NSE 8 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Trust boundary

A line across which the required security policy changes. Zones are defined by trust boundary rather than physical location, so an exposed internal host belongs with other exposed assets.

Blast radius

The set of hosts reachable from a compromised segment. It equals the reachable set defined by policy, so many small zones with explicit allows shrink it.

Asymmetric routing

A flow whose forward and return packets traverse different firewalls. Stateful inspection fails because each device sees only one direction; fix by making the path symmetric or adding an exception.

Session capacity sizing

Estimate concurrent sessions as peak users times average flows per user, plus server connections, then add headroom for failover so a surviving HA member can absorb full load.

TLS forward proxy

Outbound decryption where the firewall presents an enterprise-CA certificate to clients and re-encrypts to servers. Requires clients to trust the enterprise CA.

Inbound TLS decryption

Decrypting server-side traffic requires the private key on the appliance. Certificate pinning on clients breaks this, so it is often limited to specific server pools.

Hub-and-spoke VPN

A topology where all sites tunnel to a central hub. Policy is centralized but hub bandwidth and one extra hop become bottlenecks as sites grow.

Full mesh VPN

Every site tunnels directly to every other site, giving n(n−1)/2 tunnels. Lowest latency but configuration and key management scale poorly.

Out-of-band management

A dedicated management segment reachable only from jump hosts, with no inbound path from user zones. Protects device administration even when a user zone is compromised.

Split-brain HA

Both HA members believe they are active because the heartbeat link failed. The design must fail closed, never open, when this occurs.

Policy evaluation order

Firewalls evaluate rules top-down and stop at the first match. Specific deny rules must sit above broad allow rules, with the implicit deny last.

NAT evaluation order

Destination NAT is applied before routing and before source NAT; source NAT is applied after the egress interface is chosen by the route lookup.

Virtual IP requirement

Inbound access via a VIP needs both the VIP object (address and port mapping) and a firewall policy permitting the translated traffic. One without the other silently fails.

Route precedence

Policy routes override static routes; static routes are chosen by administrative distance then metric; connected routes win over all dynamic and static entries.

Policy route pitfall

A policy route silently overrides a correct static route. When traffic exits an unexpected interface, check policy routes before examining the routing table.

Interface-mode IPsec

The tunnel is bound to a virtual interface and ordinary firewall policies control traffic through it. Preferred over policy-mode for complex routing and multiple subnets.

Policy-mode IPsec

The tunnel is bound directly to a firewall policy. Mixing policy mode and interface mode for the same peer causes phase 2 selector mismatches and failed tunnels.

Phase 1 parameters

IKE version, encryption, hash, DH group, pre-shared key, and peer ID must match on both ends. Any mismatch prevents the management tunnel from forming.

Phase 2 selectors

The local and remote subnet pairs negotiated for data. A phase 2 failure with phase 1 up almost always indicates mismatched or overlapping selectors.

Tunnel MTU clamping

IPsec adds overhead, so tunnel interfaces use reduced MTU, typically 1400 or lower, and TCP MSS is clamped to prevent fragmentation of large packets and routing hellos.

VDOM isolation

Virtual domains separate routing tables and policies per tenant or function. Traffic between VDOMs requires an inter-VDOM link plus an explicit firewall policy.

SD-WAN SLA probe

Probes measure latency, jitter, and loss per member link to steer applications. If no member meets the SLA, traffic follows the defined fallback, which must be explicit.

Config diff before change

Export and diff the running configuration against the last known-good backup before and after changes, so a regression can be identified quickly.

Layered isolation

Troubleshoot in order: link and ARP, then route selection, then policy match, then session and NAT state. Stop at the first failing layer.

No session created

If no session exists, the packet never matched a policy or the route lookup failed. Check policy match keys and the return route before deeper packet analysis.

Session without reply

A session exists but shows no return traffic. Causes include wrong NAT translation, a server default gateway pointing elsewhere, or an intermediate firewall on the return path.

Phase 1 up phase 2 down

The IKE tunnel formed but data selectors failed. Check for mismatched or overlapping local and remote subnets, or a duplicate phase 2 entry.

MTU symptom pattern

Small pings succeed while large transfers stall. Test with DF-set pings of decreasing size to find path MTU, then clamp TCP MSS on the tunnel.

Inbound works outbound fails

A classic NAT or gateway error: the server's default gateway does not point at the firewall, or source NAT is applied in only one direction.

Certificate chain validation

Clients must trust the root and receive the intermediate certificates. A missing intermediate causes failures that look like connectivity problems in logs.

Log correlation

Compare firewall traffic logs, event logs, and server logs by timestamp and source port. An allow followed by a reset means the server refused, not the firewall.

HA sync mismatch

One member behaves differently from its peer after a change. Check HA configuration synchronization status before diagnosing packet-level causes.