Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Architecture

Learn about the Packet Forwarding Engine architecture and behavior on the SRX1600, SRX4120, and SRX4300 Firewalls.

The SRX1600, SRX4120, and SRX4300 Firewalls use standard two-part architecture: a RE (Routing Engine) for control plane functions and a Packet Forwarding Engine for data plane forwarding. The Routing Engine performs routing, system control, and device management. The Routing Engine processes routing protocols to update routes, determines optimal paths, maintains the routing table, and configures the Packet Forwarding Engine with forwarding entries. The Packet Forwarding Engine performs Layer 2 (L2) and Layer 3 (L3) switching, route lookups, security lookups and functions, and packet forwarding.

Figure 1: Data Packet Processing Data Packet Processing

The ingress path is the packet’s journey from the receiving interface into the Packet Forwarding Engine, while the egress path is the journey from the Packet Forwarding Engine out to the transmit interface.

For Packet Forwarding Engine behavior, the definitions are as follows:

  • Ingress—The packet enters the ingress interface and is mapped to an existing session or first-packet flow path.

  • Forwarding—The packet is assigned to the correct Services Processing Unit (SPU) using the session distribution hash or session-table lookup.

  • Egress—The SPU returns the packet to the physical interface for transmission through the selected egress port.

Packet processing involves ingress and egress network processing unit (NPU), and the firewall uses session tables and flow distribution to determine packet destinations in the forwarding pipeline.

The firewall applies NAT, security policies, and security zones within the packet-processing flow as follows:

  • Security zones—Provide the security context for traffic processing. Interfaces are assigned to security zones. By default, inbound traffic to the firewall is blocked unless host-inbound services or protocols are explicitly allowed on the zone or interface.

  • Security policies—Control whether traffic is permitted between security zones. For transit traffic, the firewall evaluates policy rules based on the source (from-zone) and destination (to-zone) security zones. The traffic must match a permitted policy to pass between zones.

  • NAT—Applies address translation during packet processing. Static NAT and destination NAT are performed before route and security policy evaluation, while source NAT is applied within the security and NAT framework.

The data packet processing features enable the following key functions:

  • Hardware-accelerated encryption/decryption—Offloads CPU-intensive cryptographic processing and improves SSL/TLS and IPsec performance.

  • Selective stateless packet-based processing—Firewall filters can mark specific traffic for packet-mode forwarding and bypass flow-based services.