Licenses for SRX Series
Software Feature Licenses for SRX Series Devices
Each feature license is tied to exactly one software feature, and the license is valid for one device. You can use the license to activate the specified advanced software features on a single device. Platform support depends on the Junos OS release in your installation.
We have simplified the ordering and application of SRX Series software feature licenses in flex license model. You can purchase many of the individual features as a bundle based on use case. For more information, see Flex Software License for SRX Series Devices.
To understand more about Junos OS Software Licensing, see the Juniper Licensing Guide. Please refer to the product Data Sheets accessible from Products & Services for details, or contact your Juniper Account Team or Juniper Partner.
ATP Cloud, SecIntel, and Enhanced Web Filtering individual license are available. This is not a complete list of licenses. For the most up-to-date license models available, contact your Juniper Networks representative for license information.
- Features Requiring a License on SRX300 Devices
- Features Requiring a License on SRX320 Devices
- Features Requiring a License on SRX340 Devices
- Features Requiring a License on SRX345 Devices
- Features Requiring a License on SRX1500 Devices
- Features Requiring a License on SRX4100 Devices
- Features Requiring a License on SRX4200 Devices
- Features Requiring a License on SRX4600 Devices
- Features Requiring a License on SRX5400 Devices
- Features Requiring a License on SRX5600 Devices
- Features Requiring a License on SRX5800 Devices
- Features Requiring a License on SRX100 and SRX110 Devices
- Features Requiring a License on SRX210 Devices
- Features Requiring a License on SRX220 Devices
- Features Requiring a License on SRX240 Devices
- Features Requiring a License on SRX550 Devices
- Features Requiring a License on SRX650 Devices
- Features Requiring a License on SRX3400 Devices
Features Requiring a License on SRX300 Devices
Table 1 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX300 |
Intrusion Detection and Prevention (1 year, 3 years and 5 years subscription) |
SRX300 |
Features Requiring a License on SRX320 Devices
Table 2 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX320 |
Intrusion Detection and Prevention (1 year, 3 years and 5 years subscription) |
SRX320 |
Features Requiring a License on SRX340 Devices
Table 3 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices l |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX340 |
Intrusion Detection and Prevention (1 year, 3 years and 5 years subscription) |
SRX340 |
Sky Advanced Threat Prevention (1 year, 3 years and 5 years subscription) |
SRX340 |
SecIntel |
SRX340 |
Features Requiring a License on SRX345 Devices
Table 4 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX345 |
Intrusion Prevention Signature (1 year, 3 years and 5 years subscription) |
SRX345 |
Sky Advanced Threat Prevention (1 year, 3 years and 5 years subscription) |
SRX345 |
SecIntel |
SRX345 |
Features Requiring a License on SRX1500 Devices
Table 5 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX1500 |
Intrusion Prevention Signature (1 year, 3 years and 5 years subscription) |
SRX1500 |
Logical System License (1, 5, and 25 Incremental) |
SRX1500 |
Remote Access (5 Concurrent users, NCP) |
SRX1500 |
Remote Access (10 Concurrent users, NCP) |
SRX1500 |
Remote Access (25 Concurrent users, NCP) |
SRX1500 |
Remote Access (50 Concurrent users, NCP) |
SRX1500 |
Remote Access (100 Concurrent users, NCP) |
SRX1500 |
Remote Access (150 Concurrent users, NCP) |
SRX1500 |
Remote Access (250 Concurrent users, NCP) |
SRX1500 |
Remote Access (500 Concurrent users, NCP) |
SRX1500 |
Remote Access (1000 Concurrent users, NCP) |
SRX1500 |
Remote Access (2000 Concurrent users, NCP) |
SRX1500 |
SecIntel |
SRX1500 |
ATP Cloud (1 year, 3 years and 5 years subscription) |
SRX1500 |
Features Requiring a License on SRX4100 Devices
Table 6 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced performance (upgrade to firewall IMIX performance up to 20G IMIX to the base 20G IMIX firewall throughput supported and application security) |
SRX4100 |
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX4100 |
Intrusion Prevention Signature (1 year, 3 years and 5 years subscription) |
SRX4100 |
Logical System License (1, 5, and 25 Incremental) |
SRX4100 |
Remote Access (5 Concurrent users, NCP) |
SRX4100 |
Remote Access (10 Concurrent users, NCP) |
SRX4100 |
Remote Access (25 Concurrent users, NCP) |
SRX4100 |
Remote Access (50 Concurrent users, NCP) |
SRX4100 |
Remote Access (100 Concurrent users, NCP) |
SRX4100 |
Remote Access (150 Concurrent users, NCP) |
SRX4100 |
Remote Access (250 Concurrent users, NCP) |
SRX4100 |
Remote Access (500 Concurrent users, NCP) |
SRX4100 |
Remote Access (1000 Concurrent users, NCP) |
SRX4100 |
Remote Access (2000 Concurrent users, NCP) |
SRX4100 |
Remote Access (5000 Concurrent users, NCP) |
SRX4100 |
SecIntel |
SRX4100 |
ATP Cloud (1 year, 3 years and 5 years subscription) |
SRX4100 |
Features Requiring a License on SRX4200 Devices
Table 7 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX4200 |
Intrusion Prevention Signature (1 year, 3 years and 5 years subscription) |
SRX4200 |
Logical System License (1, 5, and 25 Incremental) |
SRX4200 |
Remote Access (5 Concurrent users, NCP) |
SRX4200 |
Remote Access (10 Concurrent users, NCP) |
SRX4200 |
Remote Access (25 Concurrent users, NCP) |
SRX4200 |
Remote Access (50 Concurrent users, NCP) |
SRX4200 |
Remote Access (100 Concurrent users, NCP) |
SRX4200 |
Remote Access (150 Concurrent users, NCP) |
SRX4200 |
Remote Access (250 Concurrent users, NCP) |
SRX4200 |
Remote Access (500 Concurrent users, NCP) |
SRX4200 |
Remote Access (1000 Concurrent users, NCP) |
SRX4200 |
Remote Access (2000 Concurrent users, NCP) |
SRX4200 |
Remote Access (5000 Concurrent users, NCP) |
SRX4200 |
SecIntel |
SRX4200 |
ATP Cloud (1 year, 3 years and 5 years subscription) |
SRX4200 |
Features Requiring a License on SRX4600 Devices
Table 8 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX4600 |
Intrusion Prevention Signature (1 year, 3 years and 5 years subscription) |
SRX4600 |
Logical System License (1, 5, and 25 Incremental) |
SRX4600 |
Remote Access (5 Concurrent users, NCP) |
SRX4600 |
Remote Access (10 Concurrent users, NCP) |
SRX4600 |
Remote Access (25 Concurrent users, NCP) |
SRX4600 |
Remote Access (50 Concurrent users, NCP) |
SRX4600 |
Remote Access (100 Concurrent users, NCP) |
SRX4600 |
Remote Access (150 Concurrent users, NCP) |
SRX4600 |
Remote Access (250 Concurrent users, NCP) |
SRX4600 |
Remote Access (500 Concurrent users, NCP) |
SRX4600 |
Remote Access (1000 Concurrent users, NCP) |
SRX4600 |
Remote Access (2000 Concurrent users, NCP) |
SRX4600 |
Remote Access (5000 Concurrent users, NCP) |
SRX4600 |
SecIntel |
SRX4600 |
ATP Cloud (1 year, 3 years and 5 years subscription) |
SRX4600 |
Features Requiring a License on SRX5400 Devices
Table 9 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX5400 l |
Intrusion Detection and Prevention (1 year, 3 years and 5 years subscription) |
SRX5400 |
Logical System License (1, 5, and 25 Incremental) |
SRX5400 |
Remote Access (5 Concurrent users, NCP) |
SRX5400 |
Remote Access (10 Concurrent users, NCP) |
SRX5400 |
Remote Access (25 Concurrent users, NCP) |
SRX5400 |
Remote Access (50 Concurrent users, NCP) |
SRX5400 |
Remote Access (100 Concurrent users, NCP) |
SRX5400 |
Remote Access (150 Concurrent users, NCP) |
SRX5400 |
Remote Access (250 Concurrent users, NCP) |
SRX5400 |
Remote Access (500 Concurrent users, NCP) |
SRX5400 |
Remote Access (1000 Concurrent users, NCP) |
SRX5400 |
Remote Access (2000 Concurrent users, NCP) |
SRX5400 |
Remote Access (5000 Concurrent users, NCP) |
SRX5400 |
Remote Access (10K Concurrent users, NCP) |
SRX5400 |
SecIntel |
SRX5400 |
ATP Cloud (1 year, 3 years and 5 years subscription) |
SRX5400 |
Features Requiring a License on SRX5600 Devices
Table 10 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX5600 |
Intrusion Detection and Prevention (1 year, 3 years and 5 years subscription) |
SRX5600 |
Logical System License (1, 5, and 25 Incremental) |
SRX5600 |
Remote Access (5 Concurrent users, NCP) |
SRX5600 |
Remote Access (10 Concurrent users, NCP) |
SRX5600 |
Remote Access (25 Concurrent users, NCP) |
SRX5600 |
Remote Access (50 Concurrent users, NCP) |
SRX5600 |
Remote Access (100 Concurrent users, NCP) |
SRX5600 |
Remote Access (150 Concurrent users, NCP) |
SRX5600 |
Remote Access (250 Concurrent users, NCP) |
SRX5600 |
Remote Access (500 Concurrent users, NCP) |
SRX5600 |
Remote Access (1000 Concurrent users, NCP) |
SRX5600 |
Remote Access (2000 Concurrent users, NCP) |
SRX5600 |
Remote Access (5000 Concurrent users, NCP) |
SRX5600 |
Remote Access (10K Concurrent users, NCP) |
SRX5600 |
SecIntel |
SRX5600 |
ATP Cloud (1 year, 3 years and 5 years subscription) |
SRX5600 |
Features Requiring a License on SRX5800 Devices
Table 11 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX5800 |
Intrusion Detection and Prevention (1 year, 3 years and 5 years subscription) |
SRX5800 |
Logical System License (1, 5, and 25 Incremental) |
SRX5800 |
Remote Access (5 Concurrent users, NCP) |
SRX5800 |
Remote Access (10 Concurrent users, NCP) |
SRX5800 |
Remote Access (25 Concurrent users, NCP) |
SRX5800 |
Remote Access (50 Concurrent users, NCP) |
SRX5800 |
Remote Access (100 Concurrent users, NCP) |
SRX5800 |
Remote Access (150 Concurrent users, NCP) |
SRX5800 |
Remote Access (250 Concurrent users, NCP) |
SRX5800 |
Remote Access (500 Concurrent users, NCP) |
SRX5800 |
Remote Access (1000 Concurrent users, NCP) |
SRX5800 |
Remote Access (2000 Concurrent users, NCP) |
SRX5800 |
Remote Access (5000 Concurrent users, NCP) |
SRX5800 |
Remote Access (10K Concurrent users, NCP) |
SRX5800 |
SecIntel |
SRX5800 |
ATP Cloud (1 year, 3 years and 5 years subscription) |
SRX5800 |
Features Requiring a License on SRX100 and SRX110 Devices
Table 12 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Application Security and Intrusion Prevention Signatures (1 year and 3 years subscription) |
SRX100 SRX110 |
Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX100 SRX110 |
Kaspersky antivirus (1 year and 3 years subscription) |
SRX100 SRX110 |
Kaspersky antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX100 SRX110 |
Sophos antispam (1 year and 3 years subscription) |
SRX100 SRX110 |
Sophos antivirus (1 year and 3 years subscription) |
SRX100 SRX110 |
Sophos antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX100 SRX110 |
Websense Enhanced Web Filtering (1 year and 3 years subscription) |
SRX100 SRX110 |
Features Requiring a License on SRX210 Devices
Table 13 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Application Security and Intrusion Prevention Signatures (1 year and 3 years subscription) |
SRX210 |
Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX210 |
Kaspersky antivirus (1 year and 3 years subscription) |
SRX210 |
Kaspersky antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX210 |
Sophos antispam (1 year and 3 years subscription) |
SRX210 |
Sophos antivirus (1 year and 3 years subscription) |
SRX210 |
Sophos antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX210 |
Websense Enhanced Web Filtering (1 year and 3 years subscription) |
SRX210 |
Features Requiring a License on SRX220 Devices
Table 14 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Application Security and Intrusion Prevention Signatures (1 year and 3 years subscription) |
SRX220 |
Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX220 |
Kaspersky antivirus (1 year and 3 years subscription) |
SRX220 |
Kaspersky antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX220 |
Sophos antispam (1 year and 3 years subscription) |
SRX220 |
Sophos antivirus (1 year and 3 years subscription) |
SRX220 |
Sophos antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX220 |
Websense Enhanced Web Filtering (1 year and 3 years subscription) |
SRX220 |
Features Requiring a License on SRX240 Devices
Table 15 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Application Security and Intrusion Prevention Signatures (1 year and 3 years subscription) |
SRX240 |
Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX240 |
Kaspersky antivirus (1 year and 3 years subscription) |
SRX240 |
Kaspersky antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX240 |
Sophos antispam (1 year and 3 years subscription) |
SRX240 |
Sophos antivirus (1 year and 3 years subscription) |
SRX240 |
Sophos antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX240 |
Websense Enhanced Web Filtering (1 year and 3 years subscription) |
SRX240 |
Features Requiring a License on SRX550 Devices
Table 16 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Intrusion Detection and Prevention (1 year, 3 years and 5 years subscription) |
SRX550 |
Kaspersky antivirus (1 year, 3 years and 5 years subscription) |
SRX550 |
Kaspersky antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX550 |
Remote Access (5 Concurrent users, NCP) |
SRX550 |
Remote Access (10 Concurrent users, NCP) |
SRX550 |
Remote Access (25 Concurrent users, NCP) |
SRX550 |
Remote Access (50 Concurrent users, NCP) |
SRX550 |
Remote Access (100 Concurrent users, NCP) |
SRX550 |
Remote Access (150 Concurrent users, NCP) |
SRX550 |
Remote Access (250 Concurrent users, NCP) |
SRX550 |
Remote Access (500 Concurrent users, NCP) |
SRX550 |
Remote Access (1000 Concurrent users, NCP) |
SRX550 |
SecIntel |
SRX550 |
Sky Advanced Threat Prevention (1 year, 3 years and 5 years subscription) |
SRX550 |
Sophos antispam (1 year, 3 years and 5 years subscription) |
SRX550 |
Sophos antivirus (1 year and 3 years subscription) |
SRX550 |
Sophos antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year, 3 years and 5 years subscription) |
SRX550 |
Features Requiring a License on SRX650 Devices
Table 17 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Application Security and Intrusion Prevention Signature (1 year and 3 years subscription) |
SRX650 |
Enhanced Web Filtering (1 year, 3 years and 5 years subscription) |
SRX650 |
Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX650 |
Kaspersky antivirus (1 year and 3 years subscription) |
SRX650 |
Kaspersky antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX650 |
Sophos antispam (1 year and 3 years subscription) |
SRX650 |
Sophos antivirus (1 year and 3 years subscription) |
SRX650 |
Sophos antivirus, Enhanced Web Filtering, Sophos antispam, Application Security and Intrusion Detection and Prevention (1 year and 3 years subscription) |
SRX650 |
Features Requiring a License on SRX3400 Devices
Table 18 lists the licenses you can purchase for each SRX Series software feature.
Licensed Software Feature |
Supported Devices |
---|---|
Application Security, Intrusion Detection and Prevention, Enhanced Web Filtering, Antivirus and Sky Advanced Threat Prevention (1 year and 3 year subscription) |
SRX3400 |
Understanding Chassis Cluster Licensing Requirements
There is no separate license required for chassis cluster. However, some Junos OS software features require a license to activate the feature. To configure and use the licensed feature in a chassis cluster setup, you must purchase one license per feature per device and the license needs to be installed on both nodes of the chassis cluster. Both devices (which are going to form a chassis cluster) must have the valid, identical features licenses installed on them. If both devices do not have an identical set of licenses, then after a failover, a particular feature (that is, a feature that is not licensed on both devices) might not work or the configuration might not synchronize in chassis cluster formation. Licensing is usually ordered when the device is purchased, and this information is bound to the chassis serial number. For example, Intrusion Detection and Prevention (IDP) is a licensed feature and the license for this specific feature is tied to the serial number of the device.
For information about how to purchase software licenses, contact your Juniper Networks sales representative at https://www.juniper.net/in/en/contact-us/.
Installing Licenses on the SRX Series Devices in a Chassis Cluster
You can add a license key from a file or a URL, from a terminal, or from the J-Web user
interface. Use the filename
option to activate a
perpetual license directly on the device. Use the
url
option to send a subscription-based
license key entitlement (such as Content Security) to the Juniper Networks licensing
server for authorization. If authorized, the server downloads the license to the
device and activates it.
Before adding new licenses, complete the following tasks:
Purchase the required licenses.
Set the chassis cluster node ID and the cluster ID. See Example: Setting the Node ID and Cluster ID for Security Devices in a Chassis Cluster .
Ensure that your SRX Series device has a connection to the Internet (if particular feature requires Internet or if (automatic) renewal of license through internet is to be used). For instructions on establishing basic connectivity, see the Getting Started Guide or Quick Start Guide for your device.
To install licenses on the primary node of an SRX Series device in a chassis cluster:
To install licenses on the secondary node of an SRX Series device in a chassis cluster:
Initiate a failover to change node 1 (secondary node) to be the primary node:
{primary:node0}
user@host>
request chassis cluster failover redundancy-group 0 node 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Initiated manual failover for redundancy group 0Note:Initiating a failover to the secondary node is not required if you are installing licenses manually on the device. However, if you are installing the license directly from the Internet, you must initiate a failover.
-
Repeat the steps described to install licenses on the secondary node.
Reboot the device for licenses to take effect.
You must install the updated license on both nodes of the chassis cluster before the existing license expires.
In a chassis cluster configuration, when one device has a license installed, and the other device does not have the same license installed, an error message is displayed when you try to configure that specific feature as shown in the following example:
[edit security utm feature-profile web-filtering type]
'type juniper-enhanced'
warning: requires 'wf_key_websense_ewf' license <<<<<<<<<<<<<<<<<<<<<<
configuration check succeeds
If you are not using any specific feature or license , you can delete the license from both devices in a chassis cluster. You need to connect to each node separately to delete the licenses. For details, see Example: Deleting a License Key.
Verifying Licenses on an SRX Series Device in a Chassis Cluster
Purpose
You can verify the licenses installed on both the devices
in a chassis cluster setup by using the show system license installed
command to view license usage.
Action
Licenses details on node 0.
user@host>
show system license installed
{primary:node0}
user@host> show system license
License usage:
Licenses Licenses Licenses Expiry
Feature name used installed needed
logical-system 1 26 0 permanent
services-offload 0 1 0 permanent
Licenses installed:
License identifier: JUNOS363684
License version: 2
Valid for device: JN111A654AGB
Features:
services-offload - services offload mode
permanent
License identifier: JUNOS531744
License version: 4
Valid for device: JN111A654AGB
Features:
services-offload - services offload mode
permanent
License identifier: JUNOS558173
License version: 4
Valid for device: JN111A654AGB
Features:
logical-system-25 - Logical System Capacity
permanent
Licenses details on node 1.
{secondary-hold:node1} user@host> show system license License usage: Licenses Licenses Licenses Expiry Feature name used installed needed idp-sig 0 1 0 permanent logical-system 1 26 0 permanent services-offload 0 1 0 permanent Licenses installed: License identifier: JUNOS209661 License version: 2 Valid for device: JN111AB4DAGB Features: idp-sig - IDP Signature permanent License identifier: JUNOS336648 License version: 2 Valid for device: JN111AB4DAGB Features: logical-system-25 - Logical System Capacity permanent License identifier: JUNOS363685 License version: 2 Valid for device: JN111AB4DAGB Features: services-offload - services offload mode permanent License identifier: JUNOS531745 License version: 4 Valid for device: JN111AB4DAGB Features: services-offload - services offload mode permanent
Meaning
Use the fields License version
and Features
to make sure that licenses installed on both the nodes
are identical.
Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Devices
This topic provides licensing information for SRX Series devices running logical systems and tenant systems.
Starting in Junos OS Release 18.3R1, an SRX Series device running logical systems or tenant systems includes three licenses by default. Starting in Junos OS Releases 20.3R3, 20.4R2, 21.1R2, and 21.2R1, you can use the features for logical systems and tenant systems without a license. One license for a primary logical system and the other two licenses for user-defined logical system or tenant system. The system does not allow you to configure additional logical systems or tenant systems if the number of logical systems and tenant systems exceeds the number of available licenses. In the earlier releases, the system allowed you to configure an additional logical system even if the number of logical systems exceeds the number of available licenses, but with a warning message of non-licensed logical-systems do not pass traffic. You can purchase licenses for additional logical systems and tenant systems that you intend to create. If you intend to configure an interconnect logical system or interconnect tenant system to use as a switch, it also requires separate licenses.
We enforce that you do not configure more logical systems or tenant systems than the number of licenses you have purchased. If the number of logical systems or tenant systems that you attempt to configure exceeds the number of licenses that you have purchased, then the system displays an error message similar to the following:
user@host# commit error: 2 more multitenancy license(s) are needed! error: configuration check-out failed
You can use the show system license status all-logical-systems-tenants or show system license usage commands to view the active logical systems and tenant systems on the device.
user@host> show system license status all-logical-systems-tenants logical system name license status root-logical-system enabled LSYS2 enabled LSYS0 enabled LSYS11 enabled LSYS12 enabled LSYS23 enabled TSYS1 enabled TSYS2 enabled TSYS3 enabled
user@host> show system license usage Licenses Licenses Licenses Expiry Feature name used installed needed logical-system 9 11 0 2019-05-18 08:00:00 CST
When you use SRX Series devices running logical systems or tenant systems in a chassis cluster, you must purchase and install the same number of licenses for each node in the chassis cluster. Logical systems or tenant systems licenses pertain to a single chassis, or node, within a chassis cluster and not to the cluster collectively.
See Also
Understanding Content Security Licensing
The majority of Content Security features function as a subscription service requiring a license. You can redeem this license once you have purchased your subscription license SKUs. You redeem your license by entering your authorization code and chassis serial number into the Customer Service license portal interface. Once your entitlement is generated, you can use the CLI from your device to send a license update request to the license portal. The license portal then sends your subscription license directly to the device.
The products supported by the Juniper Agile Licensing (JAL) portal includes: QFX series, SRX Series, EX Series, NFX, vBNG, vMX, vSRX, and ACX. For other Juniper products (SPACE, JSA, SBR Carrier, Screen OS and so on) access the License Management System (LMS).
Content Security requires 1 GB of memory.
Content Security Feature | Requires License |
Antispam |
Yes |
Antivirus: sophos |
Yes |
Content Filtering |
No |
Web Filtering: integrated |
Yes |
Web Filtering: redirect |
No |
Web Filtering: local |
No |
Web Filtering: enhanced |
Yes |
License enforcement is supported on all SRX Series devices. Licensed features including anti-virus or Enhanced Web Filtering will not function until a license has been installed. The license must be installed after installing or upgrading to a new Junos OS Release version. Unlicensed features such as Content Security blocklists and allowlists will continue to function without a license.
Updating Content Security Licenses (CLI Procedure)
To apply the Content Security subscription license to SRX Series devices, use the following CLI command:
user@host> request system license update
After you install the license for SRX300, SRX320, SRX340, SRX345, SRX550M, and SRX1400 devices, reboot the device. The device reserves additional memory for Content Security features and hence decreases the session capacity.
For SRX3400, SRX3600, SRX4600, SRX5600 and SRX5800 devices, use the following command to manually reallocate the memory for Content Security features:
user@host>set security forwarding-process application-services enable-utm-memory
Reboot the device for the configuration to take effect.
SRX1500, SRX4100 and SRX4200 devices have enough memory for Content Security. These devices do not require any command for memory allocation.
See Also
Installing the IPS License (CLI)
You can either download an IPS license from the license server, or manually install IPS if you received a license from Juniper Networks.
Access the SRX Series device console through the serial cable plugged into the console port on the device or by using a terminal session such as SSH.
To apply your IPS subscription license to the device, use the following CLI command:
user@host> request system license update
If you received a license for manual installation, perform the following tasks:
See Also
Installing and Verifying Licenses for an Application Signature Package
The Junos OS application signature package update is a separately licensed subscription service. You must install the application signature package update license key on your device to download and install the signature database updates provided by Juniper Networks. If your license key expires, you can continue to use the locally stored application signature package content.
Licensing is usually ordered when the device is purchased, and this information is bound to the chassis serial number. These instructions assume that you already have the license. If you did not order the license during the purchase of the device, contact your account team or Juniper customer care for assistance. For more information, refer to the Knowledge Base article KB9731 at https://kb.juniper.net/InfoCenter/index?page=home.
Starting from Junos OS 15.1X49-D30 and Junos OS Release 17.3R1, on SRX1500 devices, AppSecure is part of Junos Software Enhanced (JSE) software license package. There is no separate license key for AppSecure is available. You must use JSE software license on your device to download and install the AppID signature database updates, or to use other AppSecure features such as AppFW, AppQoS, and AppTrack.
Starting from Junos OS 15.1X49-D30 and Junos OS Release 17.3R1, on SRX300, SRX320, SRX340, and SRX345 devices, AppSecure is part of Junos Software Enhanced (JSE) software license package. There is no separate license key for AppSecure is available. You must use JSE software license on your device to download and install the AppID signature database updates, or to use other AppSecure features such as AppFW, AppQoS, and AppTrack.
Starting from 15.1X49-D65 and Junos OS Release 17.3R1, on SRX4100, and SRX4200 devices, AppSecure is part of Junos Software Enhanced (JSE) license package. There is no separate license key for AppSecure is available. You must use JSE software license on your device to download and install the AppID signature database updates, or to use other AppSecure features such as AppFW, AppQoS, and AppTrack.
Junos Software Base (JSB) package does not include application signatures. Please refer to the product Data Sheets at SRX Series Services Gateways for details, or contact your Juniper Account Team or Juniper Partner.
You can install the license on the SRX Series device using either the automatic method or manual method as follows:
Install your license automatically on the device.
To install or update your license automatically, your device must be connected to the Internet .
user@host> request system license update
Trying to update license keys from https://ae1.juniper.net, use 'show system license' to check status.
Install the licenses manually on the device.
user@host> request system license add terminal
[Type ^D at a new line to end input, enter blank line between each license key]
Paste the license key and press Enter to continue.
Verify the license is installed on your device.
Use the
show system license command
command to view license usage, as shown in the following example:License usage: Licenses Licenses Licenses Expiry Feature name used installed needed logical-system 4 1 3 permanent License identifier: JUNOSXXXXXX License version: 2 Valid for device: AA4XXXX005 Features: appid-sig - APPID Signature date-based, 2014-02-17 08:00:00 GMT-8 - 2015-02-11 08:00:00 GMT-8
The output sample is truncated to display only license usage details.