CloudLabBox
Try the free demo

JNCIA-SEC and JNCIS-SEC practice labs

16 guided labs on the Juniper vSRX: security policies, screens and ALGs, NAT, routing instances, route-based and policy-based IPsec VPNs, chassis clusters with real failover, custom IDP attacks, SSL forward proxy, identity-aware policy and logging, with troubleshooting labs and a capstone.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 9 of the 16 labs also run in the free demo.

Guided labs
16
Follows
Juniper JNCIA-SEC (JN0-232) and JNCIS-SEC (JN0-336)
Runs every lab
Standard
Devices
EVE-NG GUI server, vSRX NextGen template, IOSv and vSRX NextGen template

Who these labs are for

For anyone preparing for JNCIA-SEC or JNCIS-SEC, and engineers who look after SRX firewalls.

The labs run on the vSRX’s built-in 60-day trial, and each pane says plainly what that trial can and can’t show.

The 16 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

JNCIA-SEC and JNCIS-SEC course 16 labs

Shared folderJNCIA-SEC and JNCIS-SEC SRX security guided labs

From first steps and policies to VPNs, chassis clusters and IDP, then troubleshooting and a capstone.

  1. 01SRX first steps with zones and host-inbound traffic

    Bring a blank SRX into service: address its interfaces, build trust, dmz and untrust zones, decide what may reach the firewall itself, write the first policy and read the session table.

    1× vSRX NextGen template, 3× EVE-NG GUI server

    5 vCPU, 7,168 MBFits LiteRuns in the free demo

  2. 02Security policies with objects and order

    Replace an empty rule base with named addresses and applications, get the order right, find a shadowed rule, add a global policy, and see why unified policies need a signature package.

    1× vSRX NextGen template, 3× EVE-NG GUI server

    5 vCPU, 7,168 MBFits LiteRuns in the free demo

  3. 03Screens and ALGs

    Bind a screen to the untrust zone in alarm mode, read what it catches from crafted attacks, let it drop a real flood, then see exactly why FTP stops when its ALG is off.

    1× vSRX NextGen template, 3× EVE-NG GUI server

    5 vCPU, 7,168 MBFits LiteRuns in the free demo

  4. 04NAT and proxy ARP

    Give Hartwell its public addressing: interface NAT, a PAT pool, a pool that keeps ports, destination NAT for the public site, static NAT for a mail relay, and proxy ARP for all of them.

    1× vSRX NextGen template, 3× EVE-NG GUI server

    5 vCPU, 7,168 MBFits LiteRuns in the free demo

  5. 05Routing instances and filter-based forwarding

    Send voice traffic out of a second internet line with filter-based forwarding, and keep guests in their own virtual router, joined to the main table by a next-table route and a rib-group.

    2× IOSv, 1× vSRX NextGen template, 2× EVE-NG GUI server

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  6. 06Route-based IKEv2 VPN with st0

    Join Poole and Falmouth with a route-based IKEv2 VPN: proposals, policies, gateway, st0 in its own zone, routes and policies, then dead peer detection.

    2× vSRX NextGen template, 1× IOSv, 2× EVE-NG GUI server

    7 vCPU, 10,752 MBFits Standard

  7. 07Policy-based VPN and traffic selectors

    Build a policy-based VPN with pair policies and a NAT exemption alongside a route-based VPN with a traffic selector, compare how each picks its traffic, and read about dial-up.

    2× vSRX NextGen template, 1× IOSv, 2× EVE-NG GUI server

    7 vCPU, 10,752 MBFits Standard

  8. 08VPN troubleshooting with traceoptions

    A VPN that has never worked has five faults, one behind another. Use IKE traceoptions and SA output on both ends to find each one, fix it, and leave the firewalls clean.

    2× vSRX NextGen template, 1× IOSv, 2× EVE-NG GUI server

    7 vCPU, 10,752 MBFits Standard

  9. 09Chassis cluster build

    Turn two vSRX firewalls into a chassis cluster: enable it, renumber your thinking, add node groups, fabric links, redundancy groups and reth interfaces, then read the session copied to the standby node.

    2× vSRX NextGen template, 2× EVE-NG GUI server

    6 vCPU, 10,240 MBFits Standard

  10. 10Cluster failover and troubleshooting

    Load a contractor's cluster configuration, find its four faults against the design, then prove failover by hand, by a failed link, and with a download running across it.

    2× vSRX NextGen template, 2× EVE-NG GUI server

    6 vCPU, 10,240 MBFits Standard

  11. 11Content security and IDP

    Block a site with local web filtering, stop program downloads with content filtering, and drop an attack with an IDP custom signature, with a plain account of what the trial image can and can not do.

    1× vSRX NextGen template, 2× EVE-NG GUI server

    4 vCPU, 6,144 MBFits LiteRuns in the free demo

  12. 12SSL forward proxy with a lab CA

    Make the SRX a forward proxy: build a private CA, load upstream trust, find out why a proxy on its own does nothing, deploy the CA to a client, and stop an attack hidden inside HTTPS.

    1× vSRX NextGen template, 2× EVE-NG GUI server

    4 vCPU, 6,144 MBFits LiteRuns in the free demo

  13. 13Identity-aware policy

    Write rules about people rather than addresses: fill the local authentication table, match roles and unknown users in policy, see names in the logs, and read how JIMS feeds the same machinery.

    1× vSRX NextGen template, 2× EVE-NG GUI server

    4 vCPU, 6,144 MBFits LiteRuns in the free demo

  14. 14Logging and monitoring

    Send session logs to a local file and a remote server, read sessions and counters, trace a dropped packet to the policy that dropped it, and find out who changed what.

    1× vSRX NextGen template, 3× EVE-NG GUI server

    5 vCPU, 7,168 MBFits LiteRuns in the free demo

  15. 15Troubleshooting policy NAT and VPN

    Five tickets, five faults across two firewalls: a NAT typing slip, a forgotten block, a destination NAT policy on the wrong address, a VPN on the wrong interface and a one-way rule. Prove each from the evidence.

    2× vSRX NextGen template, 1× IOSv, 3× EVE-NG GUI server

    8 vCPU, 11,776 MBFits Standard

  16. 16Capstone clustered head office and branch VPN

    Deliver the whole design from a brief: a chassis cluster, screens, source and destination NAT, and a route-based VPN on reth1 to the branch, then prove it all survives a failover with a download running.

    3× vSRX NextGen template, 1× IOSv, 3× EVE-NG GUI server

    10 vCPU, 15,872 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the JNCIA-SEC and JNCIS-SEC practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB1639
Juniper vSRX NextGen templatevsrxng-24.4R1.92 vCPU, 4,096 MB1523
Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB67
Juniper vSRX NextGen templatevsrxng-21.2R3-S3.52 vCPU, 4,096 MB11

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIA-SEC and JNCIS-SEC SRX security guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the JNCIA-SEC and JNCIS-SEC labs

Are these JNCIA-SEC and JNCIS-SEC labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 9 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 9 of the 16. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone clustered head office and branch VPN”, needs 10 vCPU and 15,872 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Juniper Networks?

No. CloudLabBox wrote them to follow the topics of Juniper’s JNCIA-SEC (JN0-232) and JNCIS-SEC (JN0-336). They aren’t training material from Juniper Networks, and CloudLabBox is independent of Cisco and Juniper Networks.

Do I need a vendor licence?

No. The labs use the vSRX’s built-in 60-day trial, which starts at a node’s first boot. CloudLabBox doesn’t provide vendor licences or subscriptions.

What can’t the trial show?

IDP and AppID packages aren’t available, so IDP labs use custom attacks and dynamic-application doesn’t commit. Antivirus and antispam are configuration only. Local web filtering inspects traffic on Junos 21.2, which is why lab 11 runs that version. JIMS, Secure Connect, ATP Cloud and Security Director are reading only.

Which plan do I need?

Nine of the 16 labs fit Lite, and seven need Standard. The capstone uses 10 vCPU and 15.9 GB, the top of Standard.

How long does a vSRX take to start?

A few minutes to a usable CLI, usually 3 to 8, then a minute or two more for the forwarding plane. Cluster labs start with two reboot commands, about 4 minutes.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 9 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Cisco and Juniper Networks. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.