CloudLabBox
Try the free demo

Palo Alto firewall practice labs

30 guided labs on a PAN-OS 11.2 VM-Series firewall, from first boot to a whole small site: interfaces and zones, security policy and NAT, App-ID and custom applications, file blocking and data filtering, custom URL categories and external lists, decryption, User-ID, OSPF and BGP, policy-based forwarding, site-to-site IPsec, high availability, a GlobalProtect SSL tunnel from a lab client, and the XML and REST APIs, with a troubleshooting toolkit and two labs that start broken. Four newer labs go deeper: GlobalProtect from a Linux client with IPsec fallback and HIP checks, HA troubleshooting, packet-flow troubleshooting, and custom App-ID and threat signatures.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 25 of the 30 labs also run in the free demo.

Guided labs
30
Follows
Palo Alto Networks Certified Network Security Analyst and Next-Generation Firewall Engineer (PAN-OS 11.x)
Runs every lab
Standard
Devices
EVE-NG GUI server, VM-Series, IOSv and VM-Series

Who these labs are for

For firewall administrators and network engineers preparing for the Palo Alto Networks Certified Network Security Analyst or Next-Generation Firewall Engineer certification, students following the Firewall Essentials (EDU-210) syllabus, and anyone who needs hands-on PAN-OS practice. You should know IP addressing, routing and basic security ideas.

The firewall image has no licence, so it runs the App-ID content it shipped with and gets no threat, antivirus, WildFire or PAN-DB updates. File blocking, data filtering, custom URL categories, external lists, decryption, User-ID, IPsec and HA all work. The images have no GlobalProtect app, so those labs build real tunnels with a small client written for them. Lab 27 uses a pre-licensed PAN-OS 10.2.5 image for its HIP checks, so its logs show 2023 and it takes 10 to 17 minutes to boot. Each firewall takes 6.5 to 9 minutes to boot and answers “Login incorrect” until it’s ready.

The 30 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

Palo Alto NGFW course 30 labs

Shared folderPalo Alto NGFW PAN-OS 11 guided labs

One PAN-OS topic per lab, a troubleshooting toolkit, two labs with planted faults, a capstone that builds a whole small site, then four deeper labs.

  1. 01First boot and initial configuration

    Take a factory-new PAN-OS 11.2 VM-Series firewall from its first console login to a managed device: forced password change, static management interface, hostname, DNS, banner, time zone and locked-down management access, then log in to the web interface.

    1× VM-Series, 1× EVE-NG GUI server

    3 vCPU, 6,656 MBFits LiteRuns in the free demo

  2. 02Configuration management - commit revert snapshots and rollback

    Work safely with PAN-OS configurations: candidate versus running, previewing and reverting changes, commit descriptions, named snapshots, reading commit and validation errors, rolling back, and checking software, content and licence status.

    1× VM-Series, 1× EVE-NG GUI server

    3 vCPU, 6,656 MBFits LiteRuns in the free demo

  3. 03Administrators roles and authentication

    Give three people the access they need and no more: a read-only auditor, a policy administrator with a custom role, and an operations engineer who signs in through an authentication profile and sequence. Add password complexity, a password-expiry profile, lockout and idle timeout, then prove each account's rights through the XML API.

    1× VM-Series, 1× EVE-NG GUI server

    3 vCPU, 6,656 MBFits LiteRuns in the free demo

  4. 04Layer 3 interfaces zones and the virtual router

    Connect the depot firewall to its three networks: check the factory data plane, build Outside, Inside and DMZ zones on Layer 3 interfaces, add interface management profiles, route through the virtual router with a default route, and prove every hop with the firewall's own test tools.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  5. 05Virtual wire and Layer 2 deployments

    Insert a firewall into a network without changing a single IP address: replace the factory-style virtual wire with your own, write policy between virtual-wire zones, then bridge two warehouse segments at Layer 2 with a VLAN object and control what crosses between them.

    1× VM-Series, 4× EVE-NG GUI server

    6 vCPU, 7,936 MBFits LiteRuns in the free demo

  6. 06Security policy fundamentals

    Write the depot's first real rulebase: address objects, groups and tags; allow rules built on App-ID with application-default; a deny rule placed above the allow; logging on the default rules; shadowed rules; and the tools to prove which rule matches: test security-policy-match, the session table, traffic logs and rule hit counts.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  7. 07NAT - source destination port translation and U-turn

    Build every NAT type an exam expects: dynamic IP and port for users, a bidirectional static NAT for a server's own outbound traffic, destination NAT with port translation to publish the intranet, and U-turn access for inside users. Learn the pre-NAT address, post-NAT zone rule for security policy and prove each translation in the session table.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  8. 08App-ID - from port-based to application-based policy

    Watch App-ID identify real traffic behind a legacy port-based rule: web, TLS, FTP, SSH on a standard and a non-standard port, and an unknown home-grown protocol. Then use Policy Optimizer to turn the port rule into application rules with application-default, and work with dependencies, application filters and groups.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  9. 09Custom applications and application override

    Teach the firewall Calder's home-grown tracking protocol with a custom application and signature, so it's identified on content instead of being unknown-tcp. Then use application override for a trusted high-volume backup stream, and understand exactly what inspection you give up.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  10. 10Security profiles - file blocking data filtering and profile groups

    Add Content-ID to the depot's allow rules: block Windows executables and alert on PDFs with a file blocking profile, stop project codes leaving web01 with a custom data pattern, bundle everything in a security profile group, and learn exactly which profiles need a subscription and what this lab firewall can and cannot show.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  11. 11URL filtering with custom categories and external dynamic lists

    Control web access the way the depot's acceptable-use policy says: custom URL categories for gaming and finance sites, a URL filtering profile with block and alert actions, external dynamic lists of bad IP addresses and URLs fetched from web01, and a service route so the management plane can fetch them.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  12. 12Zone protection and DoS protection

    Defend the published intranet server from the internet side: a zone protection profile that blocks port scanners, drops spoofed packets and turns on SYN cookies under flood, and a classified DoS protection policy that limits concurrent sessions per source. Attack it yourself from the Internet node and watch the firewall respond.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  13. 13Certificates PKI and SSL-TLS service profiles

    Replace the firewall's self-signed web certificate with a proper PKI: create a Calder root CA on the firewall, issue a management certificate with the right names, enforce TLS 1.2 or later with an SSL/TLS service profile, distribute the root to clients, import an external CA, and build a certificate profile.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  14. 14Decryption - SSL forward proxy and inbound inspection

    Make encrypted traffic visible: build a root CA with a subordinate forward-trust CA and a separate forward-untrust CA, trust the internet's public root, decrypt outbound HTTPS while exempting banking, and inspect inbound HTTPS to the published server with its own key. Prove each decision from the client's view of the certificate chain and from the decryption log.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  15. 15User-ID - API and syslog mapping dynamic user groups and user-based policy

    Write policy for people instead of addresses: map users to IP addresses through the XML API and a syslog listener that parses Wi-Fi controller logins, restrict the finance portal to one user, then quarantine contractors with a dynamic user group tagged through the API.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  16. 16Logging log forwarding syslog and reports

    Get the firewall's logs where the SOC can use them: a syslog server profile, a service route from the DMZ interface, a log forwarding profile on every rule, system and configuration log forwarding, plus log filters, the ACC and a custom report on the box.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  17. 17Policy-based forwarding and dual-ISP failover

    Give the depot a second internet line: path-monitored static routes for automatic failover, source NAT per ISP, and a policy-based forwarding rule that sends the big file-transfer site over the backup line while it's healthy. Pull the plug on the primary ISP and watch the firewall reroute.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  18. 18Dynamic routing - OSPF inside BGP to the ISP redistribution between them

    Make FW1 a real routing participant: OSPF with the depot core router, eBGP with the ISP, a discard route for Calder's public block advertised into BGP, and the ISP's default route redistributed into OSPF. Verify adjacencies and routes from both sides, then map it all to the Advanced Routing Engine.

    2× IOSv, 1× VM-Series, 1× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  19. 19Site-to-site IPsec VPN with IKEv2

    Join the Leeds and York depots with a route-based IKEv2 VPN between two PAN-OS firewalls: crypto profiles, IKE gateways with FQDN identities, tunnel interfaces in a VPN zone, routes, policy, tunnel monitoring and proxy IDs for interoperability. Bring it up, then read every SA and flow.

    2× VM-Series, 2× EVE-NG GUI server

    6 vCPU, 13,312 MBFits Standard

  20. 20High availability - active-passive with link and path monitoring

    Pair two VM-Series firewalls in active/passive HA: HA1 over the management ports, HA2 on a dedicated data link, priorities and preemption, configuration and session synchronisation, link and path monitoring. Then fail over by suspending the active member and watch the passive one carry the depot's traffic.

    2× VM-Series, 2× EVE-NG GUI server

    6 vCPU, 12,800 MBFits Standard

  21. 21GlobalProtect remote access - portal gateway authentication and split tunnelling

    Build GlobalProtect for Calder's travelling staff: certificates and an SSL/TLS profile, local-database authentication, a portal that hands out the gateway, a gateway with an IP pool and split-tunnel routes, and policy for the GP-Users zone. Then walk the client's conversation with the portal and gateway, connect a test laptop through a real SSL tunnel, and read the firewall's view of the user and the traffic.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  22. 22Automating PAN-OS with the XML and REST APIs

    Manage the firewall from code: get an API key, run operational commands, read and write configuration by XPath, commit and poll the job, use the REST API with JSON, and bulk-load depot devices from a CSV file with a Python script, learning the XML of any CLI command with debug cli on.

    1× VM-Series, 1× EVE-NG GUI server

    3 vCPU, 6,656 MBFits LiteRuns in the free demo

  23. 23Troubleshooting toolkit - packet flow captures counters and sessions

    Learn the PAN-OS packet flow and the tools that let you see a packet at each stage: dataplane packet captures at receive, firewall, transmit and drop stages, filtered global counters, session details, policy and route tests, and system resources. Use them to find out exactly why the admins can't SSH to web01, then fix it.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  24. 24Troubleshooting - the broken branch firewall

    A contractor configured the Wakefield depot firewall and left. Nothing works. Work through four user tickets with the troubleshooting method from lab 23 and find the six faults hidden in the configuration: in the management profile, routing, the virtual router, a mis-scoped deny rule, a wrong service and a NAT translation.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  25. 25Troubleshooting - the VPN that stays down

    The Leeds to York VPN was built over the weekend and has never passed a packet. Work through IKE, IPsec, routing, policy and NAT on both firewalls with the system log, the VPN test commands and the session table, and fix five faults so the depots can talk.

    2× VM-Series, 2× EVE-NG GUI server

    6 vCPU, 13,312 MBFits Standard

  26. 26Capstone - bring the Halifax depot live

    Everything together, from a requirements brief instead of steps: interfaces and routing, NAT for users and a published server, App-ID policy with a user-based rule, file blocking and URL filtering in a profile group, User-ID from the API, zone protection on the internet edge and syslog forwarding, verified by an automated acceptance test.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  27. 27GlobalProtect in depth - Linux client IPsec fallback per-user settings and HIP

    Run GlobalProtect from a Linux laptop and go beyond a first build. Read the tunnel from both ends, watch IPsec fall back to SSL, fix a user the gateway refuses, give contractors and executives their own client settings, enforce a Host Information Profile check on disk encryption and the host firewall, and carry one user's internet traffic through the firewall with a full tunnel.

    1× VM-Series, 4× EVE-NG GUI server

    6 vCPU, 8,704 MBFits Standard

  28. 28Troubleshooting high availability - split brain HA2 and a flapping firewall

    A contractor left the Leeds pair broken. Both firewalls claim to be active, the session link is down, and once those are fixed the preferred firewall flaps and falls over. Read the HA state and system log, fix each layer in turn, synchronise the configuration, then prove the repair by failing over with a download running.

    2× VM-Series, 2× EVE-NG GUI server

    6 vCPU, 12,800 MBFits Standard

  29. 29Packet-flow troubleshooting - four tickets four different drops

    Four tickets, and none of them is a policy deny. Use filtered packet captures at each stage, global counters, the dataplane flow log, and the routing and NAT tests to find an asymmetric path, an MTU black hole, a NAT rule pointing at nothing and a forgotten blackhole route. Prove each cause from evidence, then fix it.

    1× VM-Series, 4× EVE-NG GUI server

    6 vCPU, 8,192 MBFits StandardRuns in the free demo

  30. 30Custom App-ID and threat signatures - write them tune them prove them

    Name traffic the firewall doesn't know and stop what no signature covers yet. Write a custom application for a home-grown protocol and another on top of web-browsing, score your patterns, then write custom vulnerability and spyware signatures. Tune them with severity actions, a threshold signature for brute force and an exception for a scanner, proving each result in the logs.

    1× VM-Series, 3× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the Palo Alto NGFW practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB; 1 vCPU, 512 MB; 1 vCPU, 384 MB3079
Palo Alto Networks VM-Series (PAN-OS)paloalto-11.2.52 vCPU, 5,632 MB2933
Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB12
Palo Alto Networks VM-Series (PAN-OS)paloalto-10.2.5-Pre-Licensed-Eval2 vCPU, 6,144 MB11

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Palo Alto NGFW PAN-OS 11 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the Palo Alto NGFW labs

Are these Palo Alto NGFW labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 25 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 24 of the 30. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Site-to-site IPsec VPN with IKEv2”, needs 6 vCPU and 13,312 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Palo Alto Networks?

No. CloudLabBox wrote them to follow the topics of Palo Alto Networks’ Certified Network Security Analyst and Certified Next-Generation Firewall Engineer certifications (PAN-OS 11.x), and the hands-on topics of its Firewall 11.1 Essentials course (EDU-210). They aren’t training material from Palo Alto Networks, and CloudLabBox is independent of Palo Alto Networks and Cisco.

Do I need a Palo Alto Networks licence for these labs?

No. The labs run PAN-OS 11.2.5 with no licence, apart from lab 27’s pre-licensed 10.2.5 image, and each was tested that way. That means no content updates: the firewall keeps the App-ID content it shipped with and gets no threat, antivirus, WildFire or PAN-DB updates. For those updates, or for any other PAN-OS image, bring your own licence or a Palo Alto Networks evaluation: CloudLabBox doesn’t provide licences or subscriptions.

Do the GlobalProtect labs use the GlobalProtect app?

No. The images have no GlobalProtect app, so the labs use a small client written for them, which builds real tunnels through the firewall’s portal and gateway. Lab 21’s client uses SSL only. Lab 27’s adds IPsec with SSL fallback and sends HIP reports from a small file. Neither checks the firewall’s certificate as the app does. The labs’ CLI steps were tested; their web-interface steps weren’t run in a browser.

Why does the firewall say Login incorrect when a lab starts?

It’s still booting. A firewall takes 6.5 to 9 minutes to boot and answers “Login incorrect” until it’s ready, so wait and try again. Each lab’s pane says so.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 25 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Palo Alto Networks and Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.