JNCIA Firewall Filters 1 — Questions and Answers
Question 1: What is the primary function of a stateless firewall filter in Junos OS?
- To track connection state and allow or deny traffic based on session tables
- To examine individual packets based on match conditions and apply defined actions (Correct answer)
- To provide NAT functionality for translating IP addresses on interfaces
- To encrypt traffic between network endpoints using IPsec
Correct answer: To examine individual packets based on match conditions and apply defined actions
Junos stateless firewall filters examine each packet individually against defined match conditions and apply actions without maintaining session state.
Question 2: Which Junos CLI command correctly applies a firewall filter in the inbound direction on a logical interface?
- set interfaces ge-0/0/0 unit 0 family inet filter input <filter-name> (Correct answer)
- set firewall filter <filter-name> apply interface ge-0/0/0 input
- set policy-options policy-statement <filter-name> apply ge-0/0/0
- set interfaces ge-0/0/0 firewall-filter <filter-name> direction input
Correct answer: set interfaces ge-0/0/0 unit 0 family inet filter input <filter-name>
Firewall filters are applied under the interface's logical unit and address family using the 'filter input' or 'filter output' knob.
Question 3: What are the two fundamental building blocks of a Junos OS firewall filter?
- Policies and rules
- Terms and actions (Correct answer)
- Access lists and extended lists
- Match sets and forwarding tables
Correct answer: Terms and actions
A Junos firewall filter is composed of ordered terms, where each term contains match conditions (from) and actions (then).
Question 4: What happens to a packet that does not match any term in a Junos firewall filter?
- It is accepted and forwarded normally
- It is rejected with an ICMP unreachable message sent to the source
- It is silently discarded by an implicit default action (Correct answer)
- It is forwarded to the Routing Engine for further processing
Correct answer: It is silently discarded by an implicit default action
Junos firewall filters have an implicit discard at the end, so any packet not matched by an explicit term is silently dropped.
Question 5: Which of the following is a valid match condition that can be used in a Junos firewall filter term?
- next-hop
- source-address (Correct answer)
- ttl-exceeded
- routing-instance
Correct answer: source-address
The 'source-address' match condition is a standard IPv4 match condition in a Junos inet firewall filter term.
Question 6: What is the key difference between the 'reject' and 'discard' actions in a Junos firewall filter?
- 'Reject' drops the packet silently; 'discard' sends an ICMP unreachable back to the sender
- 'Reject' sends an ICMP unreachable to the sender; 'discard' drops the packet silently (Correct answer)
- Both actions are identical and produce the same behavior
- 'Reject' logs the packet to syslog; 'discard' increments a counter only
Correct answer: 'Reject' sends an ICMP unreachable to the sender; 'discard' drops the packet silently
'Reject' drops the packet and sends an ICMP unreachable message to the source, while 'discard' silently drops the packet with no notification.
Question 7: On which Junos component are stateless firewall filters primarily processed for transit traffic?
- Routing Engine (RE)
- Packet Forwarding Engine (PFE) (Correct answer)
- Management plane daemon
- Control plane protocol stack
Correct answer: Packet Forwarding Engine (PFE)
Stateless firewall filters for transit traffic are enforced on the Packet Forwarding Engine (PFE) in hardware, enabling line-rate filtering.
JNCIA Firewall Filters 1
What is the primary function of a stateless firewall filter in Junos OS?