NGFW Engineer key terms

An automated first-boot process in which a new firewall contacts a central server, downloads its software image and configuration, and joins the network without an engineer at the console.

A separate management interface and network path reserved for administration, so that administrator sessions keep working even when production traffic or data interfaces fail.

Reaching the firewall's administration interface over an interface that also carries user traffic, which means a data-path problem can also cut off administrative access.

The functions of the firewall that handle configuration, administrative sessions, logging, and updates, kept logically separate from the code that forwards and inspects packets.

A periodic download of application signatures, threat definitions, and URL categories from the vendor, which keeps detection accurate as new applications and attacks appear.

A platform that stores policy and device settings once and pushes them to many firewalls, and often collects their logs and reports in one place.

A named logical grouping of interfaces that share a trust level; policy rules are written between zones, so moving a port between zones changes which rules apply to it.

An ordered entry that matches traffic on zone, address, application, user, and service, then applies an action such as allow, deny, or reset.

The firewall compares a packet against rules from the top down and enforces the first one that matches; rules below it are never checked for that traffic.

A rule that can never match because an earlier, broader rule already covers all of its traffic, making it dead configuration that misleads auditors.

The default drop applied to any traffic that no explicit rule matches, sitting below all configured rules and enforcing a default-deny posture.

Classification of a session by the actual application protocol in use, identified from payload and behaviour rather than from the TCP or UDP port number.

The mapping of source IP addresses to directory usernames and groups, so security rules can allow or block traffic based on who the user is.

A collection of inspection settings such as antivirus, anti-spyware, vulnerability protection, and URL filtering that is attached to an allow rule to scan permitted traffic.

Rules that decide which TLS sessions the firewall decrypts, inspects, and re-encrypts, and which are left encrypted because of privacy, legal, or compatibility reasons.

Translation that rewrites the source address of outbound packets, usually to a public address, letting many internal hosts share internet access.

Translation that rewrites the destination address, and often the port, of inbound packets so external clients can reach a server on an internal private address.

A software routing instance with its own routing table, interfaces, and next hops, allowing a single firewall to act as several independent routers.

A manually configured entry that sends traffic for a given destination network to a fixed next hop or interface, with no dynamic learning.

A rule that overrides the normal routing table for matching traffic and sends it out a chosen interface or next hop, often used for traffic steering or inspection.

A situation where packets of a flow arrive through one path and return through another, which can break stateful inspection and cause silent drops.

A preference value attached to each routing source; when two protocols offer a route to the same network, the lower value wins.

An encrypted, authenticated connection between two gateways that protects traffic as it crosses an untrusted network such as the internet.

The first negotiation between VPN peers, which authenticates each side and builds a secure management channel used to set up the IPsec tunnels.

The second negotiation, which creates the IPsec security associations that define which traffic is protected and which encryption and integrity algorithms are used.

A secret text string entered identically on both VPN peers and used during IKE to prove each side's identity before any tunnel is built.

A property of key exchange where every session derives fresh keys, so stealing one key does not let an attacker decrypt earlier or later sessions.

A VPN design that places a tunnel interface in the routing table and steers traffic into the tunnel with routes, instead of selecting traffic by proxy identifiers.

A keepalive method that periodically probes the remote VPN gateway and tears down or rebuilds the tunnel when replies stop arriving.

A pair arrangement where one device carries all traffic while the other stays synchronized and idle, ready to take over if the active device fails.

A pair arrangement where both devices forward traffic simultaneously, usually with sessions split between them, giving higher throughput but more complex troubleshooting.

The connection between HA peers that carries heartbeats, role negotiation, and configuration synchronization so both agree which device should be active.

The continuous copying of connection and NAT state from one HA peer to the other so established sessions keep working after a failover.

Health checks that probe a target address or interface and trigger a failover when the monitored path becomes unreachable, even if local links stay up.

A condition where the HA control link fails and both peers conclude they are active, producing duplicate addresses, conflicting ARP replies, and unpredictable forwarding.

A per-session record listing source, destination, application, matched rule, bytes, and the action taken, used for troubleshooting and auditing.

An entry written when a security profile detects malicious or suspicious content in inspected traffic, such as a virus, exploit attempt, or spyware callback.

A configuration that decides which log types go to which external destinations, such as a syslog server, email recipient, or SIEM.

A standard protocol for sending event messages from the firewall to a central collector, where they are stored, searched, and correlated with other devices.