Threat Defense, NGFW, TrustSec & MACsec Quick Reference

No single security layer is assumed sufficient — multiple, genuinely independent layers (endpoint, network, perimeter) each catch what another might miss. The layers are also meant to be coordinated: an endpoint detection can trigger network-wide enforcement automatically, not just log the event in isolation.

Signature-based detection: fast and precise for KNOWN threats, but structurally blind to genuinely novel ones until a signature exists.

Behavior-based detection: can catch novel threats by watching for suspicious activity patterns, at the cost of more false positives.

Posture assessment only matters if it's tied to actual network-access enforcement (like a restricted VLAN for non-compliant devices) — a posture check that only reports, without enforcing, is a monitoring feature, not a security control.

Routed mode: the NGFW is a Layer 3 hop with its own IP addressing — full inspection, but requires re-addressing/re-routing to insert into an existing segment.

Transparent mode: the NGFW sits as a Layer 2 device with no data-path IP addressing — same inspection capability, but can be inserted into an already-addressed segment with no re-addressing or re-routing required.

Security Group Tags assign policy based on authenticated IDENTITY, not IP address or VLAN — policy stays valid even as a device's address or physical location changes.

SGT propagation requires every hop to either support inline tagging or have SXP configured — a single unmanaged, non-participating device anywhere along the path breaks propagation for that segment, even with correct SGACL policy and correct assignment everywhere else.

MACsec encrypts Layer 2 traffic between two DIRECTLY connected devices only — unlike IPsec's typical end-to-end, multi-hop scope. An intermediate device with no MACsec capability creates a genuine, unencrypted gap on that specific segment, even with MACsec correctly configured on the segments to either side of it.