Juniper SRX Series Firewall Reviews

We leverage this as a firewall and for IT tech services. It's more of a firewall used in a router sorting device. I see major benefits from leveraging it like this.

This is a product on the customer side, not in our services. What I have identified so far is that, considering the complex deployment that the customer wanted to make, the scalability with the feature support that they already have, and its functionality provided, Juniper SRX was one of the better products available. It helped us to scale well with that product customer requirement because they wanted the IT side on a virtual router, with a firewall so it was integrated to work. Such a complex setup cannot be easily accomplished by just using a firewall. SRX actually helps us scale and integrate the product according to customer requirements. It also helped us with its routing capabilities which eased the cost, because otherwise I would have had to take a router and firewall, and then integrate it. With this, however, it was an integration of firewall and routing services all together in a single product. That was one thing that I loved about it.

IPS is something that I do not find valuable, but the other features are awesome. Firewall IP second router is good, but IPS needs to be worked upon.

IPS, or IDS services, need improvement. Their major problem is that you have to integrate it with MSN or web building services, you need to buy support for that and services but you cannot. The best thing that I see was a filtering service with custom categories that I can create. If I buy a license, I can integrate it with a different product, but their own web building services is poor. So they can improve web building services, as well as look for application awareness, and maybe, with IPS, they can have their own built-in services rather than integration with MSN for using IPS. There are three things that can be improved.

IPS is one that I would definitely want to be improved. I would also like SSL VPN to be integrated. Other than that, I guess it's doing a firewall, so I would say it's cool. Next in features, I would want that to be included, along with SSL VPN, if possible. Other than that for the product, I don't think there's a need for doing anything with this.

More than 7 or 8 years

It's cool. I would say it's one of the most stable services. Providing for redundancy is a bit challenging, but it actually is something that can be worked upon because they have a different concept of highway building, as opposed to general people doing stuff. I would say it is a good, stable product, except for the problematic part of it. If people are not aware of how to deal with it, it can be very cumbersome.

You can scale it well, but when you scale you need to take a product out to another one. On a scale level, it's a very good scalable product. It's a good firewall so if you pump it in high traffic, it will be able to adapt to it, unless and until you outgrow its throughput. Then you would either have to get a new model or maybe if you have to avert your firewall, you might have to upgrade it to a new version. So far it's a good product.

This was for a 1,000 user base.

You don't need extra staff to maintain the solution. Unless and until you have a problem of lags or circuit issues, I don't think you need extra staff. One SE should be fine with this product.

I think there will be future plans to increase usage and get more devices. We are also trying to leverage this into a cloud platform, so there would be some more usage.

The technical support or tech team is good. So far, when I worked with them, they have been able to resolve issues firmly. If they cannot do it, they connect you with someone you can work with, so they can just connect to the engineering team. Their data services is something which is really good.

However, their documentation is a bit more challenging. They have unsourced to work, like knowledge base articles and stuff, but they would need to work a bit more on the documentation to compare with Cisco documentation. That's something that they can improve on. They have good documentation. The documentations are clear, but there is not sufficient content available.

The initial setup was very simple. I would say it was the simplest one to date.

Deployment time depends on the solution. This was a very complex one, so it took us four weeks to get the most complexity out of it. I think taking a single deployment, it would not be more than a couple of hours. If you are already working with Juniper products, it would be a couple of hours. If you're not working with Juniper products, maybe a week, not more than a week.

I did the implementation myself, I don't normally take help but in scenarios where documentation is not available, I do go ahead and refer it out but this was simple. I don't think I needed the technical support staff, but I have worked with Juniper tech for certain scenarios in integrating this. It was tax-supported, non-profit services.

There was no additional licensing cost because there were no IPS services. It was just a firewall IP circuit router so they have the default licensing. We just need to renew the support yearly.

Our customer evaluated Palo Alto also. They liked it, and even integrated it, but the scalability requirements they had were an issue. They loved Palo Alto for the security services, but their requirement was routing and security in a single device. That's the reason they were not able to go with the Palo Alto services, but they chose Juniper.

If you're looking for a product that can give you routing as well as security services, and you're not looking for too much taxing on the security part, I guess this is a good product. If, however, you're looking for security services on a greater edge, maybe something like next-gen firewall features, referencing services, or IPS to a greater level, I would recommend going with other security products. If you want integration of both, you can use this, and maybe if you evaluate, or move forward with better services over a period of time and better models of that, maybe this is something that you can always look for both, routing as well as security services.

SRX is a security product that's not that good on security, but it's good at routing, so they actually balance out. I would rate them around six of ten. 

Cisco does one thing right. Cisco has AnyConnect so they can fully integrate SSL routing services. Previously Juniper used to have Pulse Secure and MAG devices. They sold it off to Pulse Secure, but maybe they could try to integrate SSL VPN with their products. Maybe that would help them increase market share.

I like the routing and firewall features.

The workplace management console needs improvement. It should be a little bit more developed. Also, the interface needs a bit more improvement.

If the solution would have an intuitive interface would be much better because the work-based interface is not so perfectly developed and it's not ideal. It's not complete yet, and it makes it difficult for beginners and first-time users of this solution. As it is, for new users, it would make it very difficult for them to deploy this solution. Otherwise, the rest is fine. There's no other problem with it.

In terms of stability, everything was okay except for one situation which happened about three years ago. There was an upgrade which was released. Once we got the upgrade on the software, it would crash and it wouldn't work as it had before, so we had to downgrade to the previous version. Once we started using that there was no problem.

Due to sanctions, we haven't used the technical support of the original company so the maintenance and everything is done by us.

We were using a different solution, a Microsoft solution. We were looking for a more affordable solution which would suit our needs.

The initial setup was difficult the first time. It was a little bit complicated, but after it was done, we've been using it just fine and there's no problem with the use. It was the first time we were using a firewall, the initial setup procedure took about one month to define all the zones. 

We extend the license yearly and the prices, because of the sanctions, are expensive and costs much more compared to other solutions. It's pricey compared to other locations where there are representatives and you can buy directly from them.

At the moment the solution satisfies our needs. There are no extra features that we need at the moment.

I would rate this solution 8.5 out of 10 because it seems to satisfy our needs. Everything seems good and works fine.

We primarily use this solution for data center segregation.

The features that are most valuable are the high-speed interfaces and MPLS.

The throughput when using features can be improved.

100-gigabit interfaces should be added into the next release because we'd like to adopt them.

The solution's stability is very good.

The scalability of the solution is limited.

We did use a different solution. The old boxes were at end of life.

The initial setup was complex because we have a complex network.

I find that the interfaces are okay. The big thing is performance. With all the features turned on it slows down.

The advice I would give to everyone is to specify a larger box than you think you need.

Due to the performance indications, I'd rate this product as a 7 out of 10.

I've found the security features, such as IDS and the VPN most valuable.

In terms of other features, I'd like to see a web filter, 10 point control, application control and DNA features in the next release.

We previously didn't use a different solution.

I would rate this solution a 7 out of 10.

The most valuable features in this solution are AppSecure and the IPsec VPN.

The solution previously had a Clientless SSL VPN, but it has been removed and I would like access to it again.

The GUI needs improvement. I can work fine with the command line (CLI), but new people would like a better user interface.

I would like to see an SSH VPN in the next release.

I am very satisfied with the stability of this solution.

We have more than one hundred users for this solution. They range from non-technical, Level 1 users, up to administrators, technical support staff, and expert-level users.

I am satisfied with their technical support. It is better than what I have experienced with some other solutions.

This is the first solution that we implemented.

I find the setup simple, given that I have been using it for ten years. The deployment is quite easy and fast.

The price of this solution is more than other products, but it's stable, and the technical support is better than I have seen with others.

The solution was in place before I joined the company, so I am unaware if we evaluated other solutions.

We have found this solution to be easy to implement and easy to use. It is a little more expensive than some products, but it is worth the investment.

I would rate this solution an eight out of ten.

Our primary use case is for MPBN, where we provide a firewall for our mobile data customers. As an ISP, we protect the 2G, 3G, and 4G customers.

The most valuable feature is the virtualization because it can be used for customers who are using the mobile data network to request a private connection to a remote site.

There are also standard security features such as NTP groups and firewalling features and these are also good. 

The Juniper product has to improve in terms of innovation.

It only has standard reports, such as memory capacity and data traffic. By comparison, the Check Point solution comes with great reports. Check Point tracks the logs, then analyses the logs and can tell you when you are under attack. Then, you can prevent it. With Juniper today, what you have in terms of log analysis is not so good. I think that they have another solution for this, but it is not embedded, and you have to purchase it separately.

Since we have deployed, there have been maybe two or three minor issues. Our local support helped us to clear these.

I cannot really tell if it is scalable because we are managing twenty gigabytes of traffic on the node. They say that it can scale up to almost one terabyte, but we don't have the capacity so I can't really tell.

This solution is used for all of our mobile customers, which is approximately twelve million. All of our 4G customers use it. This includes standard users who want internet access on their phone, as well as those who want a VPN connected to a private server.

I would rate their support seven out of ten.

The technical support directly from Juniper is too expensive, so we receive support from our local reseller instead. This can take between one and three hours, which at times is not up to our company standards.

While the Juniper support staff is skilled, is it too expensive, which is why I rate it seven.

At one point we tried to move the mobile data firewall from our Juniper SRX56 to the Cisco ASA 5585. What we found out is that Cisco was not performing well at all. I was very disappointed by the Cisco solution. There were more issues for the same amount of traffic. With Juniper, you just have to upgrade to handle additional clients, but when we tried with Cisco, definitely the result was not good at all.

The initial setup was straightforward, especially compared to that of Cisco. It was very simple with the help of our local provider.

From the design phase up to the implementation stage took approximately one month per site. This included the time to validate the design documents and then validate and approve the changes. We needed to slot a window of time for the change, consider whether there is any impact on the customer, and then monitor what happens during the change. For both of our sites, it took approximately three months.

For the design and clarification, we had one person for four nodes. In terms of operations, we have two engineers.

Our local provider assisted us with the implementation of the final solution. In Cameroon, we had Erikson, and they knew what they had to do so it was really straightforward.

While the price of support is expensive, the price of the solution, itself, is not.

The problem came about when we tried switching to Cisco and discontinued our support. In order to subscribe again later, we had to pay a reinstatement fee. We found out that if you have not used the product for a certain period of time, you have to pay for this period before paying for a new year of support. Say, for example, that you don't pay for support for one year. That year must be paid for, first, before getting support. That is why I am saying that support is expensive, in my opinion.

We did not evaluate vendors other than Juniper and Cisco because in the enterprise we have a set of approved vendors for each sector and these are two only two in this group.

My advice is to make sure that you have local support because it is very important. Juniper does have some good options in terms of support.

This is not a perfect solution because I think that there is still room for improvement, but I think it is the best solution that I have tested for MBPN.

I would rate this solution an eight and a half out of ten. 

The primary use case is a combination of a firewall, router, and VPN termination device.

It allows us to do remote configuration changes, and if there is a problem, not losing connectivity to the device.

I really like the Juniper operating system. It is more of a UNIX based system, more than Cisco, and I really like it. There is a lot of flexibility in how you can commit, check, and back out of a configuration.

In terms of improvement, it could use more on the security side. It's a good stable firewall, but it's nowhere near what it needs to be for a next-generation type firewall. 

They also need to improve their documentation. With Cisco, you can find lots of examples, but with Juniper, it is not always the case. One area that needs more focus is instruction on how to interoperate with other vendor's products. I would like to see documentation on running IPsec tables between Fortinet and Juniper or Cisco and Juniper because the information is not there.

Their technical support also needs improvement, as they are lagging behind Cisco.

This is a very, very stable solution. Again, their operating system is outstanding. Really, this is what differentiates it.

In terms of scalability, it clusters nicely so you can put it into a stacked mode. The size that it is meant to serve, it does very well. It is not meant as a large enterprise-type firewall. Rather, it is meant for a small to medium sized customer.

We currently have about seventy-five users, and we don't plan to increase that number at this time.

I would say that their technical support is ok, but it needs improvement. This is an area where they are not as good as Cisco.

We migrated to this solution from a Cisco ASA (Adaptive Security Appliance).

Transitioning from the Cisco ASA that we had running took about two hours of planning and another two hours of execution time.

In terms of the maintenance, myself and one other person take care of everything. We take on small contracts all over the place.

I handled the implementation for this solution myself.

The pricing is perhaps half to around forty percent of Cisco. 

Juniper is my favorite and I had used it so much that we did not evaluate any other products.

This solution is really nice to use. It's very similar in terms of capabilities to a Cisco, but it's just that the operating system is so much nicer to use.

I would say that you need some time to get comfortable with the operating system if you've never used it before, but don't let that scare you. Buy it and put it on your desk for a week, then play with it. If you've got a live environment or if you've got some type of simulation you can set it up in, it won't take long and you can feel comfortable using it.  

I would rate this product an eight and a half out of ten.

Our primary use case is consultation and deployment of the solution. We operate as a Juniper Elite Partner. Our customers, large enterprises, want to prevent network failure and downtime.

Improvements can be made to the GUI. The GUI can be improved by creating policies to handle IPS requirements. The configuration should be a one-step process. This would make it easier to complete the setup to register the time of operation.

Yes, it's very stable.

It's scalable. Juniper Select has a solution to boot in high availability technology. We use the Juniper Select from low-end and high-end. In my position as a Senior Network Security Engineer, I handle the high-end suite of Juniper Select 5K.

Currently, the solution is being used every day. We have plans to increase usage in the future.

Technical support is good. They seem to understand our customer's requirements. When they troubleshoot or support our customers, they seem to know what they are doing. They seem to be very helpful. But customers need support right away, and this has been an issue. It can take two to three days to get help some times just because of the volume of ticket request. 

Previously we used a CISCO ASA solution. But in the last three years, we switched to the Juniper solution because Juniper has a competitive price per feature.

The initial setup was complex. It took a group of five, engineers and architects, to get it up and running within 24-hours. And it takes a group of five, engineers and IT experts, to operate and maintain

Licensing which covers maintenance is on an annual basis. Our customers are on one-year contracts. There are additional cost above and beyond the standard licensing fees.

Before choosing Juniper, we evaluated a Fortinet solution because Fortinet has a competitive price. It's also effortless for our engineers to operate and maintain. They can understand and complete tasks quickly. 

Further advice regarding this solution is that anyone planning to implement this product should understand the Juniper suite. They should understand the firewall concept, Juniper configuration, and the command line. They need previous experience with Juniper products. 

On a scale from one to ten, one being the worst and ten being the best I'd give Juniper SRX an overall rating of eight because of its' competitive price. But it's a very complex product compared with other similar products.