Overview:
The NFX150 Network Services Platform provides multiple network connection options (including 4G/LTE) and an open, standards-based architecture. It uses SRX Series next-generation firewall software for security. The NFX150 simplifies network connectivity and delivers a broad portfolio of business services, such as SD-WAN. It is appropriate for enterprise organizations that manage their own WANs and for service providers that deliver managed services to the enterprise.
As a secure, universal customer premises equipment (uCPE) device, the NFX150 can support and manage multiple Juniper and third-party VNFs. When used with Juniper Contrail Service Orchestration, it delivers fully automated, secure SD-WAN, secure router, and cloud CPE solutions for the cost-effective deployment of multiple business and application-based services, easily managed from one GUI management tool.
The NFX150 is ideal for SD-WAN applications:
- Its integrated security provides the same capabilities as the Juniper Networks SRX Series Services Gateways—perimeter security, IPsec connectivity, applications detection, and filtering for malicious traffic without sacrificing reliability, visibility, or policy control.
- Its Zero Touch Provisioning (ZTP) capability automates deployment and management of the NFX150 platform and its VNFs.
Its wireless 4G/LTE interface speeds up initial service delivery by enabling the enterprise or managed service provider to deploy the NFX150 in advance of fixed-line service connectivity being available at branch locations.
The NFX Series Network Services Platform delivers a flexible, secure, on-demand network service experience to enterprise organizations. An integral part of Juniper’s fully automated software-defined WAN (SD-WAN), secure router, and Cloud CPE solutions, this high-performance universal CPE platform delivers dynamic SD-WAN functionality with Zero Touch Provisioning (ZTP), nextgeneration network security, and a portfolio of managed services.
The NFX Series supports multiple Juniper and third-party VNFs on a single device, enabling enterprise customers to accelerate application deployment across geographical locations with a single, automated, highly scalable solution.
Product Description
The Juniper Networks® NFX Series Network Services Platform includes the NFX150 and NFX250, offering secure, standards-compliant, redundant customer premises devices that simplify the creation and delivery of network services. This enables service providers to deliver innovative managed services with agility and scale, while allowing enterprises to automate and accelerate branch network connectivity.
More than ever, enterprises rely on the Internet to support their business operations. This increasing dependence on the Internet to access geographically distributed data centers and the multitude of mission-critical cloud-based applications has made branch offices difficult to manage, maintain, and upgrade. Rapid business expansion, both local and international, also creates new challenges for branch office deployment and connectivity. Enterprises require a solution that can create branches on demand, accelerate service deployment, and instantly apply business updates and security policies consistently across a diverse and growing number of business applications and branch locations.
While traditional customer premises equipment (CPE) devices have served the market well for years, many of these devices are closed, Layer 2 purpose-built platforms that do not provide the flexibility, agility, reliability, or scalability required to support a flexible cloud deployment. As a result, these devices often inhibit innovation and complicate or, even worse, restrict the ability to automate configuration and provisioning management.
The NFX Series highly scalable, open, and secure customer premises devices work with Juniper Contrail® Service Orchestration to deliver fully automated SD-WAN, secure router, and Cloud CPE solutions. Whether you are an enterprise business or a service provider, this automated, software-driven solution dynamically provisions new services, enabled by Juniper or third-party virtualized network functions (VNFs), on demand, resulting in near instantaneous service delivery. Its Zero Touch Provisioning (ZTP) capability greatly simplifies branch network connectivity for initial deployment and ongoing management. Subsequent service updates and policy changes are consistently and dynamically inserted into the existing device, resulting in operational efficiency for service providers and enterprise customers alike by limiting or even eliminating service interruptions and business disruptions.
The NFX Series empowers service providers to improve overall operational efficiency and service agility. It delivers a platform to the enterprise that can support multiple managed services, such as SD-WAN, managed security, managed Wi-Fi, and managed WAN acceleration, which can all be delivered and managed from the cloud. Fully integrated with the Juniper Networks SRX Series Services Gateways, which are high-performance next-generation firewalls (NGFWs), the NFX Series devices can be deployed as secure router platforms, ensuring the security of the platform itself and the services it delivers. Built with industry-standard interfaces, the NFX Series can also be used with third-party management and orchestration solutions. Additionally, the NFX Series supports multiple connectivity options such as broadband Internet, 4G/LTE, traditional MPLS, ADSL2/ VDSL2, and more. As service providers look to evolve their service portfolios, the NFX Series can evolve with them, transitioning from a virtual network services platform to an application services platform, supporting the delivery of a wide array of application-based network services, such as market data caching, Internet of Things (IoT) gateway, and edge computing.
The NFX150 Network Services Platform delivers versatility, agility, and scale to enterprise organizations and service providers. Its two form factors, compact (desktop) and rack-mount, integrated SRX Series NGFW, and 4G/LTE interface options, make it a great choice for secure SD-WAN, secure router, and managed security use cases.
The NFX250 Network Services Platform delivers capacity, performance, and scale to larger enterprise organizations and service providers who are looking to run multiple services on one platform. The NFX250 family provides greater VNF capacity and is integrated with Juniper Networks vSRX Virtual Firewall for the secure delivery of SD-WAN, secure router, and a broad portfolio of managed services.
Architecture and Key Components:
The NFX Series Network Services Platform leverages IP and virtualization technologies as the cornerstones of automated, on-demand branch creation and rapid service delivery solutions. Based on field-proven Juniper technology, including open architectures and the Juniper Networks Junos® operating system, the NFX Series delivers high performance and scalability for routing, switching, and security applications. The NFX Series devices are a key component of the Juniper Contrail SD-WAN and Cloud CPE solutions, which also include the following products and technologies:
- SD-WAN functionality: The NFX Series efficiently utilizes links across the enterprise WAN, blending traditional MPLS with other connectivity options such as broadband Internet, 4G, LTE, ADSL2/VDSL2, and more. Policy and applicationbased forwarding capabilities enforce business rules set by the enterprise to steer application traffic towards a preferred path.
- Secure router (integrated security): The NFX Series provides the same high-performance NGFW capabilities as the Juniper Networks SRX Series Services Gateways, providing next-generation security, IPsec connectivity, application detection, and filtering for malicious traffic without sacrificing reliability, visibility, or policy control. This functionality is a component of the NFX150 platforms, while it is provided as a VNF by the vSRX for the NFX250 platforms.
- Contrail Service Orchestration: Juniper Contrail Service Orchestration is a comprehensive management and orchestration solution that delivers VNFs to the NFX Series platforms. It works with the NFX Series to deliver Juniper Contrail SD-WAN, a comprehensive SD-WAN solution for enterprises and service providers. A simple GUI customer portal offers service providers the flexibility to select and build customized services from a catalog, or work with third-party VNF suppliers to build a catalog of their own. Contrail Service Orchestration automates service activation and provisions newly requested services instantaneously under an open NFV environment.
- Virtualized network functions: The NFX Series is capable of hosting and chaining multiple network functions on a single platform. It supports multiple VNFs, including the vSRX Virtual Firewall, the industry’s most efficient and fullfunction virtualized security appliance1.
- Wireless support: Specific NFX150 models support wireless 4G/LTE connectivity, enabling enterprises and service providers to activate the platform in new locations quickly and seamlessly. In new deployments, it can provide network connectivity before other network connection services become available. The wireless network connection can be the primary network connection or one of multiple transport paths.
- Cloud CPE: The NFX Series platforms are universal CPE platforms, built for the delivery of virtual managed services. When used with the Juniper Cloud CPE solution, service providers can use the graphic service design and management tools to create new services as quickly as business requirements emerge. The NFX Series supports a variety of flexible deployments; a distributed services deployment model ensures high availability, performance, and compliance, while a hybrid model provides versatility and cost efficiency for branch connectivity. These flexible deployment models provide freedom of choice, helping enterprise customers with ever-growing business requirements and branch expansions.
- Open framework: The NFX Series is based on an open framework providing the same service consistency and operational model found in the telco cloud. The open framework supports industry standards, protocols, and seamless API integration.
1 SRX Series next-generation firewall software is fully integrated with the NFX Series product family. The vSRX software runs on the NFX250 platform as a VNF, while the SRX Series software is fully integrated into the NFX150.
Features and Benefits:
VNF Flexibility
Unlike traditional CPE devices that inhibit agility, the NFX Series is highly scalable, supporting multiple concurrent VNFs on a single device. This substantially reduces upfront CapEx and software costs, establishing a flexible consumption model for on-demand network services from the cloud. The NFX Series features Open vSwitch, an open-source network automation and switching framework that intelligently manages service chaining. Open vSwitch effectively optimizes data traffic flow within the NFX Series platforms, providing consistent VNF service functions and improving performance to minimize service interruptions.
Security and Reliability
The NFX Series incorporates many advanced security features. The Secure Boot feature ensures that only an authentic, unmodified Junos OS can launch at boot time, safeguarding system integrity from factory to the branch site. The embedded Trusted Platform Module (TPM) ensures platform integrity and provides entropy for cryptographic operations. It also provides the same security: IPsec connectivity, applications detection, and filtering for malicious traffic without sacrificing reliability, visibility, or policy control, as found in the SRX Series high-performance NGFWs. This functionality is a standard component of the NFX150, while provided as a VNF by the vSRX in the NFX250.
High Availability
The NFX Series high availability (HA) redundancy features provide both enterprises and service providers the peace of mind that comes from knowing their networks will scale without affecting performance or reliability. With link redundancy, the NFX Series can address many common causes of system failures, such as a physical port going bad or someone inadvertently disconnecting a cable, to ensure that a connection is available without having to fail over the entire system. When NFX Series platforms are configured in a dual CPE cluster as an active/active high-availability pair, their traffic and configuration information, including routing and FIB tables, are mirrored automatically to provide active firewall and VPN session maintenance in case of a failure. The NFX Series platforms synchronize both configuration and runtime information. As a result, during failover, synchronization of the following information is shared: connection/session state and flow information, IPsec security associations, Network Address Translation (NAT) traffic, address book information, configuration changes, and more. NFX250 offers high availability on link, CPE, and/or vSRX VNF failovers.2
Zero Touch Provisioning
When bringing up a new network device in a remote office or branch, it can be costly to dispatch resources to provision equipment. With Zero Touch Provisioning (ZTP), all new devices connected to the ZTP environment can function without any manual CLI or GUI intervention. The network device simply needs to be connected and turned on. This is useful when technical staff is limited or unavailable at customer premises locations.
The ZTP process is simple. First, the service provider registers the NFX Series platform via the service activation portal, guaranteeing their customer a seamless activation experience. Once the platform is registered, it is ready for customer delivery and self-activation. Upon receiving the device, the customer simply needs to apply power and connect it to the Internet; the NFX Series platform will then securely boot its software, self-upgrade (if necessary), download its customer-specific configuration, and self-provision all services through a secure connection with Contrail Service Orchestration. In a matter of minutes the device is fully activated, services are enabled, and the customer is ready for business.
Cost Efficiencies
The NFX Series improves the overall cost efficiency of the enterprise WAN by supporting SD-WAN and a broad portfolio of managed services as a component of the Juniper Cloud CPE solution. CapEx efficiency is enhanced where a single and scalable NFX Series platform replaces multiple on-premises devices. OpEx efficiency is achieved through automation, which simplifies operations and eliminates the extensive manual processes required by traditional CPE devices. Cost efficiencies help enterprise customers achieve operational agility and boost profitability.
Agility
Enterprise business requirements are always evolving, reflecting constantly changing market dynamics and seasonality. The NFX Series devices let enterprise customers select and automatically implement new services and applications from an extensive service catalog in real time, fostering collaboration across branch sites to improve overall productivity.
Table 1. NFX Series Features and Benefits
| Features |
Benefits |
| SD-WAN functionality effectively allocates workloads across the enterprise WAN. |
Efficient utilization of links across the enterprise WAN leverage policy-based routing, blending traditional MPLS with other connectivity options such as broadband Internet, 4G, LTE, ADSL2/VDSL2, and more. |
| The NFX Series provides the same high-performance NGFW security services found in the physical SRX Series Services Gateways. |
The SRX Series next-generation firewall software comes fully integrated with the NFX150. The vSRX virtual firewall is a comprehensive virtual security and routing solution that enables the NFX250 to deliver the highest possible performance across branch locations. Use the integrated vSRX/SRX Series software to secure the WAN and the LAN, and to delivervalue added managed security services. |
| Seamless integration with Contrail Service Orchestration ensures automated management and a consistent service lifecycle experience. |
Service chaining and delivery can be automated on demand, increasing revenue-generating service delivery opportunities. |
| Network Service Activator enables fast device discovery and provisioning. |
Automated configuration eliminates complex device setup and delivers a plug-and-play experience. |
| Wire-speed performance ensures 1GbE and 10GbE rates. |
High performance simplifies network topologies and operations. |
| Data Path Development Kit (DPDK) and Single Root I/O Virtualization (SR-IOV) harness high performance from the Intel x86 processor.‡ |
DPDK enables fast packet processing of networking applications by providing a framework for Intel x86 processors. SR-IOV allows VNFs to bypass the hypervisor to directly access resources on the CPU network interface, significantly boosting I/O performance. |
2 Dual CPE high availability is not supported on the NFX150 at this time. ‡ Available on the NFX250 only
