CloudLabBox
Try the free demo

JNCIA-SEC and JNCIS-SEC lab 16 of 16

Capstone clustered head office and branch VPN

Deliver the whole design from a brief: a chassis cluster, screens, source and destination NAT, and a route-based VPN on reth1 to the branch, then prove it all survives a failover with a download running.

Run this lab

It needs Standard: its 7 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then JNCIA-SEC and JNCIS-SEC SRX security guided labs, then 16 - Capstone clustered head office and branch VPN

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 150 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

This is the handover of Hartwell's new network: a clustered firewall at Poole, joined to Falmouth by a VPN, with public services and proper protection on the internet side. You've done each part in earlier labs. This time, the brief says what must be true, and how you get there is up to you. This is the largest lab in the course, so expect it to take a while on start-up. It needs about 16 GB, the very top of the Standard plan.

DeviceInterfaceAddressNotes
Clusterreth0.010.10.10.1/24Zone trust
Clusterreth1.0198.51.100.2/29Zone untrust, default route to 198.51.100.1
Clusterst0.0172.16.12.1/30Zone vpn
LAN-PCeth010.10.10.10/24Gateway 10.10.10.1, runs the Poole web server
SRX-BRge-0/0/0 / ge-0/0/1203.0.113.2/30 / 10.20.10.1/24Already configured for internet access with source NAT
SRX-BRst0.0172.16.12.2/30Zone vpn
BR-PCeth010.20.10.10/24Gateway 10.20.10.1
ISPGi0/0, Gi0/1, Gi0/2198.51.100.1/29, 203.0.113.1/30, 192.0.2.1/24Already configured
INETeth0192.0.2.10/24A web server on the internet

The ports on the Poole cluster follow the same plan as labs 9 and 10:

Port in EVE (before clustering)After clustering, node0After clustering, node1Used for
first data port (ge-0/0/0)em0em0Control link
second (ge-0/0/1)ge-0/0/0ge-7/0/0Fabric link
third (ge-0/0/2)ge-0/0/1ge-7/0/1reth0, the office LAN
fourth (ge-0/0/3)ge-0/0/2ge-7/0/2reth1, the internet

What you’ll practise

  • Plan and build a cluster from a written brief
  • Layer zones, screens, NAT and policy on reth interfaces
  • Run a route-based VPN on a cluster
  • Prove resilience with live traffic

The tasks

  • The brief
  • Suggested order
  • The final test

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone clustered head office and branch VPN7 nodes and 2 networks, 11 links. Every link is listed as text below the diagram.SRX-ASRX-BSRX-BRISPLAN-PCBR-PCINETLANWANeth0ge-0/0/2Gi0/0Gi0/2eth0ge-0/0/1eth0ge-0/0/3ge-0/0/3ge-0/0/2Gi0/1ge-0/0/0ge-0/0/0ge-0/0/0ge-0/0/1ge-0/0/1
7 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SRX-A ge-0/0/0 to SRX-B ge-0/0/0
  • SRX-A ge-0/0/1 to SRX-B ge-0/0/1
  • SRX-A ge-0/0/2 to LAN (network)
  • SRX-B ge-0/0/2 to LAN (network)
  • SRX-A ge-0/0/3 to WAN (network)
  • SRX-B ge-0/0/3 to WAN (network)
  • LAN-PC eth0 to LAN (network)
  • ISP Gi0/0 to WAN (network)
  • ISP Gi0/1 to SRX-BR ge-0/0/0
  • SRX-BR ge-0/0/1 to BR-PC eth0
  • ISP Gi0/2 to INET eth0
Nodes in Capstone clustered head office and branch VPN, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SRX-AJuniper vSRX NextGen templatevsrxng-24.4R1.92 vCPU, 4,096 MB
SRX-BJuniper vSRX NextGen templatevsrxng-24.4R1.92 vCPU, 4,096 MB
SRX-BRJuniper vSRX NextGen templatevsrxng-24.4R1.92 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
LAN-PCEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
BR-PCEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIA-SEC and JNCIS-SEC SRX security guided labs.

  3. Open 16 - Capstone clustered head office and branch VPN and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More JNCIA-SEC and JNCIS-SEC labs

All JNCIA-SEC and JNCIS-SEC labs

Related labs in other courses

CloudLabBox is independent of Cisco and Juniper Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.