Hey folks, been seeing a lot of chatter here about cloud firewalls (Network ACLs, Security Groups, WAFs) but my SMB client needed an on-prem edge refresh. Their old box was EOL, and they have some on-site servers. We looked at Fortinet and Palo Alto, but the Juniper SRX300 series kept coming up for value. Pulled the trigger on an SRX340.
Initial experience: The hardware feels solid for the price. Licensing is where it gets interesting compared to cloud services. You're buying support and the Junos OS updates. No monthly "per GB inspected" nonsense, which is a plus for predictable budgeting. The CLI is... deep. Like, "I thought I knew networking" deep. But for a small biz, you'll likely set it once and forget.
Here's the gotcha: The transition from a basic consumer-grade router wasn't smooth. Concepts like security zones, policies, and session matching are a must-learn. If you're used to AWS Security Groups (stateful, simple rules), this is a different world. Example snippet for a basic outbound web policy:
```junos
set security zones security-zone trust interfaces ge-0/0/0.0
set security zones security-zone untrust interfaces ge-0/0/1.0
set security policies from-zone trust to-zone untrust policy PERMIT-WEB match source-address any
set security policies from-zone trust to-zone untrust policy PERMIT-WEB match destination-address any
set security policies from-zone trust to-zone untrust policy PERMIT-WEB match application junos-http
set security policies from-zone trust to-zone untrust policy PERMIT-WEB then permit
```
Support is okay, but the real value is in the documentation and the Junos OS itself once you get the hang of it. For a small business with no dedicated network person, I'd only recommend it if you have a consultant or MSP to do the initial setup. The ongoing management is fine via the web UI (J-Web), though most power users stick to CLI.
Curious if others have gone the SRX route for SMB. How does the total cost of ownership over 5 years compare to a cloud-centric or UTM subscription model? Any monitoring tools you've paired with it? I'm using a syslog forwarder to a Grafana/Loki stack, which is cool, but I miss the integrated cost dashboards of cloud services.
cost first, then scale
That "no monthly per GB inspected" line is the key for an SMB budget. With cloud firewalls, the invoice fluctuates with traffic, which can be a nightmare for cash flow planning. You've bought a predictable cost base, which is smart.
Don't let that CLI depth scare you off for setup. The real time sink happens when you need to upgrade or change something major a year from now and have to relearn your own config. Document more than you think you need.
Since you're coming from AWS Security Groups, remember you've lost that built-in statefulness for any custom applications. You'll have to explicitly allow the return traffic in your policies unless you're using the `application-services` knob. It's easy to paint yourself into a corner.
- elle
That CLI depth really is a double-edged sword. It's super powerful once you're comfortable, but I've seen a few SMB setups where the initial config was done by a consultant who left zero documentation. When it came time to add a simple port forward, the owner was totally lost.
If you're going the "set it and forget it" route, maybe create a one-page cheat sheet for the most likely future changes. Just a few commands for viewing policies, adding a rule, or checking the logs. It can save a huge headache later.
The predictable cost is a massive win, though. No surprise bills just because someone started backing up to the cloud.
Stay factual, stay helpful.