JNCIE-SEC case studies
JNCIE-SEC · Put your knowledge to work in context.
JNCIE-SEC (also written JNCIE-Security) is the expert-level tier of the Juniper security certification ladder, sitting above the associate and specialist levels and aimed at engineers who design, deploy, and troubleshoot SRX Series firewall environments at scale. This page is an independent, unofficial study resource: we are not affiliated with, endorsed by, or sponsored by Juniper Networks or Hewlett Packard Enterprise, and nothing here is official exam material. The JNCIE-SEC case studies are 5 cases and about 3,900 words.
1Single Fabric Link in an Active/Active SRX4600 Cluster
An SRX4600 pair runs a chassis cluster with reth0.0 (trust) and reth1.0 (untrust). Redundancy group 1 is primary on node0 and redundancy group 2 is primary on node1, so traffic is active/active across the two nodes.
782 words, about 4 min2Destination NAT Before Policy Lookup on an SRX1500
An SRX1500 protects a small data center. Untrust is reth0.0 (198.51.100.1/24), trust is reth1.0 (10.20.0.0/16), and DMZ is reth2.0 (172.16.5.1/24).
739 words, about 4 min3Traffic Selector Mismatch on a Route-Based Hub
An SRX1500 hub terminates route-based IPsec for 40 branch SRX300s. Each spoke uses st0.0, and the hub reaches each branch subnet through a static route pointing at the spoke's st0.0.
731 words, about 4 min4Hairpin Destination NAT for Internal Portal Users
A regional service provider uses an SRX1500 chassis cluster for a customer portal. The portal name resolves to 203.0.113.10, which a destination NAT rule translates to 10.20.5.10:443 in the DMZ zone.
838 words, about 4 min5Sequence Check Drops and a Misbehaving Automation Job
An SRX4100 chassis cluster has two ISP links: reth0.0 to ISP-A and reth2.0 to ISP-B, each with interface source NAT and eBGP. After ISP-A's BGP session flapped, long-lived HTTPS sessions from a branch office through a route-based VPN began to stall, while new sessions worked.
810 words, about 4 min