Data Center Security and Network Services
Domain 4 - Data Center Security and Network Services
This domain tests segmentation, policy enforcement, control-plane protection, and service insertion in the data center. Juniper questions often focus on stateless firewall filters, policers, security zones, and tenant isolation in EVPN fabrics.
Core rules
- Stateless filters are ordered terms with an implicit discard at the end; always include an explicit accept or count for traffic you need.
- Protect the control plane on lo0: accept BGP, SSH, and ICMP from management or peer prefixes; discard everything else; apply the filter to lo0, not to a physical interface.
- Use policers for DDoS and exception traffic; classify with DSCP and CoS and protect critical control traffic.
- Segment tenants with VLANs or VNIs, VRFs, and EVPN route targets. Anycast gateway gives a consistent first hop but does not replace policy.
- For stateful services, insert an SRX or firewall service chain; stateful inspection changes forwarding symmetry requirements.
Worked example
A leaf must accept BGP from spine loopbacks 10.0.0.0/29 and SSH from 10.10.10.0/24, and drop the rest. Filter term 1: from source-address 10.0.0.0/29 protocol tcp destination-port bgp, accept. Term 2: from 10.10.10.0/24 protocol tcp destination-port ssh, accept. Term 3: protocol icmp, accept with a policer. Term 4: discard with count. Apply input on lo0. The common error is applying the filter to xe-0/0/0 and then wondering why transit BGP still works.
Traps
- Implicit discard confusion.
- Filtering BGP but forgetting return traffic or ICMP.
- Applying a control-plane filter to a data interface.
- Allowing any-to-any in the management VRF.
- Assuming EVPN segmentation alone provides firewall policy.