SRX1600 Overview:
The SRX1600 Firewall protects enterprise campus networks and serves as a perimeter firewall in small and midsized data centers. The 1 U, power-efficient device delivers up to 24 Gbps firewall throughput per rack unit and supports 25 Gbps interfaces with wire speed MACsec to safeguard data in motion.
Juniper's Connected Security Distributed Services Architecture, managed by Juniper Security Director Cloud, offers a high-performance, scalable, and easy-to-manage firewall solution to secure today’s distributed data centers. Juniper Networks SRX1600 Firewall is integral to this new architecture, and it empowers organizations to operationalize security across their networks. This 1U, power-efficient firewall features built-in zero-trust, Ethernet VPN-Virtual Extensible LAN (EVPN-VXLAN) fabric integration, and AI-Predictive Threat Prevention to secure your network. The SRX1600 delivers next-generation firewall throughput of 21 Gbps per rack unit and supports 25 Gbps interfaces with wire speed MACsec.
Product Description
Juniper Networks® SRX1600 Firewall is a high-performance, next-generation firewall (NGFW) designed to safeguard your enterprise campus edge, data center edge, and branch offices. It also supports roaming, SD-WAN large branch, and SD-WAN secure hub use cases. Combining industry-leading security efficacy and carrier-grade routing with state-of-the-art switching, this platform delivers robust network security, effective threat protection, and comprehensive automation and mitigation capabilities.
As network architectures become more distributed and decentralized, Juniper Networks SRX Series Firewalls ensure seamless integration with other Juniper and third-party networking platforms. At the same time, the NGFWs facilitate architectural transformation, taking organizations from on-premises to hybrid cloud environments seamlessly and cost effectively. SRX Series Firewalls are the first to implement industry-standard Ethernet VPN (EVPN) type 5 and Virtual Extensible LAN (VXLAN) protocols within data center environments, enabling the SRX1600 to act as a secure, fabric-aware leaf in the data center spine-leaf architecture.
The SRX1600 participates in Juniper’s Connected Security Distributed Services Architecture, enabling organizations to scale both horizontally and elastically, and it simplifies operational management of large-scale firewall networks. With this architecture, several SRX1600 platforms can work together as a single large logical firewall to provide security at higher performance and scale.
The SRX1600 is powered by the Junos® operating system, the OS that underpins and helps secure the world’s largest mission-critical enterprise and service provider networks. It is managed by Juniper Security Director Cloud, Juniper’s unified management experience that connects the organization’s current deployments with future architectural rollouts. Security Director Cloud uses a single policy framework enabling consistent security policies across any environment and expanding zero trust to all parts of the network from the edge into the data center. This provides unbroken visibility, policy configuration, administration, and collective threat intelligence all in one place.
Highlights
The next-generation firewall (NGFW) has built-in zero-trust capabilities, EVPN-VXLAN fabric integration, AI Predictive Threat Prevention, and high port density to secure your network reliably. Centrally managed by Juniper Security Director Cloud, the SRX1600 supports intrusion detection and prevention, application visibility and control, and content security features that include antivirus, antispam, and web filtering.
The SRX1600 is integral to Juniper’s Connected Security Distributed Services Architecture and empowers organizations to operationalize zero trust across their networks.
To increase trust and streamline operations, the SRX1600 features several built-in zero trust device capabilities, including an embedded Trusted Platform Module (TMP) 2.0 and cryptographically signed device ID. The SRX1600 supports RFC compliant Secure Zero Touch Provisioning (sZTP) to deploy products in your network efficiently, expediently, and remotely. Additionally, the SRX1600 supports MACsec at wire speed, ensuring data integrity and confidentiality.
Technical Specifications:
| Specifications |
SRX1600 |
| Onboard ports |
16 x 1 GbE 10/100/1000 BASE-T |
| Onboard small form-factor pluggable plus (SFP+) transceiver ports |
4 x 1 GbE/10 GbE SFP+
2 x 1 GbE/10 GbE/25 GbE SFP28 |
| Out-of-Band (OOB) management ports |
1 x 1 GbE G (RJ-45) |
| Dedicated high availability (HA) ports |
2 x 1 GbE SFP |
| Console |
1 (RJ-45) |
| USB 3.0 ports (Type A) |
1 |
| Storage (SSD) |
1 x 120 GB (system/logging) |
| Form factor |
1U |
| Size (W x H x D) |
17.28 x 1.74 x 18.20 in
(43.89 x 4.42 x 46.23 cm) |
| Weight (device and PSU) |
Chassis with two AC power supplies: 15.7 lb (7.1 kg)
Chassis with two DC power supplies: 15.9 lb (7.2 kg)
Chassis with package for shipping: 32.8 lb (14.9 kg) |
| Redundant PSU |
1+1 |
| Power supply |
2 x 450 W AC PSU redundant
2 x 650 W DC PSU redundant |
| Average heat dissipation |
1 x DC PSU (40V): 487.9 BTU/h
2 x DC PSU (40V): 498 BTU/h
1 x AC PSU (110V): 467.5 BTU/h
1 x AC PSU (230V): 445.3 BTU/h
2 x AC PSU (110V): 510 BTU/h
2 x AC PSU (230V): 501.6 BTU/h |
| Maximum current consumption |
2 A (for 110 V AC PSM)
1 A (for 230 V AC PSM)
4.7 A (for -40 V DC PSM) |
| Maximum inrush current |
50 A for 1 cycle of AC (AC PSM)
40 A-pk (DC PSM) |
| Acoustic noise level |
58 dB (max) |
| Airflow/cooling |
Front to back |
| Operating temperature |
32° to 104° F (0° to 40° C at 6000 ft altitude) |
| Operating humidity |
5% to 90% non-condensing |
| Meantime between failures (MTBF) |
Over 100,000 hours (12 years) |
| FCC classification |
Class A |
| RoHS compliance |
RoHS 6 |
| Firewall (IMIX packet size) throughput Gbps3 |
9 Gbps |
| Firewall (1518B packet size) throughput Gbps3 |
24 Gbps |
| IPsec VPN (IMIX packet size) throughput Gbps3 |
5.5 Gbps |
| IPsec VPN (1400B packet size) throughput Gbps3 |
18 Gbps |
| Application security performance in Gbps (TPS#/CPS**) |
21.5 Gbps/5.3 Gbps |
| IPS recommended in Gbps (TPS#/CPS**) |
21 Gbps/2.75 Gbps |
| Next-generation firewall in Gbps (TPS#/CPS**)4 |
21 Gbps/2.75 Gbps |
| Secure Web Access Firewall in Gbps (TPS**) |
2.5 Gbps |
| Advanced Threat in Gbps (CPS6 |
1.3 Gbps |
| Connections per second (64B) |
95,000 |
| Maximum security policies |
16,000 |
| Maximum concurrent sessions (IPv4 or IPv6) |
2 Million |
| Route table size (RIB/FIB) (IPv4) |
2 Million/1 Million |
| IPsec VPN tunnels |
2,000 |
| Number of remote access/SSL VPN (concurrent) users |
2,000 |
| Max VLANs |
4,096 |
| GRE Tunnels |
2,000 |
| Maximum Security Zones |
512 |
| Maximum Virtual Routers |
512 |
| NAT Rules |
8,000 |
Additional Specification Features:
Firewall Services
- Stateful firewall services
- Zone-based firewall
- Screens and distributed denial of service (DDoS) protection
- Protection from protocol and traffic anomalies
- Unified Access Control (UAC)
- User role-based firewall
- SSL inspection
- Integration with Juniper Mist™ Access Assurance
Carrier-Grade Network Address Translation (CGNAT)
- Carrier-grade Network Address Translation (Large-scale NAT)
- IPv4 and IPv6 address translation NAT44, NAPT44, NAT66, NAPT66, NAT64, NAT46
- Static and dynamic 1-1 translation
- Source NAT with Port Address Translation (PAT)
- Destination NAT with Port Address Translation (PAT)
- Persistent NAT (EIM/EIF)
- Port Block Allocation (PBA)
- Deterministic NAT (DetNAT)
- Port overload
- Twice-NAT44
- DS-lite and Port Control Protocol (PCP)
VPN Features
- Tunnels: Site-to-site, hub and spoke, dynamic endpoint, AutoVPN, ADVPN, Group VPN (IPv4/ IPv6/Dual Stack)
- Juniper Secure Connect: Remote access/SSL VPN
- Configuration payload: Yes
- IKE encryption algorithms: Prime, 3DES-CBC, AEC-CBC, AES-GCM, Suite B
- Authentication: Pre-shared key and public key infrastructure (PKI) (X.509)
- IPsec: Authentication Header (AH) / Encapsulating Security
- Payload (ESP) protocol
- IPsec authentication algorithms: hmac-md5, hmac-sha-196, hmac-sha-256
- IPsec encryption algorithms: Prime, DES-CBC, 3DES-CBC, AEC-CBC, AES-GCM, Suite B
- Perfect forward secrecy, anti-reply
- Internet Key Exchange: IKEv1, IKEv2
- Monitoring: Standard-based dead peer detection (DPD) support, VPN monitoring
- VPNs GRE, IP-in-IP, and MPLS
High Availability Features
- Virtual Router Redundancy Protocol (VRRP)
- Stateful high availability
- Virtual Router Redundancy Protocol (VRRP)–IPv4 and IPv6
- Stateful high availability: Dual box clustering
- Active/passive
- Active/active
- Configuration synchronization
- Firewall session synchronization
- Device/link detection
- In-Service Software Upgrade (ISSU)
- IP monitoring with route and interface failover
- Chassis cluster HA and Multinode HA (MNHA)
- IP monitoring with route and interface failover
Application Security Services (offered as advanced security subscription license)
- Application visibility and control
- Application QoS
- Advanced/application policy-based routing (APBR)
- Application Quality of Experience (AppQoE)
- Application-based multipath routing
- User-based firewall
Threat Defense and Intelligence Services (offered as advanced security subscription license)
- Intrusion prevention system
- AI-Predictive Threat Prevention
- Antivirus
- Antispam
- Category/reputation-based URL filtering
- SSL proxy/inspection
- Protection from botnets (command and control)
- Adaptive enforcement based on GeoIP
- Juniper Advanced Threat Prevention, a cloud-based SaaS offering, to detect and block zero-day attacks
- Adaptive Threat Profiling
- Encrypted Traffic Insights
- SecIntel threat intelligence
- Juniper ATP virtual appliance, a distributed, on-premises advanced threat prevention solution to detect and block zero-day attacks
Routing Protocols
- IPv4, IPv6, static routes, RIP v1/v2
- OSPF/OSPF v3
- BGP with route reflector
- IS-IS
- Multicast: Internet Group Management Protocol (IGMP) v1/v2; Protocol Independent Multicast (PIM) sparse mode (SM)/ source-specific multicast (SSM); Session Description Protocol (SDP); Distance Vector Multicast Routing Protocol (DVMRP); Multicast Source Discovery Protocol (MSDP); reverse path forwarding (RPF)
- Encapsulation: VLAN, Point-to-Point Protocol over Ethernet (PPPoE)
- Virtual routers
- Policy-based routing, source-based routing
- EVPN-VXLAN (EVPN Type 5 route)
- Equal-cost multipath (ECMP)
QoS Features
- Support for 802.1p, DiffServ code point (DSCP), EXP
- Classification based on VLAN, data-link connection identifier (DLCI), interface, bundles, or multifield filters
- Marking, policing, and shaping
- Classification and scheduling
- Weighted random early detection (WRED)
- Guaranteed and maximum bandwidth
- Ingress traffic policing
- Hierarchical shaping and policing
- Virtual channels
Switching Features
- ASIC-based Layer 2 forwarding
- MAC address learning
- VLAN addressing and integrated routing and bridging (IRB) support
- Link aggregation and LACP
- Link Layer Discovery Protocol (LLDP) and Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED)
- STP, RSTP, MSTP
- Multiple VLAN Registration Protocol (MVRP)
- 802.1x authentication
- MACsec
Network Services
- Dynamic Host Configuration Protocol (DHCP) client/server/ relay
- Domain Name System (DNS) proxy, dynamic DNS (DDNS)
- Juniper real-time performance monitoring (RPM) and IP monitoring
- Juniper flow monitoring (J-Flow)
Advanced Routing Services
- Packet Mode
- MPLS (RSVP, LDP)
- Circuit cross-connect (CCC), translational cross-connect (TCC)
- L2/L2 MPLS VPN, pseudo-wires
- Virtual private LAN service (VPLS), next-generation multicast VPN (NG-MVPN)
- MPLS traffic engineering and MPLS fast re-route
Management, Automation, Logging, and Reporting
- SSH, Telnet, SNMP-MIBS, Traps
- Smart image download
- Juniper CLI and Web UI, NetCONF, XML APIs, RMON
- Juniper Networks Security Director Cloud
- Python
- Junos events, commit and OP scripts
- Application and bandwidth usage reporting
- Debug and troubleshooting tools
3Throughput numbers based on UDP packets and RFC2544 test methodology
4Next-generation firewall performance is measured with firewall, application security, and IPS enabled
5Secure Web Access firewall performance is measured with firewall, application Security, IPS, SecIntel, and URL filtering
enabled 6Advanced Threat performance is measured with firewall, application security, IPS, SecIntel, URL filtering, and malware protection enabled
#TPS Method: Fixed, long-lived sessions with multiple transactions
**CPS Method: Short-lived sessions with single transaction
