JN0-336: Security, Specialist (JNCIS-SEC)Demo

Juniper Identity Management Service centralizes user identity data and IP-address-to-user mappings for SRX firewalls. The firewalls use this identity information to populate authentication entries and apply user- or group-based security policies.

ip-notify records the event but does not take action against future matching traffic, allowing administrators to assess the activity without disrupting it. Juniper Junos OS ip-action reference

An SRX SSL forward proxy acts as a client when communicating with destination servers. It terminates the client-side TLS session and presents a replacement certificate that is signed by the SRX-configured root CA; client devices must trust that CA. The original server certificate is intercepted rather than forwarded unchanged.

The primary-server address is 192.168.1.10, and its connection status is Online. The connection-status field represents connectivity from the SRX Series Firewall to the Juniper Identity Management Service (JIMS) server. It does not report JIMS connectivity to a domain controller.

Asymmetric encryption uses a paired public key and private key. Symmetric encryption—including DES and AES—uses a single shared key.

An SRX firewall using Active Directory directly as its identity source supports a maximum of 10 domain controllers on the higher-capacity supported platforms. With 15 domain controllers, the deployment exceeds that limit. JIMS is intended to collect and maintain identity data from larger, distributed Active Directory environments and supports many more event-log sources.

A client-protection SSL proxy is a forward proxy. Its profile requires a configured root CA so the firewall can generate and sign certificates presented to internal clients, while a server certificate is not configured. Juniper documents the supported forward-proxy combination as root-ca configured and server-certificate not configured.

An SRX chassis cluster uses one shared, nonzero cluster ID for both members and node IDs 0 and 1 for its two devices. The set chassis cluster cluster-id ... node ... command is an operational-mode command. Cluster ID 0 disables clustering, and valid node IDs range only from 0 through 1.

JIMS uses domain PC probes as a supplement to event-log collection when IP-address-to-username mapping information is unavailable. A successful probe obtains the active user's identity details, allowing JIMS to update its authentication information and provide the updated identity mapping to SRX enforcement points. PC probes are not sent to all domain PCs on a universal 30-second or 60-second schedule.

Juniper Secure Connect supports external authentication for remote users, including RADIUS, LDAP, and identity-provider-based authentication. It also supports SSL VPN connectivity, including use when IPsec ports are not allowed, which provides flexibility in establishing secure remote access.

Adaptive Threat Profiling can use SRX Series Firewalls as sensors on tap ports to detect threats and share intelligence, while inline devices enforce policy in real time.

An SSL proxy profile is applied as an application service in a security policy. SSL proxy services are bypassed if the policy has no advanced Layer 7 service configured, so the policy must also enable a Layer 7 service for decrypted traffic processing.

The Drop Packet action discards the matching packet before it reaches its destination without closing the connection or sending reset packets, which is a silent discard. Juniper documents it as dropping the matching packet while leaving the connection open.

Hashing produces a fixed-size digest from input data. VPN protocols use hashes or keyed hash mechanisms to verify data integrity, detecting whether transmitted data has been altered. Hashing does not encrypt data for confidentiality or compress it.

Nonzero ESP authentication and decryption failures indicate that ESP-protected packets do not match the configured authentication or encryption parameters, so the ESP configuration is incorrect between the tunnel endpoints. The encrypted and decrypted packet and byte counters are all zero, meaning no traffic has been successfully processed through the tunnel. Zero AH authentication failures do not indicate an AH configuration problem.

Juniper ATP Cloud requires an SSL forward-proxy (SSL proxy) profile to inspect encrypted HTTPS traffic for malware. The profile must be configured and applied to the security policy so the HTTPS payload can be decrypted and scanned.

In a Junos IDP IPS rule, custom attack objects are matched in the attacks custom-attacks hierarchy, while the rule response is configured under then action. The drop-packet action drops the matching packet before it reaches its destination.

Juniper ATP Cloud uses dynamic sandbox analysis with realistic user interactions and environments to induce evasive malware to execute, improving detection. It also uses threat intelligence and mitigation capabilities to identify, block, and remediate known and unknown threats in real time.

SSL Proxy uses application-identification services to dynamically determine whether a session is SSL-encrypted. A session marked as encrypted by application identification can transition to SSL proxy processing; static port binding is used only as a fallback if application-identification results are unavailable.

A CGNAT-hosted mobile endpoint requires NAT Traversal (NAT-T), which encapsulates IKE and ESP in UDP so address and port translation does not invalidate IPsec traffic. For an SRX dynamic endpoint VPN using IKEv1, the IKE policy must use aggressive mode so the unknown-address peer can be identified during negotiation. IKEv2 does not use aggressive mode, and Dead Peer Detection is optional liveness monitoring rather than the required dynamic-endpoint setting. Juniper: IPsec VPN configuration overview

Encapsulating Security Payload (ESP) is the IPsec protocol that encrypts payload data to provide confidentiality. Authentication Header (AH) provides integrity and data-origin authentication but does not encrypt the payload.

An SRX Series Firewall uses Lightweight Directory Access Protocol (LDAP) as a client to query Active Directory for user and group information. In typical deployments, the Windows domain controller acts as the LDAP server.

An enabled Junos chassis cluster uses a cluster ID from 1 through 255; setting the cluster ID to 0 disables clustering. Its two members use node IDs 0 and 1.

A device policy is created for an individual device and is used to push a unique firewall-policy configuration per device. Device policy rules are therefore the appropriate rule type for a specific SRX Series device.