Description

The SRX Series Services Gateways are high-performance security, routing and network solutions for enterprise and service providers. SRX Series gateways pack high port-density, advanced security, and flexible connectivity, into a single, easily managed platform that supports fast, secure, and highly-available, data center and branch operations.

SRX Series Service Gateways are based on Junos, Juniper’s proven operating system which delivers security and advanced protection services, the foundation of the world’s largest networks. Junos also supports rich routing capabilities, and Junos’ unique architecture provides reliable service operations and manageability, even under the highest loads.

The cost effectiveness and the versatility of the SRX Series platforms results in some of the best price-performance ratios in the industry. Hardware and OS consolidation, operational flexibility and unmatched performance simplify deployment and operations delivering an attractive low TCO.

SRX Series Services Gateways for the Data Center

These platforms deliver market-leading performance, scalability and service integration in a chassis-based form factor ideally suited for medium to large enterprise and service provider data centers and large campus environments where scalability, high performance and concurrent services, are essential.

Designed from the ground up to provide flexible processing and scalability, the SRX Series can meet the network and security requirements of data center hyper-consolidation, rapid managed services deployments, and aggregated security solutions. The SRX Series Services Gateways provide unrivaled performance and scalability, ensuring uninterrupted expansion and growth of your network infrastructure without sacrificing security.

SRX Series Services Gateways for the Branch

Branch SRX Series Gateways deliver secure and manageable networks of up to thousands of sites. A wide variety of product options efficiently support a range of performance, functionality, security, and budget requirements, connecting and protecting from a handful to thousands of users.

The consolidation of routing, WAN connectivity, switching, and Unified Threat Management (UTM) simplifies deployment and administration while delivering fast and consistent service quality regardless of user location. UTM services include best-in-class antivirus, antispam, URL filtering, firewall/VPN and AppSecure application level security that enable the branch SRX Series to be full-featured solution. The routing services include IPv4 and IPv6 unicast and multicast, extensive NAT, QoS, performance and SLA monitoring, and flow management features.

Firewall

– Network attack detection: Yes
– DoS and DDoS protection: Yes
– TCP reassembly for fragmented packet protection: Yes
– Brute force attack mitigation: Yes
– SYN cookie protection: Yes
– Zone-based IP spoofing: Yes
– Malformed packet protection: Yes
– GPRS stateful inspection: Yes

Intrusion Prevention System

– Stateful protocol signatures: Yes
– Attack detection mechanisms: Stateful signatures, protocol anomaly detection (zero-day coverage), application identification
– Attack response mechanisms: Drop connection, close connection, session packet log, session summary, email, custom session
– Attack notification mechanisms: Structured syslog
– Worm protection: Yes
– SSL encrypted traffic inspection: Yes
– Simplified installation through recommended policies: Yes
– Trojan protection: Yes
– Spyware/adware/keylogger protection: Yes
– Other malware protection: Yes
– Protection against attack proliferation from infected systems: Yes
– Reconnaissance protection: Yes
– Request and response side attack protection: Yes
– Compound attacks — combines stateful signatures and protocol anomalies: Yes
– Create custom attack signatures: Yes
– Access contexts for customization: 500+
– Attack editing (port range, other): Yes
– Stream signatures: Yes
– Protocol thresholds: Yes
– Stateful protocol signatures: Yes
– Approximate number of attacks covered: 6,000+
– Detailed threat descriptions and remediation/patch info: Yes
– Create and enforce appropriate application-usage policies: Yes
– Attacker and target audit trail and reporting: Yes
– Deployment modes: Inline or TAP

Modules

Switch Fabric and Control Board (SCB)
At the heart of the Dynamic Services Architecture is the switch fabric and control board (SCB). The SCB transforms the chassis from a simple module enclosure into a highly effective mesh network. The purpose of the SCB is to allow all modules in the chassis to send traffic at extremely high bandwidth.

The Route Engine (RE)
The routing engine (RE) is tightly coupled with the functionality of the SCB and can be considered the central nervous system of the architecture. The RE is the control plane of the chassis, and provides overall management and communications to and from system administrators, as well as calculating route tables for routing network traffic.

Services Processing Card (SPC)
As the “brains” behind the SRX3000 services gateways, services processing cards (SPCs) are designed to process all available services on the gateway. By eliminating the need for dedicated hardware for specific services or capabilities, no piece of hardware is ever taxed to the limit while other hardware sits idle. All of the processing capabilities of the SPCs are used to support any and all services and capabilities of the gateway. The same SPCs are supported on both the SRX3600 and the SRX3400 services gateways.(Note: A minimum of one NPC and one SPC is required for proper system functionality.)

Network Processing Cards (NPC)
To ensure maximum processing performance and flexibility, the SRX3000 line of services gateways utilize network processing cards (NPCs) to distribute inbound and outbound traffic to the appropriate SPCs and IOCs, apply QoS, and enforce DoS/DDoS protections. The SRX3600 can be configured to support one to three NPCs, while the SRX3400 can be configured to support one or two NPCs. Adding additional NPCs to these gateways allows organizations to tailor the solution to fit their specific performance requirements.(Note: A minimum of one NPC and one SPC is required for proper system functionality.)

Input/Output Cards (IOC)
In addition to supporting an ideal mix of built-in copper, small form-factor pluggable (SFP), and high-availability (HA) ports, the SRX3000 line allows the greatest I/O port density of any comparable offering. Each SRX3000 services gateway can be equipped with one or several input/output cards (IOCs), each supporting either 16 gigabit interfaces (16 x 1 copper or fiber Gigabit Ethernet), or 20 gigabit interfaces (2 x 10 Gigabit XFP Ethernet). With the flexibility to add additional IOCs, the SRX3000 line of services gateways can be equipped to support an ideal balance between interfaces and processing capabilities. (Note: A minimum of one NPC and one SPC is required for proper system functionality.)

SRX Cluster Module
The SRX Cluster Module is a hardware module that can be installed in the SRX3600 gateway to enable dual, or redundant, H/A control links for chassis clustering. When deploying SRX3600’s in H/A clusters, the SRX Cluster Module utilizes the redundant architecture design of the SRX3000 line to provide full control link resiliency for mission critical environments.