SRX4300 Firewall Datasheet

SRX4300 delivers NGFW features that support the changing needs of cloud-enabled enterprise networks and data centers. Whether rolling out new services within an enterprise campus, connecting to the cloud seamlessly, complying with industry standards, or achieving operational efficiency, the SRX4300 empowers organizations to operationalize zero-trust principles at scale while realizing their business objectives. The SRX4300 protects critical corporate assets with features such as intrusion prevention system (IPS), follow-the-user and follow-the-application access policies, and Juniper’s AI-Predictive Threat Prevention. Furthermore, SRX4300 works with Juniper’s cloud security solutions to secure hybrid-cloud environments with networkwide visibility and control, providing consistently secure on-premises and cloud environments.

As network architectures become more distributed and decentralized, Juniper Networks SRX Series Firewalls ensure seamless integration with other Juniper and third-party networking platforms, and facilitate architectural transformation. At the same time, the NGFWs facilitate architectural transformation, taking organizations from on-premises to hybrid cloud environments seamlessly and cost effectively. SRX Series Firewalls are the first to implement industry-standard Ethernet VPN (EVPN)  type 5 and Virtual Extensible LAN (VXLAN)  protocols within data center environments, enabling the SRX4300 to act as a secure, fabric aware leaf in the data center spine-leaf architecture.

The SRX4300 participates in the industry-first Connected Security Distributed Services Architecture, enabling organizations to scale both horizontally and elastically, and it simplifies operational management of large-scale firewall networks. With this architecture, several SRX4300 platforms can work together as a single large logical firewall to provide security at higher performance and scale.

The SRX4300 is powered by Junos^® operating system, the OS that underpins and helps secure the world’s largest mission-critical enterprise and service provider networks. It is managed by Juniper Security Director Cloud, Juniper’s unified management experience that connects the organization’s current deployments with future architectural rollouts. Security Director Cloud uses a single policy framework enabling consistent security policies across any environment and expanding zero trust to all parts of the network from the edge into the data center. This provides unbroken visibility, policy configuration, administration, and collective threat intelligence all in one place.

The SRX4300 hardware and software architecture provides cost- effective security in a compact, scalable 1U form factor. Purpose- built to protect network environments and provide Internet Mix (IMIX) firewall throughput of up to 50 Gbps, the SRX4300 incorporates multiple security services and networking functions on top of Junos OS, providing highly customizable threat protection, automation, and integration capabilities. Best-in-class advanced security capabilities on the SRX4300 are offered as 45 Gbps of NGFW, 45 Gbps of IPS, and up to 30 Gbps of IPsec VPN in the data center, enterprise campus, and regional headquarters deployments with IMIX traffic patterns.

To increase trust and streamline operations, the SRX4300 features several built-in zero trust device capabilities, including an embedded Trusted Platform Module (TMP) 2.0 and cryptographically signed device ID. The SRX4300 supports RFC compliant Secure Zero Touch Provisioning (sZTP) to deploy products in your network efficiently, expediently, and remotely. Additionally, the SRX4300 supports MACsec at wire speed, ensuring data integrity, and confidentiality.

The SRX4300 is part of Juniper’s Connected Security Distributed Services Architecture which revolutionizes data center security. With Juniper’s Connected Security Distributed Services Architecture, firewall performance can scale horizontally by interconnecting traffic forwarding and security services across multiple geographic locations. Juniper’s solution also provides automated failover and backup nodes for both forwarding and inspection components. In addition to redundancy and load balancing, Juniper’s Connected Security Distributed Services Architecture simplifies how large-scale data center firewall networks are managed and operated. Regardless of how many firewall engines across the various form factors (physical, virtual, containerized) are added, they can all be managed as one logical unit. This centralized management eliminates the complexity that has been an unintended consequence of a traditional scale-out approach.

• Stateful firewall services
• Zone-based firewall
• Screens and distributed denial of service (DDoS) protection
• Protection from protocol and traffic anomalies
• Unified Access Control (UAC)
• Integration with Juniper Mist^™ Access Assurance

• Carrier-grade Network Address Translation (Large-scale NAT)
• IPv4 and IPv6 address translation NAT44, NAPT44, NAT66, NAPT66, NAT64, NAT46
• Static and dynamic 1-1 translation
• Source NAT with Port Address Translation (PAT)
• Destination NAT with Port Address Translation (PAT)
• Persistent NAT (EIM/EIF)
• Port Block Allocation (PBA)
• Deterministic NAT (DetNAT)
• Port overload
• Twice-NAT44
• DS-lite and Port Control Protocol (PCP)

• Tunnels: Site-to-site, hub and spoke, dynamic endpoint, AutoVPN, ADVPN, Group VPN (IPv4/ IPv6/Dual Stack)
• Juniper Secure Connect: Remote access/SSL VPN
• Configuration payload: Yes
• IKE encryption algorithms: Prime, 3DES-CBC, AEC-CBC, AES-GCM, Suite B
• Authentication: Pre-shared key and public key infrastructure (PKI) (X.509)
• IPsec: Authentication Header (AH) / Encapsulating Security Payload (ESP) protocol
• IPsec authentication algorithms: hmac-md5, hmac-sha-196, hmac-sha-256
• IPsec encryption algorithms: Prime, DES-CBC, 3DES-CBC, AEC-CBC, AES-GCM, Suite B
• Perfect forward secrecy, anti-replay
• Internet Key Exchange: IKEv1, IKEv2
• Monitoring: Standard-based dead peer detection (DPD) support, VPN monitoring
• VPNs GRE, IP-in-IP, and MPLS

• Virtual Router Redundancy Protocol (VRRP): IPv4 and IPv6
• Stateful high availability: Dual box clustering
  • Active/passive
  • Active/active
  • Configuration synchronization
  • Firewall session synchronization
  • Device/link detection
  • In-Service Software Upgrade (ISSU)
  • IP monitoring with route and interface failover
  • BFD monitoring 
• Chassis cluster HA and Multinode HA (MNHA)

• Application visibility and control
• Application QoS
• Advanced/application policy-based routing (APBR)
• Application Quality of Experience (AppQoE)
• Application-based multipath routing
• User-based firewall

• Intrusion prevention system
• AI-Predictive Threat Prevention
• Antivirus
• Antispam
• Category/reputation-based URL filtering
• SSL proxy/inspection
• Protection from botnets (command and control)
• Adaptive enforcement based on GeoIP
• Juniper Advanced Threat Prevention, a cloud-based SaaS offering, to detect and block zero-day attacks
• Adaptive Threat Profiling
• Encrypted Traffic Insights
• SecIntel threat intelligence
• Juniper ATP virtual appliance, a distributed, on-premises advanced threat prevention solution to detect and block zero-day attacks

• IPv4, IPv6, static routes, RIP v1/v2
• OSPF/OSPF v3
• BGP with route reflector
• IS-IS
• Multicast: Internet Group Management Protocol (IGMP) v1/v2; Protocol Independent Multicast (PIM) sparse mode (SM)/ source-specific multicast (SSM); Session Description Protocol (SDP); Distance Vector Multicast Routing Protocol (DVMRP); Multicast Source Discovery Protocol (MSDP); reverse path forwarding (RPF)
• Encapsulation: VLAN, Point-to-Point Protocol over Ethernet (PPPoE)
• Virtual routers
• Policy-based routing, source-based routing
• EVPN-VXLAN (EVPN Type 5 route)
• Equal-cost multipath (ECMP)

• Support for 802.1p, DiffServ code point (DSCP), EXP
• Classification based on VLAN, data-link connection identifier (DLCI), interface, bundles, or multifield filters
• Marking, policing, and shaping
• Classification and scheduling
• Weighted random early detection (WRED) Guaranteed and maximum bandwidth
• Ingress traffic policing
• Virtual channels

• Dynamic Host Configuration Protocol (DHCP) client/server/ relay
• Domain Name System (DNS) proxy, dynamic DNS (DDNS)
• Juniper real-time performance monitoring (RPM) and IP monitoring
• Juniper flow monitoring (J-Flow)
  

• MPLS (RSVP, LDP)
  
• Circuit cross-connect (CCC), translational cross-connect (TCC)
• L2/L2 MPLS VPN, pseudo-wires
• Virtual private LAN service (VPLS), next-generation multicast VPN (NG-MVPN))
• MPLS traffic engineering and MPLS fast re-route

• SSH, Telnet, SNMP-MIBs, Traps
• Smart image download
• Juniper CLI and Web UI, NetCONF, XML APIs, RMON
• Juniper Networks Security Director Cloud
• Python
• Junos events, commit and OP scripts
• Application and bandwidth usage reporting
• Debug and troubleshooting tools

Juniper Networks is the leader in performance-enabling services designed to accelerate, extend, and optimize your high-performance network. Our services allow you to maximize operational efficiency while reducing costs and minimizing risk, achieving a faster time to value. Juniper Networks ensures operational excellence by optimizing the network to maintain required levels of performance, reliability, and availability. For more details, please visit https://www.juniper.net/us/en/products.html.

To order Juniper Networks SRX Series Firewalls, and to access software licensing information, please visit the How to Buy page at https://www.juniper.net/us/en/how-to-buy/form.html.

At Juniper Networks, we are dedicated to dramatically simplifying network operations and driving superior experiences for end users. Our solutions deliver industry-leading insight, automation, security and AI to drive real business results. We believe that powering connections will bring us closer together while empowering us all to solve the world’s greatest challenges of well-being, sustainability and equality.

Statement of Product Direction

The information on this page may contain Juniper's development and plans for future products, features, or enhancements (“SOPD Information”). SOPD Information is subject to change at any time, without notice. Juniper provides no assurances, and assumes no responsibility, that future products, features, or enhancements will be introduced. In no event should any purchase decision be based upon reliance of timeframes or specifics outlined as part of SOPD Information, because Juniper may delay or never introduce the future products, features, or enhancements.

Any SOPD Information within, or referenced or obtained from, this website by any person does not give rise to any reliance claim, or any estoppel, against Juniper in connection with, or arising out of, any representations set forth in the SOPD Information.  Juniper is not liable for any loss or damage (howsoever incurred) by any person in connection with, or arising out of, any representations set forth in the SOPD Information.

1000779 - 003 - EN DECEMBER 2023