JNCIE-SEC study plan

Map every Junos security platform component (SRX chassis clustering, logical systems, tenant systems, VSYS-style partitioning) to the exam objectives and write a one-page architecture summary in your own words.

Configure a two-node chassis cluster in a lab with redundancy groups, reth interfaces, and control/data link redundancy, then verify failover with show chassis cluster status and show chassis cluster interfaces.

Build a baseline security policy set that exercises zone-based policies, global policies, and application-aware rules, and document the evaluation order (global before zone, first-match) with packet-flow traces.

Set up a repeatable lab snapshot/rollback workflow (commit confirmed, rescue configuration, virtual routers) so later weeks can be reset in under five minutes.

Implement stateless and stateful firewall filters (family inet/inet6, bridge, CCC) including policers, three-color marking, and action modifiers, and verify counters with show firewall.

Design and apply a security policy hierarchy that uses address books, applications, application sets, and dynamic application lookup, then prove match order with traceoptions and session logs.

Configure screens (syn-flood, land, ping-of-death, IP spoofing) and verify each screen triggers and logs under generated traffic.

Troubleshoot a deliberately broken policy set (shadowed rule, wrong zone, missing application) using session table inspection and flow traceoptions.

Configure a route-based site-to-site IPsec VPN with IKEv2, multiple traffic selectors, and dead peer detection, and verify SAs with show security ike sa and show security ipsec sa.

Build a hub-and-spoke or auto-discovery VPN (NHTB/ADVPN-style) and document how next-hop tunnels and IKE responder behavior differ from static tunnels.

Configure remote-access IPsec with dynamic peers, XAuth or certificate authentication, and address assignment, then test from a simulated client.

Introduce and diagnose common failures: mismatched proposals, PSK mismatch, proxy-ID mismatch, and NAT-Traversal issues, capturing logs for each.

Implement source NAT with interface and pool translation, destination NAT with port mapping, and static NAT, then verify with session and flow output.

Combine NAT with IPsec (NAT before/after tunnel, NAT-T) and document the order of operations for each direction.

Configure IPv6 transition features (NAT64, DS-Lite) or carrier-grade NAT scenarios and verify translation behavior.

Build a troubleshooting runbook for NAT and VPN interaction that maps symptoms to likely causes and commands.

Deploy advanced services: UAC/JIMS-style user role firewalling, application firewall, and content security profiles (antivirus, antispam, web filtering) if supported in your lab image.

Configure high-availability features beyond basic clustering: IP monitoring, link monitoring, preempt, and failover thresholds, and test each trigger.

Implement unified threat management logging and reporting, and verify events reach a syslog or stream-mode destination.

Review platform scaling limits (sessions, policies, tunnels, zones) and document which limits affect design decisions.

Automate configuration and verification with Junos PyEZ or NETCONF/Ansible: push a policy set, collect operational state, and assert on results.

Build a commit-time validation script (commit scripts or event scripts) that enforces a naming or policy standard.

Set up structured logging and telemetry (streaming telemetry or SNMP) and write a query that surfaces top denied flows.

Practice safe change management: commit confirmed, rollback, configuration groups, and diff review on a simulated production change.

Complete timed troubleshooting drills: given a broken cluster, policy, or VPN, isolate root cause and fix within 20 minutes using a defined command sequence.

Analyze packet captures and flow traceoptions to distinguish policy drops from routing, NAT, or screen drops.

Write and run a self-assessment of all five domains, scoring confidence per objective and listing weak areas.

Re-run the weakest two labs from weeks 1-6 without notes and record completion time.

Perform a full mock practical exam: design, configure, and verify a multi-site scenario combining clustering, policies, IPsec, and NAT within a time limit.

Review every weak area from week 7 and close each with a targeted lab or written explanation.

Rehearse explaining design trade-offs aloud (why route-based vs. policy-based VPN, why this NAT order) as if defending a design.

Finalize a one-page command and concept reference for exam-day recall.