Security Operations, Logging and Troubleshooting
This domain tests the evidence you use to prove what a firewall did. Expect questions about log types, where logs go, and which display or debug command answers a symptom.
Core rules
- Log categories include traffic logs, threat logs from IPS and antivirus, system logs, and operation logs.
- Traffic logging must be enabled on the security policy; a permit without logging produces no traffic log.
- Syslog sends logs to eLog/LogCenter or a third-party collector; severity and time synchronization matter.
- Display commands show policy hit counts, sessions, NAT translations, and HRP state; debugging is targeted and time-limited.
- Packet capture on the gateway separates forwarding problems from policy problems.
Worked example
Users report HTTP timeouts and the policy shows no hits. Check the rule’s match dimensions and zone direction, then display the session table for the flow. Reasoning: no hit count means the packet never matched the rule, so the cause is a wrong zone, address object, service, or routing. The session table shows whether a session was created and translated.
Traps that cost marks
- Debugging all traffic in production.
- Forgetting that logging is enabled per rule.
- Checking logs before checking policy hit counts.
- Ignoring clock skew when correlating events.