JNCIA-SEC key terms

A logical grouping of one or more interfaces that share the same security policy and trust level. Traffic entering or leaving an interface is evaluated against the zone it belongs to rather than the physical port.

A numeric setting (0-300 on Junos) that ranks how much a zone is trusted. When two zones have different levels, the higher-level zone may initiate sessions toward the lower-level zone by default, while the reverse is denied.

Traffic destined to the device itself, such as SSH, HTTPS, or IKE, rather than traffic transiting the firewall. Junos controls it per zone with host-inbound-traffic system-services and protocols statements.

The tree-structured configuration model where settings are nested under named stanzas such as security zones and set with commands like set security zones security-zone trust. Understanding the hierarchy is essential for reading and editing SRX configuration.

The Junos command that validates the candidate configuration and applies it to the running system. A commit check validates syntax without applying, and commit confirmed reverts automatically unless confirmed again.

The editable working copy of the Junos configuration that changes are written to before commit. The running configuration stays unchanged until the candidate is committed.

A logical interface (lo0) that is always up and is commonly used for management access, router IDs, and VPN termination. It is reachable regardless of which physical link is active.

An ordered rule that matches traffic by zone pair, source and destination address, application, and user, then applies an action such as permit, deny, or reject. The first matching policy is applied.

The disposition applied when traffic matches a security policy. Common actions are permit, deny (silent drop), and reject (drop with a TCP reset or ICMP unreachable), plus tunnel actions for VPN traffic.

The combination of a from-zone and a to-zone that a security policy applies to. Policies are evaluated only for traffic flowing between the two specified zones in that direction.

The default behavior that drops any traffic not matched by an explicit policy. Administrators must create a permit policy for desired traffic, because no traffic is allowed between zones unless a policy permits it.

The sequence in which security policies are evaluated, top to bottom, with the first match winning. Placing a broad deny above a specific permit blocks the intended traffic, so order matters greatly.

Identifying traffic by application (such as junos-http or a custom application) rather than only by port. SRX uses predefined and custom applications in policies to allow or block specific protocols.

Translation that rewrites the source address of outbound traffic, typically to the egress interface address, so internal hosts can reach the internet. Also called NAT with interface or pool translation.

Translation that rewrites the destination address of inbound traffic, commonly used to publish an internal server on a public address and port. It is evaluated before security policy lookup.

A named, ordered collection of NAT rules that are evaluated from top to bottom. Rule sets are bound to a from-zone and to-zone, and the first matching rule is applied to the packet.

A one-to-one, bidirectional mapping between an internal address and an external address. It lets outside hosts initiate connections to the mapped address and is often used for servers.

A feature where the firewall answers ARP requests for addresses it does not own, so upstream devices send traffic to the firewall for translation. It is commonly enabled with destination or static NAT.

The IKE negotiation that authenticates peers and establishes a secure management channel, producing an IKE security association. It defines encryption, hashing, DH group, and authentication method.

The negotiation that creates the IPsec security associations used to protect actual data traffic. It defines the protocol (ESP or AH), encryption and hash algorithms, and the proxy IDs or traffic selectors.

The Junos configuration object that defines the remote peer address, local address, authentication method, and phase 1 proposals. It is referenced by the VPN configuration to establish the tunnel.

A secret string configured identically on both IPsec peers to authenticate phase 1. It must match exactly, and mismatches are a leading cause of failed tunnel establishment.

The local and remote subnet pair (proxy ID) that defines which traffic is encrypted into an IPsec tunnel. Both peers must agree, or phase 2 negotiation fails.

The set of negotiated parameters, including keys and algorithms, that protect a VPN connection in one direction. IPsec uses pairs of SAs, one inbound and one outbound.

A Junos configuration object that binds an IKE gateway, an IPsec policy, and a bind interface to define a tunnel. Policies then reference the tunnel to direct traffic into it.

A logical interface (st0) that carries traffic into and out of an IPsec tunnel. It is placed in a security zone so normal policy and NAT rules apply to tunneled traffic.

A keepalive mechanism that probes the remote IPsec peer and tears down SAs when the peer stops responding. It helps failover and prevents traffic from being black-holed.

The Junos suite of application-aware security features that identifies applications regardless of port, enabling application-based policy, risk controls, and user-role awareness.

A pattern definition that identifies a specific application's traffic by inspecting payloads and protocol behavior. Signatures let the firewall recognize applications that use dynamic or nonstandard ports.

An AppSecure feature that enforces rules on identified applications, allowing, denying, or rate-limiting them and applying actions such as redirect or logging based on application identity.

A signature-based engine that inspects traffic for known attack patterns and can drop or alert on malicious packets. On SRX it is configured as an IPS policy attached to a security policy.

The set of attack detection signatures the IPS engine uses, updated through license and download. Out-of-date signatures reduce detection coverage for new threats.

A bundle of content-security features on the firewall, typically antivirus, antispam, web filtering, and content filtering, applied together through a UTM policy attached to a security policy.

A named Junos object that groups the UTM profiles (antivirus, web filtering, content filtering, antispam) to be applied. It is referenced in a security policy's then statement.

A UTM feature that categorizes and blocks or allows web requests based on URL category or reputation. It requires a licensed category database to classify sites.

The stateful table that tracks active flows, including addresses, ports, state, and policy action. Forward and reverse packets are matched to the same session, enabling stateful inspection.

The current phase of a tracked flow, such as init, established, or closing. Viewing session state helps confirm whether traffic passed policy and whether return traffic was permitted.

A troubleshooting option that logs the internal processing path a packet takes, showing which policy, NAT rule, or screen check matched. It is enabled per flow and viewed in the trace log.

A troubleshooting tool that records packets on an interface or firewall, often matching a filter, for later analysis. On SRX it is configured with capture statements and viewed with file commands.

The standard logging protocol SRX uses to send event messages to a collector. Logging is configured with host, facility, and severity settings, and security events can be streamed to a log server.

A record generated for session events such as permits, denies, and policy matches, tagged with a session ID. Logs are enabled per policy with the then log or session-init options.