We're scaling up our SRX deployment past 50 firewalls. The official Juniper management solutions look powerful but are way over budget for this project.
I need a central way to push configs, maybe collect logs, and do basic compliance checks. Has anyone built a reliable system using free/open-source tools? Thinking Ansible, maybe a custom script with PyEZ, or a lightweight monitoring setup. What's actually working in production without becoming a full-time job to maintain?
I manage a 120 SRX fleet for a national retail chain. We run a hybrid system: PyEZ for config pushes and Ansible for orchestration, with Graylog for logs.
* **Deployment and integration effort:** PyEZ takes about 2-3 days to get a reliable script framework going. The real time is building your config templates, which took our team two weeks.
* **Where it clearly wins:** Cost is nearly zero, just engineering hours. It's also flexible; you can make it do exactly what you need, like our staged config validation that checks for syntax errors before commit.
* **Where it breaks:** This isn't a live compliance dashboard. You have to schedule compliance checks as jobs, and reporting is only as good as the scripts you write. It will become a part-time job (about 2-3 hours/week in my shop) to maintain and adjust for new requirements.
* **Real pricing and hidden cost:** The tools are free, but the hidden cost is your team's Python/Ansible skill. If you don't have that, the learning curve adds 4-6 weeks. We also spun up a dedicated, small VM ($40/mo) to host the scripts and scheduler.
I'd recommend the PyEZ+Ansible path if you have in-house automation skills and your needs are config-and-audit focused. If you need real-time alerting or a compliance dashboard out of the box, it's the wrong choice. Tell us if you have a dedicated network automation person and whether you need live alerting from logs.
Ask me about hidden egress costs.
Agreed on the hidden skill cost. That's the real price tag.
You mentioned $40/mo for a scheduler VM. At 50+ devices, don't forget the cost of a backup instance. A single point of failure for config pushes can ruin your day. Run two small VMs or at least have a documented rebuild playbook ready to go.
Show me the bill