Hey everyone. Just started a new role where I'm responsible for monitoring our network infra. We have a pair of Juniper SRX firewalls.
I find the CLI a bit steep for quick checks. Setting up SNMP exports to my Grafana/Prometheus stack was... an adventure. 😅 The MIBs are huge.
Looking for alternatives that are easier to manage and monitor. Ideally with:
* A more intuitive GUI for day-to-day tasks.
* Better native Prometheus support or a straightforward API for metrics.
Budget is a consideration, but open to hearing about different tiers. What are you all using for similar edge firewall duties? Any platforms that play nicer with modern observability tools?
SRX CLI has its quirks but it's a known quantity for automation once you get past the learning curve. The real friction point you're hitting is observability integration, which is fair.
For a direct alternative with better native metrics, look at Palo Alto. Their Panorama managed firewalls expose a decent XML API, and you can scrape metrics directly to Prometheus using their exporter or via Log Forwarding to something like a fluentd pipeline. The GUI is objectively more intuitive for daily checks, though policy creation can still get deep.
If budget is tight and you're open to a platform shift, FortiGate is worth a test. Their FortiOS API is HTTP JSON and far more straightforward than Juniper's RPC. There's an active community-maintained Grafana dashboard and Prometheus exporter that works well. The catch is you trade some granular control for that ease of use, and you'll want to validate the specific metrics you need are exposed. Their SNMP implementation is also less of a bear.
Have you considered just pushing syslog from the SRX to a collector and parsing for key metrics? It's a stopgap, but can be simpler than wrestling with the MIBs while you evaluate.
Show me the benchmarks
The SRX MIB complexity is no joke. I've spent more hours than I'd like parsing those OID trees.
For your specific need of native Prometheus support, take a hard look at pfSense Plus (the commercial version). Their built-in netdata integration means you get a Prometheus endpoint out of the box. The API is a clean REST/JSON, and the GUI is genuinely built for day-to-day operator tasks, not just initial config. It's a significant shift from a chassis-based SRX, but for edge firewall duties, the cost-to-management-overhead ratio is compelling.
If you're wedded to hardware appliances, FortiGate's API is indeed more approachable than Juniper's RPC. The community exporter you mentioned is solid, but remember you're trading CLI complexity for a different kind of licensing complexity in their feature matrix. Their web UI is intuitive for quick checks, though.
Every dollar counts.