SRX SERIES 서비스 게이트웨이 · 필수적인연결,보안,관리기능들을 공합니다. 하나의장비에빠르고가용성높은 스위칭 ,라우팅,보안애플리케이션

DATASHEET

1

제품 설명 주니퍼네트웍스SRXSeries서비스게이트웨이브랜치용은주니퍼네트웍스SRXSeries하이엔드용,EXSeries이더넷스위치,MSeries멀티서비스에지라우터,MXSeries이더넷서비스라우터,TSeries코어라우터와함께주니퍼네트웍스의단일운영시스템인JunosOS를기반으로뛰어난확장성을제공하는포트폴리오를구성합니다.JunosOS를통해기업과통신사업자들은분산된조직전반에대한구축및운영비용을절감할수있습니다.

• SRXSeries브랜치용은JunosOS소프트웨어를탑재하고있습니다.JunosOS는전세계100대통신사업자들의네트워크에서코어인터넷라우터에탑재되어사용되고있습니다.JunosOS의IPv4/IPv6,OSPF,BGP,멀티캐스트등캐리어급라우팅기능들은10년이상전세계현장에서검증되어왔습니다.

• SRXSeries서비스게이트웨이브랜치용은네트워크경계보안,컨텐트보안,접근제어,네트워크전반의위협에대한가시성및제어기능을제공합니다.동급최강의방화벽과VPN기술들은최소한의설정만으로도일관된성능으로네트워크경계에대한보안을보장합니다.보안존과정책들을사용함으로써새로운네트워크관리자들도SRXSeries브랜치용을빠르고안전하게설정하고구축할수있습니다.정책기반VPN은다이나믹어드레싱(dynamicaddressing)과분할터널링(splittunneling)이요구되는보다복잡한보안아키텍처들을지원할수있습니다.컨텐트보안을위해SRXSeries브랜치용은IPS,안티바이러스,안티스팸,웹필터링,데이터손실방지등을포함한종합적인UTM(UnifiedThreatManagement)서비스를제공합니다.컨텐트필터링을통한이러한위협관리는나날이진화하는컨텐트내재형위협들로부터네트워크를보호합니다.선택사양으로하이퍼포먼스IPS와안티바이러스성능을위한ContentSecurity

Accelerator기능을제공합니다.브랜치용SRX시리즈는다른주니퍼보안제품들과통합되어엔터프라이즈전반에대한일원화된접근제어(UAC:unifiedaccesscontrol)와능동적위협관리

(adaptivethreatmanagement)를제공합니다.이러한기능들은보안전문가들에게사이버범죄및데이터손실에대응할수있는강력한도구를제공합니다.

• SRXSeries브랜치용은전세계수천곳의사이트에네트워크를구축해야하는기업들에게하이퍼포먼스의검증된구축기능들을제공합니다.다양한옵션들은수십에서수천명에이르기까지이용자규모에맞게성능,기능,가격대를설정할수있도록해줍니다.조직의여러사이트들을안전하게연결하기위한WAN또는인터넷연결옵션으로이더넷,시리얼,T1/E1,xDSL,메트로이더넷,3G셀룰러무선옵션을모두사용할수있습니다.SRXSeries는또한여러가지외형으로제공되기때문에미션-크리티컬한구축들을위한비용대비효과적인모델을선택할수있습니다.네트워크관리는검증된JunosOSCLI(command-lineinterface)와스크립팅기능들,또는간단한웹기반GUI를통해간편하게수행할수있습니다.

제품 소개

주니퍼네트웍스SRXSeries서비스게이트웨이브랜치용은수십에서수백명의이용자를보유한지점들을위한필수적인연결,보안,관리기능들을제공합니다.

하나의장비에빠르고가용성높은스위칭,라우팅,보안,애플리케이션기능들을통합함으로써기업환경에서새로운서비스들과안전한연결성을경제적으로제공할수있으며,이용자들의만족스러운경험을보장할수있습니다.브랜치,캠퍼스,데이터센터애플리케이션을위한모든SRXSeries서비스게이트웨이들은주니퍼네트웍스JunosOS를탑재하고있습니다.

JunosOS는다양한장비와기능들전반에서일관성을보장하는동시에뛰어난성능과서비스,강력한인프라스트럭처보안을실현합니다.아울러TCO절감을실현합니다.

SRXSERIES서비스게이트웨이:브랜치용SRX100,SRX210,SRX240SRX650

2

아키텍처 및 주요 구성요소

브랜치SRXSeries제품들의주요하드웨어사양

제품 설명

SRX100서비스게이트웨이

• 8개의10/100이더넷LAN포트

• 종합적인UTM2;안티바이러스2,안티스팸2,웹필터링2,IPS2(하이메모리버전)

• UnifiedAccessControl(UAC)및컨텐트필터링

• 1GB8DRAM,1GB플래쉬디폴트(로우메모리버전에서512MBDRAM가능)


• 2개의10/100/1000이더넷및6개의10/100이더넷LAN포트,1Mini-PIM슬롯,1ExpressCard슬롯및2USB포트

• 4개의다이나믹PoE(PoweroverEthernet)포트802.3af팩토리옵션

• T1/E1,시리얼,ADSL/2/2+,이더넷SFP(smallform-factorpluggabletransceiver)및기가빗이더넷인터페이스지원

• IPS및ExpressAV의빠른성능을위한ContentSecurityAccelerator하드웨어



• 512MBDRAM디폴트,1GBDRAM팩토리옵션,1GB플래쉬디폴트


• 16개10/1000/1000이더넷LAN포트,4개Mini-PIM슬롯

• 16개PoE포트팩토리옵션;PoE+803.3at,백워드호환802.3af

• T1/E1,시리얼,ADSL2/2+,이더넷SFP(smallform-factorpluggabletransceiver)및기가빗이더넷인터페이스지원




• 512MBRAM디폴트,1GBDRAM팩토리옵션,1GB플래쉬디폴트


• 4개고정포트10/100/1000이더넷LAN포트,8개GPIM(GigabitEthernet-backplanePhysicalInterfaceModule)슬롯

• T1,E1,기가빗이더넷LAN포트지원;최대48포트스위칭지원및802.3at,PoE+,백워드호환802.3af포함PoE옵션




• 모듈형서비스및라우팅엔진;향후내부페일오버및핫스왑

• 2GBDRAM디폴트,2GB컴팩트플래쉬디폴트,추가스토리지를위한외장컴팩트플래쉬슬롯

• AC전원이중화옵션;표준AC전원(PoE지원,PoE전력최대250와트이중화,또는500와트비-이중화)

네트워크 구축

SRXSeries서비스게이트웨이브랜치용은원격지네트워크및브랜치로케이션에구축되어올-인-원으로보안기능이포함된WAN연결,IP텔레포니,통합된이더넷스위칭을통한로컬PC및서버들과의연결을제공합니다.

기능 및 이점

보안 라우팅

네트워크보안을위해반드시라우터와방화벽을모두사용해야할까요?동급최강의라우팅및방화벽기능을하나의제품으로통합한SRXSeries를구축한다면그럴필요가없습니다.적절하지않은트래픽까지전부다포워딩할필요가있을까요?SRXSeries브랜치용은트래픽이적절한지아닌지를검사하고,적절한트래픽만을포워딩합니다.이렇게함으로써네트워크부하를감소시키고,중요한애플리케이션들에대역폭을할당할수있습니다.또한해킹으로부터네트워크를보호할수있습니다.

보안라우터의주목적은방화벽기능과정책적용을제공하는것입니다.방화벽(존)기능은트래픽플로우와상태를검사하여특정존에대해세션내의오리진및리턴정보가일치하는지확인하고허용되도록보장합니다.보안정책은해당세션이어떤존내에서만들어져다른존으로이동할수있는지를결정합니다.이러한아키텍처는다양한종류의클라이언트및서버들로부터패킷들을수신하여모든세션,모든애플리케이션,

모든이용자들을추적합니다.이렇게함으로써허용된트래픽만이자사네트워크에진입하고,허용된트래픽이목적하는방향으로전송되도록보장할수있습니다.

그림1:방화벽,존,정책

“Untrust” Zone

“Trust” Zone

“Guest” Zone

“DMZ” Zone

Intranet

INTERNET

3

그림2:고가용성

방화벽설정을간소화하기위해SRXSeries브랜치용은“존(zones)”과“정책”두가지기능을사용합니다.이것들은사용자가설정할수있으며,디폴트설정에는최소한의트러스트존(trustzone)및언트러스트존

(untrustzone)이포함되어있습니다.트러스트존은브랜치용SRX

Series에LAN을연결하는데사용됩니다.언트러스트존은WAN또는인터넷인터페이스를위해사용됩니다.설치및설정을간소화하기위해디폴트정책이적용되어있어서트러스트존에서언트러스트존으로이동하는트래픽을허용해줍니다.

이정책은언트러스트존에서트러스트존으로이동하는모든트래픽을차단합니다.전통적인라우터는방화벽(세션인식)또는정책(세션의소스및목적지)의개념이없으므로모든트래픽을포워딩합니다.

웹인터페이스또는CLI를사용하여엔터프라이즈는일련의보안정책들을만들수있습니다.이러한보안정책들은존내부와각기다른존들사이를이동하는트래픽을제어합니다.가장넓게는보안존내의모든소스에서나오는모든종류의트래픽이다른존들의어떤목적지로든시간제한없이전송될수있습니다.가장좁게는제한된시간동안한존내부의특정호스트와다른존의특정호스트사이에서오직한종류의트래픽만이동할수있도록허용하는정책들을만들수있습니다.

고가용성 (High Availability)JunosOSServicesRedundancyProtocol(JSRP)은SRXSeries브랜치용의핵심기능입니다.JSRP은두대의보안시스템들이하나의고가용성네트워크아키텍처로쉽게통합될수있도록해줍니다.시스템들과인접한스위치들은이중화된물리적링크로연결됩니다.링크이중화를통해주니퍼네트웍스는물리적포트에결함이발생하거나,케이블이빠지는것과같은흔히발생하는시스템오류원인들에대처합니다.하나의연결이언제든지유지되도록보장함으로써전체시스템중단을방지합니다.이는라우팅복원프로토콜들의일반적인액티브/스탠바이특징과일치합니다.

SRXSeries서비스게이트웨이브랜치용이액티브/액티브페어로설정되었을경우,오류발생시트래픽과설정은자동적으로미러링되어액티브방화벽및VPN세션유지를제공합니다.브랜치용SRXSeries는설정과런타임정보모두를일치시킵니다.그결과페일오버중에도연결/세션상태및플로우정보,IPsecSA(securityassociations),

NAT트래픽,어드레스북정보,설정변경및기타정보들이공유됩니다.

VRRP(VirtualRouterRedundancyProtocol)와같은일반적인라우터액티브/스탠바이복원프로토콜(resiliencyprotocols)들은모든다이나믹플로우및세션정보는손실되고페일오버발생시반드시재생성되어야합니다.일부또는모든애플리케이션세션들은링크나노드의

StandbySRX240SRX240

Active

High AvailabilityActive/Standby

EX Series EX Series

INTERNET

FailureSRX240SRX240

Active

Active/Standby

EX Series EX Series

INTERNET

SRX240SRX240Active Active

Active/Active

EX Series EX Series

INTERNET

FailureSRX240SRX240

Active

Active/Active

EX Series EX Series

INTERNET

4

ConvergenceTime에따라재시작됩니다.상태를유지함으로써세션이보존될뿐만아니라보안역시그대로유지됩니다.불안정한네트워크에서는이러한액티브/액티브설정이링크변동으로인해세션성능에미치는영향을최소화합니다.

성능 저하 없는 세션 기반 포워딩

통합된라우터와방화벽의처리량과지연시간을최적화하기위해Junos

OS는세션기반포워딩을사용합니다.세션기반포워딩은전통적인방화벽의세션상태정보와전통적인라우터의넥스트-홉(next-hop)포워딩을단일처리로통합한혁신적인기술입니다.JunosOS를사용하면포워딩정책에의해승인된세션은다음단계루트로의포인터와함께포워딩테이블에추가됩니다.

이미생성된세션의트래픽은허용된세션인지의여부와다음단계(next-

hop)루트를찾기위해단한번의세션테이블검사만으로처리가됩니다.이러한효율적인알고리듬은세션정보검증과루트탐색을위한다수의테이블을보유한전통적인라우터에비해세션기반트래픽에대한처리량을향상시키고지연시간을줄입니다.

그림3은세션기반포워딩알고리듬을보여줍니다.새로운세션이생성되었을때,JunosOS를사용하는세션기반아키텍처는해당세션이정책들에의해승인되는지를검증합니다.

세션이승인되는경우,JunosOS는라우팅테이블에서다음단계(next-

hop)루트를탐색합니다.그리고해당세션과다음단계루트를세션과포워딩테이블에기록하고패킷을전송합니다.이미전송된세션에뒤이어처리되는패킷들은세션과포워딩테이블을이용한단한번의테이블검사를통해서출구(egress)인터페이스로전송됩니다.

그림3:세션기반포워딩알고리듬

Security Policy Evaluationand Next-Hop Lookup

Forwarding forPermitted Tra�c

IngressInterface

Session InitialPacket Processing

TableUpdate

Disallowed byPolicy: Dropped

EgressInterface

Session andForwarding Table

PSTN

Service ProviderSIP So�switch

Service ProviderSIP So�switch

PSTN

SRX210

SRX240

POPPOPPOP

Cle

ar

cha

nn

el T

-1D

ata

(B

8Z

S)

Ch

an

ne

lize

d T

-1V

oic

e (

AM

I)

PBX

EX4200 EX4200

LARGE OFFICE

HEAD QUARTERS BRANCH BRANCH

EX4200/EX2200 EX3200/EX2200

Fax Fax

EX3200/EX2200

FIXED MOBILE SITE(Mobile – 3G)

SMALL OFFICE

Cellular Wireless

DSL

MobileSRX210SRX210

INTERNET

SRX650

SRX240

그림4:DistributedEnterprise

5

SRX100 SRX210

SRX240

Specifications

Protocols• IPv4,IPv6,ISOConnectionlessNetworkService(CLNS)

Routing and Multicast• Staticroutes• RIPv2• OSPF• BGP• BGPRouterReflector1

• IS-IS• Multicast((InternetGroupManagementProtocol(IGMPv3),

PIM,SessionDescriptionProtocol(SDP),DistanceVectorMulticastRoutingProtocol(DVMRP),source-specific))7

• MPLS4

IP Address Management• Static• DynamicHostConfigurationProtocol(DHCP)(clientandserver)• DHCPrelay

Encapsulations• Ethernet(MACandtagged)• Point-to-PointProtocol(PPP)(synchronous)

–MultilinkPoint-to-PointProtocol(MLPPP)• FrameRelay

–MultilinkFrameRelay(MLFR)(FRF.15,FRF.16)• High-LevelDataLinkControl(HDLC)• Serial(RS-232,RS-449,X.21,V.35,EIA-530)• 802.1qVLANsupport• Point-to-PointProtocoloverEthernet(PPPoE)

Traffic Management• Marking,policing,andshaping• Class-basedqueuingwithprioritization• Weightedrandomearlydetection(WRED)• QueuingbasedonVLAN,data-linkconnectionidentifier(DLCI),

interface,bundles,orfilters

Security• Firewall,zones,screens,policies• Statefulfirewall,ACLfilters• Denialofservice(DoS)anddistributeddenialofservice(DDoS)

protection(anomaly-based)• Preventreplayattack;Anti-Replay• UnifiedAccessControl• UTM2(SRX650andhighmemoryversionsofSRX240,SRX210,

andSRX100only)–Antivirus2,antispam2,Webfiltering2,IPS2

–ContentSecurityAcceleratorinSRX210highmemory,SRX240highmemory,andSRX6502

–ExpressAVoptioninSRX210highmemory,SRX240highmemory,andSRX6502

–Contentfiltering

VPN • Tunnels(genericroutingencapsulation,IP-in-IP,IPsec)• IPsec,DataEncryptionStandard(DES)(56-bit),tripleData

EncryptionStandard(3DES)(168-bit),AdvancedEncryptionStandard(AES)(256-bit)encryption

• MessageDigest5(MD5)andSHA-1authentication• AccessManager:DynamicVPNClient.Browserbasedremote

accessfeaturerequiringalicense.

Voice Transport• FRF.12• Linkfragmentationandinterleaving(LFI)• CompressedReal-TimeTransportProtocol(CRTP)

High Availability• VRRP• StatefulfailoveranddualboxclusteringviaJSRP3• SRX650:

–Redundantpower(optional)–FutureGPIMhotswap(onlineinsertionandremoval,OIR)–FutureinternalfailoverandSREhotswap(OIR)

• Backuplinkvia3GwirelessorotherWAN

SRX650

6

IPv64

• OSPFv3• IPv6MulticastListenerDiscovery(MLD)• BGP• Qualityofservice(QoS)

Wireless• CX111CellularBroadbandDataBridgesupportedonallbranch

SRXSeriesdevices• 3GExpressCardssupportedonSRX210withbuilt-in

ExpressCardslot• AX411WirelessLAN(WLAN)AccessPointsupportedonall10

branchSRXSeriesdevices

SLA and Measurement• Real-timeperformancemonitoring(RPM)• Sessions,packets,andbandwidthusage• J-Flowflowmonitoringandaccountingservices

Logging and Monitoring• Syslog• Traceroute

Administration• JuniperNetworksNetworkandSecurityManagersupport• JuniperNetworksSTRMSeriesSecurityThreatResponse

Managerssupport• JuniperNetworksAdvancedInsightSolutionssupport• Externaladministratordatabase(RADIUS,LDAP,SecureID)• Autoconfiguration• Configurationrollback• Rescueconfigurationwithbutton• Commitconfirmforchanges• Autorecordfordiagnostics• Softwareupgrades• J-Web

Product ComparisonSRX100 SRX210 SRX240 SRX650

Maximum Performance and Capacity

JunosOSversiontested JunosOS10.0 JunosOS10.0 JunosOS10.0 JunosOS10.0

Firewallperformance(largepackets) 650Mbps 750Mbps 1.5Gbps 7Gbps

Firewallperformance(IMIX) 200Mbps 250Mbps 500Mbps 2.5Gbps

Firewall+routingPPS(64Byte) 75Kpps 80Kpps 200Kpps 900Kpps

AES256+SHA-1/3DES+SHA-1VPNperformance 65Mbps 75Mbps 250Mbps 1.5Gbps

IPsecVPNTunnels 128 256 1,000 3,000

IPS(intrusionpreventionsystem) 60Mbps 80Mbps 250Mbps 900Mbps

Antivirus 25Mbps 30Mbps 85Mbps 350Mbps

Connectionspersecond 2,000 2,000 9,000 30,000

MaximumconcurrentsessionsDRAMoptions

16K/32K5

512MB8/1GBDRAM

32K/64K5

512MB/1GBDRAM64K/128K5

512MB/1GBDRAM512K6

2GBDRAM

Maximumsecuritypolicies 384 512 4,096 8,192

Maximumuserssupported Unrestricted Unrestricted Unrestricted Unrestricted

Network Connectivity

FixedI/O 8x10/100 2x10/100/1000BASE-T+6x10/100

16x10/100/1000BASE-T 4x10/100/1000BASE-T

I/Oslots N/A 1xSRXSeriesMini-PIM 4xSRXSeriesMini-PIM 8xGPIMormultipleGPIMandXPIMcombinations

ServicesandRoutingEngineslots N/A N/A N/A 23

ExpressCardslot(3GWAN) No Yes No No

WAN/LANinterfaceoptions N/A Seeorderinginformation Seeorderinginformation Seeorderinginformation

OptionalmaximumnumberofPoEports N/A Upto4portsof

802.3afwithmaximum50W

Upto16portsof

802.3af/atwithmaximum150W

Upto48portsof

802.3af/atwithmaximum247W

USB 1 2 2 2perSRE

Routing

BGPinstances 5 10 20 64

BGPpeers 8 16 32 256

BGProutes 4K/8K5 8K/16K5 32K/64K5 1M6

OSPFinstances 4 10 20 64

OSPFroutes 4K/8K5 8K/16K5 32K/64K5 1M6

RIPv1/v2instances 4 10 20 64

RIPv2routes 4K/8K5 8K/16K5 32K/64K5 1M6

Staticroutes 4K/8K5 8K/16K5 32K/64K5 1M6

Specifications (continued)

7

SRX100 SRX210 SRX240 SRX650

Routing (continued)

Source-basedrouting Yes Yes Yes Yes

Policy-basedrouting Yes Yes Yes Yes

Equal-costmultipath(ECMP) Yes Yes Yes Yes

Reversepathforwarding(RPF) Yes Yes Yes Yes

MPLS4

Layer2VPN(VPLS) Yes Yes Yes Yes

Layer3VPN Yes Yes Yes Yes

LDP Yes Yes Yes Yes

RSVP Yes Yes Yes Yes

CircuitCross-connect(CCC) Yes Yes Yes Yes

TranslationalCross-connect(TCC) Yes Yes Yes Yes

Multicast7

IGMP(v1,v2,v3) Yes Yes Yes Yes

Protocolindependentmulticast(PIM)sparsemode(SM)

Yes Yes Yes Yes

PIMdensemode(DM) Yes Yes Yes Yes

PIMsource-specificmulticast(SSM) Yes Yes Yes Yes

MulticastinsideIPsectunnel Yes Yes Yes Yes

IPsec VPN

ConcurrentVPNtunnels 128 256 1,000 3,000

Tunnelinterfaces 10 64 128 512

DES(56-bit),3DES(168-bit)andAES(256-bit) Yes Yes Yes Yes

MD-5andSHA-1authentication Yes Yes Yes Yes

Manualkey,InternetKeyExchange(IKE),publickeyinfrastructure(PKI)(X.509)

Yes Yes Yes Yes

Perfectforwardsecrecy(DHGroups) 1,2,5 1,2,5 1,2,5 1,2,5

Preventreplayattack Yes Yes Yes Yes

DynamicremoteaccessVPN Yes Yes Yes No

IPsecNATtraversal Yes Yes Yes Yes

RedundantVPNgateways Yes Yes Yes Yes

User Authentication and Access Control

Third-partyuserauthentication RADIUS,RSASecureID,LDAP

RADIUS,RSASecureID,LDAP



RADIUSaccounting Yes Yes Yes Yes

XAUTHVPN,Web-based,802.Xauthentication Yes Yes Yes Yes

PKIcertificaterequests(PKCS7andPKCS10) Yes Yes Yes Yes

CertificateAuthoritiessupported VeriSign,Entrust,Microsoft,RSAKeon,iPLanet,(Netscape),Baltimore,DoDPKI

VeriSign,Entrust,Microsoft,RSAKeon,iPLanet,(Netscape),Baltimore,DoDPKI



Virtualization

Maximumnumberofsecurityzones 10 12 32 128

Maximumnumberofvirtualrouters 3 10 20 60

MaximumnumberofVLANs 16 64 512 4,096

Encapsulations

PPP/MLPPP N/A Yes Yes Yes

MLPPPmaximumphysicalinterfaces N/A 1 4 12

FrameRelay N/A Yes Yes Yes

MLFR(FRF.15,FRF.16) N/A Yes Yes Yes

MLFRmaximumphysicalinterfaces N/A 1 4 12

HDLC N/A Yes Yes Yes

Address Translation

SourceNATwithPortAddressTranslation(PAT) Yes Yes Yes Yes

StaticNAT Yes Yes Yes Yes

DestinationNATwithPAT Yes Yes Yes Yes

8


IP Address Assignment

Static Yes Yes Yes Yes

DHCP,PPPoEclient Yes Yes Yes Yes

InternalDHCPserver Yes Yes Yes Yes

DHCPrelay Yes Yes Yes Yes

L2 Switching

VLAN802.1Q Yes Yes Yes Yes

LinkAggregation802.3ad/LACP Yes Yes Yes Yes

JumboFrame(9216Byte) No Yes Yes Yes

SpanningTreeProtocol(STP)802.1D,RSTP802.1w,MSTP802.1s

Yes Yes Yes Yes

Authentication802.1xPortbasedandmultiplesupplicant

Yes Yes Yes Yes

Traffic Management Quality of Service (QoS)

Guaranteedbandwidth Yes Yes Yes Yes

Maximumbandwidth Yes Yes Yes Yes

Ingresstrafficpolicing Yes Yes Yes Yes

Priority-bandwidthutilization Yes Yes Yes Yes

DiffServmarking Yes Yes Yes Yes

High Availability

Active/active—L3mode Yes Yes Yes3 Yes3

Active/passive—L3mode Yes Yes Yes3 Yes3

Configurationsynchronization Yes Yes Yes3 Yes3

VRRP Yes Yes Yes Yes

SessionsynchronizationforfirewallandVPN Yes Yes Yes3 Yes3

Sessionfailoverforroutingchange Yes Yes Yes3 Yes3

Devicefailuredetection Yes Yes Yes3 Yes3

Linkfailuredetection Yes Yes Yes3 Yes3

Firewall

Networkattackdetection Yes Yes Yes Yes

DoSandDDosprotection Yes Yes Yes Yes

TCPreassemblyforfragmentedpacketprotection Yes Yes Yes Yes

Bruteforceattackmitigation Yes Yes Yes Yes

SYNcookieprotection Yes Yes Yes Yes

Zone-basedIPspoofing Yes Yes Yes Yes

Malformedpacketprotection Yes Yes Yes Yes

Unified Threat Management2

IntrusionPreventionSystem(IPS) Yes9 Yes Yes Yes

Protocolanomalydetection Yes9 Yes Yes Yes

Statefulprotocolsignatures Yes9 Yes Yes Yes

Intrusionpreventionsystem(IPS)attackpatternobfuscation

Yes9 Yes Yes Yes

Customersignaturescreation Yes9 Yes Yes Yes

Frequencyofupdates Dailyandemergency9 Dailyandemergency Dailyandemergency Dailyandemergency

Antivirus

ExpressAV(packet-basedAV) No Yes Yes Yes

File-basedantivirus Yes Yes Yes Yes

Signaturedatabase Yes Yes Yes Yes

Protocolsscanned POP3,HTTP,SMTP,IMAP,FTP

POP3,HTTP,SMTP,IMAP,FTP



Antispyware Yes Yes Yes Yes

Anti-adware Yes Yes Yes Yes

Antikeylogger Yes Yes Yes Yes

Antispam Yes Yes Yes Yes

9


Unified Threat Management2 (continued)

IntegratedWebfiltering Yes Yes Yes Yes

RedirectWebfiltering Yes Yes Yes Yes

Contentfiltering Yes Yes Yes Yes

BasedonMIMEtype,fileextension,andprotocolcommands

Yes Yes Yes Yes

System Management

WebUI Yes Yes Yes Yes

Command-lineinterface Yes Yes Yes Yes

NetworkandSecurityManager Yes Yes Yes Yes

STRMSeries Yes Yes Yes Yes

Wireless

CX1113GBridgesupport Yes Yes Yes Yes

Internal3GExpressCardslotsupport No Yes No No

MaxWLANaccesspointsupported 210 4 8 16

Flash and Memory

Memoryminimumandmaximum(DRAM) 512MB(Accessible),1GB8

512MB,1GB 512MB,1GB 2GB

Memoryslots Fixedmemory Fixedmemory Fixedmemory 4DIMM

Flashmemory 1GB 1GB 1GB 2GBCFinternalonSRE,Externalslotempty,upto2GBCFsupported

USBportforexternalstorage Yes Yes Yes Yes

Dimensions and Power

Dimensions(WxHxD) 8.5x1.4x5.8in

(21.6x3.6x14.7cm)

11.1x1.75x7.1in

(27.9x4.1x18.0cm)

17.5x1.75x15.1in

(44.4x4.4x38.5cm)

17.5x3.5x18.2in

(44.4x8.8x46.2cm)

Weight(deviceandpowersupply) 2.5lb(1.1kg) 3.3lb(1.5kg)Non-PoE/4.4lb(2kg)PoE

Nointerfacemodules

11.2lb(5.1kg)Non-PoE/12.3lb(5.6kg)PoE

Nointerfacemodules

24.9lb(11.3kg)

Nointerfacemodules

1powersupply

Rackmountable Yes,1RU Yes,1RU Yes,1RU Yes,2RU

Powersupply(AC) 100-240VAC,30W 100–240VAC,60WNon-PoE/150WPoE

100–240VAC,150WNon-PoE/350WPoE

100–240VAC,Single645WorDual645W

MaximumPoEpower N/A 50W 150W 247Wredundant,or494Wnon-redundant

Averagepowerconsumption 10W 27WLowMemory(LM),28WHighMemory(HM),84W(PoE)

61W(LM),65W(HM),179W(PoE)

122W

Inputfrequency 50-60Hz 50-60Hz 50-60Hz 50-60Hz

Maximumcurrentconsumption 0.25A@100VAC 0.41A@100VAC(LM),0.44A@100VAC(HM),1.13A@100VAC(PoE)

1.0A@100VAC(LM),1.1A@100VAC(HM),3.0A@100VAC(PoE)

5.3A@100VACwithsinglePSUwithPoE,8.3A@100VACwithdualPSUwithPoE

Maximuminrushcurrent 60A 80AforLM/HM,60AforPoE

40AforLM/HM,45AforPoE

45Afor½cycle

Averageheatdissipation 35BTU/hr 92BTU/hr(SRX210B),95BTU/hr(SRX210H),116BTU/hr(SRX210H-PoE)

208BTU/Hr(SRX240B),222BTU/Hr(SRX240H),249BTU/Hr(SRX240H-PoE)

319BTU/Hr

Maximumheatdissipation 80BTU/hr 120BTU/hr(SRX210B),126BTU/hr(SRX210H),157BTU/hr(SRX210H-PoE)

344BTU/Hr(SRX210B),369BTU/Hr(SRX210H),413BTU/Hr(SRX210H-PoE)

699BTU/Hr

Redundantpowersupply(hotswappable) No No No Yes(uptomaximumcapacityofsinglePSU)

Acousticnoiselevel

(PerISO7779Standard)

0dB(fanless) 29.1dB 54.1dB 60.9dB

10


Environment

Operationaltemperature 32°to104°F(0°to40°C)

32°to104°F(0°to40°C)

32°to104°F(0°to40°C)

32°to104°F(0°to40°C)

Nonoperationaltemperature 4°to158°F,(-20°to70°C)

4°to158°F,(-20°to70°C)

4°to158°F,(-20°to70°C)

4°to158°F,(-20°to70°C)

Humidity 10%to90%noncondensing

10%to90%noncondensing



Meantimebetweenfailures(Telcordiamodel) 24.8years[SRX100B]

24.8years[SRX100H]

15.2years(SRX210B)

14.3years(SRX210H)

10.4years(SRX210H-PoE)

15.2years(SRX240B)

14.3years(SRX240H)

10.4years(SRX240H-PoE)

9.6yearswithredundantpower

Certifications and Network Homologation

USA

Safetycertifications UL60950-1 UL60950-1 UL60950-1 UL60950-1

EMCcertifications FCCClassB FCCClassB9 FCCClassA FCCClassA

Networkhomologation TIA-968 TIA-968 TIA-968 TIA-966

Canada

Safetycertifications CSA60950-1 CSA60950-1 CSA60950-1 CSA60950-1

EMCcertifications ICESclassB ICESclassB9 ICESclassA ICESclassA

Networkhomologation CS-03 CS-03 CS-03 CS-03

Australia

Safetycertifications AS/NZS60950-1 AS/NZS60950-1 AS/NZS60950-1 AS/NZS60950-1

EMCcertifications AS/NZSCISPR22ClassB

AS/NZSCISPR22ClassB9

AS/NZSCISPR22ClassA

AS/NZSCISPR22ClassA

Networkhomologation AS/ACIFS002,S016,S043.1,S043.2

AS/ACIFS002,S016,S043.1,S043.2

AS/ACIFS002,S016,S043.1,S043.2

AS/ACIFS016

NewZealand

Safetycertifications AS/NZS60950-1 AS/NZS60950-1 AS/NZS60950-1 AS/NZS60950-1

EMCcertifications AS/NZSCISPR22ClassB

AS/NZSCISPR22ClassB9

AS/NZSCISPR22ClassA

AS/NZSCISPR22ClassA

Networkhomologation PTC217,PTC273 PTC217,PTC273 PTC217,PTC273 PTC217

Japan

Safetycertifications CBScheme CBScheme CBScheme CBScheme

EMCcertifications VCCIClassB VCCIClassB9 VCCIClassA VCCIClassA

Networkhomologation CertificateforTechnicalConditions

CertificateforTechnicalConditions



EuropeanUnion

Safetycertifications EN60950-1 EN60950-1 EN60950-1 EN60950-1

EMCcertifications EN55022ClassB,EN300386

EN55022ClassB9,EN300386

EN55022ClassA,EN300386

EN55022ClassA,EN300386

Networkhomologation CTR12/13,CTR21,DoC

CTR12/13,CTR21,DoC

CTR12/13,CTR21,DoC

CTR12/13,DoC

1.BGPRouteReflectorsupportedonSRX650.Seeorderingsectionformoreinformation.2.UnifiedThreatManagement-antivirus,antispam,WebfilteringandIPSrequireasubscriptionlicenseandthehighmemorysystemoptiontousethefeature.UTMisnotsupportedonthelow

memoryversion.Pleaseseetheorderingsectionforoptions.ContentFilteringandUACarepartofthebasesoftwarewithnoadditionallicense.3.Highavailability.VRRPsupportedonallSRXSeriesproducts.SRX240andSRX650willsupporthighavailabilityfeaturesinJunos9.6.4.Supportedin9.5inpacketmodewithoutservices.5.WhenUTMisenabledcapacitiessupportedarelowmemoryspecifications,onhighmemorysystemoptions.6.WhenUTMisenabledconcurrentsessionssupportedis50%0fvalueshown.7.MulticastfeaturesinSRX240andSRX650aresupportedasofthe9.6release.8.SRX100Binstalledwith1GBDRAM,with512MBaccessible.Optionalupgradeto1GBDRAMisavailablewithpurchaseofmemorysoftwarelicensekey.9.SRX210H-POEisClassA.10.SRX100supportsAX411in2H2010.

주니퍼 네트웍스 서비스 및 지원

주니퍼는하이퍼포먼스네트워킹의가치를가속,확장,최적화시키는Performance-Enabling서비스및지원을제공합니다.이러한서비스를통해매출과직결되는역량들을신속하게제공함으로써생산성을향상시키고,새로운비즈니스모델을지원하며,시장확대와고객만족증대를실현시킵니다.동시에주니퍼는뛰어난운영효율성을통해성능,안정성,가용성,확장성요구를만족시키고운영비용을절감시키며IT위험요소들을제거합니다.

11

Ordering Information

MODEL NUMBER DESCRIPTION

SRX650 Base System

SRX650-BASE-SRE6-645AP

SRX650ServicesGatewaywith1ServicesRoutingEngine(SRE),4x10/100/1000BASE-Tports,2GBDRAM,2GBCF,fantray,645WACPoEpowersupplyunitforSRX650.Provides397Wsystempower@12Vand247WPoEpower@50VDC.Workswith90-250VACinput.Includespowercordandrackmountkit.

SRX650 Options

InterfaceModules

SRX-GP-16GE 16-port10/100/1000BASE-TXPIM

SRX-GP-16GE-POE 16-port10/100/1000BASE-TPoEXPIM

SRX-GP-24GE 24-port10/100/1000BASE-TXPIM,includes4SFPslots

SRX-GP-24GE-POE

24-port10/100/1000BASE-TPoEXPIM,includes4SFPslots

SRX-GP-DUAL-T1-E1

DualT1/E1GPIM

SRX-GP-QUAD-T1-E1

QUADT1/E1GPIM

PowerSuppliesandAccessories

SRX600-PWR-645AC-POE

Spare645WACPoEpowersupplyunitforSRX650systems.OneisincludedinSRX650BaseSystem(SRX650-BASE-SRE6-645AP).

SRX600-SRE6HSPARE

SpareSRE6-HforSRX650.OneisincludedinSRX650BaseSystem(SRX650-BASE-SRE6-645AP).

SRX650-CHAS SRX650chassisincludingfantray.Nosystemprocessor(SRE)andnopowersupplyunit.

SRX650-FAN-01 SpareSRX650fantray.OneisincludedinSRX650ChassisSpare(SRX650-CHAS),andincludedinSRX650BaseSystem(SRX650-BASE-SRE6-645AP).

SRX650-FILT-01OPTIONAL

NotincludedinSRX650ChassisSpare(SRX650-CHAS),andnotincludedinSRX650BaseSystem(SRX650-BASE-SRE6-645AP).Optional,asthisisnotrequiredfornormaloperations,butrecommendedfordustyenvironments.

AdditionalSoftwareFeatureLicenses

SRX650-K-AV OneyearsubscriptionforJuniper-KasperskyantivirusupdatesonSRX650

SRX650-IDP OneyearsubscriptionforIDPupdatesonSRX650

SRX650-S2-AS OneyearsubscriptionforJuniper-SophosantispamupdatesonSRX650

SRX650-W-WF OneyearsubscriptionforJuniper-WebsenseWebfilteringupdatesonSRX650

SRX650-SMB2-CS Oneyearsecuritysubscriptionforenterprise-includesKasperskyantivirus,Webfiltering,Sophosantispam,andIDPonSRX650

SRX650-K-AV-3 ThreeyearsubscriptionforJuniper-KasperskyantivirusupdatesonSRX650

SRX650-IDP-3 ThreeyearsubscriptionforIDPupdatesonSRX650

SRX650-S2-AS-3 ThreeyearsubscriptionforJuniper-SophosantispamupdatesonSRX650

SRX650-W-WF-3 ThreeyearsubscriptionforJuniper-WebsenseWebfilteringupdatesonSRX650


AdditionalSoftwareFeatureLicenses(continued)

SRX650-SMB2-CS-3

Threeyearsecuritysubscriptionforenterprise-includesKasperskyantivirus,Webfiltering,Sophosantispam,andIDPonSRX650

SRX-BGP-ADV-LTU AdvancedBGPonSRX650(RouteReflector)

SRX650-K-AV-5 FiveyearsubscriptionforJuniper-KasperskyantivirusupdatesonSRX650

SRX650-IDP-5 FiveyearsubscriptionforIDPupdatesonSRX650

SRX650-S2-AS-5 FiveyearsubscriptionforJuniper-SophosantispamupdatesonSRX650

SRX650-W-WF-5 FiveyearsubscriptionforJuniper-WebsenseWebfilteringupdatesonSRX650

SRX650-SMB2-CS-5

Fiveyearsecuritysubscriptionforenterprise-includesKasperskyantivirus,WebFiltering,Sophosantispam,andIDPonSRX650

SRX240 Base System

SRX240B SRX240ServicesGatewaywith16GbEports,4Mini-PIMslots,andbasememory(512MBRAM,1GBFlash)

SRX240H SRX240ServicesGatewaywith16GbEports,4Mini-PIMslots,andhighmemory(1GBRAM,1GBFlash)

SRX240H-POE SRX240ServicesGatewaywith16GbEports,4Mini-PIMslots,andhighmemory(1GBRAM,1GBFlash),with16portsPoE(150W)

SRX240-RMK SRX240Rackmountkitfor19inrack(holdsoneunit)

InterfaceModules

SRX-MP-1SERIAL 1-portSyncSerialMiniPhysicalInterfaceModule(Mini-PIM)forbranchSRXSeries

SRX-MP-1ADSL2-A 1-portADSL2+Mini-PIMsupportingADSL/ADSL2/ADSL2+AnnexA

SRX-MP-1ADSL2-B 1-portADSL2+Mini-PIMsupportingADSL/ADSL2/ADSL2+AnnexB

SRX-MP-1VDSL2-A 1-portVDSL2Mini-PIMsupportingAnnexA,withfallbacktoADSL2/ADSL2+

SRX-MP-8GSHDSL 8-wire(4-pair)G.SHDSLMini-PIM

SRX-MP-1SFP 1-portSFPMini-PIMforbranchSRXSeries

SRX-MP-1T1E1 1-portT1orE1Mini-PIMforbranchSRXSeries

SRX-MP-1DOCSIS3 1-portDOCSIS3.0CableModemMini-PIMforSRXSeries;backwardscompatiblewithDOCSIS2.0and1.1








12


AdditionalSoftwareFeatureLicenses(continued)




SRX240-SMB2-CS-3






SRX240-SMB2-CS-5

Fiveyearsecuritysubscriptionforenterprise-includesKasperskyantivirus,Webfiltering,Sophosantispam,andIDPonSRX240

SRX-RAC-5-LTU DynamicVPNClient:5simultaneoususersforSRX100,SRX210andSRX240only



SRX-RAC-50-LTU DynamicVPNClient:50simultaneoususersforSRX240only

SRX210 Base System

SRX210B SRX210ServicesGatewaywith2GbE+6FastEthernetports,1Mini-PIMslot,1ExpressCardslotandbasememory(512MBRAM,1GBFlash)

SRX210H SRX210ServicesGatewaywith2GbE+6FastEthernetports,1Mini-PIMslot,1ExpressCardslotandhighmemory(1GBRAM,1GBFlash)

SRX210H-POE SRX210ServicesGatewaywith2GbE+6FastEthernetports,1Mini-PIMslot,1ExpressCardslotandhighmemory(1GBRAM,1GBFlash),with4portsPoE(50W)

InterfaceModules

SRX-MP-1SERIAL 1-portSyncSerialMiniPhysicalInterfaceModule(Mini-PIM)forbranchSRXSeries

SRX-MP-1ADSL2-A 1-portADSL2+Mini-PIMsupportingADSL/ADSL2/ADSL2+AnnexA

SRX-MP-1ADSL2-B 1-portADSL2+Mini-PIMsupportingADSL/ADSL2/ADSL2+AnnexB

SRX-MP-1VDSL2-A 1-portVDSL2Mini-PIMsupportingAnnexA,withfallbacktoADSL2/ADSL2+

SRX-MP-8GSHDSL 8-wire(4-pair)G.SHDSLMini-PIM

SRX-MP-1SFP 1-portSFPMiniPhysicalInterfaceModule(Mini-PIM)forbranchSRXSeries

SRX-MP-1T1E1 1-portT1orE1MiniPhysicalInterfaceModule(Mini-PIM)forbranchSRXSeries

SRX-MP-1DOCSIS3 1-portDOCSIS3.0CableModemMini-PIMforSRXSeries;backwardscompatiblewithDOCSIS2.0and1.1


AdditionalHardware

SRX210-DESK-STAND

SRX210desktopstand(holdsoneunit)

SRX210-RMK SRX210rackmountkitfor19inrack(holdsoneunit)

SRX210-WALL-KIT SRX210wallmountkit(holdsoneunit)

SRX210-PWR-60W-*

SpareSRX210switchingpowersupply,60W(non-PoE)

SRX210-PWR-150W-*

SpareSRX210switchingpowersupply,150W(PoE)

*Seepricelistforcountry-specificpowercordmodelnumbers.











SRX210-SMB2-CS-3






SRX210-SMB2-CS-5





SRX-RAC-50-LTU DynamicVPNClient:50simultaneoususersforSRX240only

Small Form Factor Pluggable (SFP) TransceiversSRX-SFP-1GE-LH SFP1000BASE-LHOpticalTransceiver

SRX-SFP-1GE-LX SFP1000BASE-LXOpticalTransceiver

SRX-SFP-1GE-SX SFP1000BASE-SXOpticalTransceiver

SRX-SFP-1GE-T SFP1000BASE-TCopperTransceiver

SRX-SFP-FE-FX SFP100BASE-FXOpticalTransceiver

Ordering Information (continued)

13


SRX100 Base SystemSRX100B SRX100ServicesGatewaywith8xFEportsand

basememory(On-board1GBRAMw/512MBaccessible,1GBFlash)

SRX100H SRX100ServicesGatewaywith8xFEportsandhighmemory(1GBRAM,1GBFlash)

AdditionalHardware

SRX100-PWR-30W-*

SpareSRX100switchingpowersupply,30W(non-PoE)

SRX-100-RMK SRX10019”rackmountkit(holdstwounits)

SRX100-WALL-KIT SRX100wallmountkit(holdsoneunit)

SRX100-DESK-STAND

SRX100deskstand(holdsoneunit)

*Seepricelistforcountry-specificpowercordmodelnumbers.


SRX100-MEM-LIC-UPG

SRX100memorysoftwarelicense-upgradesSRX100Bmodelfrom512MBRAMto1GBRAM










SRX100-SMB2-CS-3






SRX100-SMB2-CS-5


DynamicVPNClient

SRX-RAC-5-LTU 5simultaneoususersforSRX100,SRX210andSRX240only



Ordering Information (continued)

14

Notes

15

Notes

16

1000281-008-KR

저작권©2010,주니퍼네트웍스사.모든권리보유.주니퍼네트웍스,주니퍼네트웍스로고,Junos,NetScreen및ScreenOS는미국과기타국가에서주니퍼네트웍스의등록상표입니다.Junos는주니퍼네트웍스의등록상표입니다.여타모든상표,서비스마크,등록상표또는등록서비스마크는해당소유업체의자산입니다.주니퍼네트웍스는본문서의오류에대해그어떠한책임도지지않습니다.주니퍼네트웍스는사전통보없이본자료를변경,수정,교체또는정정할수있는권한을보유하고있습니다.

EMEA 본부

JuniperNetworksIreland

AirsideBusinessPark

Swords,CountyDublin,Ireland

Phone:35.31.8903.600

EMEASales:00800.4586.4737

Fax:35.31.8903.601

아태지역 본부

JuniperNetworks(HongKong)

26/F,CityplazaOne

1111King’sRoad

TaikooShing,HongKong

Phone:852.2332.3636

Fax:852.2574.7803

본사

JuniperNetworks,Inc.

1194NorthMathildaAvenue

Sunnyvale,CA94089USA

Phone:888.JUNIPER(888.586.4737)

or408.745.2000

Fax:408.745.2100

www.juniper.net

주니퍼네트웍스솔루션에대한구매문의는

한국주니퍼네트웍스(전화02-3483-3400,

이메일[email protected])로연락

주십시오.

한국주니퍼네트웍스(주) 서울시 강남구 역삼 1동 736-1 캐피탈 타워 19층 TEL : 02)3483-3400 FAX : 02)3483-3488 www.juniper.co.kr

주니퍼 네트웍스에 대하여

주니퍼네트웍스는하이퍼포먼스네트워킹으로네트워크업계를선도해나가고있습니다.주니퍼는단일네트워크상에서서비스와애플리케이션운용을가속화시키는안정적인네트워크환경구축을위해하이퍼포먼스네트워크인프라스트럭처를제공하는데주력합니다.이러한하이퍼포먼스네트워크는고객의하이퍼포먼스비즈니스를위한원동력이되고있습니다.

자세한정보는www.juniper.co.kr 에서확인할수있습니다.

Documents

SRX SERIES 서비스 게이트웨이 · 필수적인연결,보안,관리기능들을 공합니다. 하나의장비에빠르고가용성높은 스위칭 ,라우팅,보안애플리케이션