We rolled out a pair of SRX345s as our new edge firewalls about a year ago, moving off an older Cisco ASA platform. Wanted to share some real-world impressions.
The good: Junos is incredibly powerful once you get the hang of it. The commit/rollback model is a lifesaver for making changes remotely. Security policies are logical, and the integration with our IPAM for address books via a small Python script has been great for automation.
The not-so-good: The learning curve is real. The CLI syntax is deep and very different. Had a few late nights early on where I rolled back a bad commit. Also, the built-in web interface (J-Web) feels dated; we do everything via CLI or automation scripts now.
For our size, they've been rock solid. No crashes, throughput is as advertised. The Application Security (AppSecure) feature set is robust but takes time to tune properly to avoid false positives. Support experience has been positive the one time we needed it.
Would I buy them again? For our use case, yes. The operational confidence from commit/rollback and the scripting flexibility won us over. But I'd budget more time for the team's initial training. It's a different beast.
Yeah, that Junos learning curve is no joke. I felt the same way coming from a Cisco shop years back. The moment it clicked for me was when I realized the config hierarchy is actually a huge advantage for automation - you can target specific sections so cleanly with scripts.
Totally agree on J-Web being left behind. It's a shame because a good GUI could really help during the onboarding phase for teams. We ended up using a third-party tool (Ansible) as our "single pane of glass" for changes, and it's been great.
That commit/rollback model, though? Absolute game-changer for making remote changes with confidence. No more "pray and hit enter". Makes the late-night config sessions a lot less sweaty
Let the machines do the grunt work
Great write-up on the SRX345s. That commit/rollback model is seriously addictive once you've lived through an ASA "pray and reload" session.
One thing I'd add: don't sleep on `commit check` before a full commit. It validates syntax and dependencies without actually applying the change. Saves me from rolling back a bad commit before anyone notices.
Also, your IPAM integration via Python sounds slick. We do something similar with a script that pulls address objects from our CMDB and pushes them via NETCONF. The hierarchy really does make targeted config changes a breeze once you get used to it.
Have you played with `show system commit` to review your change history? Handy for audits.
>"pray and hit enter" is the perfect description for the ASA life. That anxiety evaporates with commit/rollback, it's true.
But let's be honest about the hierarchy for automation: it's great until you're trying to do a simple lookup. Ever tried to parse the raw config output with a script? The indentation is a nightmare. You *need* to use NETCONF or the structured JSON output, otherwise you're in regex hell.
Ansible as the single pane is the move, for sure. We do the same. Means the team only needs to learn YAML templates, not Junos syntax. The new guy doesn't have to touch the CLI for six months.
NightOps