JNCIA-SEC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Flow processing order

SRX evaluates ingress zone, screen options, destination NAT, routing, security policy, source NAT, then session creation and egress. Policy lookup uses the post-DNAT destination and pre-SNAT source address.

Commit confirmed

A Junos command that activates configuration but automatically rolls back after a set number of minutes unless the administrator issues a confirming commit. It protects remote management sessions from losing connectivity.

junos-host zone

A special security zone that governs traffic destined to the SRX device itself, such as SSH, HTTPS, and management traffic. Policies from or to junos-host control device access.

Session table key

Each SRX session is identified by source address and port, destination address and port, protocol, and virtual router. The session stores state, timeout, and the matching policy name.

Screen options

Per-zone attack protections that detect and drop reconnaissance and flood traffic, including SYN flood, ping of death, land attack, teardrop, IP sweep, and port scan. Configured under security screen.

Packet-based forwarding mode

An SRX mode that disables stateful flow inspection for specified protocol families, such as MPLS, so packets are forwarded without session creation. It is used when stateful processing is not required.

First-match policy evaluation

SRX security policies are evaluated top-down and the first matching policy determines the action. A broad permit rule placed above a deny rule makes the deny rule unreachable.

Deny versus reject action

A deny policy silently drops traffic with no response. A reject policy drops traffic and sends a TCP reset or ICMP unreachable message back to the source.

Source NAT

A NAT type that translates the source address of outbound traffic, typically hiding internal addresses behind a public address. Rules match on from-zone, to-zone, and source address.

Destination NAT

A NAT type that translates the destination address of inbound traffic to publish an internal server on a public address. Rules match on destination address and port, first match wins.

Proxy ARP for NAT

A configuration that makes the SRX answer ARP requests for a NAT address on an interface, so external hosts send traffic to the device for translation to the internal server.

Global address book

A shared address book configured under security address-book global that any zone or policy can reference. Zone address books are scoped to a single zone instead.

Intrazone default policy

Traffic between interfaces in the same zone is permitted by default on SRX. An explicit intrazone policy can override this behavior to deny or log specific traffic.

IKE Phase 1

The first IPsec negotiation phase that builds a secure ISAKMP SA using pre-shared keys or certificates. It establishes a protected channel for negotiating Phase 2 IPsec SAs.

IKEv2 versus IKEv1

IKEv2 negotiates in four messages and supports MOBIKE and traffic selectors. IKEv1 main mode uses six messages and hides identities; aggressive mode uses three messages but exposes peer identity.

Route-based VPN

A VPN design that binds an IPsec VPN to an st0 tunnel interface. The interface is placed in a zone and referenced by security policies, allowing dynamic routing over the tunnel.

NAT traversal ports

IKE uses UDP port 500. When NAT is detected, NAT-T encapsulates ESP and IKE in UDP port 4500 so the traffic passes through NAT devices.

Dead peer detection

A mechanism that probes an IPsec peer at a configured interval and threshold. If the peer stops responding, DPD tears down the associated SAs so traffic can be rerouted.

IPsec SA verification

Commands show security ike security-associations and show security ipsec security-associations display Phase 1 and Phase 2 state. The detail option shows proposals, lifetimes, and traffic selectors.

Traffic selector mismatch

A Phase 2 failure caused when local and remote traffic selectors do not align between peers. IKEv2 uses these selectors to decide which traffic enters the tunnel.

AppSecure components

The AppSecure suite includes AppTrack for visibility, AppFW for application firewall rules, AppQoS for bandwidth prioritization, and APBR for application-based policy routing. All require application identification.

Application identification

An SRX feature that classifies traffic by application using signatures and heuristics. Unrecognized traffic is labeled junos-unknown-application and can be handled by AppFW rules.

AppFW rule evaluation

Application firewall rules are evaluated after a security policy permits the traffic. Rules match on identified applications and can permit or deny specific applications within an allowed session.

IPS policy modes

IPS actions include terminal, which drops matching traffic; inspect, which only logs; and session, which resets the session. The IPS policy is bound to a security policy's application-services.

IPS signature update

Signature packages are downloaded with request security idp security-package download and installed with request security idp security-package install. The installed version is shown in show security idp status.

UTM profile binding

Antivirus, antispam, web filtering, and content filtering are configured as UTM profiles and bound to a security policy under then permit application-services utm-policy.

Antivirus scan protocols

The Sophos antivirus engine scans HTTP, FTP, SMTP, IMAP, and POP3 traffic. Scan size limits and fallback options determine how large files and unscannable content are handled.

Web filtering categories

A UTM feature that classifies URLs into categories using a licensed database. Local lists can supplement or override categories, and profiles define permit, block, or log actions.

Session logging

Policy logging records session-init and session-close events when then log is configured. Logs can be sent to a stream server or displayed locally with show security log.

Flow traceoptions

A troubleshooting feature configured under security flow traceoptions with flags such as basic-datapath. The trace file is read with show log and reveals packet processing decisions.

Policy hit count

The show security policies hit-count command displays how many times each policy matched traffic. A zero count on an expected policy indicates traffic is matching an earlier rule or being denied.

Monitor traffic command

A Junos command that captures live packets on an interface, similar to tcpdump. Filters can limit output by host, port, or protocol for targeted troubleshooting.