JNCIE-SEC cheat sheet

Junos control-plane versus data-plane separation: firewall filters applied to loopback (lo0) protect the Routing Engine; transit traffic never hits lo0 unless addressed to the device.

SPU (Services Processing Unit) handles flow-based security processing; SRX chassis clustering uses control link (heartbeat/HA) and fabric link (data session sync) - control link failure triggers failover, fabric link failure only suspends session sync.

Cluster failover decision order: interface monitoring, then IP monitoring, then heartbeat loss; preempt overrides priority only after the failed node rejoins and is healthy.

Logical interfaces for redundancy groups: reth interfaces carry one MAC per redundancy group; each RG has its own VRRP-style master election with priority and preempt.

Zones bind to interfaces (or reth); a zone can hold multiple interfaces but an interface belongs to exactly one zone (except host-inbound services per interface).

Session timeout defaults: TCP 1800s, UDP 60s, ICMP 60s; long-lived application flows need explicit application timeout overrides.

Screen options (syn-flood, land, ping-of-death, ICMP fragment, teardrop) are per-zone and drop malformed or flooding packets before policy evaluation.

Class of service and security policy coexist: policy action permit then CoS classification; policy deny drops before CoS marking applies.

Junos filter evaluation: terms evaluated top-down, first match wins; implicit deny at end of every filter unless a term with 'then accept' precedes it.

Stateless firewall filter actions: accept, discard, reject (with ICMP type), routing-instance, count, log, policer, next term.

Security policy match order: zone pair, then source/destination address, application, and user/group; most specific match wins, not first match.

Policy actions: permit, deny, reject (with notification profile), tunnel; 'permit' with application-any requires explicit application-services or is treated as deny in newer Junos.

Address books are per-zone; global address book entries are referenced with the 'global-' prefix and usable across zones.

Application identification: predefined applications plus custom applications with destination-port and protocol; application-set groups multiple applications under one policy.

Policer types: two-color (committed information rate + burst) and three-color (CIR, peak, excess); filters reference policers by name with 'policer '.

Policy scheduling and logging: 'scheduler-name' activates policy only in a time range; 'log' and 'session-init/session-close' generate traffic logs only when logging is enabled.

IKE phase 1 (main/aggressive mode) negotiates ISAKMP SA: encryption, hash, DH group, authentication (pre-shared key, RSA signature, certificate).

IKE phase 2 negotiates IPsec SA: ESP/AH, encryption, HMAC, PFS group (must match on both peers if PFS enabled).

Policy-based VPN binds traffic-selector local/remote subnets to a gateway; route-based VPN uses st0 tunnel interface and requires a route to the remote subnet via st0.

IPsec proposals: esp-aes256-esp-sha256, esp-gcm (AEAD), and ah; proposal mismatch causes phase 2 failure logged as 'NO_PROPOSAL_CHOSEN'.

Dead peer detection (DPD) interval and threshold detect peer failure; DPD must be configured on both peers for reliable detection.

NAT-Traversal is automatic when NAT is detected; UDP encapsulation on port 4500 follows IKE on UDP 500.

AutoVPN / ADVPN (Junos 15.1X49+) uses NCP or Next-Hop Tunnel Binding (NHTB) to build hub-and-spoke dynamic tunnels without per-spoke configuration.

Tunnel interfaces support IPsec inside GRE or IP-IP for multicast/routing protocol transport; st0 is the standard for route-based.

Source NAT (interface or pool) rewrites source address; destination NAT rewrites destination (used for inbound port forwarding); static NAT is one-to-one bidirectional.

NAT rule evaluation order: destination NAT first, then source NAT; both can apply to the same flow (double NAT).

Interface source NAT uses the egress interface address; pool NAT uses a defined address pool with optional port translation (PAT) and address-persistent option.

Proxy ARP must be enabled on the external interface for destination NAT to answer ARP for translated addresses.

ALGs (FTP, SIP, H.323, DNS, MSRPC) inspect and rewrite embedded IPs/ports; disabling ALG breaks applications that embed addresses.

Application Layer Gateway vs. application identification: ALG is per-protocol inspection; AppID classifies traffic for policy matching by application name.

NAT64/DS-Lite and IPv6 transition: stateful NAT64 maps IPv6 to IPv4 pools; DS-Lite uses AFTR with IPv4-in-IPv6 tunneling.

Unified threat management features: IDP, antivirus, antispam, content filtering, and SSL forward proxy are applied per-policy via application-services.

Junos commit model: 'commit check' validates candidate config, 'commit confirmed ' auto-rolls back unless confirmed, 'rollback 1' returns to previous config.

Operational commands: 'show security flow session' (with filters), 'show security ike sa', 'show security ipsec sa', 'show security policies hit-count', 'monitor traffic interface'.

Traceoptions: 'set security flow traceoptions file ' plus 'flag basic-datapath' logs packet path decisions; use 'file size' and 'files' to bound growth.

Junos PyEZ and REST API (Juniper REST) automate configuration; NETCONF over SSH (port 830) is the standard programmatic interface.

Junos Space Security Director manages policy lifecycle; Sky ATP provides cloud-based malware detection integrated with SRX.

Logging: 'set security log mode stream' sends to syslog; 'set security log mode event' sends structured events; 'show log messages' for system events.

Troubleshooting flow: verify zone/interface binding, then policy match (hit-count), then session table, then NAT rule, then IPsec SA state.

Configuration groups and apply-groups inherit settings; 'show configuration | display set' shows flattened set commands for automation diffing.

Phase 1 failure diagnosis: 'show security ike sa detail' shows proposal mismatch, authentication failure, or peer not responding; check pre-shared key and proposal order.

Phase 2 failure: 'show security ipsec sa detail' shows 'NO_PROPOSAL_CHOSEN' (proposal mismatch) or 'TS_UNACCEPTABLE' (traffic selector mismatch).

Session not created: check 'show security flow session' for the flow; if absent, policy deny or zone mismatch; if present but no traffic, check NAT and routing.

Packet capture: 'monitor traffic interface ' on the device; for flow-based, 'set security flow traceoptions flag basic-datapath' plus 'show log '.

Cluster troubleshooting: 'show chassis cluster status' shows RG state; 'show chassis cluster interfaces' shows monitor status; 'show chassis cluster statistics' shows failover counts.

High CPU from flow processing: check 'show security flow statistics' for session count versus capacity; 'show security monitoring fpc' for SPU utilization.

Config rollback safety: use 'commit confirmed' during remote changes; 'request system reboot' with 'media' for recovery; 'request system snapshot' before upgrades.

Log analysis: 'show log kmd' for IKE/key management daemon, 'show log messages' for daemon crashes, 'show log security' for policy and flow events.