Software Architecture

Overview

The SRX400 firewall series runs Junos OS Evolved, a Linux-native network operating system to deliver high availability security services, including next-generation firewalling, zero trust capabilities, and integration with EVPN-VXLAN fabrics. It supports centralized management using the HPE Networking Security Director Cloud, which provides a unified policy framework for consistent security across environments, secure zero-touch provisioning (SZTP), and security features such as NAT and IPsec VPN.

SRX400 firewall series consists of multiple processes that are responsible for different functions.

The core software processing components include:

• Packet Forwarding Engine

• Routing Engine

The software architecture provides a high-level overview of the Junos Evolved architecture, illustrating how the operating system integrates management, control-plane, and data-plane functions on top of the underlying hardware. Management and automation interfaces, including CLI, NETCONF, REST APIs, and telemetry, are used to configure and monitor the system.

The control plane consists of three functional stacks—Security, Routing, and Switching—which are responsible for maintaining policies, routing information, and Layer 2 services. These control-plane functions program the data plane, where the flow engine performs session processing, security policy enforcement, NAT, IPsec, Layer 4–7 inspection, and packet forwarding.

The entire architecture runs on hardware resources such as compute cores, memory, and network I/O ports, highlighting the separation between control-plane decision-making and data-plane packet processing while leveraging Junos OS Evolved as the common operating platform.

Packet Flow Overview

The SRX400 firewall series follows a packet flow model for first-packet and fast-packet processing.

When a packet arrives, the SRX400 firewall series performs initial checks and looks up the session table to determine whether the packet belongs to an existing flow. If a session exists, the packet is processed through the fast path, where stateful services such as TCP validation, NAT, ALG, and IPsec are applied before forwarding. If no session exists, the SRX creates a new session by performing screen checks, route lookup, policy lookup, service lookup, and NAT processing. Once the session is established, all subsequent packets in the flow use fast-path processing, improving performance by reusing the session information instead of repeating the full lookup process.