Juniper SRX Series Firewall Reviews

I work for a system integration company that partners with Juniper. Currently, I'm in a role akin to a technical consultant.

The SRX Series is often used by enterprise companies, typically in a cluster mode configuration, to enhance reliability. It's suitable for small to medium-sized enterprises as well.

Juniper recently announced a new SRX model that's very powerful, so I'm currently satisfied with the offerings.

The product provides good performance and has features comparable to other leading products in the market.

We typically use the SRX for VPN solutions and it supports next-generation features like antivirus, anti-spam, and IPS effectively.

There is room for improvement in scalability and performance. 

It's scalable and reliable, but when using next-generation firewall features, the performance decreases significantly for Juniper SRX. In Check Point and Cisco, the performance decrease is less.

I have been using it for ten years. I have good experience with Juniper SRX Series Firewall, especially in federal applications.

The branch model, being the smallest, sometimes has some bugs. However, the high-end and middle-end models are reliable and stable.

It is scalable, but unlike some vendors, like Check Point, which allows connecting more than two devices in a cluster, Juniper only supports configuring two devices in a cluster.

It's scalable and reliable, but when using next-generation firewall features, the performance decreases significantly for Juniper SRX. In Check Point and Cisco, the performance decrease is less.

I provide technical support myself.

Before, I found solutions myself. I don't usually need technical support for the SRX.

For me,  the initial setup is straightforward due to my experience. Juniper provides good documentation with example configurations, which should help even beginners.

I've handled installation services for service providers. I mostly work with on-premises versions, but sometimes I also install cloud-based solutions.

I start by preparing the configuration based on the customer's requirements, then upgrade to the Juniper-recommended version and install the configuration.

The deployment time depends on the number of SRX devices. Usually, I can handle it alone. It takes two to three hours to deploy one SRX firewall.

The maintenance is moderately challenging.

There is value for money. It offers a good solution at a good price. The price is normal for such a product.

I would recommend reading the documentation before beginning the configuration.

Overall, I would rate the solution an eight out of ten. 

We are a solution provider and we work closely with our clients to identify their requirements, and then we suggest a solution. Once they accept it, we implement it. The Juniper SRX is one of the models that our clients have chosen.

It is primarily used as a firewall.

The most valuable feature is robustness.

The training videos that are available need to be improved, and made more educative. This will help users to become more familiar with the product.

I have been using Juniper SRX for the past four years.

We had suggested an HA-based environment, or architecture in the majority of places that we have implemented Juniper. In these cases, it has been very stable. There have been other products that we couldn't upgrade to the latest format, but Juniper could always be upgraded. It always worked and never crashed.

I am not very sure about scalability, but I believe that we were able to migrate a few of the lower models to the high-end models and it worked perfectly well. There was no problem.

They have technical support over the phone as well as the online ticketing system and that has worked out pretty well. They have been able to solve problems for us, although I do not know all of the details because we direct our clients to them. When our clients get in touch with customer support to resolve their issues, they share the information with us later.

I sell other products from vendors such as F5, and they have a good training facility online. Juniper is behind in terms of video training that they have available.

The initial setup is not very easy. We had faced problems in the GUI, so we had to switch back to the CLI to get things done. While using the GUI, it was pretty easy and we could accomplish things by just clicking. However, for some reason, there were errors and we had to complete it using the CLI. I have no idea why this was the case, but we finally achieved what we wanted.

Our team implements this product for our clients.

This is an expensive product. The buying power of companies in my region is such that perhaps 5% of them are pretty good. The majority of them are very bad in terms of buying power, so they look at the cost of these solutions and Juniper is not able to match the price.

There are several options that we offer for our clients. These include Pala Alto, Cisco, Dell, SonicWall, F5, and FireEye. Some of our clients choosing Juniper, whereas others choose a solution from another vendor. The majority of our clients choose Cisco or FireEye.

Most of the companies that we deal with have a committee that takes care of purchases. We sit with the committee and they iterate through the various benefits of the solutions, after which the purchase is finalized. We are not biassed toward any particular product. We explain everything to our clients, show them the prices, and they come back to say what product they have chosen.

In summary, this is a good product, although it is a little bit expensive and the training could be improved. Training is something that is very important, and we were not able to get much information. For example, we couldn't get the best-recommended practices, which is something that we look at when implementing solutions. We were able to get a few of them, although not all of them have been updated. Consequently, we have a shortage of information about Juniper. Nonetheless, customer support has been able to help us in a big way.

Overall, things have been a bit slow, but we have been able to catch up.

I would rate this solution a seven out of ten.

We use the solution as a device to meet NTLS connections, a firewall, and we are thinking about using it for SD-WAN.

The firewall features and the routing capability are the most valuable. The interface is straightforward and we have not had any problems with integration.

Their models for service providers could improve. We are an MSP, we resell services and I think the company could have a better program for service providers because our needs are different from our regular customer that is buying it for.

More recently we started using the GUI interface and that looks pretty shameful and needs improvement.

Juniper has a different product line that has artificial intelligence capabilities. In the future, we would like to see that extended to the SRX line.

I have been using the solution for approximately two years.

We have found the solution to be very stable. We have had literally little to no hardware or device failures in the field and have not had any customer complaints. In the years we have been using the solution we have not had any issues using it.

The scalability is good. The solution is best for small to medium size businesses.

We had to use the support in a couple of instances. When we have used the support, it was good. They were responsive and able to resolve our issues. There is also some community support online that I have found to be helpful.

The installation difficulty depends on the setup. Initially, when we started using the solution, we were using the command line interface and it took us a while to learn the commands, eventually, it becomes straightforward. 

The full deployment took us approximately one month. We typically need only one person for deployment, and we have a service operation center that manages the devices and provides the maintenance.

The price could improve, it is a bit expensive. Our licensing cost is approximately $120.00 USD annually. There are some extra fees, for example, the GUI has an orchestrator that has its own fees. 

Some of our clients have also seen similar solutions from our competitors such as Cisco and Fortinet. I think technically they are all very good products. However, for us we were looking for a product that was stable and had good support, this is the reason we chose Juniper. We package Juniper as part of our managed service to our customers.

My advice would be, generally, it is a good product with helpful support. The one thing we would like to see changes in is the pricing could be better.

I rate Juniper SRX an eight out of ten.

Juniper is a highly flexible platform, and you get more bang for your buck compared to a Cisco product.

The centralized management platform could be improved.

Juniper devices are highly reliable. I haven't had to reboot some of these devices in five years. 

Juniper SRX firewalls are scalable. 

Compared to Cisco support, I would rate Juniper seven out of 10. It varies depending on who you get. 

Neutral

Setting up Juniper firewalls is straighforward if you have experience. You need some CLI experience. Configuring firewalls with a GUI is much easier than using the Juniper platform.

The deployment time depends on the size of the environment. I worked for a hospital system where we deployed a pair and used them as a firewall. It was relatively easy to deploy once we had a plan to bring the services in one by one as opposed to connecting the host of the hospital to us.

Juniper devices are more affordable than Cisco products. 

I rate Juniper SRX Series Firewalls nine out of 10. I recommend getting a centralized management solution because managing Juniper firewalls can be messy without it. 

We use Juniper SRX firewalls and site-to-site VPN connectivity.

Overall, in terms of uptime, they are very stable and reliable, which has benefited our organization.

The command line in Juniper SRX is extremely powerful, in my opinion. It's one of the best command lines I've used in networking products.

Both the web management and the graphical user interface are inadequate and should be improved. It's one of those situations. When it comes to Juniper, I would never use the GUI, instead, I would only use the command line.

I would like to see an improved user interface, and some kind of SD-WAN solution included, or perhaps a simpler way of configuring redundant links, such as WAN links.

I have been using Juniper SRX for 10 years.

We're working with the SRX240 and 210 models.

Juniper SRX is a very stable solution.

It should scale well, in my opinion. We are not a large company, but I don't anticipate any problems with Juniper SRX scalability.

We have approximately 300 employees, whose roles are in typical sales, accounting, operations, and transportation.

I'm not sure about increasing, but we do have other Juniper products, such as switches, that we would use.

Based on my experience with technical support, I would rate them a four out of five.

Positive

We have used other solutions. We decided to change to Juniper for something a little different. We have used some open-source firewalls in the past, and we wanted something a little more robust and fully supported in a real business class environment.

Coming from other vendors, the initial learning curve was a little steep. However, I would say that the actual setup was not that difficult.

I would rate the initial setup a three out of five.

I would recommend two people with networking knowledge, particularly in Juniper SRX, are enough to have it managed and supported.

One person could do it, but it helps to have a backup.

It only took a few weeks for them to all be deployed. It was really just a matter of timing and having a window for each location to have a little downtime to make the transition.

The deployment was completed in-house.

I would say that there has been a return on investment with Simply having the dependability, uptime, and additional security features.

Juniper SRX is reasonably priced.

We evaluated other products before choosing Juniper.

Other products had a more limited feature set, in my opinion. For some of the others, it was just the price. Juniper had a reasonable price and other reliable sources highly recommend it.

I believe that knowing exactly what you want to do is beneficial. There's a lot. It's a very flexible platform, and there's usually more than one way to accomplish your goals. Planning ahead of time is definitely beneficial. If you don't have a lot of experience, I'd recommend working with a partner if at all possible.

I would rate Juniper SRX an eight out of ten.

I use Juniper SRX Series Firewall for research purposes.

You can be very specific with what you can put in the solution. I can have the solution as my management interface. The ports are really versatile for their application and don't always have to be used for the purpose for which they were made.

When I was going to upgrade the OS, the solution didn't accept certain USB devices. So, I had to put in the OS using a trivial FTP server. Otherwise, the solution is really advanced. It's really hard to get a hold of the firmware for it. Even if you applied for customer support, getting to the software side is a little harder.

If you want to upgrade the OS, you have to do this by special pauses. You can't just upgrade from an old version to the newest one. You have to make middle landings.

I have been using Juniper SRX Series Firewall for two weeks.

Juniper SRX Series Firewall is a stable solution, but it depends on how you set it up. You can make the solution unstable if you want to, but it will be stable if you set it up correctly.

Juniper SRX Series Firewall is really scalable, but it depends on how you set up the network topology.

The solution's initial setup depends on what interface you use. If you use the J-Web, it's quite easy. If you do it by console, it isn't always clear what order you should be doing things on when you apply the settings. When you first come into the console, you might not know they're in the FreeBSD shell but not the Juniper OS.

The solution's deployment is actually ongoing. I had it up for once, but I upgraded it because it was a really old version of the OS. Currently, the biggest hurdle is that when you cross over to a new version, you have to occupy one port for management. In the previous version, I could select an in-line management instead of dedicated out-of-band management.

Now, I have to sacrifice one port for the management. It's not needed for my application, but now I am forced into having a management interface. I also noticed that several vulnerabilities have been discovered lately in the Juniper OS.

Juniper SRX Series Firewall is worth its money.

You should read all the release notes before you change the OS because you don't know what you're giving up and what new features you're getting. It's not always that the newest OS is the best for you. So, select the OS based on your specific deployment needs and not just to have the newest one.

Overall, I rate Juniper SRX Series Firewall an eight out of ten.

For different customers, we use the product in different ways. In some cases, it is going to be an on-premises solution. In some cases, it is going to be a cloud-integrated solution. That is one of the best things about Juniper. We can use a single box and have the same unified policy structure if it is off the cloud or it is on-premises.  

Our primary use case is basically to use it like you would any other firewall. I do not call this a firewall anymore because it has functionality beyond what we traditionally think of as a firewall. Those days are gone where a firewall does just one thing. Today most of the firewall products are station firewalls. You have various options in each firewall station. In terms of comparison, you can compare Juniper with Cisco, with Fortinet, with Palo Alto and other leading products. It depends on what exactly you are planning to have it do.  

The most valuable feature for me over-all is that Juniper is simplified and can still do everything that is necessary to be effective. 

On the SRX box, it has what I call a one model concept for security. I work especially with hybrid environments. With an SRX we have a single management dashboard. We can manage the internal framework easily with the centralized management component. You can work with the threat prevention, you can work with the integration, you can work with traffic management. Another good part about SRX is that you have opportunities for automation. Another thing that is very good is that all the operating systems for all Juniper boxes are the same. You do not work on different operating systems using different boxes. 

It does user validation automatically and has automated threat detection and defense. It does threat analytics, which is integrated. So as a single box, it does not just address security, it does not just handle switching, it does not just work as a firewall. It addresses everything.  

I have not given a lot of thought as to what needs to be improved because so much of technology and capabilities are expanding.  

Probably Juniper could come up with their own dedicated endpoint security. Today they have an integration with Sophos. If you really look at what SRX has as far as antivirus capability, it is really only the integration with Sophos. Sophos is good, I am not saying Sophos is a bad solution. But Juniper having their own antivirus solution may be a batter idea to make it a stand-alone product.  

If you look at Check Point. They have a lot of experience in the area of security which is integrated with their product. In comparison, Juniper could start developing its own strong capabilities with antivirus and have its own security which may even surpass relying on Sophos. Sophos could improve more but it is definitely a wonderful architecture.  

I have around 22 years of experience with various similar products. My experience for the last 10 years has been on Juniper. I have worked on Cisco, on Foundry, and on Xstream. And you can make comparisons with products like Fortinet and Palo Alto next-generation firewalls.  

I would rate stability on a scale of one to ten. If ten is best, I would rate a nine-point-five. I would not rate anything a ten in this industry in any case because nothing is perfect and there is always room for improvement. It is very robust. Because the product is robust and very agile that carries over well into the potential for reliability.  

When it comes to scalability, basically Juniper is modular. The SRX architecture is very important. Say I am a small-time customer with 50 people in my company and I deploy on the SRX 300 Series. If my business grows exponentially and I now have 500 people in the company. My traffic has boosted significantly — say about ten times what it was. I do not have to really worry. Within one hour, I can just switch and get a new SRX box in place. Let's say I go with the 500 Series or the 4000 Series. This is my new capacity.

The change over is so simple, because the architecture is common. Whether you talk about SRX 300 or you talk about the service provider architecture, it is the same thing except for the capability to expand and handle the volume. That is very important from a technical perspective, which normally you only need one tech person to deploy.  

For mid-sized companies or even large-sized companies, you have a lot of clients from SRX 300 to SRX 5000 Series and the product line covers all the options. This is from a very basic server-level SRX box to the Next-Generation Firewall and advanced threat mitigation.  

But one thing that scalability should really take into account is that Juniper is an enterprise product. If you are really only talking about using the Sophos UTM or only want to use the product like a firewall, then you should consider a UTM box. If you then want to add an SD-WAN as an additional part of the architecture, the UTM is not the right choice. You just take an SRX box and you have SD-WAN on that. You can have a firewall on that. You can have a UTM on that. You can integrate with the cloud. You can integrate with Linux infrastructure. You can have network security.  

Today when we talk about Check Point, we talk about Next-Generation Firewalls. That includes the Palo Alto Next-Generation Firewall and Cisco Next-Generation. But no one talks about what the definition of Next-Gen is. The only difference about Next-Generation is that it has a staple firewall, by definition.  

If you are a small company and you only have five in your office, obviously you want a secure network. To do this you will buy a simple firewall. When you think of the most simple firewall, people buy a router. Then people buy a switch. Then people buy a firewall. Three devices. I would say, do not buy anything. Just buy one SRX box, which does all the three.  

Now I can also expand the same SRX 300 with a branch location. Let's say, I'm a bank customer. I have branches. Simple, I can now have the simplest of SRX 300 at all my branches or SRX 500. I just connect to my main SRX, let's say a 1500 Series with an SD-WAN topology. The project is done. Simple. I secure my network. I handle my routing. I handle my security. And I have an option for just enabling the license to get the latest threat mitigation.  

For comparison, let's take a very big enterprise network. Maybe I was the head of Informatica at APAC. I am in a situation where I have 6000 R&D developers in the organization. We monitor our total performance. Latency on the firewall should be as low as possible. This is especially critical with the current environment where people work from home. Everyone who is working from home now because of COVID has all their data still in the office and people come onto the network to get connected from home to the office.  

Imagine the load on my firewall in that situation. All the people from inside my organization are sitting outside of the office now accessing the data in the internal network through the firewall. Imagine all the data tracking is coming from all over like an external traffic base. You need to have the proper solution to handle the change in traffic and scalability is the most important factor in this case for successfully running a demanding environment.  

Juniper support is very good. But more than the technical support, their documentation is awesome. You can just Google a solution right now by stating your problem. You get into the juniper.net and there is wonderful documentation. As a technical person, I have never seen any technical documentation that is as good. I would say it is awesome. Any person who has an interest to learn, who has the interest to scale his capability with the product, just has to go to the Juniper site and they will get all the information on every one of their products. I think that it is written well enough for a non-technical person to become technical.  

They have different levels of training available. They make it very easy and available for anybody to explore the solution. There are knowledgeable people available in the technical community. It is a very good solution overall.  

I consider the setup for the product to be very easy. A basic technical person can do it. But, a person would need to know the capability of a robust box like SRX to make full use of the capabilities and the right choice of the product.  

You install the box, configure the hostname, a password, and set your IP address. By default, Juniper handles the basic configurations automatically. The control frame architecture is very nice. The whole platform architecture is very good. When you work with that box, you just divide the box into two layers: the top layer and the bottom layer. The top layer is exclusively made for the SRX box. The bottom layer is nothing but throughput where the packets get in and get out. We call it a packet forwarding engine, PFE.  

Initiating the routing packets actually go in the mapping connection between the top and the bottom, which is managed as with Oracle in an internal zone. The box is already secured when an attack happens. Nothing is 100% in the world. So, there is the possibility of an attack but at least the control center protects your network.  

The entire installation is just a couple of hours. It depends on the Oracle sizing. Let's say that you want to work on the agility of SRX, something you really need to understand is where you are deploying this product. It is different if you are comparing an SRX box or the cloud. When you are using an SRX box will it be deployed for a small enterprise, a mid-size enterprise, and a data center. You can have SRX boxes for a large data center. That is a difference in the agility of Juniper SRX compared to Cisco. For example, when I work with the cloud, I have an SRX virtual firewall, which is a high-performance network security in the virtual cloud. It is especially good for rapid deployments. It hardly takes hours to deploy on the cloud.  

When you have a container with a firewall, it is known as cSRX. Which is again, a highly available container firewall. These are used especially for microservices. When you start with a small enterprise you start with either the SRX 300 series or a 500 series, which is a next-generation firewall. It is comparable to the Cisco ASA. Probably the next good product to compare is Check Point. But the SRX product is easier to manage and deploy when compared to Check Point or Cisco.  

For the mid-size enterprise organization, we have the SRX 1400 Series or you can consider the 4000 Series. It is just an appliance. You just plug it in, switch it on, configure the network IP address, and then start configuring the protocols. You enable the licenses there, malware prevention, and all the other features you want by just adding on to the licenses.  

So it is just a matter of choosing the right appliance and from there it is practically plug-and-play. The challenge is not the initial setup and deployment, it is what you make use of.  

The main competitors for Juniper are Palo Alto, Check Point, and Cisco. Juniper has a lot of features that are good for engineering. Things like Fortinet and Cyberoam can not really compete with these others when it comes to these important features. Specifically, when you talk about Juniper SRX you talk about cloud deployment. You talk about malware remediation. You talk about reporting analytics. You talk about quarantining or threat intelligence (Unified Threat Management or UTM). You talk about data throttle, control prevention, email, web analysis, and integrated management. It can even just work as a router or assisting layer. It works best especially in large networks — like when you talk about service providers — where you have huge traffic flow. It is built to have flexibility and ease-of-use.  

My advice to anyone considering Juniper as a solution would be to first understand that the product needs to be chosen to fit the environment. You want to get the one right box that has the capacity you need. You have everything you need in the model by just updating your license. You do not have to look for a new box when your traffic remains under the upper limits of the capacity. If you are under the limitations of the capacity, the traffic goes straight out, unimpeded.  

On a scale from one to ten where one is the worst and ten is the best, I would rate Juniper SRX as a nine or even a nine-point-five overall. Additional features that could be added to make this solution a ten that other competitors have would technically make it the best product. For example, Check Point offers Blade Architecture. You just keep adding more and more blades. Because of this, Check Point — especially in the area of their security database — they are quite superior to Juniper. o there is room for improvement.  

When you really study on an enterprise level where Check Point stands out or where Juniper stands out, you have got to look into the way each product fits your needs. I mean Check Point is currently easy-to-use, and very good, global product. It also has quite a good rating from the industry over the past few years. Certainly, someone considering a purchase needs to consider options and trends.  

Customers use the solution in a cluster configuration to secure the network.

The VPN feature is quite useful, as well as the IPS. The firewall is very good.

If we need to define our user system from an anti-spam perspective, we can constantly update the antivirus. We need a subscription for such updates. It helps improve our security generally.

The solution can scale.

It is stable and reliable.

It is reasonably priced.

It would be ideal if the solution could use cloud services to help update signatures or threat prevention systems. 

There might be limitations with the product, depending on the hardware we use. We need to ensure we choose the right hardware if we want more throughput. We'd like to have more control over certain parameters and over the hardware.

They could include some features that help prevent or fight DDoS attacks.

I've used the solution for more than five years. 

I'd rate the stability eight out of ten. It is stable enough. 

The solution is scalable. I'd rate the scalability seven out of ten. 

It depends on how big the project is and how many branch offices there are. We might need more devices if it is bigger. We'd also need to use templates for all branches so that it is configured uniformly. 

We tend to provide the solution for small and medium-sized companies. I've configured it for 30 or 40 clients. 

I haven't had any issues. I've only opened two or three tickets. It's a stable solution. I haven't used support too much. I'm able to solve issues myself mostly.

Sometimes there are delays in response or solving the issue.

Neutral

The initial setup is straightforward. I'd rate the process eight out of ten in terms of ease of implementation.

The deployment time depends on which features we use. Configuring the solution may take two to three hours; however, if more modifications are needed by the client, it may be longer. It depends on the technical requirements of the company.

Firstly, I needed to update the operating system. I checked the recommendations and prepared some configurations. 

The pricing is okay. It's moderate. I'd rate the pricing five out of ten. 

I'm more of a technical person, not in sales. I do not know the exact cost of the solution. I'm not sure if there are extra costs associated with the product beyond the licensing fees.

We're a Juniper partner.

I have used various versions of the solution, including the 300, 645, and 1500.

I'd recommend the solution to others.

I would rate the solution eight out of ten. It's a reliable solution. However, maybe, when we use the big box model, the pricing is reasonable.