CloudLabBox
Try the free demo

JNCIS-ENT practice labs

17 guided labs on Junos enterprise switching and intermediate routing: VLANs, IRB, spanning tree and its protection features, port security, Layer 2 filters, LAG, protocol-independent routing, filter-based forwarding, OSPF, IS-IS, BGP, GRE and IP-IP tunnels, VRRP and BFD, with two troubleshooting labs. They run on Juniper vJunos-switch and vJunos-router.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 3 of the 17 labs also run in the free demo.

Guided labs
17
Follows
Juniper JNCIS-ENT (JN0-352)
Runs every lab
Standard
Devices
vJunos-router, vJunos-switch and VPCS

Who these labs are for

For engineers who hold or are studying for JNCIA-Junos and are preparing for JNCIS-ENT (JN0-352), or who run Junos switches and routers in an enterprise network. The labs cover every objective of the exam.

vJunos nodes are set to 4 vCPU each, so most of these labs need Standard: the plan card shows which.

The 17 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

JNCIS-ENT course 17 labs

Shared folderJNCIS-ENT JN0-352 guided labs

Switching first, then routing, ending in a switching troubleshooting lab and a routing troubleshooting capstone.

  1. 01Layer 2 switching and MAC learning

    Turn a new Junos switch into a working access switch. You configure access ports the ELS way, watch the switch learn, flood and forward, read and clear the MAC table, change the ageing time and use interface ranges to configure many ports at once.

    1× vJunos-switch, 2× VPCS

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  2. 02VLANs and trunks with native and voice VLANs

    Split two floor switches into staff, guest, voice and management VLANs. You carry them over an 802.1Q trunk, put management on an untagged native VLAN, prove that VLANs isolate traffic, and prepare a desk port for an IP phone with a voice VLAN and LLDP-MED.

    2× vJunos-switch, 4× VPCS

    12 vCPU, 14,336 MBFits Standard

  3. 03Inter-VLAN routing with IRB and DHCP

    Route between the staff and guest VLANs on the switch itself with IRB interfaces, then let the guest VLAN's PCs get their addresses from a DHCP server running on the same switch.

    1× vJunos-switch, 2× VPCS

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  4. 04Spanning tree with STP and RSTP

    Three switches in a triangle: a loop that only spanning tree keeps safe. You find the root bridge the protocol chose by itself, put the root where the design wants it, steer a port role with path cost, and time a failure with RSTP and with classic STP.

    3× vJunos-switch

    12 vCPU, 15,360 MBFits Standard

  5. 05Spanning-tree protection

    Defend the spanning tree you built: shut out a switch that someone plugs into a desk port, stop a rogue switch from becoming root, and keep an alternate port blocked when BPDUs stop arriving on a link that is still passing traffic.

    3× vJunos-switch

    12 vCPU, 15,360 MBFits Standard

  6. 06Port security and DHCP snooping

    Lock down an access switch: stop a hub on a desk port from adding devices, keep known MAC addresses across reboots, build a DHCP snooping table, and use it to drop spoofed ARP replies and packets from statically addressed intruders.

    2× vJunos-switch, 3× VPCS

    11 vCPU, 13,312 MBFits Standard

  7. 07Storm control and Layer 2 filters

    Limit broadcast and multicast storms on access ports, then filter traffic at the three places a Junos switch can: on the port, on the VLAN and on the IRB, and prove the order in which they are applied with counters.

    1× vJunos-switch, 2× VPCS

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  8. 08Link aggregation and redundant trunk groups

    Bundle the two links between the distribution switches into one LACP aggregate, so spanning tree stops blocking one of them, and make a dual-homed access switch fail over to its backup uplink in about a second: with a redundant trunk group on EX hardware, and with RSTP's alternate port on the virtual switches. Finish with how Virtual Chassis would change the design.

    3× vJunos-switch

    12 vCPU, 15,360 MBFits Standard

  9. 09Protocol-independent routing

    Use the routing tools that work whatever the protocol: a static route that resolves through OSPF, an aggregate that advertises one prefix for a whole site, a default route generated only while the ISP is alive, a custom martian, and RIB groups that share routes between a services instance and the main table.

    3× vJunos-router

    12 vCPU, 15,360 MBFits Standard

  10. 10Load balancing and filter-based forwarding

    A branch with two links to one ISP and one link to a cheaper second ISP. You make Junos actually use both equal-cost links, then send guest traffic to the cheaper ISP with filter-based forwarding, while staff traffic stays on the main ISP.

    3× vJunos-router

    12 vCPU, 15,360 MBFits Standard

  11. 11OSPF in depth

    Build a two-area OSPF network from scratch. You control the DR election on a shared segment, read every LSA type in the database, turn the branch area into a stub, a totally stubby area and finally an NSSA that injects a partner network, summarise the branch at the ABR, and secure the branch link with MD5.

    3× vJunos-router

    12 vCPU, 15,360 MBFits Standard

  12. 12IS-IS levels and areas

    Run IS-IS across two areas: an L1/L2 core router, an L2-only edge router and an L1-only branch. You read the link-state database and its TLVs, watch a pre-emptive DIS election, switch to wide metrics, export a static route, and leak a level 2 route into level 1.

    3× vJunos-router

    12 vCPU, 15,360 MBFits Standard

  13. 13BGP routing and path selection

    Dual-home Ashby Freight to its ISP with two edge routers. You bring up IBGP between loopbacks and authenticated EBGP sessions to the ISP, fix the classic next-hop problem, advertise the company aggregate with a community, and steer traffic both ways with local preference and AS-path prepending.

    3× vJunos-router

    12 vCPU, 15,360 MBFits Standard

  14. 14GRE and IP-IP tunnels

    Connect HQ and a branch across a provider that only routes public addresses. You enable tunnel services, build a GRE tunnel and run OSPF through it for the office LANs, add an IP-IP tunnel for the camera network, and learn the tunnel's MTU, its recursive-routing trap and how to troubleshoot it.

    3× vJunos-router

    12 vCPU, 15,360 MBFits Standard

  15. 15High availability with VRRP and BFD

    Give a user LAN a gateway that survives a router or uplink failure with VRRP and interface tracking, cut OSPF failure detection from 40 seconds to under a second with BFD, and enable graceful restart. Along the way you learn what GRES, NSR, NSB and unified ISSU add on dual routing engine systems.

    3× vJunos-router

    12 vCPU, 15,360 MBFits Standard

  16. 16Switching troubleshooting

    Two floor switches were reconfigured over the weekend and five tickets are open. Work from the symptoms to six faults in VLAN membership, trunks, native VLANs, IRB interfaces and ports, using the switching show commands and pings from the PCs.

    2× vJunos-switch, 4× VPCS

    12 vCPU, 14,336 MBFits Standard

  17. 17Routing capstone troubleshooting

    The final routing exam: a dual-homed site with OSPF, IBGP between loopbacks, EBGP to a provider, export and import policy and a VRRP gateway, broken in six places that hide behind each other. Restore it to the design from five trouble tickets.

    3× vJunos-router

    12 vCPU, 15,360 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the JNCIS-ENT practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Juniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB824
Juniper vJunos-switchvjunosswitch-23.4R2-S2.14 vCPU, 5,120 MB918
VPCS hostBuilt in to EVE-NGcounted as 1 vCPU, 1,024 MB617

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIS-ENT JN0-352 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the JNCIS-ENT labs

Are these JNCIS-ENT labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 3 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 3 of the 17. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Spanning tree with STP and RSTP”, needs 12 vCPU and 15,360 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Juniper Networks?

No. CloudLabBox wrote them to follow the topics of Juniper’s JNCIS-ENT exam (JN0-352). They aren’t training material from Juniper Networks, and CloudLabBox is independent of Juniper Networks.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 3 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Juniper Networks. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.