NGFW Engineer cheat sheet

Interface modes: L3 (routed, needs IP and zone), L2 (switched, VLAN-based), virtual wire (transparent, forwards without changing MAC or IP), tap (receive-only copy, never forwards).

The management plane must sit on a dedicated out-of-band network; sharing the management-interface subnet with dataplane user traffic exposes the control plane.

Zero-touch provisioning sequence: DHCP lease, option 43 or option 60 provisioning URL, HTTPS fetch of bootstrap config and certificates, license activation, commit.

HA deployment prerequisites: identical hardware model, identical software version, identical license and subscription set, dedicated HA1 and HA2 links.

Licensing rule: the base/perpetual license enables the platform; content subscriptions (threat, URL, application signatures) gate updates, not packet forwarding.

Device registration needs serial number plus auth code and outbound TCP 443 to license/update servers; air-gapped sites use an offline signed license file.

Factory reset restores default management IP and default admin credentials and regenerates a blank configuration, so export a backup first.

Size deployments on inspected throughput, not raw firewall throughput: App-ID plus threat inspection plus decryption reduces the published number substantially.

Bring-up order: interfaces, zones, virtual router, NAT, security policy, security profiles, log forwarding.

Evaluation is top-down with first match winning; unmatched traffic hits the implicit deny at the bottom, and shadowed rules show zero hit counts.

Match tuple: ingress zone, source IP or user, destination IP, application, service/port, URL category, source and destination HIP profile.

If the service field is anything other than 'any', App-ID is limited to those ports; port-shifting applications go undetected.

Processing order: destination NAT, routing or policy-based forwarding, source NAT, security policy, QoS/shaping, egress.

Default intrazone action is allow while default interzone action is deny; explicit deny rules are needed to close intrazone gaps.

A security profile group bundles antivirus, anti-spyware, vulnerability, URL filtering and file blocking, applied once per rule.

Encrypted sessions need a decryption policy ahead of the security rule; exclude privacy- and compliance-sensitive categories with no-decrypt rules.

Change control: combine rule hit counters with a policy optimizer report; rules with zero hits over 30 to 90 days are removal candidates.

NAT rules must be reviewed together with the security rule that references translated addresses; log at session end to capture byte counts.

Route selection order: longest prefix match first, then administrative distance, then metric; a default route loses to any more specific prefix.

Common administrative distances: connected 0, static 10, eBGP 20, OSPF 110, iBGP 200.

A floating static route is the same prefix configured with a higher administrative distance so it installs only after the primary path is withdrawn.

Policy-based forwarding is evaluated after destination NAT and before the routing table; a rule with no matching next-hop falls through to the routing table.

Asymmetric routing breaks stateful inspection: the return packet must traverse the device that owns the session.

MTU rule: ESP/UDP encapsulation shrinks usable MTU, so clamp TCP MSS to tunnel MTU minus 40 bytes to avoid fragmentation and black holes.

OSPF: every non-backbone area must attach to area 0; cost equals reference bandwidth divided by interface bandwidth; hello and dead timers must match per neighbor.

An interface without a zone cannot be referenced by a security policy; zones define the security boundary, interfaces only carry traffic.

Proxy ARP must be enabled on the NAT egress interface when same-subnet clients must reach the translated address.

IKEv2 message flow: IKE_SA_INIT (2 messages), IKE_AUTH (2 messages), then CHILD_SA; IKEv1 main mode requires 6 messages.

Phase 1 fails on proposal mismatch (encryption, integrity/hash, DH group) or identity mismatch; phase 2 fails on proxy-ID or traffic-selector mismatch.

IKE identity types are IP address, FQDN, user-FQDN and DER ASN.1 DN; the local ID must equal the peer's configured remote ID.

NAT-T is detected during IKE; encapsulated traffic then uses UDP 4500 with a non-ESP marker, because plain ESP is IP protocol 50 and NAT devices drop it.

Route-based VPN: tunnel interface in a zone plus a route plus IKE gateway plus IPsec crypto profile; multiple subnets work without proxy-ID pairs.

DPD teardown time equals probe interval multiplied by retry count; passive mode only answers peer probes and never initiates.

Certificate authentication requires the full CA chain, valid validity dates, and a subject or SAN matching the configured peer identity.

Proposal lifetimes do not need to match; both peers use the shorter value and rekey without dropping the tunnel.

HA1 carries control and heartbeat, HA2 carries session and state synchronization, HA3 carries packet forwarding in active/active.

Failover triggers are HA1 hello timeout, link monitoring on a physical interface, and path monitoring that pings a target IP.

Session sync modes: accelerated (firewall, NAT, ARP and IP/user mappings) versus non-accelerated (all sessions); choose by failover tolerance.

Failover sequence: peer detects loss, promotes passive to active, sends gratuitous ARP, then continues synchronized sessions transparently.

Split-brain prevention needs an HA1 backup link plus redundant HA2 paths; with both HA links down each peer can activate.

Preemption lets the recovered higher-priority peer retake the active role; disable it to prevent flapping on unstable links.

Active/active requires floating IP addresses and per-session ownership mapping; asymmetric paths across ownership boundaries cause drops.

Only the active peer pushes configuration to the passive peer, so a commit must be issued on the active device to synchronize.

HA priority is lower value equals higher priority; the device ID (0 or 1) orders roles when preemption is disabled.

Log types: traffic, threat, URL filtering, data filtering, decryption, configuration, system, authentication and HIP match.

The traffic log is written at session end by default, so long-lived flows need 'log at session start' to be visible while active.

Syslog uses RFC 5424 (current) or RFC 3164 (BSD); severity runs 0 (emergency, highest) to 7 (debug, lowest).

A log forwarding profile must be attached to each security rule; rules without one keep their logs local only.

SNMP separates polling (get/walk) of counters from traps or informs for events; SNMPv3 adds authentication and privacy.

NetFlow/IPFIX and sFlow are sampled summaries, not session logs; use them for top-talker and capacity analysis.

Local storage is a rotating buffer; forward to syslog, a central manager or cloud storage before rotation overwrites entries needed for compliance.

Threat log severities are critical, high, medium, low and informational; the threat ID links each entry to signature metadata.

Useful reports: top applications, top sources and destinations, top threats, allowed-versus-denied trend, and per-rule hit counts.