JNCIA Security Fundamentals 2 — Questions and Answers

Question 1: What is the primary purpose of a Junos firewall filter?

To match packets and apply actions such as accept, discard, or reject (Correct answer)
To encrypt traffic between interfaces
To perform NAT translation
To load balance traffic

Correct answer: To match packets and apply actions such as accept, discard, or reject

Junos firewall filters (stateless ACLs) use match conditions and actions to control packet forwarding. They operate at line rate and can accept, discard, reject, or count packets.

Firewall filters in Junos OS are stateless packet filters configured under [edit firewall family inet filter]. Each filter consists of ordered terms with 'from' (match conditions) and 'then' (actions). Match conditions include source/destination address, port, protocol, DSCP. Actions include accept, discard (silent drop), reject (sends ICMP unreachable), count, log, and syslog. Filters are applied to interfaces as input or output.

Question 2: Which Junos feature provides stateful packet inspection for SRX devices?

Security policies with zones (Correct answer)
Firewall filters
Routing policies
Class of Service schedulers

Correct answer: Security policies with zones

On Junos SRX devices, security policies combined with security zones provide stateful inspection, tracking connection state for TCP, UDP, and ICMP sessions.

While EX/MX use stateless firewall filters, SRX devices use a zone-based stateful firewall model. Interfaces are assigned to security zones (e.g., trust, untrust). Security policies define which traffic is permitted between zones and what security services (UTM, IPS, AppFW) apply. Sessions are tracked in a session table allowing return traffic automatically. This is configured under [edit security policies] and [edit security zones].

Question 3: In Junos, what is the default action of a firewall filter term if no 'then' action is specified?

Accept (Correct answer)
Discard
Reject
Log and accept

Correct answer: Accept

If a firewall filter term matches but has no 'then' action specified, the default action is 'accept'. However, the implicit default at the end of a filter is 'discard'.

In Junos firewall filters, if a term matches and no 'then' clause is specified, the action defaults to 'accept'. At the end of every filter, there is an implicit default term that discards all unmatched traffic. This means if no term matches, packets are silently dropped. Best practice is to include an explicit 'term default { then accept; }' or 'then discard;' at the end of filters for clarity.

Question 4: What does the 'reject' action in a Junos firewall filter do differently from 'discard'?

'reject' sends an ICMP unreachable message to the sender; 'discard' silently drops the packet (Correct answer)
'reject' logs the packet; 'discard' does not
'reject' drops only TCP packets; 'discard' drops all protocols
'reject' and 'discard' are functionally identical

Correct answer: 'reject' sends an ICMP unreachable message to the sender; 'discard' silently drops the packet

The 'reject' action drops the packet and sends an ICMP 'destination unreachable' message back to the source, while 'discard' performs a silent drop with no notification.

In Junos firewall filters, 'discard' drops packets silently (black hole), which can cause timeouts on the sender. 'reject' drops the packet and sends an ICMP Type 3 (Destination Unreachable) message back to the source, allowing applications to fail fast. For TCP, 'reject' sends a TCP RST. 'Reject' is preferred for internal policies where immediate error notification is desired; 'discard' is used when you don't want to reveal the filter's existence.

Question 5: In Junos OS, what is the purpose of the 'log' action in a firewall filter?

Stores packet header information in the Routing Engine's firewall log buffer (Correct answer)
Sends a syslog message to an external syslog server
Records the full packet payload to disk
Generates an SNMP trap

Correct answer: Stores packet header information in the Routing Engine's firewall log buffer

The 'log' action in a Junos firewall filter records basic packet information (timestamp, protocol, addresses, ports) in the Routing Engine's local firewall log, viewable with 'show firewall log'.

The 'log' action stores a record of matching packets in a local circular buffer on the Routing Engine. This log is viewable using 'show firewall log' in operational mode. The 'syslog' action sends information to the system's syslog. Both can be combined: 'then { log; syslog; accept; }'. The log buffer is limited in size and wraps, so high-volume logging should use syslog for persistent records.

Question 6: Which command applies a firewall filter to an interface in the input direction?

set interfaces ge-0/0/0 unit 0 family inet filter input FILTER-NAME (Correct answer)
set firewall filter FILTER-NAME apply-to ge-0/0/0
set interfaces ge-0/0/0 filter input FILTER-NAME
apply filter FILTER-NAME to ge-0/0/0 input

Correct answer: set interfaces ge-0/0/0 unit 0 family inet filter input FILTER-NAME

Firewall filters are applied to logical interfaces under the protocol family. The correct syntax is 'set interfaces [if] unit [n] family inet filter input [name]'.

In Junos, firewall filters must be applied to an interface's logical unit under the appropriate address family. For IPv4: [edit interfaces ge-0/0/0 unit 0 family inet filter input FILTER-NAME]. For output: replace 'input' with 'output'. A filter can be applied to both input and output simultaneously. Filters applied at input process packets entering the interface; output filters process packets leaving the interface toward the network.

JNCIA Security Fundamentals 2

What is the primary purpose of a Junos firewall filter?