Juniper Firewall 1000281-En

7/31/2019 Juniper Firewall 1000281-En

1/20

DATASHEET

1

Product DescriptionTe Juniper Networks SRX Series Services Gatewas or te branc joins Juniper

Networks SRX Series or te data center, EX Series Eternet Switces, M Series

Multiservice Edge Routers, MX Series 3D Universal Edge Routers, and T Series Core

Routers. Tis provides a single Juniper Networks Junos operating sstem-based portolio

o unprecedented scale. Wit Junos OS, enterprises and service providers can lower

deploment and operational costs across teir entire distributed workorce.

SRX Series or te branc runs Junos OS, te proven operating sstem tat is used b core

Internet routers in all o te top 100 service providers around te world. Te rigorousl

tested carrier-class routing eatures o IPv4/IPv6, OSPF, BGP, and multicast ave been

proven in over 15 ears o worldwide deploments.

SRX Series or te branc provides perimeter securit, content securit, application visibilit,

tracking and polic enorcement, role-based access control, and network-wide treat

visibilit and control. Using zones and policies, network administrators can congure and

deplo branc SRX Series gatewas quickl and securel. Te SRX Series also includes

wizards or rewall, IPsec VPN, NAT, and initial setup to simpli congurations out o te box

Polic-based VPNs support more complex securit arcitectures tat require dnamic

addressing and split tunneling. For content securit, SRX Series or te branc oers a

complete suite o Unied Treat Management (UTM) services consisting o: intrusion

prevention sstem (IPS), application securit (AppSecure), on-box and cloud-based

antivirus, antispam, enanced Web ltering, and data loss prevention to protect our

network rom te latest content-borne treats. Select SRX Series models eature Content

Securit Accelerator or ig-perormance IPS and antivirus scanning. Te branc SRX

Series integrates wit oter Juniper securit products to deliver enterprise-wide unied

access control (UAC) and adaptive treat management. Tese capabilities give securit

proessionals powerul tools in te gt against cbercrime and data loss.

SRX Series or te branc are secure routers tat bring ig perormance and provendeploment capabilities to enterprises tat need to build a worldwide network o tousands

o sites. Te wide variet o options allow conguration o perormance, unctionalit, and

price scaled to support rom a andul to tousands o users. Eternet, serial, T1/E1, DS3/E3,

xDSL, Wi-Fi, and 3G/4G LTE wireless are all available options or WAN or Internet connectivit

to securel link our sites. Multiple orm actors allow ou to make cost-eective coices

or mission-critical deploments. Managing te network is eas using te proven Junos OS

command-line interace (CLI), scripting capabilities, a simple-to-use Web-based GUI, Junipe

Networks Network and Securit Manager (NSM) or large scale deploments, or Juniper

Networks Junos Space Securit Design or centralized management.

Product Overview

Juniper Networks SRX Series Services

Gatewas or te branc are secure

routers tat provide essential

capabilities tat connect, secure, and

manage workorce locations sized

rom anduls to undreds o users.

B consolidating ast, igl available

switcing, routing, securit, and

applications capabilities in a single

device, enterprises can economicall

deliver new services, sae

connectivit, and a satising end userexperience. All SRX Series Services

Gatewas, including products scaled

or te branc, campus, and data

center applications, are powered

b Juniper Networks Junos OS

te proven operating sstem tat

provides unmatced consistenc,

better perormance wit services, and

superior inrastructure protection at a

lower total cost o ownersip.

SRX SERIES SERVICES

GATEWAyS FOR ThE

BRANChSRX100, SRX110, SRX210, SRX220,

SRX240, SRX550, and SRX650


2/20

2

Architecture and Key Components

Key Hardware Features o the Branch SRX Series Products

Product Description

SRX100 ServicesGatewa

Eigt 10/100 Eternet LAN ports and 1 USB port (support or 3G USB)

Full UTM1; antivirus1, antispam1, enanced Web ltering1, intrusion prevention sstem1, AppSecure1 (wit ig memor version)

Unied Access Control (UAC) and content ltering

1 GB2 DRAM, 1 GB as deault (512 MB DRAM accessible in low memor version)


VDSL/ADSL2+ and Eternet WAN interaces

Eigt 10/100 Eternet LAN ports and two USB port (support or 3G USB)

Full UTM1; antivirus1, antispam1, enanced Web ltering1, intrusion prevention sstem1, AppSecure1


1 GB DRAM, 1 GB as deault


Two 10/100/1000 Eternet and 6 10/100 Eternet LAN ports, 1 Mini-PIM slot, and 2 USB ports (support or 3G USB)

Factor option o 4 dnamic Power over Eternet (PoE) ports 802.3a

Support or T1/E1, serial, ADSL/2/2+, VDSL, G.ShDSL, and Eternet small orm-actor pluggable transceiver (SFP)

Content Securit Accelerator ardware or aster perormance o IPS and ExpressAV (wit ig memor version)



1 GB DRAM, 1 GB as deault (512 MB DRAM accessible in low memor version)


Eigt 10/100/1000 Eternet LAN ports, 2 Mini-PIM slots

Factor option o 8 PoE ports; PoE+ 802.3at, backwards compatible wit 802.3a

Support or T1/E1, serial, ADSL2/2+, VDSL, G.ShDSL, and Eternet SFP

Content Securit Accelerator ardware or aster perormance o IPS and ExpressAV

Full UTM1; antivirus1, antispam1, enanced Web ltering1, intrusion prevention sstem1, AppSecure1

Unied Access Control and content ltering

1 GB DRAM, 1 GB as deault


16 10/100/1000 Eternet LAN ports, 4 Mini-PIM slots

Factor option o 16 PoE ports; PoE+ 802.3at, backwards compatible wit 802.3a

Support or T1/E1, serial, ADSL2/2+, VDSL, G.ShDSL, and Eternet SFP




512 MB RAM deault, optional actor 1 GB DRAM, 1 GB as deault


Ten xed Eternet ports (6 10/100/1000 Copper, 4 SFP), 2 Mini-PIM slots, 6 GPIM slots or multiple GPIM and XPIMcombinations

Support or T1/E1, serial, ADSL2/2+, VDSL, G.ShDSL, DS3/E3, Gigabit Eternet ports; supports up to 52 Eternet portsincluding SFP; 40 switc ports wit optional PoE including 802.3at, PoE+, backwards compatible wit 802.3a (or 50 non-PoE10/100/1000 Copper ports), 10GbE


Full UTM1; antivirus1, antispam1, enanced Web ltering1, and intrusion prevention sstem1, AppSecure1


2 GB DRAM deault, 2 GB compact as deault

Optional redundant AC power; standard AC power suppl tat is PoE-read; PoE power up to 250 watts single power suppl or500 watts dual power suppl


Four xed ports 10/100/1000 Eternet LAN ports, 8 GPIM slots or multiple GPIM and XPIM combinations

Support or T1, E1, DS3/E3, Eternet ports; supports up to 52 Eternet ports including SFP; 48 switc ports wit optional PoEincluding 802.3at, PoE+, backwards compatible wit 802.3a (or 52 non-PoE 10/100/1000 Copper ports), 10GbE


Full UTM1; antivirus1, antispam1, enanced Web ltering1, and intrusion prevention sstem1, AppSecure1


Modular Services and Routing Engine; uture internal ailover and ot-swap

2 GB DRAM deault, 2 GB compact as deault, external compact as slot or additional storage

Optional redundant AC power; standard AC power suppl tat is PoE-read; PoE power up to 250 watts single power suppl or500 watts dual power suppl

Network Deployments

Te SRX Series Services Gatewas or te branc are deploed at remote and branc locations in te network to provide all-in-one secureWAN connectivit, and connection to local PCs and servers via integrated Eternet switcing.

1 Uniied Treat Managementantivirus, antispam, Web iltering, AppSecure, and IPS require a subscription license and te ig memor sstem option to use te eature. UTM is not supported on telow memor version. Please see te ordering section or options. Content Filtering and UAC are part o te base sotware wit no additional license.

2 SRX100B installed wit 1 GB DRAM, wit 512 MB accessible. Optional upgrade to 1 GB DRAM is available wit purcase o memor sotware license ke.


3/20

3

Features and Benets

Secure RoutingSould ou use a router and a irewall to secure our network?

B building te branc SRX Series wit best-in-class routing,

switcing and irewall capabilities in one product, enterprises

dont ave to make tat coice. W orward traic i its not

legitimate?

SRX Series or te branc

cecks te traic to see i it is

legitimate and permitted, andonl orwards it on wen it is.

Tis reduces te load on te

network, allocates bandwidt

or all oter mission-critical

applications, and secures te

network rom malicious users.

Te main purpose o a

secure router is to provide

irewall protection and appl

policies. Te irewall (zone)

unctionalit inspects traic

lows and state to ensure

tat originating and returning

inormation in a session is

expected and permitted or a

particular zone. Te securit

polic determines i te session can originate in one zone and

traverse to anoter zone. Tis arcitectural coice receives

packets rom a wide variet o clients and servers and keeps track

o ever session, o ever application, and o ever user. It allows

te enterprise to make sure tat onl legitimate traic is on its

network and tat traic is lowing in te expected direction.

To ease te coniguration o a irewall, SRX Series or te branc

uses two eatureszones and policies. Wile tese can be

user-deined, te deault sipping coniguration contains, at a

minimum, a trust and untrust zone. Te trust zone is used

or coniguration and attacing te internal LAN to te branc

SRX Series. Te untrust zone is commonl used or te WAN or

untrusted Internet interace. To simpli installation and make

coniguration easier, a deault polic is in place tat allows traic

originating rom te trust zone to low to te untrust zone. Tis

polic blocks all traic originating rom te untrust zone to te

trust zone. A traditional router orwards all traic witout regard

to a irewall (session awareness) or polic (origination and

destination o a session).

B using te Web interace or CLI, enterprises can create a series

o securit policies tat will control te traic rom witin and in

between zones b deining policies. At te broadest level, all tpes

o traic can be allowed rom an source in securit zones to an

destination in all oter zones witout an sceduling restrictions.

At te narrowest level, policies can be created tat allow onl one

kind o traic between a speciied ost in one zone and anoter

speciied ost in anoter zone during a sceduled time period.

High AvailabilityJunos OS Services Redundanc Protocol (JSRP) is a core eature

o te SRX Series or te branc. JSRP enables a pair o SRX

Series sstems to be easil integrated into a ig availabilit

network arcitecture, wit redundant psical connections

between te sstems and te adjacent network switces. Wit

link redundanc, Juniper Networks can address man common

causes o sstem ailures, suc as a psical port going bad

or a cable getting disconnected, to ensure tat a connection

is available witout aving to ail over te entire sstem. Tis

is consistent wit a tpical active/standb nature o routing

resilienc protocols.

Wen SRX Series Services Gatewas or te branc are

conigured as an active/active hA pair, traic and coniguration

is mirrored automaticall to provide active irewall and VPN

session maintenance in case o a ailure. Te branc SRX Series

sncronizes bot coniguration and runtime inormation. As a

result, during ailover, sncronization o te ollowing inormation

is sared: connection/session state and low inormation, IPSec

securit associations, Network Address Translation (NAT) traic,

address book inormation, coniguration canges, and more. In

contrast to te tpical router active/standb resilienc protocols

suc as Virtual Router Redundanc Protocol (VRRP), all dnamic

low and session inormation is lost and must be reestablised in

te event o a ailover. Some or all network sessions will ave to

restart depending on te convergence time o te links or nodes. Bmaintaining state, not onl is te session preserved, but securit is

kept intact. In an unstable network, tis active/active coniguration

also mitigates link lapping aecting session perormance.

Figure 2: High availability

StandbySRX240SRX240

Active

High Availability

Active/Standby

EX Series EX Series

INTERNET

FailureSRX240SRX240

Active

Active/Standby

EX Series EX Series

INTERNET

SRX240SRX240

Active Active

Active/Active

EX Series EX Series

INTERNET

FailureSRX240SRX240

Active

Active/Active

EX Series EX Series

INTERNET

Untrust Zone

Trust Zone

Guest Zone

DMZ Zone

Intranet

INTERNET

Figure 1: Firewalls, zones,and policies


4/20

4

Session-Based Forwarding Without thePerormance HitIn order to optimize te trougput and latenc o te combined

router and rewall, Junos OS implements session-based orwarding,

an innovation tat combines te session state inormation o a

traditional rewall and te next-op orwarding o a classic router

into a single operation. Wit Junos OS, a session tat is permitted

b te orwarding polic is added to te orwarding table along wit

a pointer to te next-op route. Establised sessions ave a single

table lookup to veri tat te session as been permitted and to

nd te next op. Tis ecient algoritm improves trougput andlowers latenc or session trac wen compared wit a classic

router tat perorms multiple table lookups to veri session

inormation and ten to nd a next-op route.

Figure 3 sows te session-based orwarding algoritm. Wen a new

session is establised, te session-based arcitecture witin Junos

OS veries tat te session is allowed b te orwarding policies. I

te session is allowed, Junos OS will look up te next-op route in

te routing table. It ten inserts te session and te next-op route

into te session and orwarding table and orwards te packet.

Subsequent packets or te establised session require a single table

lookup in te session and orwarding table, and are orwarded to te

egress interace.

Security Policy Evaluationand Next-Hop Lookup

Forwarding forPermitted Trac

IngressInterface

Session InitialPacket Processing

Table

Update

Disallowed byPolicy: Dropped

EgressInterface

Session andForwarding Table

Figure 3: Session-based forwarding algorithm

Large HA Oce

Mid-sized HA Branch

Private Data CenterSmall Oce

SIPServer

3GConnectivity

VDSL

SRX110

EX4200

EX3300

EX4200

SRX650 SRX650

WLC800

UCServer

App Server

HostedServer

WebServer

WLC200

WLA532

SRX550

EX3300

SRX550

SRX240

Small, Link HA BranchSmall Branch with

Cellular Backup

SRX210

AX411

CX111AX411

T1/E1 VDSL

DS3/E3SFP

AX411

Private WAN

InternetSF.com

FacebookSkype

Google

T1/E1

4G LTE

4G LTE

Figure 4: The distributed enterprise


5/20

5

Specications

Protocols IPv4, IPv6, ISO Connectionless Network Service (CLNS)

Routing and Multicast Static routes

RIPv2 +v1

OSPF/OSPFv3

BGP

BGP Router Reector2

IS-IS

Multicast (Internet Group Management Protocol (IGMPv1/2/3),

PIM-SM/DM/SSM, Session Description Protocol (SDP), Distance

Vector Multicast Routing Protocol (DVMRP), source-specic,

Multicast inside IPsec tunnel), MSDP

MPLS (RSVP, LDP, Circuit Cross-connect (CCC), Translational

Cross-connect (TCC), Laer 2 VPN (VPLS), Laer 3 VPN, VPLS,

NGMVPN)

IP Address Management Static

DhCP, PPPoE client

Internal DhCP server, DhCP Rela

Address Translation Source NAT wit Port Address Translation (PAT)

Static NAT

Destination NAT wit PAT

Persistent NAT, NAT64

Encapsulations Eternet (MAC and VLAN tagged)

Point-to-Point Protocol (PPP) (sncronous)

- Multilink Point-to-Point Protocol (MLPPP)

Frame Rela

- Multilink Frame Rela (MLFR) (FRF.15, FRF.16), FRF.12, LFI

hig-Level Data Link Control (hDLC)

Serial (RS-232, RS-449, X.21, V.35, EIA-530)

802.1q VLAN support

Point-to-Point Protocol over Eternet (PPPoE)

L2 Switching 802.1D, RSTP, MSTP, 802.3ad (LACP)

802.1x, LLDP, 802.1ad (Q-in-Q), IGMP Snooping

Laer 2 switcing wit ig availabilit

Trac Management Quality o Service (QoS) 802.1p, DSCP, EXP

Marking, policing, and saping

Class-based queuing wit prioritization

Weigted random earl detection (WRED)

Queuing based on VLAN, data-link connection identier (DLCI),

interace, bundles, or multi-eld (MF) lters

Guaranteed bandwidt

Maximum bandwidt

Ingress trac policing

Priorit-bandwidt utilization

DiServ marking

Virtual cannels

Security

Firewall Firewall, zones, screens, policies

Stateul rewall, stateless lters

Network attack detection

Screens denial o service (DoS) and provides distributed denial o

service (DDoS) protection (anomal-based)

Prevent repla attack; Anti-Repla

Unied Access Control

- TCP reassembl or ragmented packet protection

- Brute orce attack mitigation

- SyN cookie protection

- Zone-based IP spoong

- Malormed packet protection

UTM1

Intrusion Prevention Sstem (IPS)

- Protocol anomal detection

- Stateul protocol signatures

- Intrusion prevention sstem (IPS) attack pattern obuscation

- User role-based policies1 Uniied Treat Management antivirus, antispam, Web iltering, AppSecure, and IPS require individual subscription license and is onl supported on ig memor versions o te SRX Series. UTM is

not supported on te low memor version. Please see te ordering section or options.

2 BGP Route Relector supported on SRX650. See ordering section or more inormation.

SRX100

SRX220 SRX240

SRX650

SRX210SRX110

SRX550


6/20

6

UTM1(continued) Customer signatures creation

Dail and emergenc updates

AppSecure

- AppTrack (application visibilit and tracking)

- AppFW (polic enorcement b application name)

- Custom signatures

- Dnamic signature updates

- User-based application polic enorcement

Antivirus

- Express AV (stream-based AV, not available on SRX100 and

SRX110)

- File-based antivirus

Signature database

Protocols scanned: POP3, hTTP, SMTP, IMAP, FTP

Antispware

Anti-adware

Antikelogger

- Cloud-based antivirus

Antispam

Integrated enanced Web ltering

- Categor granularit (90+ categories)

- Real time treat score

Redirect Web ltering

Content Securit Accelerator in SRX210 ig memor, SRX220,

SRX240 ig memor, SRX550, and SRX6501

ExpressAV option in SRX210 ig memor, SRX220 ig memor,

SRX240 ig memor, SRX550, and SRX6501

Content ltering

- Based on MIME tpe, le extension, and protocol commands

VPN Tunnels (GRE, IP-IP, IPsec)

IPsec, Data Encrption Standard (DES) (56-bit), triple Data

Encrption Standard (3DES) (168-bit), Advanced Encrption

Standard (AES) (128-bit+) encrption

Message Digest 5 (MD5),ShA-1 , ShA-128, ShA-256autentication

Junos Pulse Dnamic VPN client; browser-based remote access

eature requiring a license

Multimedia Transport Compressed Real-Time Transport Protocol (CRTP)

High Availability VRRP

JSRP

Stateul ailover and dual box clustering

SRX650:

- Redundant power (optional)

- GPIM ot swap on SRX550 and SRX650

- Future internal ailover and SRE ot swap (OIR) on SRX650 Backup link via 3G/4G LTE wireless or oter WAN

Active/activeL3 mode2

Active/passiveL3 mode2

Conguration sncronization2

Session sncronization or rewall and VPN2

Session ailover or routing cange2

Device ailure detection2

Link ailure detection2

IP Monitoring wit route and interace ailover

IPv6 OSPFv3

RIPng IPv6 Multicast Listener Discover (MLD)

BGP

ISIS

Wireless CX111 Cellular 3G/4G/LTE Broadband Data Bridge supported on all

branc SRX Series devices

3G USB modem support or SRX100, SRX110, and SRX210

AX411 Wireless LAN (Wi-Fi 802.11 a/b/g/n) Access Point supported

on all branc SRX Series devices

WLA Series Wireless LAN Access Points and WLC Series Wireless

LAN Controllers are supported on branc SRX Series devices

SLA, Measurement, and Monitoring Real-time perormance monitoring (RPM)

Sessions, packets, and bandwidt usage

Juniper J-Flow monitoring and accounting services

Logging Sslog

Traceroute

Extensive control- and data-plane structured and unstructured

sslog

Administration Juniper Networks Network and Securit Manager support (NSM)

Juniper Networks Junos Space Securit Design support

Juniper Networks STRM Series Securit Treat Response

Managers support

Juniper Networks Advanced Insigt Solutions support

External administrator database (RADIUS, LDAP, SecureID)

Auto-conguration

Conguration rollback

Rescue conguration wit button

Commit conrm or canges

Auto-record or diagnostics

Junos OS upgrade wit button

Sofware upgrades (USB upgrade option)

Juniper Junos Web, USB, hTTP, FTP, SSh

Command-line interace

Smart image download

Certifcations 3

Common Criteria (CC) EAL44

Common Criteria (CC) EAL3

FIPS-140 Level 2

Specifcations (continued)

1 Uniied Treat Management antivirus, antispam, Web iltering, AppSecure and IPS require individual subscription license and is onl supported on ig memor versions o te SRX Series. UTM isnot supported on te low memor version. Please see te ordering section or options.

2 SRX100B installed wit 1 GB DRAM, wit 512 MB accessible. Optional upgrade to 1 GB DRAM is available wit purcase o memor sotware license ke.3 Coming soon or SRX110.4 Certiied on Junos-FIPS 10.4R4 on all versions o SRX100, SRX210, SRX220, SRX240 and SRX650.


7/20

7

Product ComparisonSRX100 SRX110 SRX210* SRX220 SRX240 SRX550 SRX650

Maximum Perormance and Capacity

Junos OS version tested Junos OS11.2R3

Junos OS11.2R3

Junos OS11.2R3

Junos OS11.2R3

Junos OS11.2R3

Junos OS 12.1 Junos OS11.2R3

Firewall perormance(large packets)

700 Mbps 700 Mbps 850 Mbps 950 Mbps 1.8 Gbps 5.5 Gbps 7 Gbps

Firewall perormance (IMIX) 200 Mbps 200 Mbps 250 Mbps 300 Mbps 600 Mbps 1.7 Gbps 2.5 Gbps

Firewall + routing PPS (64 Bte) 70 Kpps 70 Kpps 95 Kpps 125 Kpps 200 Kpps 700 Kpps 850 Kpps

Firewall perormance5 (hTTP) 100 Mbps 100 Mbps 290 Mbps 350 Mbps 830 Mbps 1.5 Gbps 2 Gbps

IPsec VPN trougput (largepackets)

65 Mbps 65 Mbps 85 Mbps 100 Mbps 300 Mbps 1.0 Gbps 1.5 Gbps

IPsec VPN tunnels 128 128 256 512 1,000 2,000 3,000

AppSecure rewall trougput5 90 Mbps 90 Mbps 250 Mbps 300 Mbps 750 Mbps 1.5 Gbps 1.9 Gbps

IPS (intrusion preventionsstem)

60 Mbps 60 Mbps 85 Mbps 100 Mbps 230 Mbps 800 Mbps 1 Gbps

Antivirus 25 Mbps

(ExpressAV)

25 Mbps

(ExpressAV)

30 Mbps(ExpressAV)

35 Mbps(ExpressAV)

85 Mbps(ExpressAV)

300 Mbps

(Sopos AV)

350 Mbps(ExpressAV)

Connections per second 1,800 1,800 2,200 2,800 8,500 27,000 35,000

Maximum concurrent sessionsDRAM options

16 K / 32 K1

512 MB3 / 1 GBDRAM

32 K1

1 GB DRAM

32 K / 64 K1512 MB / 1 GBDRAM

96 K

1 GB DRAM

64 K / 128 K1512 MB / 1 GBDRAM

375 K2

2 GB DRAM

512 K22 GB DRAM

Maximum securit policies 384 384 512 2,048 4,096 7,256 8,192

Maximum users supported Unrestricted Unrestricted Unrestricted Unrestricted Unrestricted Unrestricted Unrestricted

Network Connectivity

Fixed I/O 8 x 10/100 VDSL/ADSL2+,8 x 10/100

2 x10/100/1000BASE-T + 6 x10/100

8 x10/100/1000BASE-T

16 x10/100/1000BASE-T

6 x10/100/1000

BASE-T + 4SFP

4 x10/100/1000BASE-T

I/O slots N/A N/A 1 x SRX SeriesMini-PIM

2 x SRX SeriesMini-PIM

4 x SRX SeriesMini-PIM

2 x SRX Series

Mini-PIM, 8x GPIM ormultiple GPIMand XPIMcombinations

8 x GPIM ormultiple GPIMand XPIMcombinations

Services and Routing Engineslots

No No No No No No 24

ExpressCard slot (3G WAN) No No yes No No No No

WAN/LAN interace options N/A N/ASee orderinginormation

See orderinginormation




Maximum number o PoE ports(PoE optional on some SRXSeries models)

N/A N/A Up to 4 portso 802.3awitmaximum50 W

Up to 8 portso 802.3a/at witmaximum120 W




USB 1 2 2 2 2 2 2 per SRE

*Tere are several models available or te SRX210 including te enanced version. Please contact our Juniper or partner account representative or more inormation.

1 Wen UTM is enabled capacities supported are low memor speciications, on ig memor sstem options.2 Wen UTM is enabled concurrent sessions supported is 50% 0 value sown.3 SRX100B installed wit 1 GB DRAM, wit 512 MB accessible. Optional upgrade to 1 GB DRAM is available wit purcase o memor sotware license ke.4 SRX650 supports a single Services and Routing Engine (SRE) as o sotware release 11.2.5 Trougput numbers based on hTTP traic wit 44 kilobte transaction size.

Certifcations (continued) Supported ardware versions o te FIPS 140-2 gatewas:

SRX100B, SRX210B, SRX240B and SRX650-BASE-SRE6-645AP

wit JNPR-FIPS-TAMPER-LBLS

- Roles, Services, and Autentication: Level 3

- EMI/EMC: Level 3

- Design Assurance: Level 3

- FIPS-approved algoritms: Triple-DES; AES; DSA; ShS;

- RNG; RSA; hMAC

NEBS Compliance or SRX240, SRX650

Department o Deense (DoD) Certication or SRX Series Services

Gatewas, including testing and certication b te Department

o Deense Joint Interoperabilit Test Command (JITC) or

interoperabilit wit DoD networks and addition o te SRX Series

Services Gatewas to te Unied Capabilities Approved Product

List (UC APL)

Specifcations (continued)


8/20

8

SRX100 SRX110 SRX210* SRX220 SRX240 SRX550 SRX650

Routing

BGP instances 5 5 10 16 20 56 64

BGP peers 8 8 16 16 32 192 256

BGP routes 4 K/8 K6 8 K 8 K/16 K6 32 K 32 K/64 K6 712 K 800 K

OSPF instances 4 4 10 16 20 56 64

OSPF routes 4 K/8 K6 8 K 8 K/16 K6 32 K 32 K/64 K6 712 K 800 K

RIP v1 / v2 instances 4 4 10 16 20 56 64

RIP v2 routes 4 K/8 K6 8 K 8 K/16 K6 32 K 32 K/64 K6 712 K 800 K

Static routes 4 K/8 K6 8 K 8 K/16 K6 32 K 32 K/64 K6 712 K 800 K

Source-based routing yes yes yes yes yes yes yes

Polic-based routing yes yes yes yes yes yes yes

Equal-cost multipat (ECMP) yes yes yes yes yes yes yes

Reverse pat orwarding (RPF) yes yes yes yes yes yes yes

IPsec VPN

Concurrent VPN tunnels 128 128 256 512 1,000 2,000 3,000

Tunnel interaces 10 10 64 64 128 456 512

DES (56-bit), 3DES (168-bit)and AES (256-bit)

yes yes yes yes yes yes yes

MD-5 and ShA-1 autentication yes yes yes yes yes yes yes

Manual ke, Internet KeExcange (IKE), public keinrastructure (PKI) (X.509)


Perect orward secrec (DhGroups)

1, 2, 5 1, 2, 5 1, 2, 5 1, 2, 5 1, 2, 5 1, 2, 5 1, 2, 5

Prevent repla attack yes yes yes yes yes yes yes

Dnamic remote access VPN yes yes yes yes yes yes yes

IPsec NAT traversal yes yes yes yes yes yes yes

Redundant VPN gatewas yes yes yes yes yes yes yes

Number o remote access users 25 users 25 users 50 users 150 users 250 users 500 users 500 users

User Authentication and Access Control

Tird-part user autentication RADIUS, RSASecureID,LDAP

RADIUS, RSASecureID,LDAP






RADIUS accounting yes yes yes yes yes yes yes

XAUTh VPN, Web-based, 802.Xautentication


PKI certicate requests (PKCS 7and PKCS 10)


Certicate Autorities supported VeriSign,Entrust,Microsof, RSAKeon, iPLanet,(Netscape),Baltimore,DoD PKI

VeriSign,Entrust,Microsof, RSAKeon, iPLanet,(Netscape),Baltimore,DoD PKI


VeriSign,Entrust,Microsof, RSAKeon, iPLanet,(Netscape),Baltimore,

DoD PKI


VeriSign,Entrust,Microsof, RSAKeon, iPLanet,(Netscape),Baltimore,

DoD PKI


VirtualizationMaximum number o securitzones

10 10 12 24 32 96 128

Maximum number o virtualrouters

3 3 10 15 20 48 60

Maximum number o VLANs 16 16 64 128 512 3,072 3,967

Product Comparison (continued)

6 Low memor/ig memor.



9/20

9


Encapsulations

PPP/MLPPP N/A N/A yes yes yes yes yes

PPPoE yes yes yes yes yes yes yes

PPPoA N/A yes yes yes yes yes yes

MLPPP maximum psicalinteraces

N/A N/A 1 2 4 12 12

Frame Rela N/A N/A yes yes yes yes yes

MLFR (FRF .15, FRF .16) N/A N/A yes yes yes yes yes

MLFR maximum psicalinteraces

N/A N/A 1 2 4 12 12

hDLC N/A N/A yes yes yes yes yes

Wireless

CX111 3G /4G LTE Bridge support yes yes yes yes yes yes yes

Junos/SRX Series managemento CX111


Internal 3G ExpressCard slotsupport

No No yes No No No No

USB 3G/4G LTE support yes yes yes No No No No

Max WLAN access pointssupported wit AX411 2 2 4 4 4 4** 4

WLA Series access points andWLC Series controllers supported

> 4 > 4 > 4 > 4 > 4 > 4 > 4

Flash and MemoryMemor minimum andmaximum (DRAM)

512 MB(accessible),

1 GB1

1 GB 512 MB, 1 GB 1 GB 512 MB, 1 GB 2 GB 2 GB

Memor slots Fixed memor Fixed memor Fixed memor Fixed memor Fixed memor 2 DIMM 4 DIMM

Flas memor 1 GB 1 GB,externallaccessible

1 GB 1 GB,externallaccessible

1 GB 2 GB CFinternal

2 GB CFinternal onSRE, externalslot empt,up to 2 GB CFsupported

USB port or external storage yes yes yes yes yes yes yes

Dimensions and PowerDimensions (W x h x D) 8.5 x 1.4 x 5.8

in (21.6 x 3.6 x14.7 cm)

11.02 x 1.72 x8.385 in(28 x 4.37 x21.3 cm)

11.02 x 1.73 x7.12 in

(28.0 x 4.4 x18.1 cm)

11.02 x 1.73 x7.04 in. (28 x4.4 x 17.9 cm)

17.5 x 1.75 x15.1 in(44.4 x 4.4 x38.5 cm)

17.5 x 3.5 x 18.2in (44.4 x 8.8 x

46.2 cm)

17.5 x 3.5 x 18.2in (44.4 x 8.8 x46.2 cm)

Weigt (device and powersuppl)

2.5 lb (1.1 kg) 6.7 lb (3.06kg)

3.3 lb (1.5 kg)non-PoE /4.4 lb(2 kg) PoENo interacemodules

3.43 lb (1.56kg) non-PoENo interacemodules

For LM andhM-AC: 11.2 lb(5.1 kg)

For hM - DC:12.56 lb (5.7kg) / 12.3 lb(5.6 kg) PoENo interacemodules

21.96 lb (9.96kg)

No interacemodules

1 power suppl

24.9 lb(11.3 kg)No interacemodules1 power suppl

Rack-mountable yes, 1 RU yes, 1 RU yes, 1 RU yes, 1 RU yes, 1 RU yes, 2 RU yes, 2 RU

Power suppl (AC) 100-240 VAC,30 W

100-240 VAC,60 W

100240 VAC,60 W non-PoE/150 W PoE

100240 VAC,60 W non-PoE /200 W PoE

150 W or LMand hM

190 W or hMwit DC

360 W or PoE

100240 VAC,

single 645W or

dual 645 W

100240 VAC,single 645W ordual 645 W

Maximum PoE power N/A N/A 50 W 120 W 150 W 247 Wredundant, or494 W non-redundant

247 Wredundant, or494 W non-redundant


.1 SRX100B installed wit 1 GB DRAM, wit 512 MB accessible. Optional upgrade to 1 GB DRAM is available wit purcase o memor sotware license ke.



10/20

10


Dimensions and Power (continued)Average power consumption 10 W 24 W 27 W (LM),

28 W (hM),84 W (PoE)

28 W (LM) SRX240B -71 W

SRX240h -74 W

SRX240h-DC- 72 W

SRX240h-PoE- 86 W

122 W 122 W

Input requenc 50-60 hz 50-60 hz 50-60 hz 50-60 hz 50-60 hz 50-60 hz 50-60 hz

Maximum current consumption 0.25 A @ 100VAC

1.75 A @ 100VAC

0.41 A @ 100VAC (LM),0.44 A @ 100VAC (hM), 1.13A @ 100 VAC(PoE)

0.44 A @ 100VAC (hM)

1.0 A @ 100VAC (LM), 1.1A @ 100 VAC(hM), 3.0 A@ 100 VAC(PoE)

5.3 A @ 100VAC witsingle PSUwit PoE, 8.3A @ 100 VACwit dual PSUwit PoE

5.3 A @ 100VAC witsingle PSUwit PoE, 8.3A @ 100 VACwit dual PSUwit PoE

Maximum inrus current 60 A 70 A 80 A or LM/hM, 60 A orPoE

80 A or hM 40 A orLM/hM,45 A or PoE

45 A or ccle

45 A or ccle

Average eat dissipation 35 BTU/r 81 BTU/r 92 BTU/r(SRX210B),95 BTU/r(SRX210h),116 BTU/r(SRX210h-PoE)

126 BTU/our(SRX220h)

SRX240B -242 BTU/r

SRX240h -253 BTU/r

SRX240h-DC- 246 BTU/r

SRX240h-PoE- 294BTU/r

319 BTU/r 319 BTU/r

Maximum eat dissipation 80 BTU/r 99 BTU/r 120 BTU/r(SRX210B),126 BTU/r(SRX210h),157 BTU/r(SRX210h-PoE)

126 BTU/our(SRX220h)

SRX240B -396 BTU/r

SRX240h -427 BTU/r

SRX240h-DC- 409 BTU/r

SRX240h-PoE- 560BTU/r

699 BTU/r 699 BTU/r

Redundant power suppl (otswappable)

No No No No No yes (up tomaximumcapacit osingle PSU)

yes (up tomaximumcapacit osingle PSU)

Acoustic noise level

(Per ISO 7779 Standard)

0 dB (anless) 0 dB (anless) 29.1 dB 51.1 dB 70.0 dB 51.8 dB 60.9 dB

Environment

Operational temperature 32 to 104 F(0 to 40 C)

32 to 104 F(0 to 40 C)

32 to 104 F(0 to 40 C)

32 to 104 F

(0 to 40 C)

32 to 104 F(0 to 40 C)

32 to 104 F

(0 to 40C)

32 to 104 F(0 to 40C)

Nonoperational temperature 4 to 158 F,(-20 to70 C)

4 to 158 F,(-20 to70 C)

4 to 158 F,(-20 to70 C)

4 to 158 F,

(-20 to70 C)

-40 to 158 F,(-40 to70 C)

4 to 158 F,

(-20 to70 C)

4 to 158 F,(-20 to70 C)

humidit (operating) 10% to 90%noncondesing

10% to 90%noncondesing






humidit (nonoperating) 5% to 95%noncondesing







Mean time between ailures(Telcordia model)

24.8 ears(SRX100B)

24.8 ears(SRX100h)

24.8 ears 15.2 ears(SRX210B)

14.3 ears(SRX210h)

10.4 ears

(SRX210h-PoE)

14.3 ears(SRX220h)

10.4 ears(SRX220h-PoE)

15.2 ears(SRX240B)

14.3 ears(SRX240h)

10.4 ears

(SRX240h-PoE)

9.6 earswitredundantpower

9.6 earswitredundantpower




11/20

11


Certications and Network Homologation

USA

Saet certications UL 60950-1 UL 60950-1 UL 60950-1 UL 60950-1 UL 60950-1 UL 60950-1 UL 60950-1

EMC cert icat ions FCC Class B FCC Class B FCC Class B1 FCC Class A FCC Class A FCC Class A FCC Class A

Network omologation TIA-968 TIA-968 TIA-968 TIA-968 TIA-968 TIA-966 TIA-966

Canada

Saet certications CSA 60950-1 CSA 60950-1 CSA 60950-1 CSA 60950-1 CSA 60950-1 CSA 60950-1 CSA 60950-1

EMC certications ICES class B ICES class B ICES class B1 ICES Class A ICES class A ICES class A ICES class A

Network omologation CS-03 CS-03 CS-03 CS-03 CS-03 CS-03 CS-03

Australia

Saet certications AS / NZS60950-1

AS / NZS60950-1

AS / NZS60950-1

AS / NZS60950-1

AS / NZS60950-1

AS / NZS60950-1

AS / NZS60950-1

EMC certications AS / NZSCISPR22Class B

AS / NZSCISPR22Class B

AS / NZSCISPR22Class B1

AS / NZSCISPR22Class A




Network omologation AS / ACIF S002, S 016, S043.1, S043.2

AS / ACIF S002, S 016, S043.1, S043.2

AS / ACIF S002, S 016, S043.1, S043.2

AS / ACIF S002, S 016, S043.1, S043.2

AS / ACIF S002, S 016, S043.1, S043.2

AS / ACIF S016

AS / ACIF S016

New Zealand

Saet certications AS / NZS60950-1 AS / NZS60950-1 AS / NZS60950-1 AS / NZS60950-1 AS / NZS60950-1 AS / NZS60950-1 AS / NZS60950-1

EMC certications AS / NZSCISPR22Class B

AS / NZSCISPR22Class B

AS / NZSCISPR22Class B1





Network omologation PTC 217, PTC273

PTC 217, PTC273

PTC 217, PTC273

PTC 217, PTC273

PTC 217, PTC273

PTC 217 PTC 217

Japan

Saet certications CB Sceme CB Sceme CB Sceme CB Sceme CB Sceme CB Sceme CB Sceme

EMC certications VCCI Class B VCCI Class B VCCI Class B1 VCCI Class A VCCI Class A VCCI Class A VCCI Class A

Network omologation Certicateor TecnicalConditions

Certicateor TecnicalConditions






European Union

Saet certications EN 60950-1 EN 60950-1 EN 60950-1 EN 60950-1 EN 60950-1 EN 60950-1 EN 60950-1

EMC certications EN 55022Class B,EN 300 386

EN 55022Class B,EN 300 386

EN 55022Class B1,EN 300 386

EN 55022Class A,EN 300 386

EN 55022Class A,EN 300 386

EN 55022

Class A,

EN 300 386

EN 55022Class A,EN 300 386

Network omologation CTR 12/13,CTR 21, DoC

CTR 12/13,CTR 21, DoC




CTR 12/13,DoC

CTR 12/13,DoC

Juniper Networks Services and SupportJuniper Networks is te leader in perormance-enabling services tat are designed to accelerate, extend, and optimize our ig-

perormance network. Our services allow ou to maximize operational eicienc wile reducing costs and minimizing risk, acieving a

aster time to value or our network. Juniper Networks ensures operational excellence b optimizing te network to maintain required

levels o perormance, reliabilit, and availabilit. For more details, please visit www.juniper.net/us/en/products-services.



1 SRX210h-POE is class A.


12/20

12

Interace Modules Compatibility Matrix

Component Description SRX100 SRX110 SRX210 SRX220 SRX240 SRX550 SRX650

SRX-GP-16GE 16-port10/100/1000BASE-TXPIM

X X X X X 3 3

SRX-GP-16GE-POE 16-port10/100/1000BASE-T PoEXPIM

X X X X X 3 3

SRX-GP-2XE-SFPPTX

2-port 10GbESFP+/10GbE BASE-TCopper XPIM

X X X X X 3 3

SRX-GP-24GE 24-port10/100/1000BASE-TXPIM, includes

4 SFP slots

X X X X X 3 3

SRX-GP-24GE-POE 24-port10/100/1000BASE-TPoE XPIM, includes 4 SFPslots

X X X X X 3 3

SRX-GP-DUAL-T1-E1

Dual T1/E1 GPIM X X X X X 3 3

SRX-GP-QUAD-T1-E1

Quad T1/E1 GPIM X X X X X 3 3

SRX-GP-1DS3-E3 1-port clear cannel DS3/E3 GPIM single GPIM slot

X X X X X 3 3

SRX-GP-8SERIAL Eigt-port Snc SerialGPIM

X X X X X 3 3

SRX-MP-1SERIAL 1-port Snc SerialMini-PIM

X X 3 3 3 3 X

SRX-MP-1ADSL2-A 1-port ADSL2+ Mini-PIMsupporting ADSL/ADSL2/ADSL2+ Annex A

X X 3 3 3 3 X

SRX-MP-1ADSL2-B 1-port ADSL2+ Mini-PIMsupporting ADSL/ADSL2/ADSL2+ Annex B

X X 3 3 3 3 X

SRX-MP-1VDSL2-A 1-port VDSL2 Mini-PIMsupporting Annex A,wit allback to ADSL2/ADSL2+

X X 3 3 3 3 X

SRX-MP-8GShDSL 8-wire (4-pair) G.ShDSL

Mini-PIM

X X 3 3 3 3 X

SRX-MP-1SFP-GE 1-port SFP Mini-PIM X X 3 3 3 3 X

SRX-MP-1T1E1 1-port T1 or E1 Mini-PIM X X 3 3 3 3 X


13/20

13

Ordering Inormation

Model Number Description

SRX650 Base SystemSRX650-BASE-SRE6-645AP

SRX650 Services Gatewa wit SRE 6,645 W AC PoE PSU; includes 4 onboard10/100/1000BASE-T ports, 2 GB DRAM, 2 GBCF, 247 W PoE power, an tra, power cord andrack-mount kit

SRX650-BASE-SRE6-645DP

SRX650 Services Gatewa wit SRE 6,645 W DC PoE PSU; includes 4 onboard10/100/1000BASE-T ports, 2 GB DRAM, 2 GB

CF, 247 W PoE power, an tra, power cord andrack-mount kit

SRX650B-SRE6-645AP-TAA

Trade Agreement Act-compliant SRX650Services Gatewa wit SRE 6, 645 W AC PoEPSU; includes 4 onboard 10/100/1000BASE-Tports, 2 GB DRAM, 2 GB CF, 247 W PoE power,an tra, power cord and rack-mount kit

SRX650 Power Supplies and AccessoriesSRX600-PWR-645AC-POE

Spare 645 W AC PoE power suppl unit orSRX650, SRX550 sstemsone is includedin SRX650, SRX550 base sstem (SRX650-BASE-SRE6-645AP, SRX550-645AP)

SRX600-PWR-645DC-POE

645 W DC source power suppl or SRX550 andSRX650; provides 397 W sstem power @ 12 Vand 248 W PoE power @ 50 VDC; works wit43-56 VDC inputno power cord

SRX600-SRE6h Spare SRE6-h or SRX650one is included inSRX650 base sstem (SRX650-BASE-SRE6-645AP)

SRX650-ChAS SRX650 cassis including an trano sstemprocessor (SRE) and no power suppl unit

SRX650-FAN-01 Spare SRX650 an tra, one is included inSRX650 cassis spare (SRX650-ChAS), andincluded in SRX650 base sstem (SRX650-BASE-SRE6-645AP)

SRX650-FILT-01 Not included in SRX650 cassis spare(SRX650-ChAS), and not included in SRX650base sstem (SRX650-BASE-SRE6-645AP)optional, as tis is not required or normaloperations, but recommended or dustenvironments

SRX650 Additional Sofware Feature Licenses

SRX650-K-AV One ear subscription or Juniper-Kasperskantivirus updates on SRX650

SRX650-S-AV One ear subscription or Juniper-Soposantivirus updates on SRX650

SRX650-IDP One ear subscription or IDP updates onSRX650

SRX650-S2-AS One ear subscription or Juniper-Soposantispam updates on SRX650

SRX650-W-WF One ear subscription or Juniper-WebsenseWeb ltering updates on SRX650

SRX650-SMB4-CS One ear securit subscription or enterpriseincludes Kaspersk AV, enanced WF, SoposAS, AppSecure and IDP on SRX650

SRX650-S-SMB4-CS One ear securit subscription or enterpriseincludes Sopos AV, enanced WF, Sopos AS,

AppSecure and IDP on SRX650

SRX650-K-AV-3 Tree ear subscription or Juniper-KasperskAV updates on SRX650

SRX650-S-AV-3 Tree ear subscription or Juniper-Sopos AVupdates on SRX650

SRX650-IDP-3 Tree ear subscription or IDP updates onSRX650


SRX650-S2-AS-3 Tree ear subscription or Juniper-Soposantispam updates on SRX650

SRX650-W-WF-3 Tree ear subscription or Juniper-WebsenseWeb ltering updates on SRX650

SRX650-SMB4-CS-3 Tree ear securit subscription or enterpriseincludes Kaspersk AV, enanced WF, SoposAS, AppSecure and IDP on SRX650

SRX650-S-SMB4-

CS-3

Tree ear securit subscription or enterprise

includes Sopos AV, enanced WF, Sopos AS,AppSecure and IDP on SRX650

SRX-BGP-ADV-LTU Advanced BGP License or SRX550 andSRX650 onl

SRX650-K-AV-5 Five ear subscription or Juniper-Kaspersk AVupdates on SRX650

SRX650-S-AV-5 Five ear subscription or Juniper-Sopos AVupdates on SRX650

SRX650-IDP-5 Five ear license or IDP updates or SRX650

SRX650-W-WF-5 Five ear subscription or Juniper-WebsenseWeb ltering updates on SRX650

SRX650-SMB4-CS-5 Five ear securit subscription or enterpriseincludes Kaspersk AV, enanced WF, SoposAS, AppSecure and IDP on SRX650

SRX650-S-SMB4-

CS-5

Five ear securit subscription or enterprise

includes Sopos AV, enanced WF, Sopos AS,AppSecure and IDP on SRX650

SRX-RAC-5-LTU Dnamic VPN Client: 5 simultaneous users orSRX100, SRX110, SRX210, SRX220, SRX240,SRX550, and SRX650



SRX-RAC-50-LTU Dnamic VPN Client: 50 simultaneous usersor SRX210, SRX220, SRX240, SRX550, andSRX650 onl

SRX-RAC-100-LTU Dnamic VPN Client: 100 simultaneous usersor SRX220, SRX240, SRX550, and SRX650onl


SRX-RAC-250-LTU Dnamic VPN Client: 250 simultaneous usersor SRX240, SRX550, and SRX650 onl

SRX-RAC-500-LTU Dnamic VPN Client: 500 simultaneous usersor SRX550 and SRX650 onl

SRX650-APPSEC-A-1 One ear subscription or Application Securitand IPS updates or SRX650

SRX650-APPSEC-A-3 Tree ear subscription or Application Securitand IPS updates or SRX650

SRX650-APPSEC-A-5 Five ear subscription or Application Securitand IPS updates or SRX650


14/20

14


SRX550 Base System

SRX550- 645AP SRX550 Services Gatewa, 2 RU eigt, 6 GPIMslots, 2 Mini-PIM slots, 6 10/100/1000BASE-Tports, 4 GbE SFP ports, dual PS slots, ans;sips wit one 645 watt AC power suppl wit247 W PoE power (power cord and rack-mountkit included)

SRX550- 645DP SRX550 Services Gatewa, 2 RU eigt, 6 GPIM

slots, 2 Mini-PIM slots, 6 10/100/1000BASE-Tports, 4 GbE SFP ports, dual PS slots, ans;sips wit one 645 watt DC power suppl wit247 W PoE power (no power cord and rack-mount kit Included)

SRX550 Power Supplies and Accessories

SRX600-PWR-645AC-POE

Spare 645 W AC PoE power suppl unitor SRX550 and SRX650 sstemsone isincluded in SRX550 and SRX650 base sstems(SRX650-BASE-SRE6-645AP, SRX550-645AC)

SRX600-PWR-645DC-POE

645 W DC source power suppl or SRX550,SRX650 provides 397 W sstem power @ 12 Vand 248 W PoE power @ 50 VDC; works wit43-56 VDC inputno power cord

SRX550-ChAS SRX550 Services Gatewa, 2 RU eigt, 6 GPIMslots, 2 Mini-PIM slots, 6 10/100/1000BASE-Tports, 4 GbE SFP ports, dual PS slots, ans(power suppl not included)

SRX550-FILT-01 Not included in SRX550 sstems, optional, astis is not required or normal operations, butrecommended or dust environments








SRX550-S-SMB4-CS One ear securit subscription or enterpriseincludes Sopos AV, enanced WF, Sopos AS,AppSecure and IDP on SRX550

SRX550-K-AV-3 Tree ear subscription or Juniper-KasperskAV updates on SRX550

SRX550-S-AV-3 Tree ear subscription or Juniper-Sopos AVupdates on SRX550

SRX550-IDP-3 Tree ear subscription or IDP updates onSRX550

SRX550-S2-AS-3 Tree ear subscription or Juniper-Sopos

antispam updates on SRX550


SRX550-SMB4-CS-3 Tree ear securit subscription or enterpriseincludes Kaspersk AV, enanced WF, SoposAS, AppSecure and IDP on SRX550

SRX550-S-SMB4-CS-3

Tree ear securit subscription or enterpriseincludes Sopos AV, enanced WF, Sopos AS,AppSecure and IDP on SRX550


SRX-BGP-ADV-LTU Advanced BGP License or SRX550 andSRX650 onl

SRX550-K-AV-5 Five ear subscription or Juniper-Kaspersk AVupdates on SRX550

SRX550-S-AV-5 Five ear subscription or Juniper-Sopos AVupdates on SRX550

SRX550-IDP-5 Five ear license or IDP updates or SRX550



SRX550-S-SMB4-CS-5

Five ear securit subscription or enterpriseincludes Sopos AV, enanced WF, Sopos AS,AppSecure and IDP on SRX550

SRX-RAC-5-LTU Dnamic VPN Client: 5 simultaneous users orSRX100, SRX110, SRX210, SRX220, SRX240,and SRX550

SRX-RAC-10-LTU Dnamic VPN Client: 10 simultaneous users orSRX100, SRX110, SRX210, SRX220, SRX240,and SRX550

SRX-RAC-25-LTU Dnamic VPN Client: 25 simultaneous users orSRX100, SRX110, SRX210, SRX220, SRX240,

SRX550, and SRX650

SRX-RAC-50-LTU Dnamic VPN Client: 50 simultaneous usersor SRX210, SRX220, SRX240, SRX550, andSRX650 onl




SRX-RAC-500-LTU Dnamic VPN Client: 500 simultaneous usersor SRX550 and SRX650 onl

SRX550-APPSEC-A-1 One ear subscription or Application Securit

and IPS updates or SRX550SRX550-APPSEC-A-3 Tree ear subscription or Application Securit

and IPS updates or SRX550


SRX240 Base System

SRX240B SRX240 Services Gatewa wit 16 GbE ports,4 Mini-PIM slots, and base memor (512 MBRAM, 1 GB Flas)

SRX240h SRX240 Services Gatewa wit 16 GbE ports,4 Mini-PIM slots, and ig memor (1 GB RAM,1 GB Flas)

SRX240h-POE SRX240 Services Gatewa wit 16 GbE ports,4 Mini-PIM slots, and ig memor (1 GB RAM, 1GB Flas), wit 16 ports PoE (150 W)

SRX240-RMK SRX240 rack-mount kit or 19 in rack (oldsone unit)

SRX240h-TAA Trade Agreement Act-compliant SRX240Services Gatewa wit 16 GbE ports, 4 Mini-PIMslots, and ig memor (1 GB RAM, 1 GB Flas)

SRX240h-POE-TAA Trade Agreement Act-compliant SRX240Services Gatewa wit 16 GbE ports, 4 Mini-PIMslots, and ig memor (1 GB RAM, 1 GB Flas),wit 16 ports PoE (150 W)

SRX240h-DC SRX240 Services Gatewa wit 16 GbE ports,4 Mini-PIM slots, and ig memor (1 GB RAM,1 GB Flas)

Ordering Inormation (continued)


15/20

15











SRX240-K-AV-3 Tree ear subscription or Juniper-Kasperskantivirus updates on SRX240

SRX240-S-AV-3 Tree ear subscription or Juniper-Soposantivirus updates on SRX240

SRX240-IDP-3 Tree ear subscription or IDP updates on

SRX240SRX240-S2-AS-3 Tree ear subscription or Juniper-Sopos



SRX240-SMB4-CS-3 Tree ear securit subscription orenterpriseincludes Kaspersk AV, enancedWF, Sopos AS, AppSecure and IDP onSRX240

SRX240-S-SMB4-CS-3

Tree ear securit subscription orenterpriseincludes Sopos AV, enanced WF,Sopos AS, AppSecure and IDP on SRX240

SRX240-K-AV-5 Five ear subscription or Juniper-Kasperskantivirus updates on SRX240

SRX240-S-AV-5 Five ear subscription or Juniper-Sopos

antivirus updates on SRX240

SRX240-IDP-5 Five ear subscription or IDP updates onSRX240

SRX240-S2-AS-5 Five ear subscription or Juniper-Soposantispam updates on SRX240



SRX240-S-SMB4-CS-5




SRX240-SMB2-CS-5 Five ear securit subscription or enterpriseincludes Kaspersk antivirus, Web ltering,Sopos antispam, and IDP on SRX240


SRX240-S-SMB-CS-5 Five ear securit subscription or enterpriseincludes Sopos antivirus, Web ltering,Sopos antispam and IPS on SRX240


SRX-RAC-10-LTU Dnamic VPN Client: 10 simultaneoususers or SRX100, SRX110, SRX210, SRX220,

SRX240, SRX550, and SRX650SRX-RAC-25-LTU Dnamic VPN Client: 25 simultaneous

users or SRX100, SRX110, SRX210, SRX220,SRX240, SRX550, and SRX650

SRX-RAC-50-LTU Dnamic VPN Client: 50 simultaneous usersor SRX210, SRX22, SRX240, SRX550 andSRX650 onl





SRX240-APPSEC-A-3 Tree ear subscription or ApplicationSecurit and IPS updates or SRX240


SRX220 Base System

SRX220h SRX220 Services Gatewa wit 8 GbE ports,2 Mini-PIM slots, and ig memor (1 GB RAM,1 GB Flas)external power suppl and cordincluded

SRX220h-POE* SRX220 Services Gatewa wit 8 GbE ports, 2Mini-PIM slots, and ig memor (1 GB RAM, 1GB Flas), wit 8 ports PoE (120 W)*


SRX220-WALL-KIT SRX220 wall mount kit (olds one unit)

SRX220-PWR-60W**

Spare SRX220 switcing power suppl,

60 W (non-POE)









*SRX220h-POE available as o Q4 2010.

**See price list or countr-speciic power cord model numbers.


16/20

16


SRX220 Additional Sofware Feature Licenses(continued)



SRX220-IDP-3 Tree ear subscription or IDP updates on

SRX220SRX220-S2-AS-3 Tree ear subscription or Juniper-Sopos



SRX220-SMB4-CS-3 Tree ear securit subscription orenterpriseincludes Kaspersk AV, enancedWF, Sopos AS, AppSecure and IDP onSRX220

SRX220-S-SMB4-CS-3



SRX220-S-AV-5 Five ear subscription or Juniper-Sopos


SRX220-IDP-5 Five ear subscription or IDP updates onSRX220



SRX220-S-SMB4-CS-5



SRX-RAC-10-LTU Dnamic VPN Client: 10 simultaneous users or

SRX100, SRX110, SRX210, SRX220, SRX240,SRX550, and SRX650

SRX-RAC-25-LTU Dnamic VPN Client: 25 simultaneous usersor SRX100, SRX110, SRX210, SRX220, SRX240,SRX550, and SRX650

SRX-RAC-50-LTU Dnamic VPN Client: 50 simultaneous usersor SRX210, SRX220, SRX240, SRX550, andSRX650

SRX-RAC-100-LTU Dnamic VPN Client: 100 simultaneous usersor SRX220, SRX240, SRX550, and SRX650

SRX-RAC-150-LTU Dnamic VPN Client: 150 simultaneous usersor SRX220, SRX240, SRX550, and SRX650


SRX220-APPSEC-A-3 Tree ear subscription or Application Securit

and IPS updates or SRX220SRX220-APPSEC-A-5 Five ear subscription or Application Securit

and IPS updates or SRX220


SRX210 Base System

SRX210BE SRX210 Services Gatewa wit 2 GbE + 6 FastEternet ports, 1 Mini-PIM slot, 1 ExpressCardslot and base memor (512 MB RAM, 1 GBFlas)

SRX210hE SRX210 Services Gatewa wit 2 GbE+ 6 FastEternet ports, 1 Mini-PIM slot, 1 ExpressCardslot and ig memor (1 GB RAM, 1 GB Flas)

SRX210hE-POE SRX210 Services Gatewa wit 2 GbE + 6 FastEternet ports, 1 Mini-PIM slot, 1 ExpressCardslot and ig memor (1 GB RAM, 1 GB Flas),wit 4 ports PoE (50 W)

SRX210B SRX210 Services Gatewa wit 2 GbE + 6 FastEternet ports, 1 Mini-PIM slot, 1 ExpressCardslot and base memor (512 MB RAM, 1 GBFlas)

SRX210h SRX210 Services Gatewa wit 2 GbE+ 6 FastEternet ports, 1 Mini-PIM slot, 1 ExpressCardslot and ig memor (1 GB RAM, 1 GB Flas)

SRX210h-POE SRX210 Services Gatewa wit 2 GbE + 6 FastEternet ports, 1 Mini-PIM slot, 1 ExpressCardslot and ig memor (1 GB RAM, 1 GB Flas),wit 4 ports PoE (50 W)

SRX210 Additional Hardware

SRX210-DESK-STAND

SRX210 desk top stand (olds one unit)



SRX210-PWR-60W-* Spare SRX210 switcing power suppl,60 W (non-PoE)

SRX210-PWR-150W-*

Spare SRX210 switcing power suppl,

150 W (PoE)



SRX210-S-AV One ear subscr iption or Juniper-Sopos









SRX210-IDP-3 Tree ear subscr iption or IDP updates onSRX210

SRX210-S2-AS-3 Tree ear subscription or Juniper-Soposantispam updates on SRX210


*See price list or countr-speciic power cord model numbers.


17/20

17



(continued)


SRX210-SMB4-CS-3 Tree ear securit subscription orenterpriseincludes Kaspersk AV, enancedWF, Sopos AS, AppSecure and IDP on SRX210

SRX210-S-SMB4-CS-3



SRX210-S-AV-5 Five ear subscription or Juniper-Soposantivirus updates on SRX210

SRX210-IDP-5 Five ear subscr iption or IDP updates onSRX210



SRX210-SMB4-CS-5 Five ear securit subscription or enterpriseincludes Kaspersk AV, enanced WF, Sopos

AS, AppSecure and IDP on SRX210

SRX210-S-SMB4-CS-5





SRX-RAC-50-LTU Dnamic VPN Client: 50 simultaneous usersor SRX210, SRX220, SRX240, SRX550, and

SRX650 onl




Small Form Factor Pluggable (SFP)Transceivers

SRX-SFP-1GE-Lh SFP 1000BASE-Lh Optical Transceiver

SRX-SFP-1GE-LX SFP 1000BASE-LX Optical Transceiver

SRX-SFP-1GE-SX SFP 1000BASE-SX Optical Transceiver

SRX-SFP-1GE-T SFP 1000BASE-T Copper Transceiver

SRX-SFP-FE-FX SFP 100BASE-FX Optical Transceiver


SRX110 Base System

SRX110h-VA SRX110 Services Gatewa wit 8xFE ports,1 GB RAM and Flas, 1-port VDSL2/ADSL2+over POTS, USB port or cellular modemconnectivit, and external PS and cordincluded

SRX110h-VB SRX110 Services Gatewa wit 8xFE ports,1 GB RAM and Flas, 1-port VDSL2/ADSL2+

over ISDN BRI, USB port or cellular modemconnectivit, and external PS and cordincluded

SRX110 Additional Hardware

SRX110-DESK-STAND SRX110 desktop stand; olds one unit

SRX110-RMK SRX110 rack-mount kit; olds one unit

SRX110-WALL-KIT SRX110 wall mount kit; olds one unit

SRX100 Base System

SRX100B SRX100 Services Gatewa wit 8xFE ports andbase memor (On-board 1 GB RAM w/ 512 MBaccessible, 1 GB Flas)

SRX100h SRX100 Services Gatewa wit 8xFE ports andig memor (1 GB RAM, 1 GB Flas)

SRX100 Additional HardwareSRX100-PWR-30W-* Spare SRX100 switcing power suppl, 30 W

(non-PoE)

SRX-100-RMK SRX100 19 rack-mount kit (olds two units)


SRX100-DESK-STAND

SRX100 desk stand (olds one unit)

SRX100/SRX110 Dynamic VPN Client

SRX-RAC-5-LTU 5 simultaneous users or SRX100, SRX110,SRX210, SRX220, SRX240, SRX550, andSRX650

SRX-RAC-10-LTU 10 simultaneous users or SRX100, SRX110,SRX210, SRX220, SRX240, SRX550, and

SRX650

SRX-RAC-25-LTU 25 simultaneous users or SRX100, SRX110,SRX210, SRX220, SRX240, SRX550, andSRX650

SRX100/SRX110 Additional Sofware FeatureLicenses **

SRX1XX-K-AV One ear subscription or Juniper-KasperskAV updates

SRX1XX-K-AV-3 Tree ear subscription or Juniper-KasperskAV updates

SRX1XX-K-AV-5 Five ear subscription or Juniper-Kaspersk AVupdates

SRX1XX-S-AV One ear subscription or Juniper-Sopos AVupdates

SRX1XX-S-AV-3 Tree ear subscription or Juniper-Sopos AVupdates

SRX1XX-S-AV-5 Five ear subscription or Juniper-Sopos AVupdates

SRX1XX-S2-AS One ear subscription or Juniper-Soposantispam updates

SRX1XX-S2-AS-3 Tree ear subscription or Juniper-Soposantispam updates


*See price list or countr-speciic power cord model numbers.

**Te additional sotware eature licenses appl to bot te SRX100 and te SRX110.Available in Q1, 2012 or SRX110.


18/20

18


SRX100/SRX110 Additional Sofware FeatureLicenses ** (continued)

SRX1XX-S2-AS-5 Five ear subscription or Juniper-Soposantispam updates

SRX1XX-W-EWF One ear subscription or Juniper-Websenseenanced Web ltering updates

SRX1XX-W-EWF-3 Tree ear subscription or Juniper-Websenseenanced Web ltering updates

SRX1XX-W-EWF-5 Five ear subscription or Juniper-Websenseenanced Web ltering updates

SRX1XX-SMB4-CS One ear securit subscription or enterpriseincludes Kaspersk AV, enanced WF, SoposAS, AppSecure and IDP

SRX1XX-SMB4-CS-3 Tree ear securit subscription or KasperskAV, enanced WF, Sopos AS, AppSecure andIDP

SRX1XX-SMB4-CS-5 Five ear securit subscription or enterpriseincludes Kaspersk AV, enanced WF, SoposAS, AppSecure and IDP

SRX1XX-S-SMB4-CS One ear securit subscription or enterpriseincludes Sopos AV, enanced WF, Sopos AS,AppSecure, AppSecure and IDP

SRX1XX-S-SMB4-CS-3

Tree ear securit subscription orenterpriseincludes Sopos AV, enanced WF,

Sopos AS, AppSecure and IDP

SRX1XX-S-SMB4-CS-5

Five ear securit subscription or enterpriseincludes Sopos AV, enanced WF, Sopos AS,AppSecure and IDP

SRX1XX-IDP One ear license or IDP updates

SRX1XX-IDP-3 Tree ear license or IDP updates

SRX1XX-IDP-5 Five ear l icense or IDP updates

SRX1XX-K-AV-3-R Tree ear renewal subscription or Juniper-Kaspersk AV updates

SRX1XX-K-AV-5-R Five ear renewal subscription or Juniper-Kaspersk AV updates

SRX1XX-K-AV-R One ear renewal subscription or Juniper-Kaspersk AV updates

SRX1XX-S-AV-3-R Tree ear renewal subscription or Juniper-Sopos AV updates

SRX1XX-S-AV-5-R Five ear renewal subscription or Juniper-Sopos AV updates

SRX1XX-S-AV-R One ear renewal subscription or Juniper-Sopos AV updates

SRX1XX-S2-AS-3-R Tree ear renewal subscription or Juniper-Sopos antispam updates

SRX1XX-S2-AS-5-R Five ear renewal subscription or Juniper-Sopos antispam updates

SRX1XX-S2-AS-R One ear renewal subscription or Juniper-Sopos antispam updates


SRX1XX-W-EWF-3-R Tree ear renewal subscription or Juniper-enanced Websense enanced Web lteringupdates

SRX1XX-W-EWF-5-R Five ear renewal subscription or Juniper-enanced Websense enanced Web lteringupdates

SRX1XX-W-EWF-R One ear renewal subscription or Juniper-enanced Websense enanced Web lteringupdates

SRX1XX-SMB4-CS-R One ear renewal securit subscription orenterpriseincludes Kaspersk AV, enancedWF, Sopos AS, AppSecure and IDP

SRX1XX-SMB4-CS-3-R

Tree ear renewal securit subscription orenterpriseincludes Kaspersk AV, enancedWF, Sopos AS, AppSecure and IDP

SRX1XX-SMB4-CS-5-R

Five ear renewal securit subscription orenterpriseincludes Kaspersk AV, enancedWF, Sopos AS, AppSecure and IDP

SRX1XX-S-SMB4-CS-R

One ear renewal securit subscription orenterpriseincludes Sopos AV, enanced WF,Sopos AS, AppSecure and IDP

SRX1XX-S-SMB4-CS-3-R

Tree ear renewal securit subscription orenterpriseincludes Sopos AV, enanced WF,Sopos AS, AppSecure and IDP

SRX1XX-S-SMB4-

CS-5-R

Five ear renewal securit subscription or

enterpriseincludes Sopos AV, enanced WF,Sopos AS, AppSecure and IDP

SRX1XX-IDP-R One ear renewal subscr ipt ion or IDPSignature service

SRX1XX-IDP-3-R Tree ear renewal subscription or IDPSignature service

SRX1XX-IDP-5-R Five ear renewal subscription or IDPSignature service




** Te additional sotware eature licenses appl to bot te SRX100 and te SRX110. Availablein Q1, 2012 or SRX110.

About Juniper NetworksJuniper Networks is in te business o network innovation. From

devices to data centers, rom consumers to cloud providers,

Juniper Networks delivers te sotware, silicon and sstems tat

transorm te experience and economics o networking. Te

compan serves customers and partners worldwide. Additional

inormation can be ound at www.juniper.net.


19/20

19


20/20

20

1000281-017-EN Ma 2012

Coprigt 2012 Juniper Networks, Inc. All rigts reserved. Juniper Networks, te Juniper Networks logo, Junos,

NetScreen, and ScreenOS are registered trademarks o Juniper Networks, Inc. in te United States and oter

countries. All oter trademarks, service marks, registered marks, or registered service marks are te propert o

teir respective owners. Juniper Networks assumes no responsibilit or an inaccuracies in tis document. Juniper

Networks reserves te rigt to cange, modi, transer, or oterwise revise tis publication witout notice.

EMEA Headquarters

Juniper Networks Ireland

Airside Business Park

Swords, Count Dublin, Ireland

Pone: 35.31.8903.600

EMEA Sales: 00800.4586.4737

Fax: 35.31.8903.601

APAC Headquarters

Juniper Networks (hong Kong)

26/F, Citplaza One

1111 Kings Road

Taikoo Sing, hong Kong

Pone: 852.2332.3636

Fax: 852.2574.7803

Corporate and Sales Headquarters

Juniper Networks, Inc.

1194 Nort Matilda Avenue

Sunnvale, CA 94089 USA

Pone: 888.JUNIPER (888.586.4737)

or 408.745.2000

Fax: 408.745.2100

www.juniper.net

Printed on reccled paper

To purcase Juniper Networks solutions,

please contact our Juniper Networks

representative at 1-866-298-6428 or

autorized reseller.

Documents

Juniper Firewall 1000281-En