Interface Types and Configurations

Overview

The SRX1600, SRX4120, and SRX4300 Firewalls provide high interface density to support scalable network connectivity across enterprise and service provider deployments. These firewalls support a range of interface types and speeds, from 10 MBps through 100-Gigabit Ethernet (GbE). Interfaces provide the physical and logical connectivity required for packet forwarding, traffic segmentation, and security enforcement. You can configure interfaces for IPv4 and IPv6 addressing, VLAN tagging, and security zone assignments.

Interfaces use the following naming convention:

• ge — 1GbE interfaces (includes dedicated 1GbE RJ-45 ports and supported 10/25GbE ports operating with 1GbE SFP transceivers.)
• xe — 10GbE interfaces (SFP+)
• et — 25GbE, 40GbE, or 100GbE interfaces (SFP28, QSFP, or QSFP28)
• mge — 1GbE, 2.5GbE, 5GbE or 10GbE interfaces (RJ-45)

Interface availability varies by platform:

• The SRX1600 Firewall provides 16 RJ-45 ports that support 10 Mbps, 100 Mbps, and 1 GbE; four SFP+ ports with MACsec capability that support 1 GbE and 10 GbE; and two uplink ports with MACsec capability for 1/10 GbE SFP+ or 25 GbE SFP28 transceivers.

• The SRX4120 and SRX4300 Firewalls provide high-density interface options and support 10GbE, 25GbE, 40GbE, and 100GbE interfaces. These firewalls support high-speed uplinks, including QSFP28 transceivers. Depending on the hardware configuration, these firewalls also support multigigabit interfaces. These interface options enable efficient traffic aggregation and secure connectivity across deployment sizes.

The SRX1600, SRX4120, and SRX4300 Firewalls support MACsec encryption. MACsec is available on all ports of the SRX4120 and SRX4300 and on the SFP+ and SFP28 ports of the SRX1600. These firewalls also support link aggregation groups (LAGs) through aggregated Ethernet (ae) interfaces. When deployed in chassis cluster mode, these firewalls support redundant Ethernet (reth) interfaces, allowing up to 128 reth interfaces and up to four member links per node per reth interface.

For complete port-to-interface mappings, see Port Speed on SRX1600 Firewall, Port Speed on SRX4120 Firewall, and Port Speed on SRX4300 Firewall.

Table 1: Interface Details and Naming Conventions

Model	Port Location	Number and Type of Ports	Supported Speeds	Default Speed	Naming Format
SRX1600	PIC 0, ports 0-15	16 RJ45 BASE-T	10 MBps/100 MBps/1GbE	1GbE	ge-0/0/[0-15]
	PIC 1, ports 0-1	2 SFP28	1/10/25GbE	25GbE	ge-0/1/[0-1] / xe-0/1/[0-1] / et-0/1/[0-1]
	PIC 2, ports 0-3	4 SFP+	1/10GbE	10GbE	xe-0/2/[0-3]
SRX4120	PIC 0, ports 0-7	8 RJ45 multigigabit	1/2.5/5/10GbE	10GbE	mge-0/0/[0-7]
	PIC 1, ports 0-7	8 SFP+	1/10GbE	10GbE	ge-0/1/[0-7] / xe-0/1/[0-7]
	PIC 2, ports 0-3	4 SFP28	1/10/25GbE	25GbE	ge-0/2/[0-3] / xe-0/2/[0-3] / et-0/2/[0-3]
	PIC 3, ports 0-1	2 QSFP28	40/100GbE	100GbE	et-0/3/[0-1]
SRX4300	PIC 0, ports 0-7	8 RJ45 multigigabit	1/2.5/5/10GbE	10GbE	mge-0/0/[0-7]
	PIC 1, ports 0-7	8 SFP+	1/10GbE	10GbE	ge-0/1/[0-7] / xe-0/1/[0-7]
	PIC 2, ports 0-3	4 SFP28	1/10/25GbE	25GbE	ge-0/2/[0-3] / xe-0/2/[0-3] / et-0/2/[0-3]
	PIC 3, ports 0-5	6 QSFP28	40/100GbE	100GbE	et-0/3/[0-5]

For more information, see SRX4300 - Port Checker, SRX1600 - Transceivers, SRX4120 - Transceivers, and SRX4300 - Transceivers.

Configure Interfaces

After the initial configuration of your device, you can configure physical interfaces and Layer 3 (L3) interfaces and channelize interfaces on your firewalls:

• To configure the interface description:

• To configure interface speed without channelization:

• (Optional) To configure an IPv4/IPv6 address on a logical interface for L3 routing:

• To configure channelization at the chassis level:

• To configure link aggregation by bundling multiple physical Ethernet interfaces into a single logical aggregated Ethernet interface (aex) and enabling Link Aggregation Control Protocol (LACP) for dynamic negotiation:

  An Ethernet link configured for lacp active mode periodically transmits LACP protocol data units (PDUs) to establish and maintain a LACP session. An Ethernet link configured for lacp passive mode transmits LACP PDUs only after receiving the PDUs from the remote end.

  For more information about aex, see Configure Aggregated Ethernet Interfaces.

  To specify the interval and speed at which the interfaces send LACP packets:

Configure PIC Mode

The PIC mode enables you to configure ports with default speeds.

If you do not configure PIC mode on your firewall, Junos OS automatically creates interfaces based on the default speed of each PIC and the type of transceiver inserted. PIC 0 interfaces are always created by default.

Use the following command to configure the PIC mode:

Example to configure the PIC mode in SRX1600:

Example to configure the PIC mode in SRX4120:

Example to configure the PIC mode in SRX4300:

Verify Interfaces

To verify interface configuration on your device:

To verify that LACP has been set up correctly and enabled as active on one end:

To verify that the LACP packets are being exchanged between interfaces:

To verify the active and standby links:

To validate the optical module connected to an interface by reviewing its diagnostics such as transmit and receive power:

For more information about configuring, monitoring, and troubleshooting Ethernet interfaces, see Configure Ethernet Interfaces.

Here's a quick verification checklist:

Table 2: Verification Checklist

Verify	Command	What to Look For
Physical link status	show interfaces terse	Are both physical and logical interfaces up?
IP assignment	show interfaces terse	To view IP address assignments on interfaces, use this command and filter for inet protocol family entries.
Errors and drops	show interfaces <int>	Error counters should be low or zero
Traffic flow	show interfaces	Expected traffic rates
Optics health	show interfaces diagnostics optics	No alarms, healthy signal
Routing presence	show route protocol direct	Verify if all active direct routes (connected interface routes with preference 0) are displayed in the routing table.