Security fundamentals and SRX platform basics
Security fundamentals and SRX platform basics
This domain checks that you understand what an SRX is doing before a firewall policy is even consulted: packet flow, zones, interface binding, and host-inbound services. The exam expects Junos-specific terminology, not generic firewall theory.
Core rules
- An SRX is a flow-based device. The first packet in a session takes the slow path, creates a session entry, and later packets use the fast path.
- Transit traffic is controlled by security policies between zones. Traffic destined to the device itself is controlled by host-inbound-traffic settings on the ingress interface zone.
- Every interface used for security processing must be assigned to a zone. The junos-host zone represents the device itself.
- Host-inbound system services include ssh, https, and ping; routing protocols such as OSPF and BGP are configured under host-inbound protocols.
- A policy that permits trust-to-untrust transit traffic does not automatically permit SSH or ping to the device.
Worked example
You place ge-0/0/0.0 in zone trust and want SSH and ping to the SRX from that subnet. Configure set security zones security-zone trust interfaces ge-0/0/0.0 and set security zones security-zone trust host-inbound-traffic system-services ssh plus ... system-services ping. If you stop there, transit policies still do not apply to device-bound traffic; the host-inbound entries are what make the device answer. If SSH fails, check the zone binding, the interface unit, and the host-inbound list before looking at policies.
Traps
Do not confuse a zone policy with host-inbound services. Do not forget the logical unit (.0) when binding an interface. Do not assume a default permit for management access; the default behavior is to drop unsolicited host-bound traffic.