SRX

Hi, i'm facing to problem of more than 1Gbps IPSEC vpn.

Choosing berween 1400 and 3400

And want to ask about Processing cards, because at this moment i have only 650s and 240s.

I need router only for fastest VPN and nothing more - what cards do i need?

In datasheets written AES256+SHA-1 / 3DES+SHA-1 VPN performance SRX1400 - 2 Gbps, and SRX3400 6 - Gbps.

Theese speeds calculated with what cards?

If i will use for example just DES or AES128 - will i have more spped?

Hi,

I suppose you took those values from the "Product & Services" page ?

If it is so, these values should be the ones you get by buying the base kit/box

I haven't had time to double check, but i suppose that the SRX1400 and higher have, like the MX routers and other series additional modules to further increase the performances.

Remember that the encryption capabilities are affected by the packet size.

The given numbers refer, most probably, to the "standard" IMIX traffic .

However if you have on average more big packets your bandwidth will be better, on the other hand if you have more small packets you might end up with a worse bandwidth than indicated.

If you cange the encryption system you might see some slight bandwidth gain, but i wouldn't expect the gain would be very significant

Cheers

Andy

---

@Andy C wrote:

Hi,

 

I suppose you took those values from the "Product & Services" page ?

If it is so, these values should be the ones you get by buying the base kit/box

---

Not quite...

The SRX1400 uses an integrated "NSPC" card that combines the NPC and SPC functions onto a single card.  It is my understanding that an SRX1400 with the NSPC card is rated at the advertised speeds.

However, the SRX3400 uses separate NPC and SPC cards, and supports multiple of each.  It doesn't appear that us lowly customers have the ability to see any scaling or spec buildout for how many cards of each type are needed, it looks like that info is reserved for Juniper employees and partners only.  To achieve max performance and capacity in the SRX3400, based on the datasheet, it must be fully loaded with 4 SPCs and 2 NPCs.

---

@keithr wrote:

 

The SRX1400 uses an integrated "NSPC" card that combines the NPC and SPC functions onto a single card.  It is my understanding that an SRX1400 with the NSPC card is rated at the advertised speeds.

 

---

Sorry but i don't think that you are not right

BASE 1400

SRX1400BASE-GE-AC 

But i think if i want more than gigabit per sec encryption - better to buy

SRX1400BASE-XGE-AC 

And there is an option

Network and Services Processing Card (NSPC)SRX1K-NPC-SPC-1-10-40 that costs 20 000 $

So looks like SRX1400 doesn't come with integrated NSPC

---

@keithr wrote:

 To achieve max performance and capacity in the SRX3400, based on the datasheet, it must be fully loaded with 4 SPCs and 2 NPCs.

---

About SRX3400 - are you sure that I need 6 more cards to reach maximum encryption speed? They are pretty expensive.

---

@rijiy wrote:

 

Sorry but i don't think that you are not right

BASE 1400

SRX1400BASE-GE-AC 

SRX1400 Chassis, Backplane, Fan, RE, AC PSU, GE-SYSIO - no NPC/SPC

10 000 $

But i think if i want more than gigabit per sec encryption - better to buy

SRX1400BASE-XGE-AC 

SRX1400 Chassis, Backplane, Fan, RE, AC PSU, XGE-SYSIO - no NPC/SPC

25 000 $

And there is an option

Network and Services Processing Card (NSPC)SRX1K-NPC-SPC-1-10-40 that costs 20 000 $

 

So looks like SRX1400 doesn't come with integrated NSPC

 

---

 

I didn't say it comes with it -- I said it uses an integrated NSPC.

When you buy the SRX1400 you have to put NPC and SPC functionality into it.  The base units don't come with any.  You have the option of using the NSPC integrated card which ONLY works in the SRX1400, or you can use the SPC and NPC cards from the SRX3000-series, and you put them into a double-wide adapter slot.  They give you that option in case you already use SRX3000-series components and you want to use the same cards in the SRX1400.  It's all in the datasheet.

---

@rijiy wrote:

About SRX3400 - are you sure that I need 6 more cards to reach maximum encryption speed? They are pretty expensive.

---

Yes, they are expensive.  And yes, in order to get full performance you need to fully load the chassis with processing cards.

Again, it's all in the datasheet.  Your reseller / VAR can confirm.

OK

Thanks for your reply

one more question about 1400

For reaching 2 gigabits from datasheet i need to buy more expensive XGE commutation fabric, or i can try to reach this speed with GE commutation fabric?

That would depend on how you need to connect the SRX.

Obviously you can't get 2Gbps of VPN throughput over a single Gig uplink/downlink.  If you plan to use multiple Gig connections to your connected devices and the 2Gbps is aggregate, then you probably don't need the 10G modules.

If you plan on trying to get 2Gbps over a single connection, then you'd need 10G ports.

I'd suggest you talk to a sales engineer or your VAR/reseller.

Keith - nice explaination of the cards on the 1400!