Securing the Network
This domain examines security design for Juniper SRX Series and Junos OS: zones, policies, IPsec, NAT, segmentation, and secure management.
Core rules
- Default-deny between zones; permit only required applications and addresses.
- Use IKEv2, AES-GCM or AES-CBC with SHA-2, DH group 14+, and certificate or strong PSK authentication.
- Separate management into a dedicated VRF or out-of-band network; restrict Junos management protocols.
- Segment by function (PCI, guest, IoT, corporate) and enforce policy at SRX boundaries.
- Log at session close, use UTM where appropriate, and design HA so security survives a node failure.
Worked example
A branch has POS, guest Wi-Fi, and corporate VLANs. The requirement is PCI separation and encrypted transport to the DC. Design: SRX at branch with three zones-trust-POS, trust-corp, untrust-Internet; guest on a separate VLAN with only Internet NAT; POS zone gets an IPsec tunnel to DC with policy permitting only POS application ports; all else denied. Use IKEv2, AES-256-GCM, SHA-256, DH14, and a PKI certificate. Reason: least privilege and zone separation reduce PCI scope; IPsec protects data over Internet; NAT hides guest addresses.
Traps
- Any-any rules and overly broad address books.
- Forgetting return-path policy and NAT for overlay traffic.
- Weak IKE proposals or PSK reuse.
- No HA or no logging, leaving blind spots.