Certified Stormshield Network Troubleshooting & Support (NT-CSNTS)

• SSH features
• File system and associated commands
• Directories and associated commands
• System and user environment
• Files and associated commands

Logs

• Local logs: location, characteristics, syntax and categories
• Associated commands
• Configuration files
• Logd, logctl, kernel message logs

Configuration files

• Directories, structure and general syntax
• Backups (*.na), decbackup and tar
• Default configuration

Objects

• Object syntax
• Dynamic and FQDN objects

Network and routing

• Network interface settings
• Bridges and associated commands
• Routing functions and their priorities
• Default routes and static routes
• Gatemon and router objects
• Dynamic routing
• Relative commands and showing routes
• Verbose mode
• Lab: Network and routing

Traffic captures and analyses

• Introduction and tips
• General syntax and arguments
• Common filters
• Commented examples and preparations for effective captures
• Analyzing traffic with tcpdump (TCP and UDP/icmp traffic)
• Lab: Network/tcpdump

ASQ: the various stages of its analysis

• Step-by-step analysis of network layers
• Associated commands
• Global settings
• Special profiles and settings
• Asynchronous ASQ: various cases and watermarking
• ASQ verbose mode
• Lab: ASQ settings

ASQ: security policy

• Configuration files and directories, and rule syntax
• Filtering: associated commands
• Filtering: examples of loaded rules (action, inspection level, plugin, PBR, QoS, interfaces and proxy)
• Filtering: translation of groups and lists
• NAT: revision (dynamic NAT, static NAT by port, static NAT/bimap and no NAT)
• NAT: associated commands
• NAT: syntax of loaded rules
• Lab: NAT and filtering

ASQ: stateful tracking and status tables

• Protected address table
• Host table
• Connection table: examples of connection statuses (NAT, vconn, FTP plugin, async, lite, etc.)
• Lab: ASQ stateful tracking

Daemons and processes

• Lists and roles
• Supervisor daemon
• Relative commands

Eventd: event manager

IPSec VPN

Lessons

• Stormshield Network IKE/IPsec implementation
• Configuration files
• Security policy (SPD and SAD)
• IKE negotiations
• Negotiations: main mode and aggressive mode
• ISAKMP and IPsec SAs
• IKE proposals
• Specific features: NAT-T, DPD, Keepalive, SharedSA, Policy None and SPD cache
• Associated commands
• Analysis of an IPSec-SA
• Logs
• “Delete SA” notifications
• ISAKMP traffic captures and analyses
• Particularities of dynamic peers
• Verbose mode and common errors
• Lab: ISAKMP/IPsec

PKIs and certificates

• Recap and global directives
• CA directory
• Configuration tips
• Certificate verification

High availability

• Overview
• Configuration files
• Relative commands
• Enabling HA and managing network interfaces
• Processes and traffic involved
• Replications/synchronization
• HA events and logs