Hands-on Junos CLI tutorials, OSPF and BGP configuration guides, SRX firewall policies and step-by-step network troubleshooting — lab-tested by working network engineers preparing for JNCIA, JNCIS and beyond.
Latest Guide
An IDP policy attached to a security policy does not mean traffic is inspected. The community thread 'Either configure idp or idp-policy and not both' shows the confusion — here is how IDP actually engages and how to verify inspection is happening.
Read full guide →
The upgrade command fails with validation failed or the install aborts midway. Learn how Junos validation works, how to find the exact unsupported config statement, free disk space, and when no-validate is safe.
SRX security flow traceoptions show every decision the flow engine makes: session lookup, NAT, route, zone and policy. This guide covers the cheaper checks to run first, monitor security packet-drop on newer releases, how to read a trace line by line, and the root causes ranked by how often they bite.
A Junos ISIS adjacency stuck in Initializing means one router hears the other, but its own hellos are not being accepted in return. This guide gives the ordered checks, ranks the root causes from missing family iso to hello padding and ISO MTU, and shows healthy and broken output.
A Juniper EX BPDU error means a BPDU-protected port received a spanning tree BPDU, so Junos shut it down until someone clears it. This guide shows how to confirm the error, find the source, clear it on ELS and non-ELS switches, and set auto-recovery without creating a flapping loop.
'Everything works until we enable screens, then traffic dies' is a classic SRX support thread. Flood and scan screens have real thresholds and real side effects — here is how to read the counters and tune the values instead of disabling protection.
The tunnel was fine yesterday. Today it is down. Follow the Juniper KB approach: determine whether Phase 1 or Phase 2 failed, match proposals, proxy-IDs and PSKs, and use IKE traceoptions when nothing else explains it.
An SRX chassis cluster node goes disabled to prevent split brain, usually after the control link or fabric link fails. This guide shows how to read the Events reason, checks both links in order from cheapest to most expensive, ranks the root causes, and explains how to bring the node back safely.
Build an SRX site to site VPN as a route-based IKEv2 tunnel on st0, with a copy-ready Junos config, healthy and broken show output, and an ordered diagnostic. Includes the FortiGate and Palo Alto interop gotchas and the PFS mismatch that kills new tunnels at the first rekey.
SASE is SD-WAN plus cloud-delivered security (SSE), enforced at vendor PoPs instead of your headquarters firewall. This guide explains the architecture, maps the 2026 vendor field including HPE and Juniper, and shows how to tunnel an SRX branch into an SSE PoP with fail-open or fail-closed routing.