JNCIP-SEC cheat sheet

Junos policy lookup order is global policy, then inter-zone policy, then intra-zone policy; the first matching policy is applied and evaluation stops.

A policy match requires from-zone, to-zone, source-address, destination-address, and application; source-identity is optional but must resolve when configured.

show security match-policies from-zone <a> to-zone <b> source-ip <ip> destination-ip <ip> source-port <p> destination-port <p> protocol <proto> simulates the lookup without sending traffic.

Zone host-inbound-traffic must explicitly allow management and routing protocols; a missing system-services ping or protocols ospf entry blocks traffic destined to the SRX.

An interface can be bound to only one security zone; show security zones and show configuration security zones reveal missing or duplicate bindings.

show security flow session shows session state and policy; show security flow session extensive adds NAT, timeout, and application details.

show security policies hit-count and show security policies detail identify the matching policy; zero hits with active traffic usually means an earlier deny or no session created.

clear security flow session removes existing sessions so a policy change can be tested immediately; existing sessions continue to use the old policy until cleared.

A logical system is an independent security and routing context on one Junos device, with its own zones, policies, address books, routing tables, and administrators.

A tenant system is a logical system nested under another logical system; it provides a separate tenant namespace for zones, policies, and interfaces.

Interfaces are assigned to a logical system or tenant system with logical-system or tenant-system interface configuration; an interface cannot belong to two contexts simultaneously.

set cli logical-system <name> enters the logical system context so subsequent operational and configuration commands are scoped to it.

show logical-systems lists configured logical systems and their status; show logical-systems <name> security policies shows that context's policies.

Routing protocols, static routes, and security policies are configured per logical system; the master logical system does not automatically leak routes into tenants.

Users can be restricted to a logical system through login classes and permissions; the master administrator can manage all logical systems.

Traffic between logical systems is not permitted by default and must be explicitly routed and permitted by security policy; it is not an intra-zone shortcut.

SRX transparent mode forwards Layer 2 frames within a bridge domain or VLAN while still applying security policy and Layer 2 inspection to the traffic.

Transparent-mode interfaces use family ethernet-switching; VLAN membership and trunk or access mode determine the Layer 2 forwarding path.

DHCP snooping classifies ports as trusted or untrusted and builds a binding table of MAC, IP, VLAN, and port; DHCP server replies on untrusted ports are dropped.

Dynamic ARP inspection uses DHCP snooping bindings to validate ARP packets and drops ARP replies with an IP-to-MAC mapping not in the binding table.

MAC limiting caps the number of learned MAC addresses per interface; MAC move limiting restricts how often a MAC can move between interfaces in a time window.

Storm control limits broadcast, multicast, or unknown-unicast traffic and drops or disables the port when the configured threshold is exceeded.

show ethernet-switching table displays learned MAC addresses; show vlans and show interfaces verify VLAN membership and trunk allowed VLANs.

Native VLAN mismatch or a missing allowed VLAN on a trunk causes silent Layer 2 failures; verify both ends before changing security policy.

802.1X authenticates supplicants before granting Layer 2 access and can assign a guest VLAN or dynamic VLAN after authentication.

Junos applies destination NAT before security policy lookup on ingress; source NAT is applied after policy lookup on egress.

NAT rule sets are selected by from-zone and to-zone, then rules are evaluated top-down; the first matching rule is used.

Source interface NAT uses the egress interface address; source pool NAT uses configured addresses and ports, with address-pooling paired providing deterministic mappings.

Destination NAT maps a public address and port to a private address and port; configure proxy ARP on the ingress interface for public addresses outside the interface subnet.

Static NAT creates a fixed one-to-one mapping and is bidirectional; it does not require a separate destination NAT rule for return traffic.

Persistent NAT keeps a source NAT binding after the session closes; permit-any-remote-host allows any external host to initiate traffic to the mapped internal host.

show security nat source summary, show security nat destination rule all, and show security nat static rule all verify rule configuration and hit counts.

show security flow session displays pre-NAT and post-NAT addresses; show security nat source persistent-nat-table shows persistent bindings.

Twice NAT translates both source and destination in one flow; destination translation happens first, so policy lookup uses the translated destination.

IKE Phase 1 negotiates the ISAKMP SA with proposals for encryption, hash, authentication, and Diffie-Hellman group; both peers must match.

IKE Phase 2 negotiates the IPsec SA with IPsec proposals and optional PFS; traffic selectors must overlap or no IPsec SA is created.

A route-based VPN binds to an st0 interface; st0 must be in a security zone and security policy must permit traffic to and from that zone.

show security ike sa and show security ipsec sa show phase status; show log kmd reveals proposal, PSK, or certificate mismatches.

IKEv2 supports multiple SAs, MOBIKE, and EAP; IKEv1 main mode hides identities, while aggressive mode exposes them in clear text.

DPD probes detect an unreachable peer; after the configured interval and threshold, the SRX tears down the SA and can trigger HA failover.

NAT-T encapsulates ESP in UDP port 4500 when NAT is detected; keepalive settings maintain the UDP mapping through the NAT device.

PFS group mismatch causes Phase 2 failure even when Phase 1 is up; verify perfect-forward-secrecy keys on both peers.

clear security ike sa and clear security ipsec sa reset phases; show security ipsec statistics shows encrypt and decrypt errors and packet counts.

APBR routes traffic based on application, user, source or destination, or URL category instead of destination IP alone.

APBR depends on AppID; before the application is identified, initial packets may follow the normal route and miss the APBR rule.

APBR configuration is under security advance-policy-based-routing; rules match traffic and set a next-hop or routing-instance action.

An APBR profile is attached to a security policy action; the flow must be permitted by policy before APBR can override its route.

show security advance-policy-based-routing statistics verifies rule hits; show security flow session shows the selected next-hop or routing instance.

If no APBR rule matches, the flow uses the normal routing table; APBR does not create a default route.

APBR requires current application signatures and, on some platforms, an AppID license; stale signatures reduce match accuracy.

Asymmetric routing breaks APBR because return traffic may bypass the SRX; ensure both directions traverse the same device.

APBR rules are order-dependent; place more specific application or user matches before broad source and destination matches.

Multinode HA extends a chassis cluster beyond two nodes; control links carry heartbeats and fabric links carry session synchronization and data forwarding.

Redundancy groups are failover units; RG0 handles control plane, and RG1 and higher handle data-plane security services.

show chassis cluster status displays node roles, priority, preempt, and failover state for each redundancy group.

request chassis cluster failover redundancy-group <n> node <n> manually moves a group; request chassis cluster failover reset restores normal priority.

Interface monitoring assigns weights to links; when failed monitored weight exceeds the redundancy-group threshold, the group fails over.

Session synchronization must be enabled and healthy; show chassis cluster data-plane statistics shows sync status and errors.

Split brain occurs when control links fail and multiple nodes claim primary; control-link redundancy and heartbeat thresholds prevent it.

show chassis cluster interfaces verifies fabric and control link status; show chassis cluster statistics shows heartbeat and drop counters.

Only one node is primary per redundancy group; traffic for that group is processed by the primary node and synchronized to backups.

Automated threat mitigation combines AppID, IPS, and security intelligence feeds with policy actions to block malicious traffic without manual address updates.

SecIntel feeds populate dynamic address groups for command-and-control, malware, GeoIP, and DNS categories; policies match those dynamic addresses.

show security dynamic-address lists feed-derived addresses and categories; show security dynamic-address summary shows entry counts.

Infected host detection identifies internal hosts contacting known malicious destinations and can apply a quarantine or block action.

ATM policy actions include permit, deny, log, and quarantine; actions are applied through normal security policy evaluation.

Feed updates require a valid license and connectivity to Juniper cloud services; stale feeds reduce detection accuracy.

show security policies and show security flow session verify ATM policy hits and blocked sessions.

GeoIP categories can block or allow traffic by country; verify the dynamic address category and policy match before assuming a feed failure.

ATM logging should be exported to a central collector because local event logs can rotate and lose correlation data.