor freely, but they cannot walk into Design. If Finance must talk to Design, the letter goes to the reception desk on the ground floor, which is a router. A trunk is the main lift shaft: it carries people from every floor, and each passenger wears a coloured badge (the 802.1Q tag) saying which floor they belong to.

The pieces you will meet

Frame

The Layer 2 unit of data: destination MAC, source MAC, optional VLAN tag, payload.

MAC table

The switch's memory of which address lives behind which port (the Ethernet switching table).

VLAN

A virtual LAN: one separate broadcast domain inside the switch, identified by a 12-bit ID from 1 to 4094.

Access port

A port for one end device that belongs to exactly one VLAN and carries untagged frames.

Trunk port

A port between switches that carries many VLANs, each frame tagged.

IRB

Integrated routing and bridging: the switch's own Layer 3 interface inside a VLAN, used as the hosts' default gateway.

Enhanced Layer 2 Software (ELS)

Modern EX switches such as the EX4300 and EX2300 use ELS, a Junos configuration style where VLANs are defined under [edit vlans] and ports use family ethernet-switching on unit 0. All the commands in this module use that style. Older EX models used a different syntax with vlan members under [edit ethernet-switching-options]; the exam and the lab use ELS.

Before VLANs, trunks or routing, you must understand the one thing every switch does all day: decide where to send a frame. Think of a post-room clerk in a large office. Every letter that arrives has a sender and a receiver desk. The clerk writes down "desk 14 is in corridor B" the first time a letter from desk 14 passes by. Next time a letter is addressed to desk 14, the clerk walks straight to corridor B. If the clerk has never heard of a desk, the letter is copied to every corridor. That is exactly the learn, forward and flood behaviour of an Ethernet switch.

The Ethernet frame in one minute

A frame is the Layer 2 envelope. It carries a destination MAC address (6 bytes), a source MAC address (6 bytes), an optional 802.1Q VLAN tag (4 bytes), a type field and the payload. A MAC address is a hardware-style identifier such as 00:50:7f:06:6d:01. A switch only reads the Layer 2 header. It does not care about IP addresses when it switches.

The four actions

1. Learn. For every incoming frame the switch records the source MAC, the VLAN and the ingress port in the Ethernet switching table.
2. Forward. If the destination MAC is in the table for that VLAN, the frame leaves through that one port only.
3. Flood. Broadcasts (destination ff:ff:ff:ff:ff:ff), multicasts without snooping and unknown unicast frames go out of every port in the same VLAN except the ingress port.
4. Filter. If the destination is behind the same port the frame arrived on, the switch drops it.

Entries age out after a period of silence (default 300 seconds on Junos) and are removed when the port goes down. When a host moves to another port, the next frame it sends updates the entry: this is a MAC move.

Seeing it on the switch

In the lab Lab 1 topology (AS1 and four PCs) we ping between the hosts and then read the table. This output was captured from the simulator before any VLAN was created, so every host is in the built-in default VLAN:

lab@AS1> show ethernet-switching table

Ethernet switching table : 4 entries, 4 learned
Routing instance : default-switch
   Vlan                MAC                 MAC         Age    Logical
   name                address             flags              interface
   default             00:50:7a:06:65:01   D           -      ge-0/0/4.0
   default             00:50:7f:06:6d:01   D           -      ge-0/0/1.0
   default             00:50:80:06:6e:01   D           -      ge-0/0/2.0
   default             00:50:81:06:70:01   D           -      ge-0/0/3.0

Read it left to right: VLAN name, the learned MAC, the flag D (dynamically learned) and the logical interface. The value after the dot is the unit; on EX access ports it is almost always .0.

# useful table commands
show ethernet-switching table
show ethernet-switching table vlan-name FINANCE
show ethernet-switching table interface ge-0/0/4
clear ethernet-switching table

Imagine a single large open-plan office where every conversation is heard by everyone. Now add glass partitions: Finance in one room, Design in another. People in the same room still talk freely, but a shout in one room is not heard in the next. A VLAN (virtual LAN) is that partition, built in software. One physical switch is divided into several separate broadcast domains. A broadcast sent in VLAN 110 is never delivered to ports in VLAN 120.

Why VLANs matter

• Smaller broadcast domains: less ARP and broadcast noise on every host.
• Security and policy: traffic between VLANs has to pass through a router interface where a firewall filter can be applied.
• Flexibility: moving a desk means changing one line of configuration, not re-cabling a floor.

A VLAN is identified by a VLAN ID (also called tag), a 12-bit number from 1 to 4094. Junos gives every switch a built-in VLAN called default with ID 1.

Configuring VLANs on ELS

Modern EX switches such as the EX4300 use Enhanced Layer 2 Software (ELS). You define VLANs by name, then attach ports through family ethernet-switching on unit 0. The access port is for one end device: it belongs to one VLAN and sends and receives untagged frames.

# Lab 1: split the Chennai design studio
set vlans DESIGN vlan-id 110
set vlans FINANCE vlan-id 120
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access vlan members DESIGN
set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access vlan members DESIGN
set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members FINANCE
set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members FINANCE

interface-mode access is the default, so lines three and four are equivalent. vlan members accepts the VLAN name or its numeric ID. Before committing, review the change. This is real output from the simulator:

lab@AS1# show | compare
[edit]
+   vlans {
+       DESIGN {
+           vlan-id 110;
+       }
+       FINANCE {
+           vlan-id 120;
+       }
+   }
[edit interfaces ge-0/0/1 unit 0 family ethernet-switching]
+   interface-mode access;
+   vlan {
+       members DESIGN;
+   }

Verifying

lab@AS1> show vlans
Routing instance        VLAN name             Tag          Interfaces
default-switch          default               1
default-switch          DESIGN                110
                                                           ge-0/0/1.0*
                                                           ge-0/0/2.0*
default-switch          FINANCE               120
                                                           ge-0/0/3.0*
                                                           ge-0/0/4.0*

The asterisk means the logical interface is up. After the move, PC3 reaches PC4 but PC1 can no longer reach PC3. The simulator shows five lines of host (192.168.50.13) not reachable, which is exactly what you want: same subnet, different VLANs, no Layer 2 path and no router between them.

lab@AS1> show ethernet-switching interface ge-0/0/1 detail
Logical Interface          : ge-0/0/1.0
  State                    : up
  Interface mode           : access
  MAC addresses learned    : 1
  VLAN membership          :
    DESIGN                110   untagged  Forwarding

Return to the office building. Each floor (VLAN) has its own rooms, but the whole building shares one lift shaft. Every passenger wears a coloured badge saying which floor they belong to, so the lift can drop them at the right place. A trunk is that lift shaft: a single link between two switches that carries many VLANs at once. The coloured badge is the IEEE 802.1Q tag.

The 802.1Q tag

802.1Q inserts 4 bytes between the source MAC and the type field of the frame. Inside are a 16-bit tag protocol identifier (0x8100), 3 priority bits (used by CoS), 1 drop-eligible bit and the 12-bit VLAN ID. The receiving switch reads the ID and keeps the frame inside that VLAN. Hosts never see tags on access ports: the switch adds the tag when the frame enters a trunk and removes it when the frame leaves through an access port.

Configuring a trunk

In Lab 2 the access switch ACC already has a trunk. CORE is blank, so you build the matching end. Note that both ends must carry the same VLANs:

# on CORE
set vlans SALES vlan-id 10
set vlans ENG vlan-id 20
set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk vlan members [ SALES ENG ]

Only VLANs listed in vlan members cross the trunk. vlan members all allows every VLAN that exists. Real output of the trunk on CORE after commit:

lab@CORE> show ethernet-switching interface ge-0/0/0 detail
Logical Interface          : ge-0/0/0.0
  State                    : up
  Interface mode           : trunk
  MAC addresses learned    : 0
  VLAN membership          :
    SALES                 10    tagged    Forwarding
    ENG                   20    tagged    Forwarding

The native VLAN

Sometimes untagged frames arrive on a trunk: a management protocol, an old device, or a switch that sends its own control frames without a tag. The native VLAN tells the switch which VLAN these untagged frames belong to. On Junos a trunk has no native VLAN by default, so untagged frames arriving on it are dropped. You enable it on the physical interface:

set interfaces ge-0/0/0 native-vlan-id 99      # the numeric ID; the lab uses MGMT = 99
set interfaces ge-0/0/0 native-vlan-id MGMT

The native-vlan-id statement sits under the physical interface, not under unit 0. Frames of the native VLAN leave the trunk untagged; untagged arrivals are placed into that VLAN. The VLAN listed as native must also be in the member list of that trunk (or be covered by members all).

Both ends must agree. If ACC says native STAFF and CORE says native MGMT, an untagged frame sent by CORE in VLAN 99 arrives at ACC and is placed in VLAN 30. No log message tells you; traffic of both VLANs simply goes to the wrong place. The Lab 3 ticket is exactly this fault.

Symptom	Usual cause
One VLAN fails across the uplink, others work	VLAN missing from vlan members on one end
Untagged or management traffic fails	Native VLAN missing or different on the two ends
A PC on a port shows tagged	Port set to interface-mode trunk by mistake

VLANs are locked floors. People on the Sales floor cannot walk into Engineering. When they need to talk, they go down to the reception desk, which knows every floor and passes messages between them. On a campus network the reception desk is a Layer 3 interface. On an EX switch, that interface is called IRB: Integrated Routing and Bridging. It lives inside the switch, belongs to a VLAN, and acts as the default gateway for the hosts in that VLAN.

Why do we need it?

Two hosts in different VLANs are in different broadcast domains. The switch will never bridge a frame from VLAN 10 into VLAN 20. To connect them, a device must route at Layer 3: receive the frame in VLAN 10, look at the destination IP, and send a new frame into VLAN 20. A separate router connected with one trunk works, but a Layer 3 switch does it internally with IRB and is cheaper and faster.

Building it (Lab 2)

You create one irb logical unit per VLAN, give it an IP address, and tie it to the VLAN with l3-interface:

set interfaces irb unit 10 family inet address 10.10.10.1/24
set interfaces irb unit 20 family inet address 10.10.20.1/24
set vlans SALES l3-interface irb.10
set vlans ENG l3-interface irb.20

Tip: use the VLAN ID as the unit number. It makes irb.10 obviously the gateway of VLAN 10. After commit, verify:

lab@CORE> show interfaces terse irb
Interface               Admin Link Proto    Local                 Remote
irb                     up    up
irb.10                  up    up   inet     10.10.10.1/24
irb.20                  up    up   inet     10.10.20.1/24

lab@CORE> show vlans
Routing instance        VLAN name             Tag          Interfaces
default-switch          ENG                   20
                                                           ge-0/0/0.0*
                                                           (l3-interface irb.20)
default-switch          SALES                 10
                                                           ge-0/0/0.0*
                                                           (l3-interface irb.10)

lab@CORE> show route
inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)
10.10.10.0/24      *[Direct/0] 00:00:00
                    >  via irb.10
10.10.10.1/32      *[Local/0] 00:00:00
                       Local via irb.10
10.10.20.0/24      *[Direct/0] 00:00:00
                    >  via irb.20
10.10.20.1/32      *[Local/0] 00:00:00
                       Local via irb.20

Notice the two kinds of routes created per IRB address: a Direct route for the subnet and a Local /32 route for the gateway address itself. Now the end-to-end test from PC1 (10.10.10.11, gateway 10.10.10.1):

PC1> ping 10.10.20.12
84 bytes from 10.10.20.12 icmp_seq=1 ttl=63 time=0.500 ms
84 bytes from 10.10.20.12 icmp_seq=2 ttl=63 time=0.600 ms

PC2 sent the reply with TTL 64 and one router (CORE) decremented it, so PC1 sees 63. A TTL one lower than the sender's initial value is the signature of a single routed hop. A frame that was only switched keeps TTL 64.

So far you built VLANs one port at a time. Real campuses have hundreds of ports, and an engineer who types every line by hand will eventually make a mistake. This chapter shows how professionals keep Layer 2 designs tidy, and introduces the extra Layer 2 features the JNCIS-ENT blueprint mentions: voice VLANs, Q-in-Q tunnelling and MAC address handling. You will not configure them in the labs, but you must recognise them.

A sensible VLAN plan

Write the plan down before you type. A common pattern is one VLAN per function per building, with the VLAN ID and the third octet of the subnet kept the same, so that VLAN 30 is 10.30.0.0/24 and its gateway is irb.30 at 10.30.0.1. Lab 3 follows this: STAFF is VLAN 30 with 10.30.0.1/24, PRINT is VLAN 40 with 10.40.0.1/24 and MGMT is VLAN 99 with 10.99.0.1/24.

VLAN	Name	Subnet	Gateway (IRB)
30	STAFF	10.30.0.0/24	irb.30 = 10.30.0.1
40	PRINT	10.40.0.0/24	irb.40 = 10.40.0.1
99	MGMT	10.99.0.0/24	irb.99 = 10.99.0.1

Keep the user-facing VLANs separate from management. Management traffic (SSH, SNMP) belongs in its own VLAN, which is also a good candidate for the trunk's native VLAN so that device-to-device control traffic stays untagged and isolated from users.

Interface ranges and descriptions

An interface range lets you configure many ports once. Put the shared lines under the range and the range expands to each port at commit time:

set interfaces interface-range USERS member-range ge-0/0/1 to ge-0/0/20
set interfaces interface-range USERS unit 0 family ethernet-switching interface-mode access vlan members STAFF
set interfaces ge-0/0/0 description "uplink to CORE ge-0/0/0"
set vlans STAFF description "Staff laptops, building A"

Descriptions cost nothing and save hours during a fault. Read them with show interfaces descriptions. Remember that a setting directly on one port overrides the range, so exceptions are easy.

Extra Layer 2 features to recognise

Voice VLAN

An IP phone and a PC share one wall port. The port carries the PC untagged in the data VLAN and the phone tagged in a voice VLAN, so voice can be given priority. Junos learns the voice VLAN for a port from the switch-options voip configuration, often together with LLDP-MED.

Q-in-Q (802.1ad)

A service provider or an enterprise wraps customer frames in a second, outer tag so many customer VLANs travel through the network unchanged. On Junos this is enabled with dot1q-tunneling on a VLAN.

MAC limiting and static MACs

A port can be limited to a number of learned addresses, or a MAC can be pinned to a port. These are security tools and the Layer 2 security module covers them.

Storm control, port mirroring, LLDP

Protection against broadcast storms, copying traffic for analysis, and neighbour discovery. All are standard enterprise switch features.

A doctor does not guess. She measures temperature, pulse and pressure, and each number answers one question. A network engineer does the same with show commands. In this chapter you learn which command answers which question, and how to read the columns, so that in the next chapter you can find a fault in minutes instead of hours.

One question, one command

Question	Command
Is the cable and port up?	show interfaces terse
Which VLANs exist and which ports are in them?	show vlans
What mode and which VLANs does one port carry?	show ethernet-switching interface ge-0/0/0 detail
Which MAC was learned where?	show ethernet-switching table
Is the gateway up and is the subnet routed?	show interfaces terse irb, show route
Can I reach the neighbour end to end?	ping, traceroute
What did someone change?	show system commit, show configuration, show | compare rollback 1

Step 1: the physical layer

lab@ACC> show interfaces terse
Interface               Admin Link Proto    Local                 Remote
ge-0/0/0                up    up
ge-0/0/0.0              up    up   eth-switch
ge-0/0/1                up    up
ge-0/0/1.0              up    up   eth-switch
ge-0/0/3                up    down

Admin is what the configuration says, Link is what the cable says. up down means the port is enabled but nothing is connected or the other side is down. The Proto eth-switch on unit 0 proves that family ethernet-switching is configured. A physical port with no unit 0 line does not switch.

Steps 2 and 3: switching family and VLAN membership

lab@ACC> show ethernet-switching interface
Logical         Vlan      TAG    MAC     MAC+IP  STP         Logical     Tagging
interface       members          limit   limit   state       interface flags
ge-0/0/1.0                       294912  294912                          untagged
                STAFF     30     294912  294912  Forwarding              untagged
ge-0/0/2.0                       294912  294912                          tagged
                STAFF     30     294912  294912  Forwarding              tagged

This is the single most useful switching table. For each port it shows the VLAN, the tag, the spanning-tree state and whether frames are tagged or untagged. Here ge-0/0/2 is tagged, which is correct for a trunk but wrong for a PC. It is a real excerpt of the Lab 3 fault captured from the simulator.

Use the detail form for one port when you need the mode and native VLAN. The line Interface mode : trunk, native VLAN STAFF (30) tells you the role and the native VLAN in one go.

Step 4: the MAC table as a proof

lab@ACC> show ethernet-switching table
Ethernet switching table : 2 entries, 2 learned
Routing instance : default-switch
   Vlan   MAC                 MAC    Age    Logical
   name   address             flags         interface
   SALES  00:50:7f:06:6d:01   D      -      ge-0/0/1.0
   ENG    00:50:80:06:6e:01   D      -      ge-0/0/2.0

If a host's MAC appears in the right VLAN on the right port, Layer 2 is fine up to that point. If the MAC is missing, the frames are not reaching the switch (cable, port, VLAN mismatch, or the host is silent). If it appears in the wrong VLAN, the port membership or the native VLAN is wrong.

Step 5: Layer 3

Check show interfaces terse irb and show route from the previous chapter. Then ping from the host to its gateway first, and only then to remote subnets. A host that reaches its gateway but not another VLAN points at routing, not at switching.

Change history

When something worked yesterday, ask what changed. show system commit lists commits with user and time; show | compare rollback 1 in configuration mode shows the difference between the active configuration and the previous one.

This chapter walks through Lab 3, the Hyderabad ticket, step by step, exactly the way you should work in the simulator and in a real network. The ticket reads: "After the weekend change, staff users on ACC cannot reach their gateway, the printer VLAN is dead and CORE cannot manage ACC over the untagged management VLAN." Three symptoms, probably more than one cause.

The design (what should be true)

• Trunk ge-0/0/0 between CORE and ACC carries STAFF (30), PRINT (40) and MGMT (99).
• MGMT is the native VLAN on both ends. CORE routes with irb.30, irb.40 and irb.99 (gateways 10.30.0.1, 10.40.0.1, 10.99.0.1). ACC manages itself on irb.99 = 10.99.0.2.
• User ports are access ports: ge-0/0/1 and ge-0/0/2 are STAFF (PC1, PC2); ge-0/0/3 is PRINT (the printer PRN1).

Step 1: inspect the trunk on ACC

Start with the shared link, because it carries everything. Real output from the faulty ACC:

lab@ACC> show ethernet-switching interface ge-0/0/0 detail
Logical Interface          : ge-0/0/0.0
  State                    : up
  Interface mode           : trunk, native VLAN STAFF (30)
  VLAN membership          :
    STAFF                 30    untagged  Forwarding

Two faults at once. The native VLAN is STAFF instead of MGMT, and only STAFF is in the member list: PRINT and MGMT are not carried at all. Confirm with the configuration:

lab@ACC> show configuration interfaces ge-0/0/0
native-vlan-id STAFF;
unit 0 {
    family ethernet-switching {
        interface-mode trunk;
        vlan {
            members STAFF;
        }
    }
}

Step 2: look at the user ports

lab@ACC> show ethernet-switching interface
ge-0/0/2.0                       294912  294912                          tagged
                STAFF                    30      294912  294912  Forwarding                    tagged
ge-0/0/3.0                       294912  294912                          untagged
                PRINT                    40      294912  294912  Forwarding                    untagged

ge-0/0/1 (PC1) is fine, untagged in STAFF. But ge-0/0/2 (PC2) is a trunk with tagged STAFF. PC2 sends untagged frames and the port has no native VLAN, so they are dropped. The printer port ge-0/0/3 is correct, so its failure comes from the uplink: PRINT is missing from the trunk members.

Step 3: confirm symptoms before fixing

lab@CORE> ping 10.99.0.2 count 3
3 packets transmitted, 0 packets received, 100% packet loss

PRN1> ping 10.40.0.1
host (10.40.0.1) not reachable

Both match the diagnosis. It is good habit to record the failing tests so that you can repeat exactly the same test after the fix.

Step 4: fix all three faults in one commit

configure
set interfaces ge-0/0/0 native-vlan-id MGMT
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members PRINT
set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access
show | compare
commit and-quit

lab@ACC# show | compare
[edit interfaces ge-0/0/0]
-   native-vlan-id STAFF;
+   native-vlan-id MGMT;
[edit interfaces ge-0/0/0 unit 0 family ethernet-switching vlan]
-   members STAFF;
+   members [ STAFF PRINT ];
[edit interfaces ge-0/0/2 unit 0 family ethernet-switching]
-   interface-mode trunk;
+   interface-mode access;

Note that the trunk's member list never contained MGMT. Junos accepts a native VLAN that is not listed in the members and still carries its untagged traffic; the verification output below shows MGMT as untagged. Read the show | compare output carefully: it is a three-line proof that you changed only what you meant to change.

Step 5: verify

lab@CORE> ping 10.99.0.2 count 3
3 packets transmitted, 3 packets received, 0% packet loss

PC1> ping 10.40.0.50
84 bytes from 10.40.0.50 icmp_seq=1 ttl=63 time=0.500 ms

lab@ACC> show ethernet-switching interface ge-0/0/0 detail
  Interface mode           : trunk, native VLAN MGMT (99)
  VLAN membership          :
    STAFF                 30    tagged    Forwarding
    PRINT                 40    tagged    Forwarding
    MGMT                  99    untagged  Forwarding

The end-to-end test, PC1 printing to PRN1 across two VLANs, works with TTL 63: one routed hop through CORE.

You started with a clerk who remembers which corridor each desk is on, and ended with a campus where VLANs are floors, trunks are lift shafts and IRB is the reception desk. This chapter pulls everything into one page you can revise the night before the exam or an interview.

Can-do checklist

• I can explain learn, forward, flood and filter and read show ethernet-switching table.
• I can create VLANs with set vlans NAME vlan-id N and attach access ports on ELS.
• I can build a trunk with interface-mode trunk vlan members [ ... ] and set the native VLAN on the physical interface.
• I can create IRB units, bind them with l3-interface and explain the Direct and Local routes and the TTL drop.
• I can use interface ranges and descriptions on a larger switch.
• I can find a trunk, native VLAN or port-mode fault bottom up, fix it and prove it.

Mini glossary

Broadcast domain

The set of ports that receive a broadcast; one per VLAN.

Access port

One VLAN, untagged frames, for an end device.

Trunk port

Many VLANs, tagged frames, between switches.

802.1Q

The standard that adds a 4-byte tag with a 12-bit VLAN ID.

Native VLAN

VLAN for untagged frames on a trunk; none by default on Junos.

IRB

Integrated routing and bridging: the Layer 3 interface of a VLAN (irb.N).

ELS

Enhanced Layer 2 Software, the current EX configuration style.

MAC move

The same source MAC appears on a different port; the entry is updated.

Most tested facts

Fact	Value
Valid VLAN IDs	1 to 4094 (12 bits)
Default VLAN	default, ID 1
MAC age-out default	300 seconds
Tag size	4 bytes, TPID 0x8100
Default native VLAN on a Junos trunk	None; untagged frames are dropped
Where native-vlan-id goes	Physical interface, not unit 0
IRB binding	set vlans NAME l3-interface irb.N
Routed TTL	Decreases by one per Layer 3 hop

Command cheat-sheet

show interfaces terse
show vlans
show ethernet-switching table
show ethernet-switching interface ge-0/0/0 detail
show interfaces terse irb
show route
show system commit
clear ethernet-switching table