NetSec Professional key terms

A logical grouping of one or more network interfaces that share the same security requirements and policy rules. Traffic between zones is controlled by firewall policy; traffic within a zone may be handled differently.

A physical or logical connection point on a firewall where network traffic enters or leaves, such as an Ethernet port, VLAN sub-interface, or tunnel endpoint. Each interface is assigned addresses and usually bound to a security zone.

A logical interface created on a physical port that carries traffic tagged for one specific VLAN. It lets a single physical link serve multiple separated networks while keeping their addressing and policies distinct.

A manually configured entry in the routing table that tells the firewall where to send packets for a given destination network, defined by network address, next hop, and distance.

A route with destination 0.0.0.0/0 that matches any address not covered by a more specific route. It normally points to the upstream gateway used for internet-bound traffic.

The rule routers use to choose among several matching routes: the route with the most specific, longest subnet mask wins, regardless of the order in which the routes were configured.

A preference value assigned to routes based on how they were learned, such as connected, static, or a dynamic protocol. When two routes reach the same destination, the lower value is preferred.

A protocol such as OSPF or BGP that lets routers exchange reachability information and automatically update their routing tables as links appear, fail, or change cost.

Combining two or more physical links into one logical interface to increase bandwidth and keep connectivity if a member link fails. It requires matching configuration on both ends of the bundle.

A rule stating which traffic is allowed or denied, defined by matching conditions such as source, destination, service, user, and zone, plus the action taken for sessions that match.

The default outcome when traffic matches no configured rule. Most firewalls drop such traffic, so every permitted flow must be explicitly allowed by some policy.

The sequence in which firewall rules are evaluated. Because most platforms use first-match logic, a broad rule placed above a specific one can hide the more precise rule.

Translation that rewrites the source address of outgoing packets, typically so private hosts can share a public address when reaching the internet. Return traffic is translated back using the session table.

Translation that rewrites the destination address of incoming packets so external clients can reach an internal server through a published public address; called port forwarding when ports are also mapped.

A form of source NAT in which many internal hosts share a single public address, distinguished by unique source port numbers that the firewall tracks in its session table.

A defined range of addresses the firewall can use as translation addresses for NAT, either shared among many clients or allocated one-to-one to specific internal hosts.

A widely used protocol for centralized authentication, authorization, and accounting. The firewall forwards user credentials to a RADIUS server and applies the accept or reject result to the connection.

Requiring two or more independent proofs of identity, such as a password plus a one-time code from a token or app, before granting access to a VPN or protected resource.

A web page presented to users before network access is granted. It collects credentials or acceptance of terms, and the resulting authenticated session is then tied to a firewall policy.

A firewall rule whose match conditions include the authenticated user or user group rather than only IP addresses, so access follows the person across changing devices and addresses.

A suite of protocols that encrypts and authenticates IP traffic between peers, forming the basis of most site-to-site VPNs. It uses IKE to negotiate keys and ESP to protect data.

Internet Key Exchange: the protocol that negotiates and manages IPsec security associations, authenticating peers and deriving shared keys in two stages before data traffic is protected.

A one-way agreement between IPsec peers describing the encryption and authentication algorithms, keys, and lifetime used to protect traffic traveling in that direction.

A secret string configured identically on both VPN peers and used to prove identity during IKE negotiation. It must be long and random, and it is weaker than certificate-based authentication.

A method that lets two parties derive a shared secret over an untrusted network without ever transmitting the secret itself. Larger groups provide stronger protection for the negotiated keys.

A property ensuring that compromise of a long-term key does not expose past sessions, because each session's keys are derived fresh through a new key exchange.

An IPsec mode that wraps the whole original packet inside a new IP packet with new headers, hiding internal addresses and letting entire subnets communicate across the VPN.

A keepalive mechanism that periodically probes an idle VPN peer; if replies stop, the tunnel is torn down and renegotiated or its traffic is rerouted.

A remote-access VPN setting in which only traffic destined for corporate networks travels through the tunnel, while internet-bound traffic goes directly from the client.

A technique that encapsulates IPsec packets inside UDP so they can pass through NAT devices, which would otherwise break the integrity checks on the original packet.

A set of inspection features, such as antivirus, intrusion prevention, web filtering, and application control, attached to a firewall policy to scan the traffic that policy permits.

An engine that inspects packet payloads and behavior against signature and anomaly rules, and can reset or block sessions that match known attack patterns.

Identifying and controlling traffic by the application generating it rather than by port or protocol, so peer-to-peer, streaming, or anonymizer tools can be blocked or limited.

Inspecting web requests and categorizing destination sites so policy can allow, block, or log access to categories such as malware hosts, gambling, or social media.

Decrypting TLS traffic at the firewall, inspecting the plaintext with security profiles, then re-encrypting it. It requires clients to trust the firewall's inspection certificate.

A standard protocol and message format for sending event records from the firewall to a central collector, where they can be stored, searched, and correlated with other sources.

A numeric or named ranking, from emergency down to debug, attached to each event so administrators can filter logs and raise alerts only on important conditions.

Recording raw packets on an interface or for a specific session so they can be analyzed later, confirming whether traffic arrives, how it is addressed, and what response is sent.