Firewall Configuration, Routing, and Network Interfaces
Interfaces and zones
A firewall forwards packets based on where they arrive and where they must go. Interfaces can be physical ports, VLAN sub-interfaces, aggregates, or loopback/tunnel interfaces. Most platforms require an interface to belong to a security zone before a policy can reference it; an unassigned interface typically has no policy path and drops traffic. Understand the difference between inter-zone policies (traffic crossing zones) and intra-zone policies (traffic entering and leaving the same zone), which are often blocked by default.
Route lookup and forwarding
Routing determines the outgoing interface and next hop. Key rules: the longest-prefix match wins, connected routes normally beat static routes, and administrative distance breaks ties between routes to the same prefix. Equal-cost multipath may load-balance, which can cause asymmetric flows if stateful inspection is not applied consistently. Policy-based routing overrides the destination-based table for matching traffic. Remember that destination NAT can change the address used for route lookup, and source NAT is applied after the routing decision - a classic exam trap.
Traps to watch
- Assuming a policy will match when the interface was never added to a zone.
- Choosing a shorter prefix because it is "more specific to the subnet" - the longest prefix always wins.
- Forgetting that return traffic must have a route and a permitted policy path.
- Overlapping or summarised routes hiding a more specific route.
- Asymmetric routing breaking stateful inspection; reverse-path-forwarding checks may drop valid traffic.
Rule of thumb
When a flow fails, verify in order: interface up and zoned, route present in both directions, policy permits the flow, then NAT. For example, with routes 10.10.0.0/16 via R1 and 10.10.5.0/24 via R2, traffic to 10.10.5.20 follows R2, not R1.