JNCIE-SEC flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

reth interface

Redundant Ethernet interface used in SRX chassis clusters. Each reth belongs to a redundancy group and carries a single MAC address per group, with the active node forwarding traffic.

SPU

Services Processing Unit in SRX devices. It performs flow-based security processing including firewall, NAT, IPsec, and UTM, separate from the Routing Engine control plane.

Control link vs fabric link

Control link carries heartbeat and cluster control traffic; fabric link carries session synchronization. Control link failure triggers failover; fabric link failure only suspends session sync.

Redundancy group priority

Numeric value per redundancy group determining master election. Higher priority wins; preempt allows a higher-priority node to reclaim mastership after rejoining and becoming healthy.

Screen options

Per-zone attack mitigation settings that drop malformed or flooding packets (syn-flood, land, ping-of-death, teardrop, ICMP fragment) before security policy evaluation.

Session timeout defaults

Default idle timeouts: TCP 1800 seconds, UDP 60 seconds, ICMP 60 seconds. Long-lived applications require explicit application timeout overrides to avoid premature session teardown.

Zone interface binding

A security zone binds one or more interfaces (or reth interfaces). An interface belongs to exactly one zone, but host-inbound services are configured per interface within the zone.

Firewall filter term order

Junos filters evaluate terms top-down; the first matching term's action applies. Without a terminating accept, the implicit deny at filter end drops unmatched traffic.

Security policy match order

Policies evaluate by zone pair, then source and destination address, application, and user. The most specific match wins, unlike firewall filters where first match wins.

Policy deny vs reject

Deny silently drops the packet; reject sends an ICMP unreachable or TCP reset back to the source. Reject uses a notification profile to control the response type.

Global address book

Address book entries prefixed with 'global-' are usable across all zones. Zone-specific address books are referenced only within their own zone's policies.

Application set

A named group of predefined or custom applications referenced by a single security policy. Matching any member application satisfies the policy's application criterion.

Two-color policer

Policer with committed information rate and burst size. Traffic within the rate is conforming (green); excess traffic is non-conforming and dropped or marked.

Policy scheduler

Time-based schedule attached to a security policy. The policy is active only during the configured time range, enabling time-of-day access control.

IKE phase 1

Negotiates the ISAKMP SA: encryption, hash, DH group, and authentication method (pre-shared key, RSA signature, or certificate). Both peers must match proposals.

IKE phase 2

Negotiates the IPsec SA using ESP or AH, encryption, HMAC, and optional PFS group. A PFS mismatch or proposal mismatch causes phase 2 failure.

Route-based VPN

VPN using an st0 tunnel interface with a route to the remote subnet via st0. Traffic selectors are defined by the route, not by policy local/remote subnets.

Policy-based VPN

VPN where the security policy binds local and remote traffic-selector subnets to a gateway. No st0 interface or route to the remote subnet is required.

NAT-Traversal

Automatic detection of NAT along the IPsec path. When detected, IKE uses UDP 500 and ESP is encapsulated in UDP port 4500 to traverse NAT devices.

Dead peer detection

DPD interval and threshold detect an unresponsive IPsec peer. DPD must be configured on both peers for reliable detection and tunnel teardown.

AutoVPN ADVPN

Hub-and-spoke dynamic VPN using Next-Hop Tunnel Binding or NCP. Spokes build tunnels to the hub without per-spoke configuration on the hub device.

Source NAT

Rewrites the source address to an interface address or pool address. Pool NAT may include port translation (PAT) and address-persistent mapping for consistent source addresses.

Destination NAT

Rewrites the destination address for inbound traffic, commonly used for port forwarding. Requires proxy ARP on the external interface to answer ARP for translated addresses.

Static NAT

One-to-one bidirectional address mapping between an internal and external address. Both inbound and outbound flows use the same translation pair.

NAT rule order

Destination NAT applies before source NAT on the same flow. Both can apply simultaneously, producing double NAT with translated source and destination addresses.

ALG

Application Layer Gateway inspects and rewrites embedded IP addresses and ports in protocols such as FTP, SIP, H.323, DNS, and MSRPC. Disabling it breaks such applications.

NAT64

Stateful translation from IPv6 to IPv4 using an address pool. Used in IPv6 transition scenarios alongside DS-Lite with AFTR tunneling.

Commit confirmed

Junos command that commits configuration with automatic rollback after a specified number of minutes unless confirmed. Prevents lockout during remote configuration changes.

Traceoptions

Junos logging mechanism configured with a filename and flags. Security flow traceoptions with basic-datapath flag logs packet path decisions for troubleshooting.

NETCONF over SSH

Standard programmatic Junos interface on TCP port 830. Junos PyEZ and automation tools use it to retrieve and modify configuration and operational state.

Policy hit-count

Operational counter showing how many sessions matched each security policy. Used to verify policy match order and identify unused or shadowed policies.

Cluster status command

'show chassis cluster status' displays redundancy group state and failover counts; 'show chassis cluster interfaces' shows interface monitoring status per redundancy group.

IKE SA detail

'show security ike sa detail' displays phase 1 state, proposal mismatches, authentication failures, and peer responses. Primary command for phase 1 troubleshooting.