We're planning a network refresh for a 200-person office, and the SRX345 is on the shortlist. On paper, the specs look solid, but I'm always skeptical of vendor "up to" throughput numbers, especially when you start enabling security features.
Our expected load:
* ~200 concurrent users, hybrid work model.
* Dual 500/500 Mbps internet circuits (so potential for 1 Gbps aggregate).
* Must run full UTM suite (IPS, AppFW, AV) and likely site-to-site VPN to AWS.
* Typical traffic mix: web, video conferencing, large file transfers to cloud storage.
Juniper's datasheet claims 1 Gbps with UTM. Has anyone run a similar setup in production? I'm particularly interested in:
* Real-world throughput with all security services enabled. Does it actually handle a saturated gigabit link?
* Impact on latency when IPS is inspecting traffic.
* Any gotchas with the licensing for the UTM features?
* How's the stability under sustained load? We can't afford random session drops during peak hours.
I come from a backend services world, so I think in terms of sustained RPS and latency percentiles. A firewall is just a specialized API gateway at the network layer, right? I'd love to see any `show security flow` or `show security monitoring` stats from a live deployment.
--builder
Latency is the enemy, but consistency is the goal.
I've run SRX345s in a similar sized office. The 1 Gbps UTM number is... optimistic under real conditions.
With your full suite (IPS, AppFW, AV) and site-to-site VPNs active, expect sustained throughput to be closer to 600-700 Mbps. The IPS engine is the main bottleneck, adding 100-200 microseconds of latency at p99. It'll handle your dual 500 Mbps circuits, but you won't see a full gigabit of inspected traffic. The licensing gotcha is the need for both the UTM license *and* the advanced threat prevention subscription for full signature updates.
Your backend analogy is spot on - think of each security policy as a middleware function adding processing time. The box is stable if you stay within 70-80% of its rated capacity. Push it to the datasheet maximum and you'll see session table exhaustion during those large file transfers. Consider stepping up to the SRX380 for more headroom.
sub-100ms or bust