Datasheet
SRX4300 FIREWALL DATASHEET
Product Description
Juniper Networks® SRX4300 Firewall is a high-performance, next-generation firewall
(NGFW) designed to safeguard your enterprise campus, data center edge, and core. It also
supports roaming and SD-WAN secure hub firewall use cases. By combining carrier-grade
routing with state-of-the-art switching, this platform delivers robust security, effective
threat detection, and comprehensive automation and mitigation capabilities.
Product Overview
The firewall's role must expand
as data centers evolve from
traditional architecture to
distributed. Rather than being a
perimeter technology, firewalls
need to be part of a security Figure 1: Juniper SRX Firewalls have achieved the highest scores in security effectiveness by CyberRatings and
fabric woven throughout the NetSecOpen
network. A security fabric
The SRX4300 delivers NGFW features that support the changing needs of cloud-enabled
ensures that security is
maintained at every point of enterprise networks and data centers. Whether rolling out new services within an
connection. enterprise campus, connecting to the cloud seamlessly, complying with industry standards,
Juniper Networks SRX4300 or achieving operational efficiency, the SRX4300 empowers organizations to operationalize
next-generation firewall is Zero Trust principles at scale while realizing their business objectives. The SRX4300
integral to this new architecture, protects critical corporate assets with features such as an intrusion prevention system (IPS),
which empowers organizations follow-the-user and follow-the-application access policies, and Juniper’s AI-Predictive
to operationalize security across Threat Prevention. Furthermore, the SRX4300 works with Juniper’s cloud security
their networks. To secure your solutions to secure hybrid-cloud environments with networkwide visibility and control,
network, this 1U, power- providing consistently secure on-premises and cloud environments.
efficient firewall delivers built-in
As network architectures become more distributed and decentralized, Juniper Networks
Zero Trust, Ethernet VPN-Virtual
Extensible LAN (EVPN-VXLAN) SRX Series firewalls ensure seamless integration with other Juniper and third-party
fabric integration, and AI- networking platforms. At the same time, the NGFWs facilitate architectural transformation,
Predictive Threat Prevention. taking organizations from on-premises to hybrid cloud environments seamlessly and cost-
The SRX4300 supports multiple effectively. SRX Series firewalls are the first to implement industry-standard Ethernet VPN
100 Gbps interfaces with wire (EVPN) type 5 and Virtual Extensible LAN (VXLAN) protocols within data center
speed MACsec. environments, enabling the SRX4300 to act as a secure, fabric-aware leaf in the data center
spine-leaf architecture.
The SRX4300 participates in the industry-first Connected Security Distributed Services
Architecture, enabling organizations to scale horizontally and elastically, simplifying the
operational management of large-scale firewall networks. With this architecture, several
SRX4300 platforms can work together as a single large logical firewall to provide security at
higher performance and scale.
The SRX4300 is powered by the Junos® operating system (Junos OS), which underpins and
helps secure the world’s largest mission-critical enterprise and service provider networks. It
is managed by Juniper® Security Director Cloud, Juniper’s unified management experience
that connects the organization’s current deployments with future architectural rollouts.
1
SRX4300 Firewall Datasheet
Security Director Cloud uses a single policy framework enabling Touch Provisioning (sZTP) to efficiently, expediently, and remotely
consistent security policies across any environment and expanding deploy products in your network. Additionally, the SRX4300
Zero Trust to all parts of the network from the edge into the data supports MACsec at wire speed, ensuring data integrity and
center. This provides unbroken visibility, policy configuration, confidentiality.
administration, and collective threat intelligence all in one place.
Connected Security Distributed Services Architecture
Architecture and Key Components The SRX4300 is part of Juniper’s Connected Security Distributed
The SRX4300 hardware and software architecture provides cost- Services Architecture, revolutionizing data center security. With
effective security in a compact, scalable 1U form factor. Purpose- Juniper’s Connected Security Distributed Services Architecture,
built to protect network environments, the SRX4300 incorporates firewall performance can scale horizontally by interconnecting
multiple security services and networking functions on top of Junos traffic forwarding and security services across multiple locations.
OS, providing highly customizable threat protection, automation, Juniper’s solution also provides automated failover and backup
and integration capabilities. Best-in-class advanced security nodes for forwarding and inspection components. In addition to
capabilities on the SRX4300 are ideal for data center, enterprise redundancy and load balancing, Juniper’s Connected Security
campus, and regional headquarters deployments with IMIX traffic Distributed Services Architecture simplifies how large-scale data
patterns. center firewall networks are managed and operated. Regardless of
how many firewall engines are added across physical, virtualized,
Built-in Zero Trust and containerized form factors, they can be managed as one logical
unit. This centralized management eliminates the complexity that
The SRX4300 features built-in Zero Trust device capabilities to
has been an unintended consequence of a traditional scale-out
increase trust and streamline operations, including an embedded
approach.
Trusted Platform Module (TMP) 2.0 and cryptographically signed
device ID. The SRX4300 supports RFC-compliant Secure Zero
Features and Benefits
Business Requirement Feature/Solution SRX4300 Advantages
High performance Hardware-accelerated • Offloads CPU-intensive encryption/decryption tasks
encryption/decryption • Improves performance for SSL and IPsec
High-quality end user Application visibility and • Updates application continuously and decodes custom applications
experience control • Controls and prioritizes traffic based on application and user role
• Inspects and detects applications inside SSL-encrypted traffic, including Web and SaaS
Advanced threat NGFW Services: IPS, antivirus, • Prevents exploits with 99.9% effectiveness. Signatures update in real time
protection antispam, Web filtering • Protects against known malware and malicious Web and DNS traffic
Juniper Advanced Threat
Prevention Cloud: sandboxing, • Sandboxing for unknown malware across multiple OS types, including iOS, Windows, Android, and CentOS
Encrypted Traffic Insights, • Delivers threat intelligence in an open platform to accommodate third-party and custom threat feeds
SecIntel threat intelligence • Detects threats hidden inside encrypted traffic without decrypting
feeds
Zero-day protection Juniper’s AI-Predictive Threat • Predicts and prevents malware at line rate by using AI to identify threats from packet snippets effectively
Prevention • Eliminates patient-zero infections
• Auto-generates protective signatures that remain active for the full attack lifecycle, keeping the network safe from subsequent
attacks
Secure data transactions Juniper Secure Connect: IPsec • Provides high-performance IPsec VPN with a dedicated crypto engine
VPN, remote access/SSL VPN • Offers diverse VPN options for various network designs, including remote access and dynamic site-to-site communications
• Simplifies large VPN deployments with auto-VPN
• Includes hardware-based crypto acceleration
• Secure and flexible remote access SSL VPN
Advanced networking Routing, secure wire • Supports carrier-class advanced routing and quality of service (QoS)
services
Security embedded into EVPN-VXLAN (EVPN Type 5 • Enhances tunnel inspection for VXLAN encapsulated traffic with Layer 4-7 security services
the data center fabric route) • Eases operations with Type 5 support through BGP
• Does not require decapsulation for EVPN-VXLAN traffic
2
SRX4300 Firewall Datasheet
Business Requirement Feature/Solution SRX4300 Advantages
Reliability Chassis cluster, redundant • Provides stateful configuration and session state synchronization
power supplies • Supports active/active and active/backup deployment scenarios
• Offers highly available hardware with redundant power supply unit (PSU) and fans
Easy to manage and scale Juniper Security Director • Provides centralized management via Juniper’s unified management experience, including zero-touch provisioning (ZTP),
Cloud, on-box GUI unbroken visibility, intelligent rule placement, and simplified policy configuration and automation
• Supports Network Address Translation (NAT) and automated IPsec VPN deployments via wizards
• Supports on-box GUI
Built-in Zero Trust DevID with TPM 2.0 Module • Verifies the device’s trust posture easily
capabilities • Provides cryptographically signed device ID that supports RFC-compliant sZTP for hardware and software attestation
• Mitigates the risks of supply chain attacks
Low TCO Junos OS • Integrates routing and security capabilities into a single device
• Reduces OpEx with Junos OS automation capabilities
• Automated integration with other devices running Junos OS, such as Juniper MX, PTX, and ACX routers; EX and QFX switches,
and Cloud-Native Contrail Networking (CN2)
1
Exploit block rate results tested by CyberRatings’ 2023 Enterprise Firewall test report
Figure 2: SRX4300 firewall
Software Specifications
Firewall Services VPN Features
• Stateful firewall services • Tunnels: Site-to-site, hub and spoke, dynamic endpoint,
• Zone-based firewall AutoVPN, ADVPN, Group VPN (IPv4/ IPv6/Dual Stack)
• Screens and distributed denial of service (DDoS) protection • Juniper Secure Connect: Remote access/SSL VPN
• Protection from protocol and traffic anomalies • Configuration payload: Yes
• Unified Access Control (UAC) • IKE encryption algorithms: Prime, 3DES-CBC, AEC-CBC, AES-
• Integration with Juniper Mist™ Access Assurance GCM, Suite B
• Authentication: Pre-shared key and public key infrastructure
(PKI) (X.509)
Carrier-Grade Network Address Translation (CGNAT) • IPsec: Authentication Header (AH)/Encapsulating Security
• Carrier-grade Network Address Translation (Large-scale NAT) Payload (ESP) protocol
• IPv4 and IPv6 address translation NAT44, NAPT44, NAT66, • IPsec authentication algorithms: hmac-md5, hmac-sha-196,
NAPT66, NAT64, NAT46 hmac-sha-256
• Static and dynamic 1-1 translation • IPsec encryption algorithms: Prime, DES-CBC, 3DES-CBC,
• Source NAT with Port Address Translation (PAT) AEC-CBC, AES-GCM, Suite B
• Destination NAT with Port Address Translation (PAT) • Perfect forward secrecy, anti-replay
• Persistent NAT (EIM/EIF) • Internet Key Exchange: IKEv1, IKEv2
• Port Block Allocation (PBA) • Monitoring: Standard-based dead peer detection (DPD)
• Deterministic NAT (DetNAT) support, VPN monitoring
• Port overload • VPNs GRE, IP-in-IP, and MPLS
• Twice-NAT44
• DS-lite
3
SRX4300 Firewall Datasheet
High Availability Features • Multicast: Internet Group Management Protocol (IGMP) v1/v2,
Protocol Independent Multicast (PIM) sparse mode (SM)/
• Virtual Router Redundancy Protocol (VRRP): IPv4 and IPv6
• Stateful high availability: Dual box clustering source-specific multicast (SSM), Session Description Protocol
- Active/passive (SDP), Distance Vector Multicast Routing Protocol (DVMRP),
Multicast Source Discovery Protocol (MSDP), reverse path
- Active/active
forwarding (RPF)
- Configuration synchronization
• Encapsulation: VLAN, Point-to-Point Protocol over Ethernet
- Firewall session synchronization
(PPPoE)
- Device/link detection
• Virtual routers
- In-Service Software Upgrade (ISSU)
• Policy-based routing, source-based routing
- IP monitoring with route and interface failover
• EVPN-VXLAN (EVPN Type 5 route)
- BFD monitoring
• Equal-cost multipath (ECMP)
• Chassis cluster HA and Multinode HA (MNHA)
QoS Features
Application Security Services2
• Support for 802.1p, DiffServ code point (DSCP), EXP
• Application visibility and control
• Classification based on VLAN, data-link connection identifier
• Application QoS
(DLCI), interface, bundles, or multifield filters
• Advanced/application policy-based routing (APBR)
• Marking, policing, and shaping
• Application Quality of Experience (AppQoE)
• Classification and scheduling
• Application-based multipath routing
• Weighted random early detection (WRED) Guaranteed and
• User-based firewall
maximum bandwidth
• Ingress traffic policing
Threat Defense and Intelligence Services2 • Virtual channels
• Intrusion prevention system
• AI-Predictive Threat Prevention
Network Services
• Antivirus
• Dynamic Host Configuration Protocol (DHCP) client/server/
• Antispam
relay
• Category/reputation-based URL filtering
• Domain Name System (DNS) proxy, dynamic DNS (DDNS)
• SSL proxy/inspection
• Juniper real-time performance monitoring (RPM) and IP
• Protection from botnets (command and control)
monitoring
• Adaptive enforcement based on GeoIP
• Juniper flow monitoring (J-Flow)
• Juniper Advanced Threat Prevention, a cloud-based SaaS
offering, to detect and block zero-day attacks
• Adaptive Threat Profiling
Advanced Routing Services
• Encrypted Traffic Insights
• MPLS (RSVP, LDP)
• SecIntel threat intelligence
• Circuit cross-connect (CCC), translational cross-connect (TCC)
• Juniper ATP virtual appliance, a distributed, on-premises
• L2/L2 MPLS VPN, pseudo-wires
advanced threat prevention solution to detect and block zero-
• Virtual private LAN service (VPLS), next-generation multicast
day attacks
VPN (NG-MVPN)
2
Offered as advanced security subscription license.
• MPLS traffic engineering and MPLS fast re-route
Routing Protocols
• IPv4, IPv6, static routes, RIP v1/v2 Management, Automation, Logging, and Reporting
• OSPF/OSPF v3 • SSH, Telnet, SNMP-MIBs, Traps
• BGP with route reflector • Smart image download
• IS-IS • Juniper CLI and Web UI, NetCONF, XML APIs, RMON
• Juniper Security Director Cloud
4
SRX4300 Firewall Datasheet
• Python Specifications SRX4300
• Junos events, commit and OP scripts Secure Web Access Firewall (CPS**) in
21
Gbps
• Application and bandwidth usage reporting
Advanced Threat (CPS**)6 in Gbps 11
• Debug and troubleshooting tools
Connections per second (64B) 800,000
SSL connections per second 10,000
Maximum concurrent sessions (IPv4 or
Hardware Specifications IPv6)
10 Million
Table 1. SRX4300 Hardware Specifications Route table size (RIB/FIB) (IPv4) 2 Million/1.2 Million
Specifications SRX4300 IPsec VPN tunnels 4,000
Connectivity 3
Throughput numbers based on UDP packets and RFC2544 test methodology
Onboard ports 8 x 1 GbE/2.5 GbE/5 GbE/10 GbE BASE-T
4
Next-generation firewall performance is measured with firewall, application security, and IPS enabled
5
Secure Web Access firewall performance is measured with firewall, application security, IPS, SecIntel, and URL filtering
Onboard small form-factor pluggable 8 x 1 GbE/10 GbE SFP+ enabled
6
Advanced Threat performance is measured with Firewall, Application Security, IPS, SecIntel, URL Filtering and Malware
plus (SFP+) transceiver ports 4 x 1 GbE/10 GbE/25 GbE SFP28 Protection enabled
6 x 40 GbE/100 GbE QSFP28 ##
TPS Method: Throughput performance of average HTTP sessions
**
CPS Method: Short-lived sessions
Out-of-Band (OOB) management ports 1 x 1 GbE G (RJ-45)
Dedicated high availability (HA) ports 2 x 1 GbE SFP
Console 1 (RJ-45)
Juniper Mist WAN Assurance and AI-Native Operations
USB 3.0 ports (Type A) 1 Alternatively, the SRX4300 firewall can be operated and
Storage orchestrated through the Juniper Mist Cloud. Mist AI delivers
Storage (SSD) 1 x 120 GB (primary), 1 x 960 GB (secondary + unprecedented automation using a combination of artificial
logging disk)
intelligence, machine learning algorithms, and data science
Dimensions and Power
techniques to save time, maximize IT productivity, and deliver the
Form factor 1U
best experience to digital users.
Size (W x H x D) 17.28 x 1.74 x 18.20 in
(43.89 x 4.42 x 46.23 cm)
Juniper Mist WAN Assurance is built on the Juniper Mist Cloud and
Weight (device and PSU) Chassis with two AC PSU: 20.2 lb (9.2 kg)
Chassis with two DC PSU: 20.5 lb (9.3 kg) delivers full lifecycle management and operations, including
Chassis with package: 36.6 lb (16.6 kg)
AI‑Native insights, automated speed tests, dynamic packet capture
Redundant PSU 1+1
(dPCAP), anomaly detection, and root cause identification that
Power supply 2 x 850W AC PSU redundant
2 x 850 W DC PSU redundant focuses on end users’ experience. For Day 0 and Day 1 operations,
Average heat dissipation 1 x DC PSU (40V): 1221.5 BTU/h WAN Assurance also provides orchestration, administration, and
2 x DC PSU (40V): 1224.9 BTU/h
1 x AC PSU (110V): 1206.2 BTU/h ZTP for SRX4300. See the WAN Assurance Datasheet for more
1 x AC PSU (230V): 1175.5 BTU/h information.
2 x AC PSU (110V): 1228.4 BTU/h
2 x AC PSU (230V): 1206.2 BTU/h
Maximum current consumption 4.67 A (for 110 V AC PSM)
2.188 A (for 230 V AC PSM) Juniper Networks Services and Support
11.53 A (for -40 V DC Power)
Maximum inrush current 40 A for 1 cycle of AC (AC PSM) Juniper Networks is the leader in performance-enabling services
40 A-pk (DC PSM) designed to accelerate, extend, and optimize your high-
Environment and Regulatory Compliance performance network. Our services allow you to maximize
Airflow/cooling Front to back
operational efficiency while reducing costs and minimizing risk,
Operating temperature 32° to 104° F (0° to 40° C at 6000 ft altitude)
achieving a faster time to value. Juniper Networks ensures
Operating humidity 5% to 90% non-condensing
operational excellence by optimizing the network to maintain the
Meantime between failures (MTBF) Over 100,000 hours (12 years)
required levels of performance, reliability, and availability. For more
FCC classification Class A
RoHS compliance RoHS 6
details, please visit [Link]
Performance and Scale
Firewall throughput3 (IMIX) in Gbps 70
Ordering Information
Firewall throughput3 (1518B) in Gbps 98
IPsec VPN throughput3 (IMIX) in Gbps 40
To order Juniper Networks SRX Series firewalls, and to access
IPsec VPN throughput (1400B) in Gbps
3
94 software licensing information, please visit the How to Buy page at
Application security performance (TPS##) [Link]
85/45
in Gbps
Next-generation firewall (TPS##)4 in Gbps 83/24
5
SRX4300 Firewall Datasheet
About Juniper Networks
Juniper Networks believes that connectivity is not the same as
experiencing a great connection. Juniper's AI-Native Networking
Platform is built from the ground up to leverage AI to deliver
exceptional, highly secure, and sustainable user experiences from
the edge to the data center and cloud. Additional information can
be found at [Link] or connect with Juniper on X (formerly
Twitter), LinkedIn, and Facebook.
Corporate and Sales Headquarters APAC and EMEA Headquarters
Juniper Networks, Inc. Juniper Networks International B.V.
1133 Innovation Way Boeing Avenue 240 1119 PZ Schiphol-Rijk
Sunnyvale, CA 94089 USA Amsterdam, The Netherlands
Phone: [Link] (888.586.4737) Phone: +[Link]
or +1.408.745.2000
[Link]
Copyright 2024 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc. in the United
States and other countries. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no
responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.
1000779-005-EN Oct 2024 6