I85PREP
⌘ K
JNCIS-SEC study materials
JNCIS-SEC study resources

JNCIS-SEC: SRX Series Firewall Fundamentals

JNCIS-SEC · Work through your exam, one topic at a time.

All guide sections

SRX Series Firewall Fundamentals

JNCIS-SEC candidates meet SRX Series Firewall fundamentals as the architecture layer beneath every other domain. The exam checks whether you can distinguish control-plane tasks from data-plane forwarding, explain how the flow module creates and uses sessions, identify interface and cluster components, and predict what happens to the first packet versus later packets in a flow.

Planes and flow processing

  • The Routing Engine (RE) runs Junos OS, routing protocols, management, and commit; it does not forward transit packets.
  • The Packet Forwarding Engine (PFE) forwards packets. The flow module applies screens, zone lookup, policy, NAT, and session creation.
  • The first packet in a new flow creates a session. Later packets are matched to that session and bypass full policy lookup unless the session is invalidated or times out.

Interfaces and chassis cluster

  • Physical interfaces use names such as ge-0/0/1 and xe-0/0/0; logical units carry family inet or family inet6.
  • A chassis cluster uses two nodes, a control link, a fabric link, redundancy groups, and reth interfaces. RG0 typically handles routing; data RGs handle interfaces and services.
  • Host-inbound services are configured under the zone that contains the interface, not under a transit policy.

Worked example: A client 10.0.0.5 sends a TCP SYN to 198.51.100.20:443 through an SRX. The frame arrives on ge-0/0/1; the PFE performs screen checks, route lookup, zone lookup, and policy lookup. If a trust-to-untrust permit policy matches, the SRX creates a session recording the original and translated tuples and a timeout. The server's reply matches that session and is forwarded without a new policy lookup. If the policy denies the SYN, no session is created and the packet is dropped.

Traps: assuming the RE forwards traffic; forgetting that return traffic does not need a reverse policy when a session exists; ignoring session timeouts; configuring a reth without a cluster; and omitting host-inbound services for management.