Service Provider Data Center Use Case

In Service Provider Data Center deployments, the SRX4700 acts as a secure fabric-aware leaf in spine-leaf architectures, supporting EVPN/VXLAN, high-throughput IMIX traffic (1.4 Tbps), and Layer 7 security for core and edge workloads.

You can enhance your 4G and 5G service offerings with the SRX4700 Firewall, which secures Tier 1 service provider networks globally. The SRX4700 Firewall is ideal for environments with power and space constraints, as it operates at terabit (Tb) speeds while occupying only a single rack unit in data centers.

Deploy the SRX4700 Firewall in both distributed and centralized locations to safeguard your network infrastructure effectively.

Deploy in Connected Security Distributed Services (CSDS) or scale-out models with these configuration essentials.

In service provider data centers, the SRX4700 Firewall integrates into scale-out architectures with MX Series routers (for example, the MX304 or MX960) for load balancing and forwarding:

• Forwarding Layer: MX Series routers handle traffic distribution using ECMP (client hash or source hash for 0/0 routes), EBGP, or BFD for convergence.
• Services Layer: SRX4700 Firewall provides security services such as firewall, NAT (unique pools per firewall), and IPsec, scaling linearly by adding pairs (baseline 100 nGbps per pair).
• Supports high-scale setups up to router port limits (for example, MX304 with 32 100GbE ports).

• IPsec security gateway functionality—Enhances the security of communication between 4G and 5G base stations and the packet core by providing robust IPsec termination.

  Tier 2 and tier 3 service providers can use the SRX4700 Firewall as a security gateway for centralized termination of IPsec tunnels from 4G and 5G base stations to the packet core. Service providers can also use the SRX4700 Firewall as an X2/Xn security gateway to terminate control plane IPsec traffic between base stations.

• High-throughput—Optimizes data center operation by delivering high-throughput performance while occupying minimal rack space and consuming less power.

• N6/Gi firewall and carrier-grade NAT—Improves traffic management efficiency and security through its integration of Gi/N6 firewall and carrier-grade NAT functionalities, ensuring secure and reliable handling of network traffic.

  Use the SRX4700 Firewall as an N6 or Gi firewall for carrier-grade NAT in situations that require lower session counts, such as fixed broadband. The device limits total session scale in a Services Offloading (SOF) mode of operation.

• MEC firewall functionality—Strengthens edge computing security by processing and reencrypting traffic in real time, safeguarding data integrity and confidentiality in multiaccess edge computing (MEC) environments.

  Use the SRX4700 Firewall as a multiaccess edge computing (MEC) firewall to terminate and reoriginate IPsec tunnels from 4G and 5G base stations. You can apply security policies to the unencrypted traffic and then reencrypt it before sending it toward the packet core. The MEC server collocated with the SRX4700 Firewall can inspect the traffic from the base stations as cleartext.

The baseline configurations in this topic provide a foundational template that helps standardize deployments, improve operational reliability, and accelerate secure onboarding of the SRX4700 Firewall in a service provider data center architecture.

• Interfaces and Zones
• Routing and Load Balancing (Integrate with MX Series Routers)
• Security Zones
• Security Policies
• NAT for Service Provider
• System Services