I85PREP
⌘ K
JNCIS-SEC study materials
JNCIS-SEC study resources

JNCIS-SEC: Security Policies and Zones

JNCIS-SEC · Work through your exam, one topic at a time.

All guide sections

Security Policies and Zones

Security policies and zones is the domain where JNCIS-SEC tests whether you can build a working zone model and write policies that match the intended direction. Questions often combine zone interface binding, host-inbound services, policy order, and the difference between transit traffic and traffic destined to the SRX itself.

Zones

  • A security zone groups interfaces. An interface can belong to only one zone, and a zone needs at least one interface before its policies can carry traffic.
  • Host-inbound services (SSH, HTTPS, ping, routing protocols) are allowed per zone and per interface. They control traffic to the device, not through it.
  • Interzone traffic is denied by default; explicit policies are required.

Policy behavior

  • A policy matches on from-zone, to-zone, source address, destination address, application, and optionally other criteria.
  • Policies are evaluated top-down, first match wins. A permit creates a session; a deny or reject blocks it. Reject sends a TCP reset or ICMP unreachable; deny silently drops.
  • Reply traffic for an existing session is allowed by session lookup, so a reverse policy is not normally needed for return packets.

Worked example: ge-0/0/1 is in trust and ge-0/0/2 is in untrust. You need SSH from an administrator at 10.0.0.10 to a server at 198.51.100.20, and you need SSH management access to the SRX from the trust network. Create a trust-to-untrust policy with source 10.0.0.10/32, destination 198.51.100.20/32, application junos-ssh, action permit. For management, add host-inbound-traffic system-services ssh to the trust zone and bind ge-0/0/1. Reasoning: the first is transit traffic and needs a policy; the second terminates on the SRX and needs host-inbound, though a local policy may also be involved depending on configuration.

Traps: putting host-inbound services in a transit policy; forgetting the zone-to-zone direction; placing a broad deny above a specific permit; assuming a reverse policy is required for replies; and leaving an interface unassigned to a zone.