Firewall Fundamentals and Policy Design (USG series)
This domain tests USG zone/interface configuration and the logic of security policy matching. Questions often give a requirement and ask for the minimal correct rule set or why a rule is never hit.
Core rules
- An interface must be assigned to a zone before policy can reference it.
- Security policy rules are evaluated top-down and the first match wins; the default action between zones is deny.
- Match dimensions include source and destination zone, address, service, application, user, and time.
- ASPF is needed for multi-channel protocols such as FTP, SIP, and H.323 so return channels open dynamically.
- Content security profiles are invoked from a permitting rule, not from a separate deny rule.
Worked example
Requirement: permit only 10.1.1.0/24 in Trust to reach 192.168.10.10:80 in the DMZ, and deny other Trust-to-DMZ traffic. Rule 1: Trust to DMZ, source 10.1.1.0/24, destination 192.168.10.10, service HTTP, action permit. Rule 2: Trust to DMZ, any, deny. The specific permit must precede the broad deny; reversing them blocks everything. If FTP is later required, enable ASPF on the permit rule so the data channel is opened.
Traps that cost marks
- Placing a broad permit above a specific deny.
- Expecting a service of “any” to match without the correct application or port.
- Assuming ASPF is automatic for every protocol.
- Treating NAT as part of the security policy decision.