Source
r/networking•
esseph_

Juniper CGNAT/Firewall, MS-MPC-128 vs SRX5600?

I'm trying to figure out the best+scalable+cost effective solution for CGNAT/firewall in my environment. Right now I'm looking at using an MS-MPC-128, as it claims to handle about 60Gbps of overall service throughput. I can't find numbers on CGNAT/Firewall performance however, but I do have a lot of spare slots in an MX960 chassis.

I was also recommended using an SRX5600 (or similar), as it claims about 65Gbps of service throughput. I don't need most of the features though, and it doesn't seem like it would scale very well when we move up to 2x40Gbps feeds from our current 2x10Gbps feeds.

I'm leaning toward going with the MS-MPC-128, and adding additional ones as we grow.

Ideas? Anything I'm missing? Really only need firewall/cgnat/jflow here.

Posted Jan 29, 2016, 7:21 PM UTC

35
killbop•

definitely MS-MPC if you want high throughput for CGNAT. SRX will require lots of SPC and it will inflate the price. but be advised - performance depends on factors like: packet size, session rate. So that 60Gbps number is not an indication of what you will get with your traffic... Check with Juniper SE, they have benchmarks available. It can do Statefull FW, but i don't remember if you can run both on same MPC. Also I'd check what CGNAT features are supported on MS-MPC. Some stuff like Deterministic NAT are still on roadmap.

2
decrypt-this•

I would recommend going with the SRX5k series. The 5400 base throughput of 65Gbps (basic L4) with upwards of 400Gbps+ with express path. The current SRX5k datasheet has all of the updated information. SRX5600 has 130Gbps base throughput as well as the SRX5800 with 320Gbps. Express Path on the SRX5600 puts you at over 960Gbps as well as 2Tbps on the SRX5800. Those are fully loaded and perfect scenarios but I'm not sure why you believe it wouldn't scale well?

1
dark_15JNCIE-SEC #69 JNCIE-ENT #492•

The bigger question is - does all traffic need session inspection and NAT applied? If the answer is no, then the MS-MPC-128 might be a better way to go. If yes, then I'd look at the SRX5600 with ExpressPath. The SRX5400 isn't a good idea since it lacks redundancies for the RE/Switch Fabric. Also if you're going to cluster the units, lacking redundant cluster control ports means you'll have a bad time.

1
esseph_OPinsurance companies HATE him!!!•

No, not all traffic would need NAT... I would say probably 10-15 Gbps initially. We will be rolling out native ipv6 as well though, so those NAT numbers will drop over time (but not as quickly as many of us would like).

1
dark_15JNCIE-SEC #69 JNCIE-ENT #492•

So here's the rub then - the SRX is an awesome high-speed platform, but in the datacenter end all traffic is stateful. Unlike the branch series or the vSRX, there is no way to bypass flowd. If your mix of traffic requires to bypass flowd then you'll have no choice other than to use the MS-MIC. That being said, the SRX does support stateful inspection of IPv6 and is pretty comprehensive at that.

2