Practise firewall CLI without a lab — 22 browser simulators, one warm-up

Hero · blank prompt, no rack

Why watching never transfers

There is a moment every hands-on interview produces. The question is easy. You have seen it done. Nothing comes out. You know PAN-OS has a test command that proves policy match without generating traffic. You cannot produce the rest of the line.

That is not a memory failure. Following a demonstration trains recognition — confirming a command is correct when you see it. Interviews and P1 tickets need recall — producing it from nothing. Hours of the first do not buy the second.

The six questions

Every network or security device can answer the same six questions. Only the syntax changes. Learn the questions first. Syntax becomes a lookup. That is how you stay useful the first time someone hands you a vendor you have never touched.

1. What are you? Model, version, uptime, serial, HA role.
2. What are you connected to? Interface state, addresses, zones or VLANs.
3. Where do you send traffic? The routing table — active, not merely configured.
4. What are you allowed to pass? The policy or rulebase that is actually enforcing.
5. What is flowing right now? The session or connection table.
6. What went wrong recently? A named log or drop counter, never an unfiltered browse.

Model · six questions around one box

Same six questions, six CLIs

Read the table across a row. The row is the skill. The column is trivia. Primary source for each column is the vendor CLI reference listed in Sources.

FortiOS reverses the Cisco instinct: get reads operational state, show reads configuration. That one swap is why Cisco-trained engineers type the wrong verb on a FortiGate for the first week.

What the dummy labs actually accept

The interview dummy labs on ai.techclick.in are an allowlist, not a full vendor shell. They answer the same six questions with a smaller set. Type these when you are on the Simulator tab — they are the strings in public/data/vendor-simulators.json.

What to type next

Flowchart first. If you are handed an unfamiliar box, do not start in the policy editor. Work the six questions in order. Look up only the verb you cannot produce.

Pick a real simulator

Techclick hosts two kinds of browser lab, both on ai.techclick.in. The catalog is /simulators. Every vendor interview hub also has a Simulator tab. Nothing in the table below is a guessed path.

• Dummy CLI labs — allowlisted commands, canned fictional output, attached to /interview hubs. Best for the six-question habit and ticket sequencing.
• HTML workflow labs — specific jobs (IPsec, App Connector, F5 tickets, GRE). Best for one workflow from blank.

Every line of output is training data on a fictional estate. Nothing is sent to a live tenant, API or device. Confirm current syntax on the production release before you type on a real box.

Twenty-minute loop

Primary source for the commands you type: the vendor CLI reference in Sources, plus the dummy-lab allowlist on the Simulator tab you opened. A session with no failure in it has taught you nothing. Structure the twenty minutes so being wrong is scheduled.

Side A — Warm-up (minutes 0–2)

1. Open today’s primary lab

   PCNSE → PAN-OS dummy lab. NSE4 → FortiOS dummy lab. CCNP Security → FTD dummy lab. CCSA → Check Point dummy lab. JNCIA-SEC → SRX dummy lab. F5 201 → tmsh dummy lab or /f5-simulator.

2. Close the guide

   Type the six identity-to-log commands from memory. If one will not come, write it down and move on. That line is tomorrow’s start.

Side B — One workflow from blank (minutes 2–10)

1. Pick a single objective

   Add a security rule and prove match. Bring up an interface. Add a static route. Or open one HTML lab: IPsec on palo-alto-ipsec-simulator, a broken VIP on f5-troubleshooting, a connector on zscaler-app-connector.

2. Stay stuck for ninety seconds

   Looking it up at ten seconds wastes the retrieval. At ninety seconds, open the allowlist or the vendor cheat sheet, type it, then reset and type it again without looking.

Side C — Prove, interleave, log (minutes 10–20)

1. Verify every change

   Commit on PAN-OS and Junos. Then run the paired running-state command. Reset the workspace and rebuild the same thing once. The second pass is where retention happens.

2. Interleave four minutes

   Open a second vendor from rows 17–22 and answer the same six questions there. The friction is the point.

3. Write one line

   What you could not produce today. Tomorrow starts with that line, not with a new recording.

1–6  the six warm-up commands on today's vendor
7    the verify command after a hostname change
8    commit (PAN-OS / Junos) or the equivalent save
9    the command that proves policy match for tcp/443

Whatever you had to correct is your real skill level. Not hours watched.

Verify or it did not happen

The habit that separates a weak hands-on interview from a strong one is simple. After a configuration command, without being asked, type the command that proves it worked.

On any candidate-config platform the acknowledgement after set means only that the syntax parsed. It does not mean the value landed where you intended, that it is active, or that it survived the session. PAN-OS and Junos need commit before running state changes. A configuration-mode show reads the candidate. Traffic does not.

Proof · set, commit, show

set deviceconfig system hostname BRANCH-FW
commit
show system info

Classic fails and proof

Sources

• Palo Alto Networks — PAN-OS CLI Quick Start, “Test the configuration” / test security-policy-match. docs.paloaltonetworks.com
• Palo Alto Networks — CLI cheat sheet: networking (show routing route, interfaces). docs.paloaltonetworks.com
• Fortinet — FortiOS administration / CLI: diagnose sys session list. docs.fortinet.com
• Fortinet — CLI troubleshooting cheat sheet. docs.fortinet.com
• Cisco — Firepower Threat Defense command reference (packet-tracer, show conn, show route). cisco.com
• Check Point — Gaia Administration Guide, Clish. sc1.checkpoint.com
• Juniper — show security flow session. juniper.net
• F5 — tmsh reference (list net self, show vs list). clouddocs.f5.com
• Techclick — HTML lab catalog. ai.techclick.in/simulators
• Techclick — dummy CLI packs (allowlisted commands, canned output) on each vendor hub Simulator tab, e.g. PAN-OS, FortiOS, FTD, Check Point, SRX, F5.

Related: PAN-OS session factory · FortiGate session factory · Check Point session factory · Cisco FTD session factory · SRX session factory · F5 session factory · All HTML labs · Interview dashboards