JNCIA-SEC cheat sheet

SRX traffic processing order: ingress zone/policy screen options → destination NAT (DNAT) → routing decision → security policy evaluation → source NAT (SNAT) → session creation → egress. Policy lookup uses post-DNAT destination and pre-SNAT source.

Junos commit model: candidate configuration is edited, then 'commit check' validates syntax, 'commit' activates. 'commit confirmed ' auto-rolls back unless confirmed with 'commit', protecting remote sessions.

SRX device families: branch SRX (300/320/340/345/380/550) run Junos with a single routing engine; high-end SRX (1500/4000/5000) use separate Routing Engine and Packet Forwarding Engine with dual REs for redundancy.

Flow vs. packet mode: SRX is stateful by default (flow-based, session table); 'set security forwarding-options family mpls mode packet-based' disables stateful inspection for MPLS/L2 protocols.

Zones are logical groupings of interfaces. A security zone must contain at least one interface; interfaces not bound to a zone cannot carry transit traffic. 'junos-host' zone governs traffic destined to the device itself.

Session table entry key: source address/port, destination address/port, protocol, and VR. 'show security flow session' displays state (I for initiator, F for forward), timeout, and policy name.

Screen options protect the device from reconnaissance and floods (syn-flood, ping-of-death, land, teardrop, ip-sweep, port-scan) and are applied per zone under 'security screen'.

Factory default config: ge-0/0/0 in trust zone with /24 address, all other interfaces in untrust; a default permit-all policy from trust to untrust exists. root login has no password until configured.

Policy evaluation is top-down, first-match. Order matters: a permit-all rule placed above a deny rule makes the deny unreachable. 'insert' vs 'before/after' controls placement.

Default policy behavior: traffic not matching any policy is denied, and interzone traffic is logged only if a policy with 'then log' matches or a global 'log' is enabled. Intrazone traffic is permitted by default unless a policy overrides.

Policy components: from-zone, to-zone, source-address, destination-address, application, and action (permit/deny/reject). 'reject' sends a TCP RST or ICMP unreachable; 'deny' silently drops.

Application objects: predefined (junos-http, junos-ssh) and custom. Custom TCP/UDP applications define destination port ranges; 'junos-icmp-all' covers all ICMP types.

NAT types: source NAT (SNAT) hides internal addresses, destination NAT (DNAT) publishes internal servers, and static NAT provides one-to-one bidirectional mapping. NAT is configured under 'security nat'.

NAT rule ordering: source NAT rules match on from/to zone and source address; destination NAT rules match on destination address and port. First matching rule wins.

Proxy ARP: when DNAT publishes a server on an external address, 'set security nat proxy-arp interface address ' makes the SRX answer ARP for that address.

Address books: global address book (set security address-book global) is shared across zones; zone address books are scoped to a zone. Policies can reference either.

IPsec phases: IKE Phase 1 builds a secure channel (ISAKMP SA) using pre-shared keys or certificates; Phase 2 negotiates IPsec SAs (ESP) for data protection.

IKEv1 main mode uses six messages and hides identities; aggressive mode uses three but exposes the peer ID. IKEv2 reduces to four messages and supports MOBIKE and traffic selectors.

Proposal and policy components: encryption (aes-256-gcm, aes-256-cbc), authentication (sha-256), DH group (14/19/20), and lifetime. Phase 1 and Phase 2 proposals must match on both peers.

Route-based VPN uses a st0 tunnel interface bound to the IPsec VPN; the tunnel interface is placed in a zone and referenced by policies. Policy-based VPN binds the tunnel directly to a security policy.

Traffic selectors: IKEv2 uses local/remote traffic selectors; mismatched selectors are a common cause of Phase 2 failure. Verify with 'show security ike sa' and 'show security ipsec sa'.

NAT-T (NAT traversal) encapsulates ESP in UDP port 4500 when NAT is detected. Port 500 carries IKE; port 4500 carries IKE and ESP-in-UDP.

Dead peer detection (DPD) detects failed peers; configure 'set security ike gateway dead-peer-detection interval threshold '.

Troubleshooting commands: 'show security ike security-associations detail', 'show security ipsec security-associations detail', 'clear security ike security-associations', and 'traceoptions' under 'security ike'.

AppSecure components: AppTrack (traffic visibility and logging), AppFW (application firewall), AppQoS (bandwidth prioritization), and APBR (application-based policy routing). Requires application identification.

Application identification uses signature-based and heuristic detection; 'set services application-identification' enables it. Unknown applications are classified as 'junos-unknown-application'.

AppFW policy: 'set security application-firewall rule-set rule match applications then permit/deny'. Rules are evaluated after security policy permit.

IPS inspects traffic for exploits and protocol anomalies. Signature sets are updated via 'request security idp security-package download' and installed with 'request security idp security-package install'.

IPS policy modes: 'terminal' (drop matching traffic), 'inspect' (log only), and 'session' (reset session). Applied to a security policy with 'set security policies ... then permit application-services idp'.

UTM suite: antivirus (AV), antispam, web filtering (URL categorization), and content filtering. Each is configured as a UTM profile and bound to a security policy.

Antivirus scanning modes: 'sophos' engine scans files and protocols (HTTP, FTP, SMTP, IMAP, POP3); 'kaspersky' engine is available on select platforms. Scan size limits and fallback options control large files.

Content filtering inspects MIME types, file extensions, and protocol commands. Web filtering uses URL categories from a licensed database; local lists can supplement it.

Logging destinations: 'set system syslog host any any' for syslog, 'set security log mode stream' for structured session logs, and 'set security log source-interface' for the log source.

Session logging requires 'then log session-init session-close' on the policy or a global 'set security policies ... then log'. 'show security log' displays buffered entries.

Traceoptions: 'set security flow traceoptions file ' plus 'flag basic-datapath' captures flow processing. 'show log ' reads the trace file.

Monitoring commands: 'show security flow session summary', 'show security flow session', 'show security policies hit-count', 'show security zones', and 'show security nat source summary'.

Packet capture on SRX: 'set security flow traceoptions packet-filter match ' or 'monitor traffic interface ' for live capture. Use 'tcpdump' style filters with 'monitor traffic'.

'show security monitoring' and 'show security statistics' display performance counters; 'show chassis alarms' and 'show chassis fpc' identify hardware issues.

Common failure checks: policy denies (verify hit-count), routing (show route), NAT (show security nat), zones (interface bound?), and screen drops (show security screen statistics).

Configuration rollback: 'rollback 1' reverts to the previous committed config; 'show system commit' lists commit history. 'commit full' rebuilds the entire configuration tree.

SRX traffic processing order: ingress zone/policy screen options → destination NAT (DNAT) → routing decision → security policy evaluation → source NAT (SNAT) → session creation → egress. Policy lookup uses post-DNAT destination and pre-SNAT source.

Junos commit model: candidate configuration is edited, then 'commit check' validates syntax, 'commit' activates. 'commit confirmed ' auto-rolls back unless confirmed with 'commit', protecting remote sessions.

SRX device families: branch SRX (300/320/340/345/380/550) run Junos with a single routing engine; high-end SRX (1500/4000/5000) use separate Routing Engine and Packet Forwarding Engine with dual REs for redundancy.

Flow vs. packet mode: SRX is stateful by default (flow-based, session table); 'set security forwarding-options family mpls mode packet-based' disables stateful inspection for MPLS/L2 protocols.

Zones are logical groupings of interfaces. A security zone must contain at least one interface; interfaces not bound to a zone cannot carry transit traffic. 'junos-host' zone governs traffic destined to the device itself.

Session table entry key: source address/port, destination address/port, protocol, and VR. 'show security flow session' displays state (I for initiator, F for forward), timeout, and policy name.

Screen options protect the device from reconnaissance and floods (syn-flood, ping-of-death, land, teardrop, ip-sweep, port-scan) and are applied per zone under 'security screen'.

Factory default config: ge-0/0/0 in trust zone with /24 address, all other interfaces in untrust; a default permit-all policy from trust to untrust exists. root login has no password until configured.

Policy evaluation is top-down, first-match. Order matters: a permit-all rule placed above a deny rule makes the deny unreachable. 'insert' vs 'before/after' controls placement.

Default policy behavior: traffic not matching any policy is denied, and interzone traffic is logged only if a policy with 'then log' matches or a global 'log' is enabled. Intrazone traffic is permitted by default unless a policy overrides.

Policy components: from-zone, to-zone, source-address, destination-address, application, and action (permit/deny/reject). 'reject' sends a TCP RST or ICMP unreachable; 'deny' silently drops.

Application objects: predefined (junos-http, junos-ssh) and custom. Custom TCP/UDP applications define destination port ranges; 'junos-icmp-all' covers all ICMP types.

NAT types: source NAT (SNAT) hides internal addresses, destination NAT (DNAT) publishes internal servers, and static NAT provides one-to-one bidirectional mapping. NAT is configured under 'security nat'.

NAT rule ordering: source NAT rules match on from/to zone and source address; destination NAT rules match on destination address and port. First matching rule wins.

Proxy ARP: when DNAT publishes a server on an external address, 'set security nat proxy-arp interface address ' makes the SRX answer ARP for that address.

Address books: global address book (set security address-book global) is shared across zones; zone address books are scoped to a zone. Policies can reference either.

IPsec phases: IKE Phase 1 builds a secure channel (ISAKMP SA) using pre-shared keys or certificates; Phase 2 negotiates IPsec SAs (ESP) for data protection.

IKEv1 main mode uses six messages and hides identities; aggressive mode uses three but exposes the peer ID. IKEv2 reduces to four messages and supports MOBIKE and traffic selectors.

Proposal and policy components: encryption (aes-256-gcm, aes-256-cbc), authentication (sha-256), DH group (14/19/20), and lifetime. Phase 1 and Phase 2 proposals must match on both peers.

Route-based VPN uses a st0 tunnel interface bound to the IPsec VPN; the tunnel interface is placed in a zone and referenced by policies. Policy-based VPN binds the tunnel directly to a security policy.

Traffic selectors: IKEv2 uses local/remote traffic selectors; mismatched selectors are a common cause of Phase 2 failure. Verify with 'show security ike sa' and 'show security ipsec sa'.

NAT-T (NAT traversal) encapsulates ESP in UDP port 4500 when NAT is detected. Port 500 carries IKE; port 4500 carries IKE and ESP-in-UDP.

Dead peer detection (DPD) detects failed peers; configure 'set security ike gateway dead-peer-detection interval threshold '.

Troubleshooting commands: 'show security ike security-associations detail', 'show security ipsec security-associations detail', 'clear security ike security-associations', and 'traceoptions' under 'security ike'.

AppSecure components: AppTrack (traffic visibility and logging), AppFW (application firewall), AppQoS (bandwidth prioritization), and APBR (application-based policy routing). Requires application identification.

Application identification uses signature-based and heuristic detection; 'set services application-identification' enables it. Unknown applications are classified as 'junos-unknown-application'.

AppFW policy: 'set security application-firewall rule-set rule match applications then permit/deny'. Rules are evaluated after security policy permit.

IPS inspects traffic for exploits and protocol anomalies. Signature sets are updated via 'request security idp security-package download' and installed with 'request security idp security-package install'.

IPS policy modes: 'terminal' (drop matching traffic), 'inspect' (log only), and 'session' (reset session). Applied to a security policy with 'set security policies ... then permit application-services idp'.

UTM suite: antivirus (AV), antispam, web filtering (URL categorization), and content filtering. Each is configured as a UTM profile and bound to a security policy.

Antivirus scanning modes: 'sophos' engine scans files and protocols (HTTP, FTP, SMTP, IMAP, POP3); 'kaspersky' engine is available on select platforms. Scan size limits and fallback options control large files.

Content filtering inspects MIME types, file extensions, and protocol commands. Web filtering uses URL categories from a licensed database; local lists can supplement it.

Logging destinations: 'set system syslog host any any' for syslog, 'set security log mode stream' for structured session logs, and 'set security log source-interface' for the log source.

Session logging requires 'then log session-init session-close' on the policy or a global 'set security policies ... then log'. 'show security log' displays buffered entries.

Traceoptions: 'set security flow traceoptions file ' plus 'flag basic-datapath' captures flow processing. 'show log ' reads the trace file.

Monitoring commands: 'show security flow session summary', 'show security flow session', 'show security policies hit-count', 'show security zones', and 'show security nat source summary'.

Packet capture on SRX: 'set security flow traceoptions packet-filter match ' or 'monitor traffic interface ' for live capture. Use 'tcpdump' style filters with 'monitor traffic'.

'show security monitoring' and 'show security statistics' display performance counters; 'show chassis alarms' and 'show chassis fpc' identify hardware issues.

Common failure checks: policy denies (verify hit-count), routing (show route), NAT (show security nat), zones (interface bound?), and screen drops (show security screen statistics).

Configuration rollback: 'rollback 1' reverts to the previous committed config; 'show system commit' lists commit history. 'commit full' rebuilds the entire configuration tree.

SRX traffic processing order: ingress zone/policy screen options → destination NAT (DNAT) → routing decision → security policy evaluation → source NAT (SNAT) → session creation → egress. Policy lookup uses post-DNAT destination and pre-SNAT source.

Junos commit model: candidate configuration is edited, then 'commit check' validates syntax, 'commit' activates. 'commit confirmed ' auto-rolls back unless confirmed with 'commit', protecting remote sessions.

SRX device families: branch SRX (300/320/340/345/380/550) run Junos with a single routing engine; high-end SRX (1500/4000/5000) use separate Routing Engine and Packet Forwarding Engine with dual REs for redundancy.

Flow vs. packet mode: SRX is stateful by default (flow-based, session table); 'set security forwarding-options family mpls mode packet-based' disables stateful inspection for MPLS/L2 protocols.

Zones are logical groupings of interfaces. A security zone must contain at least one interface; interfaces not bound to a zone cannot carry transit traffic. 'junos-host' zone governs traffic destined to the device itself.

Session table entry key: source address/port, destination address/port, protocol, and VR. 'show security flow session' displays state (I for initiator, F for forward), timeout, and policy name.

Screen options protect the device from reconnaissance and floods (syn-flood, ping-of-death, land, teardrop, ip-sweep, port-scan) and are applied per zone under 'security screen'.

Factory default config: ge-0/0/0 in trust zone with /24 address, all other interfaces in untrust; a default permit-all policy from trust to untrust exists. root login has no password until configured.

Policy evaluation is top-down, first-match. Order matters: a permit-all rule placed above a deny rule makes the deny unreachable. 'insert' vs 'before/after' controls placement.

Default policy behavior: traffic not matching any policy is denied, and interzone traffic is logged only if a policy with 'then log' matches or a global 'log' is enabled. Intrazone traffic is permitted by default unless a policy overrides.

Policy components: from-zone, to-zone, source-address, destination-address, application, and action (permit/deny/reject). 'reject' sends a TCP RST or ICMP unreachable; 'deny' silently drops.

Application objects: predefined (junos-http, junos-ssh) and custom. Custom TCP/UDP applications define destination port ranges; 'junos-icmp-all' covers all ICMP types.

NAT types: source NAT (SNAT) hides internal addresses, destination NAT (DNAT) publishes internal servers, and static NAT provides one-to-one bidirectional mapping. NAT is configured under 'security nat'.

NAT rule ordering: source NAT rules match on from/to zone and source address; destination NAT rules match on destination address and port. First matching rule wins.

Proxy ARP: when DNAT publishes a server on an external address, 'set security nat proxy-arp interface address ' makes the SRX answer ARP for that address.

Address books: global address book (set security address-book global) is shared across zones; zone address books are scoped to a zone. Policies can reference either.

IPsec phases: IKE Phase 1 builds a secure channel (ISAKMP SA) using pre-shared keys or certificates; Phase 2 negotiates IPsec SAs (ESP) for data protection.

IKEv1 main mode uses six messages and hides identities; aggressive mode uses three but exposes the peer ID. IKEv2 reduces to four messages and supports MOBIKE and traffic selectors.

Proposal and policy components: encryption (aes-256-gcm, aes-256-cbc), authentication (sha-256), DH group (14/19/20), and lifetime. Phase 1 and Phase 2 proposals must match on both peers.

Route-based VPN uses a st0 tunnel interface bound to the IPsec VPN; the tunnel interface is placed in a zone and referenced by policies. Policy-based VPN binds the tunnel directly to a security policy.

Traffic selectors: IKEv2 uses local/remote traffic selectors; mismatched selectors are a common cause of Phase 2 failure. Verify with 'show security ike sa' and 'show security ipsec sa'.

NAT-T (NAT traversal) encapsulates ESP in UDP port 4500 when NAT is detected. Port 500 carries IKE; port 4500 carries IKE and ESP-in-UDP.

Dead peer detection (DPD) detects failed peers; configure 'set security ike gateway dead-peer-detection interval threshold '.

Troubleshooting commands: 'show security ike security-associations detail', 'show security ipsec security-associations detail', 'clear security ike security-associations', and 'traceoptions' under 'security ike'.

AppSecure components: AppTrack (traffic visibility and logging), AppFW (application firewall), AppQoS (bandwidth prioritization), and APBR (application-based policy routing). Requires application identification.

Application identification uses signature-based and heuristic detection; 'set services application-identification' enables it. Unknown applications are classified as 'junos-unknown-application'.

AppFW policy: 'set security application-firewall rule-set rule match applications then permit/deny'. Rules are evaluated after security policy permit.

IPS inspects traffic for exploits and protocol anomalies. Signature sets are updated via 'request security idp security-package download' and installed with 'request security idp security-package install'.

IPS policy modes: 'terminal' (drop matching traffic), 'inspect' (log only), and 'session' (reset session). Applied to a security policy with 'set security policies ... then permit application-services idp'.

UTM suite: antivirus (AV), antispam, web filtering (URL categorization), and content filtering. Each is configured as a UTM profile and bound to a security policy.

Antivirus scanning modes: 'sophos' engine scans files and protocols (HTTP, FTP, SMTP, IMAP, POP3); 'kaspersky' engine is available on select platforms. Scan size limits and fallback options control large files.

Content filtering inspects MIME types, file extensions, and protocol commands. Web filtering uses URL categories from a licensed database; local lists can supplement it.

Logging destinations: 'set system syslog host any any' for syslog, 'set security log mode stream' for structured session logs, and 'set security log source-interface' for the log source.

Session logging requires 'then log session-init session-close' on the policy or a global 'set security policies ... then log'. 'show security log' displays buffered entries.

Traceoptions: 'set security flow traceoptions file ' plus 'flag basic-datapath' captures flow processing. 'show log ' reads the trace file.

Monitoring commands: 'show security flow session summary', 'show security flow session', 'show security policies hit-count', 'show security zones', and 'show security nat source summary'.

Packet capture on SRX: 'set security flow traceoptions packet-filter match ' or 'monitor traffic interface ' for live capture. Use 'tcpdump' style filters with 'monitor traffic'.

'show security monitoring' and 'show security statistics' display performance counters; 'show chassis alarms' and 'show chassis fpc' identify hardware issues.

Common failure checks: policy denies (verify hit-count), routing (show route), NAT (show security nat), zones (interface bound?), and screen drops (show security screen statistics).

Configuration rollback: 'rollback 1' reverts to the previous committed config; 'show system commit' lists commit history. 'commit full' rebuilds the entire configuration tree.