Juniper SRX 1500 Firewall Performance 9 Gbps (1518 bytes)

Product Overview

The SRX 1500 Services Gateway is a next-generation firewall and security services gateway offering outstanding protection, performance, scalability, availability, and security service integration. Designed for port density, a high-performance security services architecture, and seamless integration of networking and security in a single platform, the SRX 1500 is best suited for client protection in enterprise campus, regional headquarters or cloud-based security solutions with a focus on application visibility and control, intrusion prevention, and advanced threat protection. The SRX 1500 is powered by Junos OS, the industry-leading operating system that keeps the world’s largest and most mission-critical enterprise networks secure.

SRX 1500 is one of newest product from security family of Juniper Networks. Juniper SRX 1400 is a previous product with the similar performance and capacity with SRX 1500.

SRX 1400 SRX 1500
Form Factor 3U (3RU) 1U (3RU)
Firewall Performance    10 Gbps 10 Gbps
(max)
Firewall Performance       -  9 Gbps
(1518 bytes)

*performance of data is based on datasheet

I have tested with simple test for one of performance SRX 1500 in lab environment use traffic generator with parameter mention in datasheet 1518 bytes. Next time I will test Juniper SRX 1500 to get maximum firewall performance.

Datasheet Actual Test
Firewall Performance         9 Gbps 9227892208 bps
(1518 bytes)

- 9227892208 bps
- 768991 pps
- CPU: 33% (FPC)
- memory: 19% (FPC)

hermawan@SRX1500> show interfaces | match "Desc|rate" | except "0 pps"
    Description: ge-0/0/1.0 - 001
  Output rate    : 9227892208 bps (768991 pps)
    Description: xe-0/0/16.0 - 003
  Input rate     : 9227898200 bps (768991 pps)

hermawan@SRX1500> show security monitoring
                  Flow session   Flow session     CP session     CP session 
FPC PIC CPU Mem        current        maximum        current        maximum

  0   0  33  19              1        2097152              0              0

Bandwidth VS Speed

I have not updated this blog for long time, due to busy and enjoy with new role on my daily job. My current role is Sales Engineer or some of people say Solution Architect. This is very different with my previous role in mostly as Project and Support Engineer with daily activity hands-on devices. Sales Engineer is combine technical perspective and soft skill to communicate product and solution to customer.

Lets back to main topic 'Bandwidth VS Speed'.

Some of people understand bandwidth and speed is same but for actual both is very different meaning. Bandwidth is how much or how many or how wide the way go to destination or to reach destination or to get something from destination, the unit on internet network world is bit or byte. We can say bandwidth is capacity of the way go to destination. Speed is how fast the source go to destination or to get something from destination, the unit on internet network world is bit/s ( bit per second ) or byte/s ( byte per second ) Even bandwidth and speed is different meaning but the both is related, lets look below tested.

# Server (receiver):

$ iperf -u -s
------------------------------------------------------------
Server listening on UDP port 5001
Receiving 1470 byte datagrams
UDP buffer size:   107 KByte (default)
------------------------------------------------------------
[  3] local 10.0.1.5 port 5001 
connected with 10.0.1.10 port 65299
[  3]  0.0-10.0 sec  1.25 MBytes  1.05 Mbits/sec  0.008 ms    
0/893 (0%)

# Client (sender):
# Please look at below with bold text ( sentence is confusing ), Bandwidth value use Mbits/sec

$ iperf -u -c 10.0.1.5 -b 1M
------------------------------------------------------------
Client connecting to 10.0.1.5, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 9.00 KByte (default)
------------------------------------------------------------
[  3] local 10.0.1.10 port 65300 
connected with 10.0.1.5 port 5001
[ ID] Interval      Transfer     Bandwidth
[  3]  0.0-10.0 sec 1.25 MBytes  1.05 Mbits/sec
[  3] Server Report:
[  3]  0.0-10.0 sec  1.25 MBytes  1.05 Mbits/sec  0.003 ms 
0/893 (0%)
[  3] Sent 893 datagrams

Cisco Etherchannel or Aggregate Cause of Forwarding Loops

The Etherchannel is an aggregated set of several physical interface as a single logical interface. The purpose of Etherchannel is to provide greater capacity than a single avaibility physical interface. The creation of danger to avoid is forwarding loops, due to two interface or more connect to same device. The Spanning Tree Protocol (STP) should be avoid forwarding loops, but some condition for example channeling ports aren't consistent, intermittent physical layer can be reason of forwarding loops.

But don't worry if you are configuring good etherchannel, the physical port will remain down untul port-channel is up.

%EC-5-STAYDOWN: Fa0/1 will remain down as its port-channel Po1 is admin-down

Here is the output of Etherchannel didn't worked :

STP will keep one of physical port which incorrect configuration remain block (BLK).
The condition will be danger if both of port Fa0/1 and Fa0/2 should be as one port-channel keep in forward and loops will be happen.

SW1#show spanning-tree vlan 200

VLAN0200

  Spanning tree enabled protocol ieee

skip

Interface           Role Sts Cost      Prio.Nbr Type

------------------- ---- --- --------- -------- --------------------------------

Fa0/1               Root LRN 19        128.1    P2p 

Fa0/2               Altn BLK 19        128.2    P2p 

Fa0/3               Desg FWD 19        128.3    P2p 

To avoid forwarding loops, this is best practices to config Etherchannel L2.