Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United
States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other
trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify,
transfer, or otherwise revise this publication without notice.
Revision History
August 2012—Revision 08
December 2012—Revision 09 Added NP-IOC, moved CFM and module content into SRX1400, SRX3400, and SRX3600 Services Gateway
Module Guide
June 2013—Revision 10 Incorporated additional warnings that the chassis must be connected to earth ground
December 2013—Revision 11 Minor revisions.
The information in this document is current as of the date on the title page.
SOFTWARE LICENSE
The terms and conditions for using this software are described in the software license contained in the acknowledgment to your purchase
order or, to the extent applicable, to any reseller agreement or end-user purchase agreement executed between you and Juniper Networks.
By using this software, you indicate that you understand and agree to be bound by those terms and conditions.
Generally speaking, the software license restricts the manner in which you are permitted to use the software and may contain prohibitions
against certain uses. The software license may state conditions under which the license is automatically terminated. You should consult
the license for further details.
For complete product documentation, please see the Juniper Networks Web site at www.juniper.net/techpubs.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks
software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at
http://www.juniper.net/support/eula.html. By downloading, installing or using such software, you agree to the terms and conditions of
SRX Series Documentation and Release Notes on page xi
•
Obtaining Documentation on page xi
•
Documentation Feedback on page xii
•
Requesting Technical Support on page xii
Objectives
This guide describes hardware components and installation, basic configuration, and
basic troubleshooting procedures for the Juniper Networks SRX3400 Services Gateway.
It explains how to prepare your site for services gateway installation, unpack and install
the hardware, power on the services gateway, perform initial software configuration, and
perform routine maintenance. After completing the installation and basic configuration
procedures covered in this guide, see the Junos OS configuration guides for information
about further Junos OS configuration.
Audience
This guide is designed for network administrators who are installing and maintaining a
Juniper Networks SRX3400 Services Gateway or preparing a site for services gateway
installation. To use this guide, you need a broad understanding of networks in general
and the Internet in particular, networking principles, and network configuration. Any
detailed discussion of these concepts is beyond the scope of this guide.
Documentation Conventions
Table 1 on page x defines the notice icons used in this guide.
Indicates a choice between the mutually
exclusivekeywords or variables on either
side of the symbol. The set of choices is
often enclosed in parentheses for clarity.
same lineas the configuration statement
to which it applies.
Encloses a variable for which you can
substitute one or more values.
Identifies a level in the configuration
hierarchy.
Identifies a leaf statement at a
configuration hierarchy level.
Representsgraphicaluser interface (GUI)
items you click or select.
broadcast | multicast
(string1 | string2 | string3)
rsvp { # Required for dynamic MPLS onlyIndicates a comment specified on the
community name members [
community-ids ]
[edit]
routing-options {
static {
route default {
nexthop address;
retain;
}
}
}
•
In the Logical Interfaces box, select
All Interfaces.
•
To cancel the configuration, click
Cancel.
> (bold right angle bracket)
Separates levels in a hierarchy of menu
selections.
SRX Series Documentation and Release Notes
For a list of related SRX Series documentation, see
http://www.juniper.net/techpubs/hardware/srx-series-main.html . If the information in
the latest SRX Series Release Notes differs from the information in the documentation,
follow the SRX Series Release Notes.
Obtaining Documentation
To obtain the most current version of all Juniper Networks technical documentation, see
the products documentation page on the Juniper Networks website at
www.juniper.net/techpubs/ .
To order printed copies of this guide and other Juniper Networks technical documents,
contact your sales representative.
Copies of the Management Information Bases (MIBs) available in a software release are
available at http://www.juniper.net .
In the configuration editor hierarchy,
select Protocols>Ospf.
We encourage you to provide feedback, comments, and suggestions so that we can
improve the documentation. You can send your comments to
techpubs-comments@juniper.net , or fill out the documentation feedback form at
http://www.juniper.net/techpubs/docbug/docbugreport.html . If you are using e-mail, be
sure to include the following information with your comments:
•
Document name
•
Document part number
•
Page number
•
Software release version (not required for Network Operations Guides [NOGs])
Requesting Technical Support
Technical product support is available through theJuniper Networks Technical Assistance
Center (JTAC). If you are a customer with an active J-Care or JNASC support contract,
or are covered under warranty, and need postsales technical support, you can access
our tools and resources online or open a case with JTAC.
•
JTAC policies—For a complete understanding of our JTAC procedures and policies,
review the JTAC User Guide located at
JTAC Hours of Operation—The JTAC centers have resources available 24 hours a day,
7 days a week, 365 days a year.
Self-Help Online Tools and Resources
For quick and easy problem resolution, Juniper Networks has designed an online
self-service portal called the Customer Support Center (CSC) that provides you with the
following features:
Join and participate in the Juniper Networks Community Forum:
www.juniper.net/company/communities
•
Open a case online in the CSC Case Manager: www.juniper.net/cm
To verify service entitlement by productserial number, use our Serial NumberEntitlement
(SNE) Tool located at https://tools.juniper.net/SerialNumberEntitlementSearch.
Opening a Case with JTAC
You can open a case with JTAC on the Web or by telephone.
•
Use the Case Manager tool in the CSC at www.juniper.net/cm.
•
Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).
For international or direct-dial options in countries without toll-free numbers, visit us at
SRX3400 Services Gateway Performance and Features on page 4
•
SRX3400 Services Gateway Physical Specifications on page 4
SRX3400 Services Gateway Description
The SRX3400 Services Gateway is a high-performance, scalable, carrier-class security
device with multi-processor architecture. The services gateway has a capacity of up to
20 gigabits per second (Gbps) in full duplex and is three rack units (U) tall. Sixteen
services gateways can be stacked in a single floor-to-ceiling rack, for increased port
density per unit of floorspace.The services gatewayprovidesseven common form-factor
module (CFM) slots that can be populated with up to four Services Processing Cards
(SPCs), up to two Network Processing Cards (NPCs), up to four I/O cards (IOCs), and
up to six Network Processing I/O cards (NP-IOCs). The services gateway also has one
dedicated slot for the Switch Fabric Board (SFB), one slot for a Routing Engine, one slot
for an SRX Clustering Module (SCM), two slots for power supplies, and one slot for the
fan tray and air filter.
Nearly all components of the SRX3400 Services Gateway are field-replaceable units
(FRUs), including the Switch Fabric Board (SFB), Routing Engine, Network Processing
Cards (NPCs), Service Processing Cards (SPCs), and I/O cards (IOCs), power supply,
fan tray, filter, and air deflector kits. To replace any of these components in your services
gateway, see “Field-Replaceable Units on the SRX3400 Services Gateway” on page 109.
This section includes the following topics:
•
SRX3400 Services Gateway Chassis on page 7
•
SRX3400 Services Gateway Component Basics on page 9
•
SRX3400 Services Gateway Midplane on page 13
•
SRX3400 Services Gateway Switch Fabric Board on page 14
•
SRX3400 Services Gateway NPCs on page 20
•
SRX3400 Services Gateway SPCs on page 20
•
SRX3400 Services Gateway IOCs on page 21
•
SRX3400 Services Gateway NP-IOCs on page 22
•
SRX3400 Services Gateway Routing Engine on page 23
•
SRX3400 Services Gateway SRX Clustering Module on page 24
•
SRX3400 Services Gateway Power Supplies on page 25
•
SRX3400 Services Gateway Fan Tray on page 29
•
SRX3400 and SRX5600 Services Gateways Air Deflector Kits on page 31
SRX3400 Services Gateway Chassis
The SRX3400 Services Gateway chassis, shown in Figure 2 on page 8 and
Figure 3 on page 8, is a rigid sheet metal structure that houses all of the other services
gateway components. The chassis measures 5.25 in. (13.3 cm) high, 17.5 in. (44.5 cm)
wide, and 25.5 in. (64.8 cm) deep (from the front to the rear of the chassis). The chassis
installs in standard 800–mm (or larger) enclosed cabinets, 19 in. equipment racks, or
telecommunications open-frame racks. Up to 16 services gateways can be installed in
This section describesthe cardform factors, the servicesgateway components available,
and where they can be installed in the SRX3400 Services Gateway. It also describes the
flow of data through the services gateway. This section includes the following topics:
•
SRX3400 Services Gateway CFMs on page 9
•
Available Components for the SRX3400 Services Gateway on page 9
•
Hardware Component Locations in the SRX3400 Services Gateway Chassis on page 11
•
Data Flow in the SRX3400 Services Gateway on page 13
SRX3400 Services Gateway CFMs
The services gateway chassis supports common form-factor modules (CFMs). A
single-wide module format and a double-wide module format are available. I/O card
(IOC), Services Processing Card (SPC), and Network Processing Card (NPC) modules
are in single-wide CFM format. The Switch Fabric Board (SFB), Routing Engine, and SRX
Clustering Module (SCM) are not in CFM format, and thus have assigned slots within the
chassis. With the interchangeability among the IOCs, SPCs, and NPCs, you have more
flexibility and scalability when deploying your networks based on the requirements in
the field. For example, if you need more ports and bigger oversubscription ratio, then you
can load more slots with IOCs; on the other hand, if you need smaller oversubscription
ratio for better QoS behavior, or you need more security services, then you can load more
slots with SPCs and only use the on-board network interface ports.
Related
Documentation
Installing CFM Cards in the SRX3400 Services Gateway on page 59•
• SRX3400 Services Gateway Description on page 3
• Hardware Component Locations in the SRX3400 Services Gateway Chassis on page 11
• Available Components for the SRX3400 Services Gateway on page 9
• Data Flow in the SRX3400 Services Gateway on page 13
Available Components for the SRX3400 Services Gateway
Table 5 on page 9 lists the various components, and the number of each, that can be
installed in the SRX3400 Services Gateway.
Table 5: Available SRX3400 Services Gateway Hardware Components
1 required, up to 4 allowedServices Processing Cards (SPCs)
1 required, up to 2 allowedPower supply
1 requiredFan tray (containing multiple fans)
NOTE: A minimum configuration must include one SPC and either one NPC
or one NP-IOC. However, if there are no NPCs in the chassis, the Ethernet
ports on the SFB will not be functional. See “SRX3400 Services Gateway
Network Processing Cards” on page 20, “SRX3400 Services Gateway
NP-IOCs” on page 22, and “SRX3400 Services GatewayServices Processing
Cards” on page 20 for details about these cards.
Table 6 on page 11 shows the supported combinations of SPCs, NPCs, and IOCs that
can be installed in the SRX3400 Services Gateway. The support is different between
standard and enhanced DC-powered services gatewaysbecause the standard DC power
supplies have a lower power rating.
Table 6: Supported Combinations of SPCs, NPCs, and IOCs
AC Power Supplies or Enhanced DC Power Supplies
NPCs
21
4 IOCs4 IOCs1SPCs
3 IOCs4 IOCs2
2 IOCs3 IOCs3
1 IOC2 IOCs4
Standard DC Power Supplies
NPCs
21
4 IOCs4 IOCs1SPCs
3 IOCs4 IOCs2
1 IOCs2 IOCs3
Not supported0 IOCs4
Related
Documentation
SRX3400 Services Gateway Chassis on page 7•
• Hardware Component Locations in the SRX3400 Services Gateway Chassis on page 11
• Data Flow in the SRX3400 Services Gateway on page 13
Hardware Component Locations in the SRX3400 Services Gateway Chassis
The SRX3400 Services Gateway is populated with one SFB, one Routing Engine, one
power supply, and a fan tray plus air filter at the factory. You must install all other cards
required to meet your configuration needs. Table 7 on page 12 lists the possible locations
of the various hardware components in the SRX3400 Services Gateway.
Figure 4 on page 12 and Figure 5 on page 12 show the locations of the slots and the
NOTE: A minimum configuration must include one SPC and either one NPC
or one NP-IOC. However, if there are no NPCs in the chassis, the Ethernet
ports in the SFB will not be functional. See “SRX3400 Services Gateway
NetworkProcessingCards” on page20, “SRX3400 Services Gateway Services
Processing Cards” on page 20 for details about these cards.
Related
Documentation
SRX3400 Services Gateway Chassis on page 7•
• Available Components for the SRX3400 Services Gateway on page 9
• Installing CFM Cards in the SRX3400 Services Gateway on page 59
• Data Flow in the SRX3400 Services Gateway on page 13
• Installation Overview for the SRX3400 Services Gateway on page 49
Data Flow in the SRX3400 Services Gateway
The services gateway receives data from the various physical interfaces on the I/O cards
(IOCs). Incoming data is passed through the Switch Fabric Board (SFB) to a Network
Processing Card (NPC), back to the SFB and on to a Services Processing Card (SPC).
The data is then passed out of the services gateway in reverse order—to the SFB, NPC,
SFB, and out to the IOC.
Related
Documentation
SRX3400 Services Gateway Chassis on page 7•
• Available Components for the SRX3400 Services Gateway on page 9
• Hardware Component Locations in the SRX3400 Services Gateway Chassis on page 11
• Installation Overview for the SRX3400 Services Gateway on page 49
SRX3400 Services Gateway Midplane
The midplane in the SRX3400 Services Gateway is in the center of the chassis and
provides connections for installing up to four common form-factor modules (CFMs)
through the front of the chassis and up to three CFMs through the rear of the chassis.
See “Hardware Component Locations in the SRX3400 Services Gateway Chassis” on
page 11 for details about where the individual modules can be installed. The power
supplies install into the midplane from the rear of the chassis. The cooling system
components also connect to the midplane.
The midplane performs the following major functions:
•
Data path—Data packets are transferred across the midplane between the IOCs and
SPCs through the fabric ASICs on the SFBs.
•
Power distribution—The services gateway power supplies are connected to the
midplane, which distributes power to all of the services gateway components.
Signal path—The midplane provides the signal path to the IOCs, SFBs, SPCs, Routing
Engine, and other services gateway components for monitoring and control of the
system.
Figure 6: Midplane
Related
Documentation
SRX3400 Services Gateway Chassis on page 7•
• Available Components for the SRX3400 Services Gateway on page 9
• SRX3400 Services Gateway Switch Fabric Board on page 14
• SRX3400 Services Gateway Network Processing Cards on page 20
• SRX3400 Services Gateway Services Processing Cards on page 20
SRX3400 Services Gateway Switch Fabric Board
The Switch Fabric Board (SFB) is the data plane for the subsystems in the chassis. The
SFB performs the following functions:
•
Powers the services gateway on and off
•
Controls clocking and distribution
•
Provides eight copper Gigabit Ethernet ports and four fiber Gigabit Ethernet ports
•
Provides two high availability (HA) Control ports
•
Provides interconnections to all the IOCs within the chassis through integrated switch
fabrics
•
Handles arbitration among the CFMs
•
Handles switching among multiple SPCs if present
•
Provides service ports, system LEDs, and operational buttons on the front panel
Table 8 on page 15 describes the behavior of the Power button near the left end of the
SFB front panel.
Table 8: Power Button Behavior
ResultActionCondition
Services
gateway
powered off
Services
gateway
powered on
Short push (3 to 5
seconds)
Short push (3 to 5
seconds)
Long push (15 seconds
or more)
Powers the services gateway on. The PWR LED
blinks to show you that the Routing Engine is
initializing.
Initiates a graceful shutdown that preserves the
services gateway state information. The PWR LED
blinks to show you that the services gateway is
shutting down.
Initiates an immediate shutdown. The services
gateway state information will be lost. Avoid using
immediate shutdown unless necessary.
Table 9 on page 15 describes the system behavior indicated by the various LEDs on the
front panel of the SFB. LEDs are listed based on their location on the services gateway,
from left to right. Table 10 on page 18 describes the ports/connections available on the
front panel of the SFB.
Table 9: Switch Fabric Board LED Indicators
Indicated BehaviorStatusColorLabel
Alarm (pair)
On steadilyYellowNon-Critical
(Top)
A noncritical alarm is present in the system.
Examples of noncritical alarms include:
(unlit)
•
Memory usageis high onthe ServicesProcessing
Unit (SPU); less than 10% available.
Table 9: Switch Fabric Board LED Indicators (continued)
Indicated BehaviorStatusColorLabel
(Bottom)
(unlit)
SFB and HA (pair)
On steadilyRedCritical
On steadilyAmber
On steadilyGreenHA
On steadilyAmber
A criticalalarm ispresent inthe system. A hardware
component or software module has failed, or the
network management interface is down.
No critical alarms are present in the system.OffDark
The SFB is operating normally.On steadilyGreenSFB
The SFB is initializing.BlinkingGreen
The switch fabric is operating normally, but the
Ethernet interfaces are not operating normally.
The SFB has failed and is not operating normally.On steadilyRed
High availability is operating normally. All cluster
members and all HA links are available.
An alarm is present on the HA link. All cluster
members are present, but some HA links are down.
There are still enough links for full functionality, but
performancecouldbe impaired (reducedbandwidth
could cause packets to get dropped, or reduced
resiliency as a single point of failure might now
exist).
(unlit)
CFM Status (pair)
On steadilyRed
OffDark
A critical alarm is present on the HA. One or more
cluster members are missing or unreachable; or
active when secondary-path is engaged.
HA is disabled—Services gateway is not configured
for clustering or HA is disabled by secondary path.