I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC: Troubleshooting Security Policies and Security Zones

JNCIP-SEC · Work through your exam, one topic at a time.

All guide sections

Troubleshooting Security Policies and Security Zones

Zone and policy troubleshooting on the SRX is about reproducing the device's own decision path rather than guessing at configuration. The exam gives you a symptom - a denied session, an unexpected permit, management traffic that fails - and expects you to name the exact lookup the device performed and the command that proves it.

Core rules

  • Lookup order: a packet arriving on a zone-bound interface is checked against from-zone/to-zone policy rules in order, then global policy rules, then the implicit deny. Intra-zone traffic is permitted by default and never consults interzone policy.
  • Only the first packet is policy-evaluated; later packets match the session cache. Editing a policy or address book does not disturb existing sessions - clear them or test with a new flow.
  • The interface must be bound to the zone on the correct unit. host-inbound-traffic controls traffic destined to the device itself (ssh, ping, https) and has no effect on transit traffic.
  • Applications match protocol plus destination port (custom application, application-set, junos-* defaults); application any skips port matching and disables AppID-based visibility.
  • Verification commands: show security policies hit-count, show security flow session, show log messages, and show security match-policies from-zone trust to-zone untrust source-ip ... destination-ip ... destination-port ... protocol tcp, which replays the lookup without generating traffic.

Worked example

Users cannot reach 203.0.113.20 on TCP 443. show security flow session source-prefix 10.1.1.0/24 shows nothing, so the packet never created a session. show security match-policies with source 10.1.1.10, destination 203.0.113.20, tcp, port 443 returns the policy deny-all: the permit above it matches only the custom application (TCP 80). Adding junos-https to the application set restores service - and because lookup is top-down, that permit must sit above any broader deny.

Traps

  • Assuming global policy precedes zone-pair policy; it follows it.
  • Debugging while the session cache is full of stale entries.
  • Forgetting that NAT rewrites happen around policy evaluation, so the policy must match the original source address.
  • Checking a zone's host-inbound list when the real failure is a missing route (the session shows Inactive - No Route).