CloudLabBox
Try the free demo

Multi-vendor firewall and VPN practice labs

16 guided labs that build, connect and troubleshoot site-to-site IPsec VPNs between Cisco IOS, Cisco ASA, FortiGate, PAN-OS, Juniper vSRX, Check Point, MikroTik and pfSense: crypto maps and VTIs, traffic selectors and proxy IDs, NAT traversal, WireGuard, certificates, BGP over redundant tunnels, DMVPN and ADVPN, and one security policy written for four firewalls, with three troubleshooting labs and a capstone that merges two companies.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 11 of the 16 labs also run in the free demo.

Guided labs
16
Follows
IPsec topics of Cisco SCOR 350-701, Fortinet NSE 4, Palo Alto Networks Next-Generation Firewall Engineer, Juniper JNCIS-SEC, Check Point CCSA and CCSE, CompTIA Network+ and Security+
Runs every lab
Standard
Devices
IOSv, FortiGate, ASAv, vSRX NextGen template, RouterOS, EVE-NG GUI server, VM-Series, Security Gateway VE, Security Management Server and pfSense CE

Who these labs are for

For network and security engineers who look after more than one firewall brand: anyone who has to bring up a tunnel to a partner, a newly acquired company or a cloud edge, and anyone preparing for the IPsec parts of the SCOR, NSE 4, NGFW Engineer, JNCIS-SEC or Check Point exams. You should already be comfortable on at least one vendor’s CLI.

Every tunnel is checked with each vendor’s own commands. The FortiGates run on their evaluation licence, which allows only DES for IPsec, so their tunnels use DES and those labs say what production uses instead.

The 16 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

Firewalls and VPNs course 16 labs

Shared folderFirewalls and VPNs multi-vendor guided labs

One VPN topic per lab across the vendors, then three troubleshooting labs and a capstone that merges two companies with overlapping networks.

  1. 01IKEv2 between IOS routers - crypto map then VTI

    Connect a depot to HQ with a policy-based IKEv2 crypto map and a shop with a route-based virtual tunnel interface (VTI), using AES-256-GCM and DH group 20, then add a new HQ subnet and see why route-based VPNs replaced crypto maps.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  2. 02IOS VTI to a vSRX st0 interface with OSPF over the tunnel

    Build a route-based IKEv2 tunnel between a Cisco IOS router and a Juniper vSRX, bind it to st0 in its own security zone, run OSPF across it, and learn the SRX pieces an IOS engineer forgets: zones, host-inbound traffic, policies and the tunnel MTU.

    4× IOSv, 1× vSRX NextGen template

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  3. 03ASA crypto map to an IOS VTI - matching traffic selectors

    Join a policy-based ASA to a branch router that uses route-based tunnels. Watch a static VTI refuse the ASA's traffic selectors, then fix it with a dynamic VTI that accepts them and injects the route, while the ASA keeps its crypto map, NAT exemption and internet PAT.

    4× IOSv, 1× ASAv

    5 vCPU, 4,096 MBFits LiteRuns in the free demo

  4. 04FortiGate to IOS - phase 1 and 2 through carrier-grade NAT

    Connect a FortiGate head office to an IOS branch router that sits behind the ISP's carrier-grade NAT. Match phase 1 and phase 2 across the two vendors, watch NAT traversal move IKE and ESP to UDP 4500, and see honestly why this evaluation FortiGate can only offer DES.

    3× IOSv, 1× FortiGate, 1× RouterOS

    5 vCPU, 3,840 MBFits LiteRuns in the free demo

  5. 05PAN-OS to vSRX - IKE gateways crypto profiles and proxy IDs

    Connect a Palo Alto Networks firewall to a Juniper vSRX with a route-based IKEv2 tunnel, then narrow the SRX to specific traffic selectors and match them on PAN-OS with a proxy ID, reading each vendor's own view of the SAs.

    3× IOSv, 1× VM-Series, 1× vSRX NextGen template

    7 vCPU, 11,264 MBFits Standard

  6. 06Check Point to IOS with an interoperable device

    Connect a Cisco IOS branch router to a Check Point gateway. Describe the router to the management server as an interoperable device, give each side its VPN domain, build a star community with IKEv2 and a pre-shared key, allow the traffic in the policy, then mirror it all in an IOS crypto map and prove the tunnel on both vendors' own commands.

    3× IOSv, 1× Security Gateway VE, 1× Security Management Server

    9 vCPU, 13,824 MBFits Standard

  7. 07MikroTik to pfSense IPsec then WireGuard between MikroTiks

    Join a MikroTik shop router to a pfSense head office with IKEv2, including the pfSense bogon trap and MikroTik's NAT bypass, then link two MikroTik shops with WireGuard and compare a policy-based IPsec tunnel with a routed WireGuard one.

    3× RouterOS, 1× pfSense CE, 1× EVE-NG GUI server

    5 vCPU, 2,816 MBFits LiteRuns in the free demo

  8. 08NAT and VPN together - exemptions identities and NAT-T

    Connect an ASA site and a FortiGate site to an IOS head office. Exempt VPN traffic from the ASA's PAT with identity NAT, keep NAT out of the FortiGate's VPN policies, and bring up a tunnel to a FortiGate that sits behind its ISP's static NAT, where NAT traversal and a private IKE identity both have to be handled.

    4× IOSv, 1× ASAv, 1× FortiGate

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  9. 09Certificate authentication - an OpenSSL CA for IOS and vSRX

    Replace pre-shared keys with certificates. Run a small certificate authority with OpenSSL, load an identity certificate onto a Cisco IOS router and a Juniper vSRX, and bring up IKEv2 with RSA signatures and FQDN identities that each side checks against the other's certificate.

    3× IOSv, 1× vSRX NextGen template, 1× EVE-NG GUI server

    6 vCPU, 6,656 MBFits LiteRuns in the free demo

  10. 10BGP over redundant tunnels with DPD and BFD

    A branch router has one tunnel to a FortiGate and one to a vSRX at head office. Run eBGP over both, prefer the FortiGate in both directions so traffic stays symmetric through one stateful firewall, add BFD and dead peer detection, then break the path to the FortiGate and watch traffic fail over within seconds.

    3× IOSv, 1× FortiGate, 1× vSRX NextGen template

    6 vCPU, 7,680 MBFits LiteRuns in the free demo

  11. 11Hub and spoke - DMVPN phase 3 on IOS and ADVPN on FortiGate

    Run two hub-and-spoke VPNs side by side. Protect an IOS DMVPN with IKEv2 and turn on phase 3 so spokes build direct tunnels after an NHRP redirect, then turn on ADVPN on a FortiGate dial-up hub with BGP so its spokes do the same, and compare how each one finds the shortcut.

    3× FortiGate, 3× IOSv

    6 vCPU, 7,680 MBFits LiteRuns in the free demo

  12. 12One policy four firewalls - ASA FortiGate PAN-OS and SRX

    Write one three-zone security policy (inside, DMZ, outside) in four dialects: ASA security levels and interface access lists, FortiGate interface-pair policies, PAN-OS zone rules with App-ID, and SRX zone-pair policies. One test router, with a VRF on every zone, proves each rule from the outside.

    1× ASAv, 1× FortiGate, 1× IOSv, 1× VM-Series, 1× vSRX NextGen template

    7 vCPU, 14,336 MBFits Standard

  13. 13Troubleshooting phase 1 across four vendors

    An IOS hub has three IKEv2 spokes, an ASA, a FortiGate and a vSRX, and none of them comes up. Find the proposal, pre-shared key, IKE version and identity faults from each vendor's own IKE output and logs, fix each on the right device and bring all three tunnels up.

    4× IOSv, 1× ASAv, 1× FortiGate, 1× vSRX NextGen template

    8 vCPU, 10,240 MBFits Standard

  14. 14Troubleshooting phase 2 - selectors NAT and routing

    Two tunnels to an IOS head office are broken by five realistic phase 2 faults on an ASA, a FortiGate and the IOS router: mismatched selectors, a NAT exemption in the wrong section, a route-based peer given narrow selectors, a safety route that wins, and a route that sends VPN traffic to the internet. Find each one from the evidence, fix it and prove both tunnels carry traffic both ways.

    4× IOSv, 1× ASAv, 1× FortiGate

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  15. 15Asymmetric routing and stateful firewalls

    A routing change sends replies back through a different firewall from the one the request used. Find the three places the traffic dies (an IOS strict uRPF check, the FortiGate session table and the ASA's TCP state check) with each vendor's own tools, then fix the routing rather than switching the safety checks off.

    4× IOSv, 1× ASAv, 1× FortiGate

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  16. 16Capstone - merge two companies with overlapping networks

    Ashgrove (Cisco ASA) has bought Brook (Juniper vSRX, with an IOS branch). Both use 10.0.1.0/24 for their servers. Build a route-based tunnel between the ASA and the SRX and translate each company into a unique range on the way through, so both head offices and Brook's branch can reach each other, without renumbering anything and without breaking either company's internet access.

    4× IOSv, 1× ASAv, 1× vSRX NextGen template

    7 vCPU, 8,192 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the Firewalls and VPNs practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB1552
Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB810
Cisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB77
Juniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB77
MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB24
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB22
Palo Alto Networks VM-Series (PAN-OS)paloalto-11.2.52 vCPU, 5,632 MB22
Check Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB11
Check Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB11
Netgate pfSense CEpfsense-CE-2.5.2-RELEASE1 vCPU, 1,024 MB11

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the Firewalls and VPNs labs

Are these Firewalls and VPNs labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 11 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 11 of the 16. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “One policy four firewalls - ASA FortiGate PAN-OS and SRX”, needs 7 vCPU and 14,336 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from the vendors or exam bodies?

No. CloudLabBox wrote them to follow the topics of Cisco’s SCOR 350-701 (v2.0), Fortinet’s NSE 4 FortiOS 7.6, Palo Alto Networks’ Next-Generation Firewall Engineer, Juniper’s JNCIS-SEC (JN0-336), Check Point’s CCSA and CCSE (R82), and CompTIA’s Network+ (N10-009) and Security+ (SY0-701), where they cover IPsec and VPNs. They aren’t training material from the vendors or exam bodies, and CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks.

Do I need vendor licences for these labs?

No. The FortiGates run FortiOS 7.0 under its evaluation licence, the vSRX nodes use the image’s built-in 60-day trial, PAN-OS 11.2.5 runs with no licence, and the Check Point images carry their own evaluation licences. The evaluation licence allows only DES for IPsec, so the FortiGate tunnels use it, and those labs say what production uses instead: AES-256-GCM with DH 19, 20 or 21. CloudLabBox doesn’t provide vendor licences or subscriptions.

How does the Check Point lab work?

Lab 06 peers an R81.20 gateway with Cisco IOS as an interoperable device, using the management API through mgmt_cli rather than SmartConsole. Allow 15 to 20 minutes from boot, and you paste two fast-forward blocks. The exam named is on R82, and the lab runs on R81.20 images.

How long do the firewalls take to boot?

PAN-OS and the vSRX take about ten minutes, and the vSRX can take 12 when the host is busy. An ASAv takes about five minutes on its first start, while EVE-NG types its starting configuration for you, so wait for its hostname prompt before you type. Each lab’s pane says what to wait for.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 11 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.