JNCIS-SEC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Candidate config vs committed

Junos edits a candidate configuration. Changes take effect only after 'commit'. Until then, running config is unchanged. 'commit confirmed' auto-rolls back unless confirmed.

Control plane vs data plane

The Routing Engine handles routing protocol and management tasks; the Packet Forwarding Engine forwards traffic and applies screens, NAT, and services. Separating them isolates management from transit.

Flow-based mode

Default SRX operating mode. It creates sessions on first packet, then applies screens, policy, NAT, and services in order. Required for most security features.

Session setup order

In flow mode: session lookup, screen checks, policy lookup, NAT translation, ALGs/services, then forwarding. NAT occurs after policy match, which explains why policy addresses are pre-NAT.

Chassis cluster

Two SRX devices paired with control and fabric links. Redundancy groups define primary/secondary roles. Failover moves traffic to the secondary on link or device failure.

reth interface

Redundant Ethernet logical interface used in chassis cluster. Both nodes share one MAC and IP; the active node forwards. Requires matching physical interfaces on both nodes.

show security flow session

Displays active sessions with source/destination, translated addresses, application, and state. Useful for verifying NAT and policy behavior on live traffic.

Factory default and commit

A new SRX boots with default config; after editing interfaces, zones, and policies you must run 'commit'. Uncommitted changes are lost on reboot.

Security zone

A logical grouping of interfaces that share a trust level. An interface belongs to exactly one zone. Zones define which policy rule sets apply to traffic.

First-match policy evaluation

Policies evaluate top-down within a from-zone/to-zone pair. The first matching policy's action applies. Order matters; place specific rules above general ones.

Default deny

If no policy matches, traffic is dropped. There is no implicit permit. Explicit permit policies are required for all allowed traffic.

Policy actions

Permit forwards traffic; deny silently drops; reject drops and sends TCP RST or ICMP unreachable. Each action can also log and count.

Host-inbound-traffic

Zone setting controlling traffic destined to the SRX itself (SSH, ping, SNMP). It does not govern transit traffic, which is controlled by security policies.

Intra-zone traffic

Traffic between interfaces in the same zone. It still requires a matching policy (trust to trust) unless explicitly permitted; it is not implicitly allowed.

Custom application

Defines protocol, destination port range, inactivity timeout, and optional ALG. Referenced by policies. Predefined apps like junos-http are built in.

Address book

Named IP or network entries referenced by policies. Address books are per-zone or global. Using them improves readability and simplifies updates.

Source NAT

Translates internal source addresses to a public address or pool. PAT is default when the pool is smaller than the session count. Applied after policy lookup.

Destination NAT

Maps a public IP/port to an internal host. Requires proxy-ARP on the external interface so the SRX answers ARP for the public address.

Static NAT

One-to-one bidirectional mapping between private and public addresses. No separate reverse rule is needed; both directions are covered.

Twice NAT

A single NAT rule that translates both source and destination addresses. Useful when internal hosts reach a server via a public address.

NAT rule-set order

Rule sets and their rules evaluate top-down; the first match applies. Zone context (from/to) narrows which traffic a rule set evaluates.

Persistent NAT

Keeps a given internal host mapped to the same translated address across sessions. Improves logging consistency and external service compatibility.

Proxy-ARP

The SRX answers ARP requests for NAT addresses on the external interface, directing traffic destined for the NAT address to itself for translation.

NAT and return routes

Forwarding uses the route table after NAT. If no route exists for translated addresses, return traffic is dropped. Verify routes for both directions.

IKE phase 1 vs phase 2

Phase 1 builds the ISAKMP SA (peer authentication, DH). Phase 2 builds the IPsec SA (ESP/AH, traffic selectors). Both must succeed for a tunnel.

Policy-based VPN

A VPN where a security policy selects traffic into the tunnel. Less scalable than route-based; requires matching proxy-ids on both peers.

Route-based VPN

Uses a st0 tunnel interface with a route selecting traffic. More scalable and easier to apply services than policy-based VPNs.

NAT-T

Encapsulates ESP in UDP 4500 when NAT is detected. IKE uses UDP 500. Firewall rules must permit 500, 4500, and ESP for VPNs to work.

IPsec parameter mismatch

Most common VPN failure: proposals, pre-shared key, identity, DH group, or traffic selectors differ between peers. Verify both sides match exactly.

UTM components

Antivirus, antispam, web filtering, and content filtering. Each needs a license and signature updates. Applied via UTM profiles attached to policies.

IDP policy

Intrusion detection/prevention signatures attached to a security policy. Actions include drop, close, alert, or log. Requires an IDP license.

Logging modes

Stream mode sends logs to a syslog server; event mode sends to an event server. Local logs are viewed with 'show log messages'.