NetSec Professional cheat sheet

Interface modes: NAT/routed (IP assigned, routing decisions), transparent (Layer 2 bridge), and tap/monitor (read-only copy).

Longest prefix match wins; equal prefixes are broken by lowest administrative distance, then lowest metric.

Policy routes are evaluated before the main routing table and can forward based on source, user, or service.

802.1Q subinterfaces carry tagged VLANs; the native VLAN is untagged on the trunk.

TCP MSS clamping sets SYN MSS to path MTU minus 40 bytes (IPv4) or 60 bytes (IPv6) to avoid fragmentation.

LACP (802.3ad) aggregates links; all member links must match speed, duplex, and VLAN configuration.

Active-passive HA shares a virtual IP and MAC; failover occurs on heartbeat loss or monitored link failure.

DHCP relay sets giaddr to the receiving interface address so the server selects the matching pool.

Security policies evaluate top-down, first match wins; an implicit deny drops unmatched traffic.

Destination NAT (VIP/port forwarding) is applied before route lookup; source NAT is applied after route lookup.

NAT overload (PAT) multiplexes many internal hosts onto one public IP using source ports.

NAT hairpin/reflection lets internal clients reach an internal server through its public address.

Authentication methods include local database, LDAP/AD, RADIUS (UDP 1812/1813), TACACS+ (TCP 49), and SAML SSO.

RADIUS encrypts only the password field; TACACS+ encrypts the full packet body.

FSSO maps IP addresses to Active Directory users by collecting domain logon events.

Certificate authentication validates the X.509 chain and revocation status via CRL or OCSP.

IKE phase 1 builds the ISAKMP SA: encryption, hash, DH group, authentication, and lifetime must match on both peers.

IKE phase 2 builds IPsec SAs: ESP or AH, traffic selectors, PFS group, and SA lifetime.

ESP (IP 50) provides confidentiality and optional integrity; AH (IP 51) provides integrity only and fails through NAT.

NAT-T encapsulates ESP in UDP 4500; IKE uses UDP 500 and switches to 4500 after NAT detection.

Policy-based VPN uses interesting traffic; route-based VPN uses a tunnel interface and routes.

PFS forces a new Diffie-Hellman exchange per phase 2 rekey, isolating phase 2 keys from a compromised phase 1 key.

DPD detects dead peers and tears down SAs; aggressive timers can cause false positives.

Split tunneling sends only remote-subnet traffic through the tunnel; full tunneling sends all traffic.

Security profiles attach to policies: antivirus, IPS, web filter, application control, DLP, and DNS filter.

IPS signatures detect exploits; the action can be monitor (log only) or block (drop/reset).

Web filtering uses URL categories; HTTPS inspection requires a CA certificate trusted by clients.

Application control identifies applications by signature, independent of TCP or UDP port.

Syslog uses UDP 514 by default; severity ranges from 0 (emergency) to 7 (debug).

SNMP traps use UDP 162; SNMPv3 adds authentication and encryption.

NetFlow/sFlow export flow metadata (IPs, ports, bytes), not full packet payloads.

Logs are sent to a remote syslog server or SIEM with NTP-synchronized timestamps for correlation.