Network Security Design
What the exam tests
Network Security Design tests zoning, policy enforcement, segmentation, firewall placement, IPsec, NAT, IPS/UTM, and high availability on Juniper SRX.
Core rules
- Segment by trust level and function: untrust, DMZ, trust, management; default deny between zones.
- Apply least-privilege policies with explicit applications, source/destination addresses, and logging.
- Place firewalls at policy boundaries, including east-west between application tiers, not only at the internet edge.
- Use stateful inspection; return traffic is allowed by session state, not a broad reverse policy.
- Design HA with chassis cluster, redundant reth interfaces, and monitored links.
Worked example
A public web app has an internet-facing web server, an application server, and a database. On an SRX chassis cluster, create zones untrust, dmz, and trust. Destination NAT maps public 203.0.113.10:443 to the web server’s DMZ address 10.10.10.10. Policy 1 allows untrust→dmz HTTPS to 10.10.10.10, the post-NAT destination. Policy 2 allows dmz→trust TCP 8443 from the web server IP to the app server IP. Policy 3 allows trust app→db TCP 5432 from the app IP to the db IP. Default deny follows. Log denies and session closes. The reasoning is that each tier has a narrow permit and the database is never directly reachable from the internet.
Traps
Any-any rules; wrong policy order; forgetting host-inbound services on interfaces; NAT and policy-order confusion; and inspecting only north-south traffic while east-west lateral movement is unrestricted.