NGFW Engineer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Virtual wire interface

Passes traffic between two interfaces without modifying MAC or IP addresses; no routing or NAT is performed, but security policy still inspects the flow in transparent mode.

Tap interface

Read-only copy of traffic for inspection; the firewall does not forward or drop packets; used for visibility and pre-deployment testing.

DHCP option 43

Vendor-specific DHCP option used by zero-touch provisioning to deliver the controller or provisioning server address to a newly racked firewall.

Registration auth code

Per-device credential paired with the serial number to activate licenses and support entitlements on the vendor portal.

Commit vs Commit All

Commit pushes the candidate configuration to the local device; Commit All pushes from the central manager to all managed firewalls at once.

HA license parity

Both HA peers must hold identical licenses and subscriptions; otherwise features differ between peers and failover silently changes enforcement behavior.

Shadowed rule

A rule never matched because an earlier rule in the same zone context matches all of its traffic; visible as zero hit counts over time.

Implicit deny

Bottom rule that drops all traffic not matched above it; logging is off by default so unmatched traffic can be invisible.

Intrazone default allow

Traffic between interfaces assigned to the same zone is permitted by default; explicit deny rules are required to block it.

Application identification

Identifies traffic by protocol behavior rather than port; the service field must be any to detect applications running on nonstandard ports.

DNAT before routing

Destination NAT rewrites the destination IP before the route lookup, so the routing table must resolve the post-NAT address.

Security profile group

Bundle of antivirus, anti-spyware, vulnerability, URL filtering and file blocking profiles applied together to a single security rule.

Longest prefix match

The most specific matching route wins over a default route, regardless of metric or administrative distance.

Administrative distance

Tiebreaker among routes to the same prefix learned from different protocols; the lower value is preferred and installed in the table.

Floating static route

Static route configured with an elevated administrative distance so it installs only after the primary route is withdrawn.

Policy-based forwarding

Routing decision made from a policy match such as source address or port instead of the destination-based routing table lookup.

MSS clamping

Rewrites the TCP MSS value to path MTU minus 40 bytes so encapsulated VPN traffic does not fragment or black-hole.

IKE phase 1

Negotiates the IKE SA that protects tunnel management traffic; mismatched encryption, hash or DH group causes phase 1 to fail.

Proxy ID

Traffic selector pair defining which subnets cross the IPsec tunnel; it must mirror on both peers or phase 2 negotiation fails.

NAT traversal

Encapsulates ESP inside UDP port 4500 so IPsec passes through NAT devices that would otherwise drop IP protocol 50.

Dead peer detection

Sends periodic probes to the peer; after the configured retry count expires the peer is declared dead and the tunnel is torn down.

Route-based VPN

Uses a tunnel interface with a zone and route; multiple subnets and failover work without matching proxy-ID pairs.

HA2 link

Dedicated link carrying session and state synchronization between peers; it should be a direct connection or same-subnet path.

Split brain

Both peers become active when HA1 heartbeats fail; prevented by an HA1 backup link and path monitoring.

HA preemption

Lets a recovered higher-priority peer retake the active role; often disabled to avoid flapping after unstable links.

Path monitoring

Pings a target from a monitored interface; when probes fail the device fails over even though the physical link stays up.

Gratuitous ARP

On failover the newly active device broadcasts gratuitous ARP so upstream switches relearn the MAC-to-port mapping and send traffic to it.

Traffic log

Records session end with source, destination, application, matched rule, byte counts and NAT translation for allowed and denied flows.

Syslog severity

Numeric zero-to-seven scale where zero is emergency and seven is debug; facility codes identify the originating process.

Log forwarding profile

Filter selecting which log types and severities are sent to syslog, SNMP, email or cloud storage from the firewall.

IPFIX and NetFlow

Flow summary export containing five-tuple, byte and packet counts; used for traffic analysis and capacity planning rather than full auditing.

Log retention

Local logs rotate in a ring buffer; compliance requires forwarding to external storage before older entries are overwritten.