High End SRX. Overview of the SRX in the datacenter

Size: px

Start display at page:

Download "High End SRX. Overview of the SRX in the datacenter"

Eleanore Leonard
5 years ago
Views:

1 High End SRX Overview of the SRX in the datacenter

2 Agenda 1 HE SRX Overview 2 Architecture What makes an High End an High End? 3 Architecture Session Setup / Packet Flow / SOF 4 New Components (RE/SCBE) 5 Q&A

3 Application visibility and control App Tracking Understand security risks Better heuristics for evasive and tunneled apps Address new user behaviors App Firewall Block access to risky apps Allows user tailored policies ngress More application signatures Open signature language App QoS Prioritize important apps Rate limit less important apps SSL Proxy SSL packet inspection Egress PS Remediate security threats

4 User firewall controls Finance P2P apps blocked YouTube allowed Anti-virus applied Sales P2P, YouTube blocked Anti-virus applied nternet CEO No apps blocked Anti-virus applied

Unified Threat Management Services Anti-Virus

5 Unified Threat Management Services Anti-Virus Anti-Spam Web Filtering Content Filtering Protection from toptier AV partner Reputation-enhanced capabilities Multilayered spam protection from security experts Protection against APTs Block malicious URLs Prevent lost productivity Filter out extraneous or malicious content Maintain bandwidth for essential traffic

Spotlight Secure threat intelligence platform Taking action at the point of enforcement Open platform for threat detection and advanced malware prevention

6 Spotlight Secure threat intelligence platform Taking action at the point of enforcement Open platform for threat detection and advanced malware prevention Connects multiple intelligence sources to the enforcement points Single point of administrative control Enables security efficiencies that matter to the business

7 Data Center SRX Platforms

connections per second (CPS) Up to 100 million sessions High performance Up to 300 Gbps firewall Up to 100 Gbps PS Up to 200

8 SRX5800:Front and rear view SRX5800 Front View Power supplies FRU SRX5800 Rear View 16 RU Modular chassis Vertical design 12 expansion slots Modules for flexible /O and service processing Junos software Massive Scale Up to 450,000 new & sustained connections per second (CPS) Up to 100 million sessions High performance Up to 300 Gbps firewall Up to 100 Gbps PS Up to 200 Gbps PSec VPN High availability Redundant management modules Redundant switching fabrics Redundant fans & power supplies Modular Junos Software

connections per second (CPS) Up to 100 million sessions High performance Up to 130 Gbps firewall Up to 50 Gbps PS Up to 90 Gbps

9 SRX5600:Front and rear views SRX5600 Front View SRX5600 Rear View Power supplies FRU 8 RU Modular chassis Horizontal design 6 expansion slots Modules for flexible /O and service processing Junos software Massive scale Up to 450,000 new & sustained connections per second (CPS) Up to 100 million sessions High performance Up to 130 Gbps firewall Up to 50 Gbps PS Up to 90 Gbps PSec VPN High availability Redundant management modules Redundant switching fabrics Redundant fans & power supplies Modular Junos Software

Service Provider networks 5 RU; 3 open card slots Software Security Services

10 SRX5400 Latest high end SRX platform, launched Dec 13 Based on successful high volume MX240 platform design deal for medium to large enterprises and Service Provider networks 5 RU; 3 open card slots Software Security Services AppSecure and PS AV and web filtering Next-generation, high-performance line cards

11 NEXT GENERATON /O CARD (NG-OC) OVERVEW NG-OC introduced in 12.1X46-D10 Only support on 5k Platform 100G PFE for SRX5800, SRX5600 and SRX5400 Single PFE complex with 2 MC slots Modular Port Concentrator (MPC) Modular nterface Card (MC) SRX5K-MC-1X100GE-CFP SRX5K-MC-2X40GE-QSFPP SRX5K-MC-10XGE-SFPP SRX5K-MC-20GE-SFP ( Supported in 12.1X47-D10)

SRX3600:SPC/NPC/NP-OC Front and rear views 2 x 10 GigE /O card Fan tray Front slot guide Power supplies FRU

Engine (future) or SCM 12 on-board GigE ports SRX3600 Rear View Switch Fabric Board (SFB) 16 x GbE SFP /O

(SPC/NPC/NP- OC) Rear slot guide Note: Power cords ( straight C19 plug) not included with BASE system.

5 RU Modular chassis 12 expansion slots (6 front and 6 rear) Compact form factor modules for /O and service

12 SRX3600:SPC/NPC/NP-OC Front and rear views 2 x 10 GigE /O card Fan tray Front slot guide Power supplies FRU Expansion slot (SPC/NP-OC)) 16 x 10/100/1000 /O card Routing Engine SRX3600 Front View USB Redundant Routing Engine (future) or SCM 12 on-board GigE ports SRX3600 Rear View Switch Fabric Board (SFB) 16 x GbE SFP /O card Expansion slot (NP- OC/OC/SPC) Redundant power supplies (optional) Fan tray door Expansion slot (SPC/NPC/NP- OC) Rear slot guide Note: Power cords ( straight C19 plug) not included with BASE system. Right-Angled power cords interfere with cards but are usable. 5 RU Modular chassis 12 expansion slots (6 front and 6 rear) Compact form factor modules for /O and service processing Dual, hot swappable management modules Junos Software Massive scale Up to 150,000 new, sustained connections per second (CPS) Up to 2.25 million sessions With Extreme license, up to 6M sessions and 300k CPS High performance Up to 55 Gbps firewall Up to 15 Gbps PS Up to 15 Gbps PSec VPN High availability Redundant power and fans Redundant management Modular Junos Software

SRX3400:SPC/NPC/NP-OCFront and rear views Fan tray Routing Engine 2 x 10 GigE /O card Front slot guide Power supply FRU SRX3400 Front View USB 16 x 10/100/1000 /O card Expansion Slot (OC/SPC) SRX3400

13 SRX3400:SPC/NPC/NP-OCFront and rear views Fan tray Routing Engine 2 x 10 GigE /O card Front slot guide Power supply FRU SRX3400 Front View USB 16 x 10/100/1000 /O card Expansion Slot (OC/SPC) SRX3400 Rear View Redundant power supply (optional) Expansion Slot (SPC/NPC) Expansion Slot (SPC/NPC) 12 on-board GbE ports 16 x GbE SFP /O card Redundant Routing Engine (future) or SCM Rear slot guide Switch Fabric Board (SFB) Fan tray door 3 RU Modular chassis 7 expansion slots (4 front and 3 rear) Compact form factor modules for /O and service processing Dual, hot swappable management modules Junos Software Massive scale Up to 180,000 new, sustained connections per second (CPS) Up to 2.25 million sessions High performance Up to 30 Gbps firewall Up to 8 Gbps PS Up to 8 Gbps PSec VPN High availability Redundant power and fans Redundant management Modular Junos Software Note: Power cords ( straight C19 plug) not included with BASE system. Right-Angled power cords interfere with cards but are usable.

Fan tray (rear) Slot guide SRX1400 Front view Management Module (RE) Expansion Slots (NSPC or SPC+NPC) Expansion Slot (OC/NP-OC/SPC) Power supply FRU 12 on-board ports: 1400GE: 6+4+2 GE 1400XGE: 3

14 Fan tray (rear) Slot guide SRX1400 Front view Management Module (RE) Expansion Slots (NSPC or SPC+NPC) Expansion Slot (OC/NP-OC/SPC) Power supply FRU 12 on-board ports: 1400GE: GE 1400XGE: 3 XGE plus GE Redundant power supply (optional) 3 RU Modular chassis 3 expansion slots Compact form factor modules shared with SRX3000 Junos Software scale Up to 45,000 new, sustained connections per second (CPS) Up to 1.5 million sessions High performance Up to 10 Gbps firewall Up to 4 Gbps PS Up to 5 Gbps PSec VPN High availability Redundant power and fans Chassis Clustering Modular Junos Software Shared HA-control ports High availability SRX3000 technology Common sparing possible Note: Region-appropriate Power Cord ( straight C13 plug) is included with BASE system but not with spare (redundant) power supplies.

15 Packet Flow: First packet of new flow 1. Packet Received by NP NP flow lookup, no match 2. NP send packet to CP 3. CP chooses SPU, forwards packet SPU does session setup 4. Packet forwarded out egress port NP NP NP Fabric CP SPU SPC #1 SPU NP SPU OC SPC #N

16 Packet Flow: Session setup Messages 1. SPU sends insert session to CP 2. SPU sends insert session to ingress NP 3. SPU sends insert session to egress NP CP SPU NP NP NP Fabric SPC #1 SPU NP SPU OC SPC #N

18 PACKET FLOW : FRST PACKET OF NEW FLOW 1. Packet Received by NP NP flow lookup, no match SW SW Fabric OC domain 2. NP sends packet to CP OC #X NPC #R NP NP 3. CP chooses SPU, forwards packet SPU does session setup 4. Packet forwarded out egress port via NPC for queuing Fabric SPC domain SPC #1 CP SPU SPU OC #Y NPC #S SPC #N Copyright 2013 Juniper Networks, nc. 18

Fabric OC domain NP OC #X NPC #R NP Fabric SPC

19 PACKET FLOW : SETUP MESSAGES 1. SPU sends insert session to CP 2. SPU sends insert session to ingress NP 3. SPU sends insert session to egress NP CP SW SW Fabric OC domain NP OC #X NPC #R NP Fabric SPC domain SPC #1 SPU SPU OC #Y NPC #S SPC #N Copyright 2013 Juniper Networks, nc. 19

20 PACKET FLOW : FAST PATH 1. Packet Received by NP NP flow lookup, match 2. NP send packet to SPU - SPU does fast path processing 3. Packet forwarded to egress NP 4. Packet egresses card CP SW Fabric OC domain NP OC #X NPC #R SW NP Fabric SPC domain SPC #1 SPU SPU OC #Y NPC #S SPC #N Copyright 2013 Juniper Networks, nc. 20

22 Packet Flow: Fast Path 1. Packet Received by NP NP flow lookup, match 2. NP send packet to SPU SPU does fast path processing 3. Packet forwarded to egress NP CP 4. Packet egresses card NP SPU NP Fabric SPC #1 NP SPU NP SPU OC SPC #N

23 NP-OC First path n Standard & SOF mode 1. Packet Received by NP NP flow lookup, no match 2. NP send packet to CP 3. CP chooses SPU, forwards packet SPU does session setup 4. Packet forwarded out egress port CP Fabric SPC #1 NP SPU OC SPC #N

24 NP-OC Fast Path in standard mode 1. Packet Received by NP NP flow lookup, match 2. NP send packet to SPU SPU does fast path processing 3. Packet forwarded to egress NP 4. Packet egresses card CP NP Fabric SPC #1 SPU OC SPC #N

25 NP-OC ntra-np fast path in SOF mode 1. Packet Received by NP 2. NP flow/session lookup, match 3. NP forwarded to egress port CP NP Fabric SPC #1 SPU OC SPC #N

26 NP-OC nter-np fast path in SOF mode 1. Packet Received by NP 2. NP flow/session lookup, match 3. NP forwarded it to egress NP through switch fabric 4. NP forwarded to egress port CP NP Fabric SPC #1 SPU NP OC SPC #N

27 What s New

28 SRX5000 Line What s New New high performance line cards now available for the SRX5800/5600/5400 Series: Routing Engine Refresh (RE-1800X4) New Enhanced System Control Board (SCBE) Corporate rebranding from Blue to Charcoal for SRX5000 chassis and most line cards (all Gen2)

29 SRX5K-RE-1800x4 Routing Engine Refresh Quad-core ntel Xeon 4G CF: - Stores Junos - Stores configs FXP0 1GE 128G SSD: - Stores coredumps - Stores logs

Key Enhancements with Routing Engine Refresh Performance Higher performance through Xeon processor Better performance with single core compared to RE-1300 Scale ncreased memory in DRAM Hardware

30 Key Enhancements with Routing Engine Refresh Performance Higher performance through Xeon processor Better performance with single core compared to RE-1300 Scale ncreased memory in DRAM Hardware enablement for 64-bit Junos * Reliability mproved Mean Time Before Failure with SSDs 6-nines Reliability equates to <20 seconds downtime/year** *@ FRS for 12.1X47-D15, we still run 32bit Junos **Telcordia Reliability Analysis and Test Report, November 2014 independent testing, not related to RE Refresh

31 Performance mprovements with RE Refresh Activity RE-1300 RE-1800X4 Time taken to push 1800 routes from RE to PFE 8 Mins 3 Mins l2ald(output of top -S command) 2.54% 1.03% User CPU 4% 3% Kernel CPU 58% 20% nterrupt CPU 24% 12% DLE CPU 13% 64% Memory Utilization 20% 13% Better performance, scalability and reliability mproved memory utilization mproved CPU utilization

Routing Engine Specs SRX5K-RE-1300 (Existing) SRX5K-RE-1800X4 NEW Processor Celeron-M@1300MHz Quad-core ntel Xeon @ 1800 Mhz Memory (RE-DRAM) 2G DRAM 16G DRAM** Compact flash storage 1G 4G Hard Disk

32 Routing Engine Specs SRX5K-RE-1300 (Existing) SRX5K-RE-1800X4 NEW Processor Quad-core ntel 1800 Mhz Memory (RE-DRAM) 2G DRAM 16G DRAM** Compact flash storage 1G 4G Hard Disk storage 40G 120G SSD Min JUNOS supported All releases of Junos 12.1X47-D15 Supported platforms/ components SRX5K with all CG/NG SPC/OC SRX5K with only NGSPC/NGOC *note the current capacity scaling numbers remain unchanged **Only 4G in 32-bit kernel

33 SRX5000 Line with SCBE

34 SCBE: Key Highlights Leverages MX SCBE which uses XF chip Supports 120Gbps fabric data throughput per slot Supports n-service-hardware-upgrade (SHU) from CG-SCB to NG-SCB for smooth upgrade transition

35 Scaling and Performance with SCBE Release X47-D15 Firewall max throughput Per NG-OC slot max throughput Firewall max throughput for MX traffic 320Gbps 120Gbps 140Gbps

36 RE-1800 & SCBE Platforms Supported Model Description Product Platform Supported with Junos 12.1X47-D15 and above releases (*SW FRS 1 st Dec, 2014 HW FRS 8 th Dec, 2014) SRX5K-SCBE SRX5K Enhanced Switch Control Board SRX5400, SRX5600, SRX5800 SRX5K-RE-1800X4 SRX5K Route Engine, 1.8Ghz quad-core Xeon, 16GB DRAM, 128GB SSD SRX5400, SRX5600, SRX5800 Model Description Supported with SRX5K-SCBE and SRX5K-RE-1800X4? SRX5K-SPC High performance services processing card for SRX5K Yes SRX5K-MPC MPC for 100GE, 40GE, 10GE, and 1GE MC nterfaces Yes SRX5K-40GE-SFP 40x1Gig SFP Ethernet /O Card for SRX5000 No SRX5K-4XGE-XFP 4x10Gig XFP Ethernet /O Card for SRX5000 No SRX5K-FPC-OC SRX 5000 Flex OC. Supports 2 pluggable port modules. No SRX5K-RE SRX5K Route Engine, 1.3Ghz, 2GB DRAM No SRX5K-SCB SRX5K Switch Control Board No SRX5K-SPC SRX5K Service Processing Card No

Approved Pricing / SKUs Available on Price List Requires 12.1X47-D15 Model Description List Price SRX5K-SCBE SRX5K Enhanced Switch Control Board $20,000 SRX5K-RE-1800X4 SRX5K Route Engine, 1.

37 Approved Pricing / SKUs Available on Price List Requires 12.1X47-D15 Model Description List Price SRX5K-SCBE SRX5K Enhanced Switch Control Board $20,000 SRX5K-RE-1800X4 SRX5K Route Engine, 1.8Ghz quad-core Xeon, 16GB DRAM, 128GB SSD $35,000 SRX5400E-B1-AC SRX5400 Enhanced Configuration 1 includes chassis, midplane, SRX5K-RE-1800X4, SRX5K-SCBE, 2xAC HC PEM, HC fan tray, SRX5K-SPC , SRX5K-MPC, and SRX-MC-10XG-SFPP $180,000 SRX5400E-B1-DC SRX5400E-B2-AC SRX5400E-B2-DC SRX5600E-BASE-AC SRX5600E-BASE-DC SRX5800E-BASE-AC SRX5800E-BASE-DC SRX5400 Enhanced Configuration 1 includes chassis, midplane, SRX5K-RE-1800X4, SRX5K-SCBE, 2xDC HC PEM, HC fan tray, SRX5K-SPC , SRX5K-MPC, and SRX-MC-10XG-SFPP SRX5400 Enhanced Configuration 2 includes chassis, midplane, SRX5K-RE-1800X4, SRX5K-SCBE, 2xAC HC PEM, HC fan tray, 2xSRX5K-SPC , SRX5K-MPC, and SRX-MC-10XG-SFPP SRX5400 Enhanced Configuration 2 includes chassis, midplane, SRX5K-RE-1800X4, SRX5K-SCBE, 2xDC HC PEM, HC fan tray, 2xSRX5K-SPC , SRX5K-MPC, and SRX-MC-10XG-SFPP SRX5600 Enhanced chassis includes chassis, midplane, SRX5K-RE-1800X4, SRX5K-SCBE, 2xAC HC PEM, HC fan SRX5600 Enhanced chassis includes chassis, midplane, SRX5K-RE-1800X4, SRX5K-SCBE, 2xDC HC PEM, HC fan SRX5800 Enhanced chassis includes chassis, midplane, SRX5K-RE-1800X4, 2xSRX5K-SCBE, 2xAC HC PEM, 2X HC fan SRX5800 Enhanced chassis includes chassis, midplane, SRX5K-RE-1800X4, 2xSRX5K-SCBE, 2xDC HC PEM, 2X HC fan $180,000 $280,000 $280,000 $65,000 $65,000 $89,000 $89,000

38 Corporate Rebranding for Entire SRX5000 Line

39 Thank you

Juniper Security Update. Karel Hendrych Juniper Networks

Juniper Security Update. Karel Hendrych Juniper Networks Juniper Security Update Karel Hendrych Juniper Networks khe@juniper.net Agenda High End SRX security gateways Overview, SRX1400 JunOS update AppSecure Competitive 2 Copyright 2009 Juniper Networks, Inc.