Juniper SRX产品介绍白皮书.ppt

效能卓越毫不妥协srx产品介绍,目标,学习本教程后，应掌握以下内容：srx有那些产品？各具有什么特性？srx与ssg、j系列有那些主要区别？srx有那些竞争优势？,产品介绍,srx产品家族概览,基于动态服务架构dsa加速新服务的应用,srx650,srx3400,srx240,srx210,srx3600,srx5600,srx5800,120g,60g,30g,20g,7g,1.5g,750m,600m,nsm,centrallymanagedbynsm,srx100,分布式企业,数据中心,产品定位,srx100,8xfe（桌面式）固定配置全utm特性(1g高内存)idpantivirusanti-spamwebfiltering性能防火墙吞吐率(大包)600mbps并发连接数16/32ksoho用户(1-25u),*q32009开始供货,srx100,idealformicro-branch,managedtelecommuters,sohofixedi/o8x10/100ethernetportsfullutmfeaturesidpantivirusanti-spamwebfilteringuacenforcementutmrequireshighmemorymodel(utm,license),nocsa,q32009,srx210,2xge+6xfe（桌面式）1x扩展插槽(非热插拔)serial/t1e1/adsl2+/sfp全utm特性(1g高内存)idp/antivirus/anti-spam/webfiltering内容安全加速器4*端口支持poe供电(802.3af/at)支持3g接入性能防火墙吞吐率(大包)750mbps并发连接数32/64k小型分支用户(20-200u),*q32009支持语音,srx210,idealforsmallbranchesfullutmfeaturesidp,antivirus,anti-spam,webfiltering,contentfilteringuacenforcementutmrequireshighmemorymodelavailablevoiceversionwithmini-pimoptionsfactory-configuredvoicemodel,q22009,srx240,16xge（1u机架）4x扩展插槽(非热插拔)serial/t1e1/adsl2+/sfp全utm特性(1g高内存)idp/antivirus/anti-spam/webfiltering内容安全加速器16*端口支持poe供电(802.3af/at)性能防火墙吞吐率(大包)1.5gbps并发连接数64/128k中型分支用户(100-500u),*q42009支持语音、3g,idealforsmallmediumbranchesfullutmfeaturesidp,antivirus,anti-spam,webfiltering,contentfilteringuacenforcementutmrequireshighmemorymodelavailablevoiceversionwithmini-pimoptionsfactory-configuredvoicemodel,srx240,q22009,*supportedinjunos9.6,srx650,4xge（2u机架）8x扩展插槽(非热插拔)2t1e1/4t1e1/16ge/24ge多核架构独立的硬件控制及转发面板电源冗余(热插拔)支持poe供电(802.3af/at)全utm特性idp/antivirus/anti-spam/webfiltering内容安全加速器性能防火墙吞吐率(大包)7gbps并发连接数512k大型分支用户(200-1000u),*junos9.6sre支持冗余,2010支持语音,ace,srx650,idealforregionalsites,largebranchesmodular-lanswitchingservicesroutingprocessorswithoptionalredundancy(future)powersupplieswithoptionalredundancy(atfrs)voiceconfigurations(fieldupgradableviapimsin2010)fullutmfeaturesidp,antivirus,anti-spam,webfiltering,contentfilteringuacenforcementmaxgige52ports(2x24gepim+4integratedports),q22009,*supportedinjunos9.6,*supportedinjunos9.6,srx分布企业系列参数汇总,srx210withintegratedconvergenceservices,srxvoiceelementssurvivablesipserversipmediagatewaysipsecuritybaseandexpandablevoiceportspoeportspoeportsscalingwithexswitch,q32009,fxsportsconnectyouranalogphoneorfaxmachinehere,fxoportsconnecttoyourwallphonesocket,e1/t1orfxosforcarriertrunkorfxsforadditionalanalogphones/faxmachines,sipserver,corporateoffice,srx210/srx240,sipsoftswitch,serviceprovidervoip,analog,pbx,keysystem,channelizedt-1/e1/fxo,localpstn,localpstn,internet,sipvoiphandset,digital,2h2009,juniperintegratedconvergenceservicesstage1:survivablemediagateway,wanmpls,softphones,fax,sipvoiphandset,sipvoiphandsettodigitaloranalogphone,1,1,enterprisechoiceandflexibility,sipstandards,choiceofsipphones,callserversandapplications,sipserverandsipsoftswitch,2,2,siptrunking“tollbypass”,“extension”,2,3,3,3,siptrunkingtocorporatetopstn(typical),3,4,4,4,siptrunking“voiptopstn”s.p.voip,failovertopstn,srx210,3gwirelesswan,deployments-primaryconnectionwherewiredbroadbandisnotavailablebackupconnectivitywithwiredprimary.outofbandmanagement,remotedeployment.availableonsrx210支持的是verizon的cdma/evdo3g,hq,datacenter,3gwireless,dynamicvpnservices,internet,2h2009,retail,branch,regional,branchwirelessapsolution,juniper802.11nindoorsolutionbackwardscompatibleto.11a/b/gdualmoderadiosupport300mbps(aggregate)singleradio200mbps(160mbpstypical)spatialstreams:2x2:2,2x3:2,3x3:2ul2043plenumratedforoverceilingmounting.50meterrange(indoor)unitcanbemountedonceilingorwallvirtualaptechnologysupportofupto16simultaneousssids802.11ewmmcapable1gigabitethernetpoesupportoptionalexternalpowersupplyserialconsolsupportl2managedbysrxbranchproductsadditionallicensingcostforbranchsrxtomanagemultipleaccesspointsclustersof4,8,16aps.srx在不增加ap软件许可的情况下最多可以管理2个ap设备目前只在srx210（4个ap）、240（8个ap）、650（16个ap）上支持无线ap,softwarefeatures802.1qvlansupportupto4,096vlansupport(platformdependent)routedvlaninterface(rvi)garpvlanregistrationprotocol(gvrp)qosonvlaninterfacel3strictpriorityqueuing(llq)l3smootheddeficitweightedroundrobin(sdwrr)l3weightedrandomearlydiscard(wred)l3perportandperqueueshaping802.1xportbasedauthentication802.3ad(ax)linkaggregation*stp,spanningtreeprotocol802.1dspanningtreeprotocol802.1smultiplestp802.1wrapidstpjumboframesupport(9,216byte)*,ethernetswitching,srx210,srx240,srx650,hardware(onboardethernet)srx1008fixed10/100(switchedorrouted)srx210fixed210/100/1000+610/100(switchedorrouted)802.3afoptionalpoe(2fe+2ge)srx240fixed16ports10/100/1000(switchedorrouted)poweroverethernet(optionalallports)802.3af,802.3atsrx650fixed4ports10/100/1000(routed),hardwareethernetpimssrxmini-pim(srx210/srx240)1portsfp16portgigexpimforsrx650double-highfull-duplex20gbpsbackplane16portgeandoptionalpoe24portgigeincluding4sfpslotsxpimforsrx650double-high-double-wideoptionalpoe-24portgewithpoeincl4sfpslotsfull-duplex20gbpsbackplaneopticssrxgesfplh|srxgesfplx|srxgesfpsx|srxgesfp1000base-t|srxfefxsfp,srx100,*notsupportedonsrx100,srxseriesfirewall,zones,andpolicies,zone“untrust”,originatingzone,srx,zone“trust”,zone“trust”,defaultpolicydenyall,defaultpolicyallowall,internet,originatingzone,unifiedthreatmanagement(utm)features,websensetoblocktounapprovedsiteaccess,webfiltering,kasperskylabavstopsviruses,file-basedtrojans,spyware,adware,keyloggers,kasperskylabavstopsviruses,file-basedtrojansorspreadofspyware,adware,keyloggers,antivirus,symantecstopsspam/phishing,anti-spam,juniperidpdetects/stopsworms,trojans,dos(l44块spc;2块npc固定接口(scb)8-10/100/1000+4-sfp模块化接口（ioc）16-10/100/1000;16-sfp;2-xfp多核架构2电源冗余(n+1)性能防火墙吞吐率(大包)10/20gbps并发连接数2.25m,*最少需配1spc,1npc,srx3600,机箱式设计(5u)12个插槽(前6后6)最大7块ioc;7块spc;3块npc固定接口(scb)8-10/100/1000+4-sfp模块化接口16-10/100/1000;16-sfp;2-xfp多核架构4电源冗余(n+1)性能防火墙吞吐率(大包)10/20/30gbps并发连接数2.25m,*最少需配1spc,1n,switchfabricboard(sfb)highspeedswitchfabric(320gbps)includesvirtualioc(8x10/100/1000+4xsfp),ha-control(2xsfp)andsysteminterface(craft)networkprocessingcard(npc)singlenetworkprocessor(np)subsystem-10gigthroughputservicesprocessingcard(spc)singlehd-cpusubsystem/10gigthroughputroutingengine(re)1.2ghzprocessor/w1gbmemorycompleteseparationofcontrol/dataplanesincludescpp(centralpfecontroller)andcb(controlboard)i/ocards(ioc)3versionsatfrs:2-port10ge-xfp(sr,lr,er)16-portge-sfp(sx,lx,lh,t)16-port10/100/1000copper10gigfull-duplexthroughput(oversubscribed),ioc2x10ge,switchfabricboard(sfb),routingengine(re),fantraydoor,airintake,servicesprocessingcard(spc),ioc16xcopper,ioc16xsfp,frontslotguide,rearslotguide,servicesprocessingcards(spc),networkprocessingcards(npc)orspcs,dual-heightsfboptioncover(srx3600only),componentreview,whatgoeswhere,srx3x00sfbswitchfabricboard,virtualioc,controlpanel,ha-controlport0,note:bitsclocksupportwillrequiredaughter-card,ha-controlport1,bitsclock,singlestolichipprovides1610gbpsfull-duplex,non-blockingendpoints(320gbps).,srx3x00sfb-controlpanel,yellowalarmled,redalarmled,note:onlyreinslot0supportedatfrs.forfutureuse.,powerbutton,re0console,re1console,aggregatedcfmstatusleds,hastatusled,sfbstatusled,masterreaux/usb,re0ethernet,re1ethernet,srx3x00sfbvirtualioc,note:these“built-in”portswillnotworkunlessannpcandanspcareinstalledinthesystem.,port0/0/6,port0/0/7,port0/0/1,port0/0/8,port0/0/11,port0/0/0,systemconfigurationflexibility,flexibleconfigurationofiocs,npcsandspcs:srx3400:7slotsforcommonform-factormodules(cfms):4inthefrontforiocsandspcs3intherearfornpcsandspcs4spcsmax(1min)2npcsmax(1min)4iocsmaxsrx3600:12slotsforcommonform-factormodules(cfms):6inthefrontforiocsandspcs6intherearfornpcsandspcs7spcsmax(1min)3npcsmax(1min)6iocsmax,srx3400-dcislimitedbypowersupplycapacity.nohalimitations.,totalsystemcapacity,srx3400maximumcapacitiesatfrsac(1000wc19straight)4spcs,2npcs,1iocs:20gbpsstatefulfirewall1mtotalsessions120ksessions/second6gbpsidp8gbpsipsecvpndc(850w)3spcs,2npcs,1iocs(optimizedforfwperformance):20gbpsstatefulfirewall1mtotalsessions120ksessions/second4gbpsidp6gbpsipsecvpnsrx3600maximumcapacitiesatfrs7spcs,3npcs,2iocs30gbpsstatefulfirewall2mtotalsessions120ksessions/second11gbpsidp14gbpsipsecvpn,srx3400-dclimitedbypowersupplycapacity.nohalimitations.,combo-cp,unlikethesrx5ks,thefirstspcinstalledonansrx3ksplitsitsresourcesbetweencpandflowduty.thefirstspconlycontributestoflow:50%ofitsmemory500ksessionsinsteadof1m85%ofitscpuifonlyonespcinthesystem67%ofitscpuiftwoormorespcsinthesysteminitially,weightedround-robindistribution2:1withotherspus.thissession/cpuimbalanceleadstesttoolstounderrateperformanceinapproximately50%ofanspu.,srx3000withjunos9.4performance/scalability,srx5600,水平式机箱(8u)8个插槽最多6块spc/ioc最多2块scb（冗余）模块化接口40-sfp;4-10gig多核架构4电源冗余(n+n/n+1)性能防火墙吞吐率(大包)60gbps并发连接数9m,*最少需配1spc,srx5800,垂直式机箱(16u)14个插槽最多11块spc/ioc最多3块scb（冗余）模块化接口40-sfp;4-10gig多核架构4电源冗余(n+n/n+1)性能防火墙吞吐率(大包)120gbps并发连接数10m,*最少需配1spc,componentreview,ioc40 x1ge,switchcontrolboards(scb),routeengine(re),upperfantray,lowerfantray,controlpanel,airintake,ioc4x10ge,serviceprocessingcards(spc),srx5800frontpanel,yellowalarmled,redalarmled,routingengine1indications,routingengine0indications,fantrayindications,powersupplyindications,slotonline/offlinebuttons,alarmrelays,alarmcut-off,note:srx5600isbasicallythesame,srx5x00scb/reconfiguration,srx5800redundantfabricconfiguration3scbsinscbslot0(withre),scbslot1andscbslot211ioc/spcwithioc/spcslots0-5andslots7-11nonredundantfabricconfiguration2scbsinscbslot0(withre)andscbslot112ioc/spcwithioc/spcslots0-5andslots6-11srx5600redundantfabricconfiguration2scbsinscbslot0(withre),scbslot16ioc/spcwithioc/spcslots0-5nonredundantfabricconfiguration1scbinscbslot0(withre)6ioc/spcwithioc/spcslots0-5onlysinglerecurrentlysupportedperchassis,srx5x00switchcontrolboard,scbsaretheswitchandcontrolboardsscbactsasrecarriereachscbhastwofabricchips,but:scbinslot2doesnotsupportre(thoughitcanbepluggedin)controlpartandswitchpartonscbareoperatingindependentlyswitchpartcanoperatewithoutrebeinginserted,srx5k-re-13-20,srx5k-re-13-201.3ghzceleron-m2gbddr2-400sdram(2dimms).1gbinternalcfusb2.0flashdrivesupport30gbhdreisnotinvolvedintrafficprocessinghandlesallroutinghandleschassismanagement,highdensityarchitecture,i/ocards:sfpsorxfpsinitiallyserviceprocessingcard,srx5800,spc,ioc,serviceprocessingcard(spc)features&capacities,highthroughput20gbps2msessions2.2mpps100knewsessions/secondflexiblenetworkingandsecurityprocessingadvancedroutingstatefulfirewallidpnatdos/ddos,serviceprocessingcard,whatisanhd-cpu?highdensitycpucharacterizedby:multiplecoremultiplethread#coresx#threads=#virtualcpushighbandwidthinterfaces&memorybusspecializedacceleration(crypto,etc)easilyprogrammablebasedonstandardcpuarchitectures,blockdiagramserviceprocessingcard,statefulfirewallipsecvpnprocessingidpprocessingnat,dos,etc,switchfabric,serviceprocessing,fabricinterface,hd-cpu,hd-cpu,spc,iocfeatures&capacities,highdensityethernet40 xgigsfpinterfaces4x10gigxfpinterfaces2mentrysessioncachepernp40gbpsthroughputflowloadbalancingsecurityscreensrich,finegrainedqos,flowlookupscreensspcloadbalancing,majorfunctions:ingressioc,networkprocessor,fabricinterface,switchfabr