JNCIS-SEC key terms

A named logical grouping of interfaces that share the same security requirements. Traffic entering and leaving zones is evaluated by policy, and interfaces of one zone are treated as equally trusted.

The built-in zone that holds the fxp0 or out-of-band management interface and any interface not explicitly assigned to a user-defined zone. It is separate from transit traffic handling.

An ordered rule that permits, denies, or rejects traffic between a from-zone and a to-zone based on match conditions such as source address, destination address, application, and user. The first matching policy takes effect.

The model in which each packet is classified into a from-zone and to-zone pair before policy lookup. Policies are grouped per zone pair, so the same addresses can be treated differently depending on the zones involved.

Traffic whose ingress and egress interfaces belong to the same zone. By default it is denied, and it requires an explicit policy with the same zone in both from-zone and to-zone.

The disposition applied when a policy matches: permit forwards the session, deny silently drops the packet, and reject drops it while sending a TCP reset or ICMP unreachable to the source.

The default behavior that drops any traffic not matched by an earlier policy. It is not a visible rule; it is the fallback at the end of every zone-pair policy set.

The process of determining which application or protocol a session carries, using signature inspection rather than only port and protocol. Policies can then match on application name instead of a fixed port number.

The stateful record of a flow that the SRX maintains, holding addresses, ports, NAT translations, policy result, and inspection state. Forward and reverse packets of the same flow share one session.

The forwarding model in which the first packet of a flow is processed in the slow path to create a session, and later packets of that flow are handled in the fast path using the session entry.

Handling of the initial packet of a new flow, including route lookup, zone determination, policy lookup, NAT, and session creation. It is performed in software and is more expensive than fast-path lookups.

Handling of packets that match an existing session, using the cached session information to skip repeated policy and route lookups. This makes established flows cheaper to forward than new ones.

The memory structure that stores all active sessions, including their state, timeout values, and translation details. Its capacity and current utilization determine how many concurrent flows the device can support.

The idle period after which an inactive session is removed from the session table. Timeouts differ by protocol, for example TCP versus UDP, and can be tuned per application.

Translation that rewrites the source address, and optionally the source port, of packets leaving a zone. It is commonly used to let internal hosts share a public address when reaching the internet.

Translation that rewrites the destination address, and optionally the destination port, of inbound packets. It is typically used to publish an internal server behind a single public address.

A one-to-one mapping between an internal address and an external address, applied in both directions. Unlike a pool, the mapping is fixed, so the same internal host always appears as the same public address.

A set of addresses or address-and-port pairs used as translation targets. Pools allow many internal hosts to share a smaller number of public addresses through port translation.

A form of translation that also rewrites the source port so multiple internal hosts can share one public address. The device tracks the port mapping in the session table to return traffic correctly.

The sequence in which NAT rules are evaluated. Rules are grouped by rule set, and within a set the first matching rule applies, so placement of specific versus general rules changes the result.

A feature that makes the SRX answer ARP requests for translated addresses on the external interface, so upstream devices send traffic for those addresses to the firewall.

A source NAT configuration that translates traffic to the address of the egress interface. It is a simple way to give internal users internet access without defining a separate address pool.

A suite of protocols that authenticates and encrypts IP packets between peers. It provides confidentiality, integrity, and peer authentication, and is the basis for site-to-site and remote-access VPNs on the SRX.

Internet Key Exchange, the protocol that negotiates and manages IPsec security associations. Phase 1 builds a protected channel between peers, and phase 2 negotiates the IPsec SAs used for data.

The agreed set of parameters, including keys, algorithms, and lifetimes, that protects one direction of an IPsec connection. Each IPsec tunnel normally uses a pair of SAs.

A secret string configured identically on both IPsec peers and used during IKE phase 1 to authenticate them. It must be long and random, and it must match exactly on both ends.

The logical path formed by an IPsec SA pair between two gateways or between a client and a gateway. Traffic is routed into the tunnel by policy and encapsulated before leaving the physical interface.

A logical interface that carries traffic into and out of an IPsec tunnel. Route-based VPNs bind the tunnel to this interface, which simplifies routing and policy compared with policy-based VPNs.

A VPN design in which the tunnel is represented by a tunnel interface and traffic is directed into it by routing. This allows dynamic routing and simpler policy than policy-based VPNs.

The firewall behavior of tracking connection state and automatically allowing return traffic that belongs to an already-permitted session, without requiring a separate policy for the reverse direction.

A set of attack-detection and anti-scanning checks applied to traffic entering a zone, such as SYN flood protection and IP spoofing checks. They are configured per zone and act before policy evaluation.

A set of content-security features applied to permitted traffic, including antivirus, antispam, web filtering, and content filtering. UTM runs after policy match and inspects payloads rather than only headers.

Intrusion prevention, which inspects traffic against signatures and can drop or alert on malicious patterns. Unlike antivirus, it targets exploit and attack behavior rather than file payloads alone.

A UTM configuration that scans permitted traffic for malware, choosing protocols to inspect and the action to take on detection, such as drop, alert, or quarantine.

A UTM feature that blocks or logs traffic based on categories, MIME types, or URL patterns. It is often used to enforce acceptable-use rules for web access.

The dedicated out-of-band port used for device administration, typically in the global zone. It is kept separate from transit interfaces so management access is not exposed to user traffic.

A named application signature used in policy or in application firewall rules. AppFW can allow, deny, or redirect specific applications even when they use the same ports.

A named group of NAT rules evaluated together in order. A rule set is referenced from a NAT configuration, and the first matching rule inside it determines the translation.