Software Licenses for SRX Series Firewalls

Legacy Software Licenses for SRX Series Firewalls

Each feature license is tied to exactly one software feature, and the license is valid for one device. You can use the license to activate the specified advanced software features on a single device. Platform support depends on the Junos OS release in your installation.

Understanding Chassis Cluster Licensing Requirements

There is no separate license required for chassis cluster. However, some Junos OS software features require a license to activate the feature. To configure and use the licensed feature in a chassis cluster setup, you must purchase one license per feature per device and the license needs to be installed on both nodes of the chassis cluster. Both devices (which are going to form a chassis cluster) must have valid, identical features licenses installed on them. If both devices do not have an identical set of licenses, then after a failover, a particular feature (that is, a feature that is not licensed on both devices) might not work or the configuration might not synchronize in chassis cluster formation. Licensing is usually ordered when the device is purchased, and this information is bound to the chassis serial number. For example, Intrusion Detection and Prevention (IDP) is a licensed feature and the license for this specific feature is tied to the serial number of the device.

For information about how to purchase software licenses, contact your Juniper Networks sales representative at https://www.juniper.net/in/en/contact-us/.

Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Firewall Devices

This topic provides licensing information for SRX Series Firewalls running logical systems and tenant systems.

Starting in Junos OS Releases 20.3R3, 20.4R2, 21.1R2, and 21.2R1, you can use the features for logical systems and tenant systems without a license.

Starting in Junos OS Release 18.3R1, an SRX Series Firewall running logical systems or tenant systems includes three licenses by default. One license for a primary logical system and the other two licenses for user-defined logical system or tenant system. The system does not allow you to configure additional logical systems or tenant systems if the number of logical systems and tenant systems exceeds the number of available licenses. In the earlier releases, the system allowed you to configure an additional logical system even if the number of logical systems exceeds the number of available licenses, but with a warning message of non-licensed logical-systems do not pass traffic. You can purchase licenses for additional logical systems and tenant systems that you intend to create. If you intend to configure an interconnect logical system or interconnect tenant system to use as a switch, it also requires separate licenses.

We enforce that you do not configure more logical systems or tenant systems than the number of licenses you have purchased. If the number of logical systems or tenant systems that you attempt to configure exceeds the number of licenses that you have purchased, then the system displays an error message similar to the following:

You can use the show system license status all-logical-systems-tenants or show system license usage commands to view the active logical systems and tenant systems on the device.

When you use SRX Series Firewalls running logical systems or tenant systems in a chassis cluster, you must purchase and install the same number of licenses for each node in the chassis cluster. Logical systems or tenant systems licenses pertain to a single chassis, or node, within a chassis cluster and not to the cluster collectively.

Understanding Content Security Licensing

Installing and Verifying Licenses for an Application Signature Package

The Junos OS application signature package update is a separately licensed subscription service. You must install the application signature package update license key on your device to download and install the signature database updates provided by Juniper Networks. If your license key expires, you can continue to use the locally stored application signature package content.

Licensing is usually ordered when the device is purchased, and this information is bound to the chassis serial number. These instructions assume that you already have the license. If you did not order the license during the purchase of the device, contact your account team or Juniper customer care for assistance. For more information, refer to the Knowledge Base article KB9731 at https://kb.juniper.net/InfoCenter/index?page=home.

Junos Software Base (JSB) package does not include application signatures. Please refer to the product Data Sheets at SRX Series Services Gateways for details, or contact your Juniper Account Team or Juniper Partner.

You can install the license on the SRX Series Firewall devices using either the automatic method or manual method as follows:

• Install your license automatically on the device.

  To install or update your license automatically, your device must be connected to the Internet.

• Install the licenses manually on the device.

  Paste the license key and press Enter to continue.

• Verify the license is installed on your device.

  Use the show system license command to view license usage, as shown in the following example:

  The output sample is truncated to display only license usage details.