Overview:
The NFX250 and NFX250-R deliver a flexible, secure, ondemand network services platform. An integral part of Juniper’s fully automated Cloud CPE solution, this highperformance vCPE platform helps service providers improve overall operational efficiency and service agility, delivering a platform to the enterprise for virtualized network services operated and delivered from the cloud.
The NFX250 enables dynamic SD-WAN functionality and sophisticated routing services, while simultaneously supporting multiple Juniper and thirdparty VNFs on a single device, empowering enterprise customers to accelerate application deployment across geographical locations with a single, automated, and highly scalable solution.
Product Description
Juniper Networks Cloud CPE solution automates the creation and the delivery of network services with agility at scale, enabling service providers to deliver innovative managed services from the data center or at the customer edge. While traditional customer premises equipment (CPE) devices have served the market well for years, they do not provide the flexibility, agility, or scalability required for a flexible cloud deployment model. As a result, service providers typically employ diverse proprietary and closed platforms that inhibit innovation and complicate configuration, provisioning, and management.
More than ever, enterprises rely on the Internet to support their business operations. This increasing dependence on the Internet to access geographically distributed data centers and the multitude of mission-critical cloud-based applications has made branch offices complex to manage, maintain, and upgrade. Rapid business expansions, both local and international, also create new challenges for branch office deployment and connectivity. Enterprises require a solution that creates branches on demand, accelerates service deployment, and instantly applies business updates and security policies consistently across a diverse and growing number of business applications and branch locations.
Juniper Networks NFX250 Network Services Platform eliminates the challenges associated with deploying, managing, maintaining, and evolving CPE. Leveraging Network Functions Virtualization (NFV) and built on the Juniper Cloud CPE solution, the NFX250 is a highly scalable solution empowering enterprise customers to deploy multiple secure and highperformance virtual network functions (VNFs) on premises. The NFX250 also serves as a reliable, scalable, and secure network service platform to rapidly deploy virtual routing services, as well as a Juniper Cloud-Enabled Branch solution. This automated, software-driven solution dynamically provisions new services on demand, resulting in a near instantaneous service delivery experience. Subsequent service updates and policy changes can be consistently and dynamically inserted into the existing device, resulting in operational efficiency for service providers and enterprise customers alike by limiting or even eliminating service interruptions and business disruptions.
The embedded SD-WAN functionality supports advanced routing features, augmenting enterprise WANs beyond the traditional MPLS. Advanced policy-driven security features by Juniper Networks vSRX virtual firewall hosted on the NFX250 provides optimal routing for applications through the MPLS or broadband connection determined by predefined policies while ensuring secure protection across the entire enterprise network and distributed branches.
The NFX250 also embeds the Juniper Networks vMX Virtual Router, a full-featured, carriergrade MX Series 3D Universal Edge Router that extends more than 15 years of Juniper edge routing expertise to the virtual realm. The vMX delivers complete feature and operational consistency with physical MX Series platforms, providing sophisticated routing services in support of provider edge and customer premises equipment (CPE) applications. With its granular “pay as you grow” licensing model, the vMX allows users to start small, move fast, and stay profitable.
Architecture and Key Components:
The Juniper Cloud CPE solution consists of the following key components:
- NFX250: The NFX250 Network Services Platform leverages IP and virtualization technologies as the cornerstones for automated on-demand branch creation and rapid service delivery. Based on field-proven Juniper technology, including open architectures and the Juniper Networks Junos operating system, the NFX250 delivers high performance and scalability for routing, switching, and security applications.
- SD-WAN Functionality: The NFX250 efficiently utilizes links across the enterprise WAN, blending traditional MPLS with other connectivity options such as broadband Internet, 4G, LTE, and more. Policy-based forwarding capabilities enforce business rules set by the enterprise to steer application traffic towards a predefined path.
- Contrail Service Orchestration: Juniper Networks Contrail Service Orchestration is a comprehensive management and orchestration solution that delivers VNFs to the NFX250. A simple GUI customer portal gives enterprise customers the flexibility to select and build customized services from a catalog. Contrail Service Orchestration automates service activation and provisions newly requested services instantaneously under an open NFV environment.
- Network Service Activator: The Network Service Activator application intelligently automates service life-cycle management on the NFX250 across managed VPN networks, in-region secured Internet connections, and outof-region IPsec connections. Automation eliminates complex manual intervention and improves overall operational efficiency while reducing the time to activate a customer.
- Virtual Network Functions: The NFX250 is capable of hosting and chaining multiple network functions on a single platform. The NFX250 platform supports multiple VNFs, including the Juniper Networks vSRX virtual firewall, the industry’s most efficient and full-function virtualized security appliance.
- Open Framework: The NFX250 is based on an open framework providing the same service consistency and operational model found in the telco cloud. The open framework supports industry standards, protocols, and seamless API integration.
- Flexible Deployments: The NFX250 supports a variety of flexible deployments. A distributed services deployment model ensures high availability, performance, and compliance, while a hybrid model provides versatility and cost efficiency for branch connectivity. These flexible deployment models provide freedom of choice, helping enterprise customers with ever-growing business requirements and branch expansions.
Features and Benefits:
Cloud Adoption
Unlike traditional CPE devices that inhibit agility, the NFX250 is highly scalable, supporting multiple concurrent VNFs on a single device. This substantially reduces upfront CapEx and software costs, establishing a flexible consumption model for on-demand network services from the cloud.
Cost Efficiencies
The NFX250 improves the overall cost efficiency of the CloudEnabled Branch and managed services with Cloud CPE. CapEx efficiency is enhanced where a single and scalable NFX250 replaces multiple on-premise devices. OpEx efficiency is achieved through automation, which simplifies operations and eliminates the extensive manual processes required by traditional CPE devices. Cost efficiencies help enterprise customers achieve operational agility and boost profitability.
Security and Reliability
The NFX250 incorporates many advanced security features. The Secure Boot feature ensures that only an authentic, unmodified Juniper OS can be launched at boot time, safeguarding system integrity from factory to the branch site. The embedded Trusted Platform Module (TPM) ensures platform integrity and provides entropy for cryptographic operations.
As a VNF for the NFX250, the vSRX provides the same capabilities as Juniper Networks SRX Series Services Gateways in a virtual form factor, providing perimeter security, IPsec connectivity, applications detection, and filtering for malicious traffic without sacrificing reliability, visibility, or policy control. The carrier-class architecture ensures reliability and high availability for every application.
Performance
The NFX250 features Open vSwitch, an open-source network automation and switching framework that intelligently manages service chaining. Open vSwitch effectively optimizes data traffic flow within the NFX250, providing consistent VNF service functions and an improving performance to minimize service interruptions.
Agility
Enterprise business requirements are always evolving, reflecting constantly changing market dynamics and seasonality. The NFX250 lets enterprise customers select and automatically implement new services and applications from an extensive service catalog in real time, fostering collaboration across branch sites to improve overall productivity.
Carrier Grade Routing
The vMX on the NFX250 delivers feature and operational consistency with physical MX Series platforms and provides sophisticated routing services in support of provider edge and CPE applications.
| Features |
Benefits |
| SD-WAN functionality effectively allocates workloads across the enterprise WAN. |
Efficient utilization of links across the enterprise WAN leverage policybased routing, blending traditional MPLS with other connectivity options such as broadband Internet, 4G, LTE, and more. |
| The vSRX virtual firewall provides the same security services as physical SRX Series Services Gateways. |
vSRX is a comprehensive virtual security and routing appliance that enables the NFX250 to deliver the highest possible performance across branch locations. |
| Seamless integration with Contrail Service Orchestration ensures automated management and a consistent service life-cycle experience. |
Contrail Service Orchestration automates service chaining and delivery on demand to increase revenue-generating service delivery opportunities. |
| Network Service Activator enables fast device discovery and provisioning. |
Automated configuration eliminates complex device setup and delivers a plug-and-play experience. |
| Local wire-speed performance ensures 1GbE rates. |
High performance simplifies network topologies and operations. |
| Data Path Development Kit (DPDK) and Single Root I/O Virtualization (SR-IOV) harness high performance from Intel x86 processor. |
DPDK enables fast packet processing of networking applications by providing a framework for Intel x86 processors. SR-IOV allows VNFs to bypass the hypervisor to directly access resources on the CPU network interface, significantly boosting IO performance. |
| The vMX on the NFX250 offers the same routing features and operational environment as physical MX Series routers. |
Running on the NFX250-S2-R, the vMX provides sophisticated routing services in support of provider edge and CPE applications. |
Specifications:
| Model: |
NFX250-LS1 |
NFX250-S1/S1E |
NFX250-S2 |
NFX250-S2-R** |
Dimensions
(H x W x D) |
1.72 x 17.36 x 12 in
(4.37 x 44.09 x 30.48 cm) |
1.72 x 17.36 x 12 in
(4.37 x 44.09 x 30.48 cm) |
1.72 x 17.36 x 12 in
(4.37 x 44.09 x 30.48 cm) |
1.72 x 17.36 x 12 in
(4.37 x 44.09 x 30.48 cm) |
| Rack units (U) |
1 U |
1 U |
1 U |
1 U |
| Weight |
4.3 kg (9.48 lb) |
4.3 kg (9.48 lb) |
4.3 kg (9.48 lb) |
4.3 kg (9.48 lb) |
| Airflow |
Front-to-back (AFO) forced cooling |
Front-to-back (AFO) forced cooling |
Front-to-back (AFO) forced cooling |
Front-to-back (AFO) forced cooling |
| Acoustics |
50 dbA |
50 dbA |
50 dbA |
50 dbA |
| Power |
Fixed PSU 100-240 VAC |
Fixed PSU 100-240 VAC |
Fixed PSU 100-240 VAC |
Fixed PSU 100-240 VAC |
| CPU |
Intel 4 Core Pentium D |
Intel 6 Core Xeon D |
Intel 6 Core Xeon D |
Intel 6 Core Xeon D |
| Software |
Wind River Linux 7 |
Wind River Linux 7 |
Wind River Linux 7 |
Wind River Linux 7 |
| Memory |
16 GB DDR4 RAM |
16 GB DDR4 RAM |
32 GB DDR4 RAM |
32 GB DDR4 RAM |
| Storage |
100 GB* SSD |
S1: 100 GB* SSD
S1E: 200 GB* SSD |
400 GB* SSD |
400 GB** SSD |
| Network Interfaces |
- • 8 x 10/100/1000BASE-T RJ-45 LAN ports
- 2 x 10/100/1000BASE-T RJ-45 LAN/WAN ports
- 2 x 100/1000BASE-X small form-factor pluggable transceiver (SFP) WAN ports
- 2 x 1GbE/10GbE SFP+ WAN ports
- 1 x 10/100/1000BASE-T RJ-45 management port
|
- 8 x 10/100/1000BASE-T RJ-45 LAN ports
- 2 x 10/100/1000BASE-T RJ-45 LAN/WAN ports
- 2 x 100/1000BASE-X SFP WAN ports
- 2 x 1GbE/10GbE SFP+ WAN ports
- 1 x 10/100/1000BASE-T RJ-45 management port
|
| Out-of-band interfaces |
- RJ-45 console port
- Mini USB console port
- USB 2.0 port
|
- RJ-45 console port
- Mini USB console port
- USB 2.0 port
|
- RJ-45 console port
- Mini USB console port
- USB 2.0 port
|
- RJ-45 console port
- Mini USB console port
- USB 2.0 port
|
| Maximum number of VNFs |
4 |
6 |
8 |
N/A |
* Raw capacity; actual capacity will be lower due to over-provisioning.
** NFX250-S2-R only supports the vMX. No other NFX250 platforms support the vMX.
Additional Feature Specifications:
Packet Switching Capacities
- Packet Forwarding Engine (PFE) capacity: 64 Gbps
- VNF capacity: 20 Gbps full-duplex path to CPU for VNF traffic
- Throughput via VNFs will vary depending on network function and acceleration technologies supported
Layer 2 Switching
- Maximum media access control (MAC) addresses in hardware: up to 16,000
- Jumbo frames: 9,216 bytes
- Number of VLANs: up to 1,024 (VLAN IDs: 4,096)
- Port-based VLAN
- MAC-based VLAN
- Voice VLAN
- Private VLAN (PVLAN)
- Number of MST instances supported: 64
- Compatible with Per-VLAN Spanning Tree Plus (PVST+)
- Routed VLAN interface (RVI)
- Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) with VoIP integration
Layer 3 Features: IPv4
- Maximum number of Address Resolution Protocol (ARP) entries: up to 512
- Maximum number of IPv4 unicast routes in hardware: up to 512
- RIP v1/v2
- OSPF v1/v2 (with 4 active interfaces)
- Static routing
- Bidirectional Forwarding Detection (BFD)
- IP directed broadcast
Access Control Lists (ACLs) (Junos OS firewall filters)
- Port-based ACL (PACL)—ingress
- VLAN-based ACL (VACL)—ingress and egress
- Router-based ACL (RACL)—ingress and egress
- ACL entries (ACE) in hardware per system: 1,500
- ACL counter for denied packets
- ACL counter for permitted packets
- Ability to add/remove/change ACL entries in middle of list (ACL editing) • L2-L4 ACL
Security
- MAC limiting
- Allowed MAC addresses—configurable per port
- Sticky MAC (persistent MAC address learning)
- Dynamic ARP inspection (DAI)
- Proxy ARP
- Static ARP support
- Dynamic Host Configuration Protocol (DHCP) snooping
High Availability
- Link aggregation
- 802.3ad Link Aggregation Control Protocol (LACP) support:
- Static max groups: 8 LAGs with 1 member per LAG
- Static max members: 1 LAG with 8 members per LAG
- LACP max groups: 8 LAGs with 1 member per LAG
- LACP max members: 1 LAG with 8 members per LAG
- LAG load sharing algorithm—Bridged unicast traffic:
- IP: S/D MAC, S/D IP
- TCP/UDP: S/D MAC, S/D IP, S/D port
- Non-IP: S/D MAC
- LAG sharing algorithm—Routed unicast traffic:
- IP: S/D IP
- TCP/UDP: S/D IP, S/D port
- LAG load sharing algorithm—Bridged multicast traffic:
- IP: S/D MAC, S/D IP
- TCP/UDP: S/D MAC, S/D IP, S/D port
- Non-IP: S/D MAC
- LAG sharing algorithm—Routed multicast traffic:
- IP: S/D IP
- TCP/UDP: S/D IP, S/D port
- Tagged ports support in LAG
- Uplink failure detection
Quality of Service (QoS)
- Layer 2 QoS
- Layer 3 QoS
- Ingress policing: 1 rate 2 color
- Hardware queues per port: 8
- Scheduling methods (egress): Strict priority (SP), shapeddeficit weighted round-robin (SDWRR)
- 802.1p, DiffServ code point (DSCP)/IP precedence trust
- and marking
- L2-L4 classification criteria: Interface, MAC address, Ethertype, 802.1p, VLAN, IP address, DSCP/IP precedence
- TCP/UDP port numbers
- Congestion avoidance capabilities: Tail drop
Multicast
- Internet Group Management Protocol (IGMP) snooping entries: 1,000
- IGMP: v1, v2, v3
- IGMP snooping
- PIM-SM
Services and Manageability
- Junos OS CLI
- Web interface (J-Web)
- Out-of-band management: Serial, 10/100BASE-T Ethernet
- ASCII configuration
- Rescue configuration
- Configuration rollback
- Simple Network Management Protocol (SNMP): v1, v2c, v3
- Remote monitoring (RMON) (RFC 2819) Groups 1, 2, 3, 9
- Network Time Protocol (NTP)
- DHCP server
- DHCP client and DHCP proxy
- DHCP relay and helper
- RADIUS authentication
- TACACS+ authentication
- SSHv2
- Secure copy
- HTTP/HTTPs
- Domain Name System (DNS) resolver
- System logging
- Temperature sensor
- Configuration backup via FTP/secure copy
- Interface range
Troubleshooting
- Debugging: CLI via console, telnet, or SSH
- Diagnostics: Show and debug command statistics
- Traffic mirroring (port)
- Traffic mirroring (VLAN)
- ACL-based mirroring
- Mirroring destination ports per system: 1
- LAG port monitoring
- Multiple destination ports monitored to 1 mirror (N:1)
- Maximum number of mirroring sessions: 1
- Mirroring to remote destination (over L2): 1 destination
- VLAN
- IP tools: Extended ping and trace
- Juniper Networks commit and rollback
Optics
- EX-SFP-10GE-USR
- EX-SFP-10GE-DAC-1M
- EX-SFP-1GE-SX
- EX-SFP-1GE-SX-ET
- EX-SFP-1GE-LX
- EX-SFP-10GE-SR
- EX-SFP-10GE-LR
- EX-SFP-10GE-DAC-3M
- EX-SFP-10GE-DAC-5M
- EX-SFP-10GE-ER
- EX-SFP-10GE-ZR
- EX-SFP-1GE-LH
- EX-SFP-1GE-T
- EX-SFP-1GE-LX40K
- EX-SFP-GE10KT13R14
- EX-SFP-GE10KT14R13
- EX-SFP-GE10KT13R15
- EX-SFP-GE10KT15R13
- EX-SFP-GE40KT13R15
- EX-SFP-GE40KT15R13
- EX-SFP-GE80KCW1470
- EX-SFP-GE80KCW1490
- EX-SFP-GE80KCW1510
- EX-SFP-GE80KCW1530
- EX-SFP-GE80KCW1550
- EX-SFP-GE80KCW1570
- EX-SFP-GE80KCW1590
- EX-SFP-GE80KCW1610
Environmental Ranges
- Operating temperature: 32° to 122° F (0° to 50° C)
- Storage temperature: -40° to 158° F (-40° to 70° C)
- Operating altitude: Up to 10,000 ft. (3,048 m)
- Relative humidity operating: 5 to 90% (noncondensing)
- Relative humidity nonoperating: 5 to 90% (noncondensing)
- Seismic: Designed to meet GR-63, Zone 4 earthquake requirements
Safety and Compliance
- cNRTL-UL60950-1 (Second Edition)
- C-UL to CAN/CSA 22.2 No.60950-1 (Second Edition)
- TUV/GS to EN 60950-1 (Second Edition)
- CB-IEC60950-1 (Second Edition with all country deviations)
- EN 60825-1 (Second Edition)
Electromagnetic Compatibility
- FCC 47CFR Part 15 Class A
- EN 55022 Class A
- ICES-003 Class A
- VCCI Class A
- AS/NZS CISPR 32 Class A
- CISPR 22 Class A, CISPR 32 Class A
- EN 55024
- EN 300386
- CE
Environmental Compliance
- Restriction of Hazardous Substances (ROHS) 6/6
- ROHS 7a exemption for power supply components acceptable
- Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH)
- Waste Electronics and Electrical Equipment (WEEE)
- Telco
- Common Language Equipment Identifier (CLEI) code
Standards Compliance
IEEE Standards
- IEEE 802.1AB: Link Layer Discovery Protocol (LLDP)
- IEEE 802.1ag: Connectivity Fault Management (CFM)
- IEEE 802.1ak: Multiple VLAN Registration Protocol (MVRP)
- IEEE 802.1D: Spanning Tree Protocol
- IEEE 802.1p: CoS prioritization
- IEEE 802.1Q: VLAN tagging
- IEEE 802.1Q-in-Q: VLAN Stacking
- IEEE 802.1w: Rapid Spanning Tree Protocol (RSTP)
- IEEE 802.1s: Multiple Spanning Tree Protocol (MSTP)
- IEEE 802.1X: Port Access Control
- IEEE 802.3: 10BASE-T
- IEEE 802.3u: 100BASE-T
- IEEE 802.3ab: 1000BASE-T
- IEEE 802.3z: 1000BASE-X
- IEEE 802.3x: Pause Frames/Flow Control
- IEEE 802.3ad: Link Aggregation Control Protocol (LACP)
- IEEE 802.3ah: Ethernet in the First Mile
Supported RFCs
- RFC 768 UDP
- RFC 783 Trivial File Transfer Protocol (TFTP)
- RFC 791 IP
- RFC 792 ICMP
- RFC 793 TCP
- RFC 826 ARP
- RFC 894 IP over Ethernet
- RFC 903 Reverse ARP (RARP)
- RFC 906 TFTP Bootstrap
- RFC 951, 1542 BootP
- RFC 1058 Routing Information Protocol
- RFC 1112 IGMP v1
- RFC 1122 Host requirements
- RFC 1256 IPv4 ICMP Router Discovery (IRDP)
- RFC 1492 TACACS+
- RFC 1519 Classless Interdomain Routing (CIDR)
- RFC 1587 OSPF not-so-stubby area (NSSA) Option
- RFC 1591 Domain Name System (DNS)
- RFC 1812 Requirements for IP Version 4 routers
- RFC 2030 SNTP, Simple Network Time Protocol
- RFC 2068 HTTP server
- RFC 2131 BOOTP/DHCP relay agent and dynamic host
- RFC 2138 RADIUS authentication
- RFC 2139 RADIUS accounting
- RFC 2267 Network ingress filtering
- RFC 2338 Virtual Router Redundancy Protocol (VRRP)
- RFC 2362 PIM-SM (edge mode)
- RFC 2453 RIP v2
- RFC 2474 Definition of the Differentiated Services Field in the IPv4 and IPv6 Headers
- RFC 2597 Assured Forwarding PHB (per-hop behavior) Group
- RFC 2598 An Expedited Forwarding PHB
- RFC 2925 MIB for remote ping, trace
- RFC 3176 sFlow
- RFC 3569 SSM
- RFC 5176 Dynamic Authorization Extensions to RADIUS
- RFC 5880 Bidirectional Forwarding Detection (BFD)
Supported MIBs
- RFC 1155 SMI
- RFC 1157 SNMPv1
- RFC 1212, RFC 1213, RFC 1215 MIB-II, Ethernet-Like MIB and TRAPs
- RFC 1901 Introduction to Community-based SNMPv2
- RFC 2011 SNMPv2 for Internet protocol using SMIv2
- RFC 2012 SNMPv2 for transmission control protocol using SMIv2
- RFC 2013 SNMPv2 for user datagram protocol using SMIv2
- RFC 2233 The Interfaces Group MIB using SMIv2
- RFC 2287 System Application Packages MIB
- RFC 2570 Introduction to Version 3 of the Internet-standard Network Management Framework
- RFC 2571 An Architecture for describing SNMP Management Frameworks (read-only access)
- RFC 2572 Message Processing and Dispatching for the SNMP (read-only access)
- RFC 2576 Coexistence between SNMP Version 1, Version 2, and Version 3
- RFC 2578 SNMP Structure of Management Information MIB
- RFC 2579 SNMP Textual Conventions for SMIv2
- RFC 2580 Conformance Statements for SMIv2
- RFC 2665 Ethernet-like interface MIB
- RFC 2787 VRRP MIB
- RFC 2790 Host Resources MIB
- RFC 2819 RMON MIB
- RFC 2863 Interface Group MIB
- RFC 3410 Introduction and Applicability Statements for Internet Standard Management Framework
- RFC 3411 An architecture for describing SNMP Management Frameworks
- RFC 3412 Message Processing and Dispatching for the SNMP
- RFC 3413 Simple Network Management Protocol (SNMP)— (all MIBs are supported except the Proxy MIB)
- RFC 3414 User-based Security Model (USM) for version 3 of SNMPv3
- RFC 3415 View-based Access Control Model (VACM) for the SNMP
- RFC 3416 Version 2 of the Protocol Operations for the SNMP
- RFC 3417 Transport Mappings for the SNMP
- RFC 3418 Management Information Base (MIB) for the SNMP
- RFC 4188 Definitions of Managed Objects for Bridges
- RFC 4318 Definitions of Managed Objects for Bridges with Rapid Spanning Tree Protocol
- RFC 4363b Q-Bridge VLAN MIB
