Junos 12.1X44
55 Gbps
15 Gbps
15 Gbps
2.25/ 6 million sessions *
* Additional Extreme License required for 6M sessions
270,000
40,000
Unrestricted
6 (front slots)
8 10/100/1000 + 4 SFP
N/A
N/A
Junos Space Security Design
- 16 x 1 10/100/1000 copper
- 16 x 1 Gigabit Ethernet small form-factor pluggable transceivers (SFP)
- 2 x 10 Gigabit Ethernet XFP
- Active/Passive, Active/Active
- Low impact chassis cluster
- Interface aggregation groups across chassis cluster
- Application Identification: yes
- Application Denial of Service Protection (AppDoS): yes
- AppTrack: yes
- AppQoS: yes
- AAppFW: yes
- Dimensions (W x H x D): 17.5 x 8.75 x 25.5 in (44.5 x 22.2 x 64.8 cm)
- Weight: Chassis: 43.6 lb (19.8 kg), Fully Configured: 115.7 lb (52.6 kg)
- Power supply (AC): 100 to 240 V AC
- Power supply (DC): -40 to -72 V DC
- Maximum power draw: 1,750 W (AC power), 1,850 W (DC power)
- Power supply redundancy: 2 + 1 / 2 + 2
- Network attack detection: Yes
- DoS and DDoS protection: Yes
- TCP reassembly for fragmented packet protection: Yes
- Brute force attack mitigation: Yes
- SYN cookie protection: Yes
- Zone-based IP spoofing: Yes
- Malformed packet protection: Yes
- GPRS stateful inspection: Yes
- Stateful protocol signatures: Yes
- Attack detection mechanisms: Stateful signatures, protocol anomaly detection (zero-day coverage), application identification
- Attack response mechanisms: Drop connection, close connection, session packet log, session summary, email, custom session
- Attack notification mechanisms: Structured syslog
- Worm protection: Yes
- SSL encrypted traffic inspection: Yes
- Simplified installation through recommended policies: Yes
- Trojan protection: Yes
- Spyware/adware/keylogger protection: Yes
- Other malware protection: Yes
- Protection against attack proliferation from infected systems: Yes
- Reconnaissance protection: Yes
- Request and response side attack protection: Yes
- Compound attacks — combines stateful signatures and protocol anomalies: Yes
- Create custom attack signatures: Yes
- Access contexts for customization: 500+
- Attack editing (port range, other): Yes
- Stream signatures: Yes
- Protocol thresholds: Yes
- Stateful protocol signatures: Yes
- Approximate number of attacks covered: 6,000+
- Detailed threat descriptions and remediation/patch info: Yes
- Create and enforce appropriate application-usage policies: Yes
- Attacker and target audit trail and reporting: Yes
- Deployment modes: Inline or TAP
Switch Fabric and Control Board (SCB)
At the heart of the Dynamic Services Architecture is the switch fabric and control board (SCB). The SCB transforms the chassis from a simple module enclosure into a highly effective mesh network. The purpose of the SCB is to allow all modules in the chassis to send traffic at extremely high bandwidth.
The Route Engine (RE)
The routing engine (RE) is tightly coupled with the functionality of the SCB and can be considered the central nervous system of the architecture. The RE is the control plane of the chassis, and provides overall management and communications to and from system administrators, as well as calculating route tables for routing network traffic.
Services Processing Card (SPC)
As the "brains" behind the SRX3000 services gateways, services processing cards (SPCs) are designed to process all available services on the gateway. By eliminating the need for dedicated hardware for specific services or capabilities, no piece of hardware is ever taxed to the limit while other hardware sits idle. All of the processing capabilities of the SPCs are used to support any and all services and capabilities of the gateway. The same SPCs are supported on both the SRX3600 and the SRX3400 services gateways.(Note: A minimum of one NPC and one SPC is required for proper system functionality.)
Network Processing Cards (NPC)
To ensure maximum processing performance and flexibility, the SRX3000 line of services gateways utilize network processing cards (NPCs) to distribute inbound and outbound traffic to the appropriate SPCs and IOCs, apply QoS, and enforce DoS/DDoS protections. The SRX3600 can be configured to support one to three NPCs, while the SRX3400 can be configured to support one or two NPCs. Adding additional NPCs to these gateways allows organizations to tailor the solution to fit their specific performance requirements.(Note: A minimum of one NPC and one SPC is required for proper system functionality.)
Input/Output Cards (IOC)
In addition to supporting an ideal mix of built-in copper, small form-factor pluggable (SFP), and high-availability (HA) ports, the SRX3000 line allows the greatest I/O port density of any comparable offering. Each SRX3000 services gateway can be equipped with one or several input/output cards (IOCs), each supporting either 16 gigabit interfaces (16 x 1 copper or fiber Gigabit Ethernet), or 20 gigabit interfaces (2 x 10 Gigabit XFP Ethernet). With the flexibility to add additional IOCs, the SRX3000 line of services gateways can be equipped to support an ideal balance between interfaces and processing capabilities. (Note: A minimum of one NPC and one SPC is required for proper system functionality.)
SRX Cluster Module
The SRX Cluster Module is a hardware module that can be installed in the SRX3600 gateway to enable dual, or redundant, H/A control links for chassis clustering. When deploying SRX3600's in H/A clusters, the SRX Cluster Module utilizes the redundant architecture design of the SRX3000 line to provide full control link resiliency for mission critical environments.
| SRX3K-SPC-1-10-40 | SRX 3000 services processing card with 1Ghz processor and 4GB memory |
| SRX3K-NPC | SRX 3000 network processing card |
| SRX3K-16GE-TX | 16x1 10/100/1000 copper CFM I/O card for SRX3000 |
| SRX3K-16GE-SFP | 16x1 Gigabit SFP Ethernet I/O card for SRX3000, no transceivers |
| SRX3K-2XGE-XFP | 2x10 Gigabit XFP Ethernet I/O card for SRX3000, no transceivers |
| SRX3K-RE-12-10 | SRX3000 line routing engine with 1200Mhz processor and 1GB memory |
| SRX3K CRM | SRX3000 line cluster module |
635 KB ]
|
| Model Number | Description |
|---|---|
| Base System | |
| SRX3600BASE-AC |
SRX3600 chassis, midplane, fan, RE, SFB-12GE, 2xAC PEM4 - no power cords - no SPC - no NPC |
| SRX3600BASE-DC |
SRX3600 chassis, midplane, fan, RE, SFB-12GE, 2xDC PEM - no SPC - no NPC |
| SRX3600BASE-DC2 |
SRX3600 chassis, midplane, fan, routing engine, SFB-12 Gigabit Ethernet, 2xDC PEM - no SPC - no NPC |
| SRX3K-PWR-DC2 |
Enhanced DC power entry module for SRX3000 line |
| SRX 3000 Line Components | |
| SRX3K-SPC-1-10-40 |
SRX3000 services processing card with 1Ghz processor and 4GB memory |
| SRX1K3K-NP-2XGE-SFPP |
SRX3000 line Network Processing and I/O Card |
| SRX3K-NPC |
SRX3000 network processing card |
| SRX3K-16GE-TX |
16x1 10/100/1000 copper CFM I/O card for SRX3000 |
| SRX3K-16GE-SFP |
16x1 Gigabit SFP Ethernet I/O card for SRX3000, no transceivers |
| SRX3K-2XGE-XFP |
2x10 Gigabit XFP Ethernet I/O card for SRX3000, no transceivers |
| SRX3K-CRM |
Clustering module for the SRX3000 line to enable redundant control links in highavailability clusters |
| Transceivers | |
| SRX-SFP-1GE-LH |
Small form factor pluggable 1000BASE-LH Gigabit Ethernet optic module |
| SRX-SFP-1GE-LX |
Small form-factor pluggable 1000BASE-LX Gigabit Ethernet optic module |
| SRX-SFP-1GE-SX |
Small form-factor pluggable 1000BASE-SX Gigabit Ethernet optic module |
| SRX-SFP-1GE-T |
Small form-factor pluggable 1000BASE-T Gigabit Ethernet module |
| SRX-XFP-10GE-SR |
10 Gigabit Ethernet pluggable transceiver, short reach multimode |
| SRX-XFP-10GE-LR |
10 Gigabit Ethernet pluggable transceiver, 10 Km, single mode |
| SRX-XFP-10GE-ER |
10 Gigabit Ethernet pluggable transceiver, 40 Km, single mode |
| Logical System License | |
| SRX-3600-LSYS-1 |
1 incremental Logical Systems License for SRX3600 |
| SRX-3600-LSYS-5 |
5 incremental Logical Systems License for SRX3600 |
| SRX-3600-LSYS-25 |
25 incremental Logical Systems License for SRX3600 |
| AppSecure Subscription | |
| SRX3600-APPSEC-A-1 |
One year subscription for Application Security and IPS updates for SRX3600 |
| SRX3600-APPSEC-A-3 |
Three year subscription for Application Security and IPS updates for SRX3600 |
| Services Offload License | |
| SRX3K-SVCS-OFFLOADRTU |
Services offload license for SRX3000 line; this is not an annual subscription license |
| IPS Subscription | |
| SRX3K-IDP |
One year IPS signature subscription for SRX3000 line |
| SRX3K-IDP-3 |
Three year IPS signature subscription for SRX3000 line |
| Extreme LTU | |
| SRX3K-EXTREME-LTU |
Expanded performance and capacity Extreme License for SRX3000 line |
| C19 Straight Power Cables | |
| CBL-PWR-C19S-132-UK |
Power cord, AC, Great Britain & Ireland, C19 at 70-80 mm, 13 A/250 V, 2.5 mm, straight |
| CBL-PWR-C19S-151-US15 |
Power cord, AC, Japan/US, NEMA 5-15 to C19 at 70-80 mm, 15 A/125 V, 2.5 m, straight |
| CBL-PWR-C19S-152-AU |
Power cord, AC, Australia/New Zealand, C19 at 70-80 mm, 15 A/250 V, 2.5 m, straight |
| CBL-PWR-C19S-162-CH |
Power cord, AC, China, C19, 16 A/250 V, 2.5 m, straight |
| CBL-PWR-C19S-162-EU |
Power cord, AC, Continental Europe, C19, 16 A/250 V, 2.5 m, RA |
| CBL-PWR-C19S-162-IT |
Power cord, AC, Italy, C19 at 70-80 mm, 16 A/250 V, 2.5 m, straight |
| CBL-PWR-C19S-162-JP |
Power cord, AC, Japan, NEMA 6-20 to C19, 16 A/250 V, 2.5 m, straight |
| CBL-PWR-C19S-162-JPL |
Power cord, AC, Japan/US, C19 at 70-80 mm, 16 A/250 V, 2.5 m, straight, locking plug |
| CBL-PWR-C19S-162-US |
Power cord, AC, Japan/US, NEMA 6-20 to C19 at 70-80 mm, 16 A/250 V, 2.5 m, straight |
| CBL-PWR-C19S-162-USL |
Power cord, AC, US, NEMA L6-20 to C19, 16 A/250 V, 2.5 m, straight, locking plug |
| SRX3600 System Configuration Guidelines | |
|---|---|
SRX3600 base-system configuration: SRX3600 base(AC or DC), one SPC, one NPC, and two power cords. |
Network Security
