"Juniper SRX Firewall Sizing Guide: Throughput, Sessions, and SRX300 to SRX4700"
Picking a firewall by its headline firewall throughput is the fastest way to over-buy at the data center and under-buy at the branch. Effective Juniper SRX sizing comes down to three numbers that vendors print in small type: real-world threat (IPS/NGFW) throughput, concurrent and new-sessions-per-second capacity, and the interface mix you actually need. This guide walks procurement and network teams through SRX firewall selection from the SRX300 line up to the SRX4700, so the platform you spec survives the next three to five years of traffic growth.
Why "firewall throughput" is the wrong number to size on
Every SRX datasheet leads with a large firewall throughput figure. That number is measured with large packets and security services largely disabled. The moment you enable IPS, application security (AppSecure), TLS inspection, and logging, usable throughput drops, often by half or more. So the figure that matters for an SRX throughput guide is the IPS or NGFW throughput with IMIX (Internet Mix) traffic the box can sustain with your security stack turned on.
The second number people skip is sessions. A firewall can have plenty of throughput and still fall over because it ran out of concurrent session capacity, common at sites with many users, IoT endpoints, or chatty cloud apps. Size for both maximum concurrent sessions and new connections per second (CPS), especially in environments behind CGNAT, SASE breakouts, or high east-west microservice traffic.
The numbers that actually drive SRX firewall selection
When you sit down to size, gather these inputs before looking at a single model:
- Aggregate WAN/internet bandwidth at the site, plus expected growth.
- Which security services run inline: IPS, antivirus/Content Security, URL filtering, TLS/SSL decryption, advanced threat prevention.
- Peak concurrent sessions and new CPS (pull from your current firewall or NetFlow/IPFIX).
- Interface requirements: copper vs. fiber, 1GbE/10GbE/25GbE/40GbE/100GbE/400GbE, and whether you need MACsec.
- High availability: active/passive or active/active chassis cluster (size each node to carry full load).
- PoE needs at branch sites that backhaul phones or APs through the gateway.
Always size to peak with security services on, not average, and leave 30 to 50 percent headroom for growth and feature creep.
SRX model selection table (branch to data center)
The SRX line scales from a fanless branch appliance to a 1U service-provider firewall. Use the table below to narrow the field, then confirm exact figures against the current Juniper datasheet for the specific model and Junos release, performance numbers move release to release.
| Model | Best fit | Firewall throughput (IMIX, approx.) | IPS / NGFW throughput (approx.) | Concurrent sessions (approx.) | Typical interfaces |
|---|---|---|---|---|---|
| SRX300 line (SRX300/320/340/345/380) | Small branch / teleworker | ~1–20 Gbps across the line | Hundreds of Mbps to low Gbps | ~64K–2M | 1GbE copper/SFP; PoE on some models |
| SRX1500 | Campus / regional HQ edge | ~9 Gbps | IPS ~3 Gbps | ~2M+ | 1/10GbE; fixed 1U |
| SRX2300 | Mid-range enterprise edge / DC | ~27 Gbps | NGFW ~39 Gbps | Millions | 1/10/25GbE SFP+ |
| SRX4700 | Large DC / cloud / service provider | Up to ~1.4 Tbps (firewall) | IPS ~110 Gbps; NGFW ~100 Gbps | Up to ~60M | 25/40/100/400GbE, MACsec |
For virtualized or public-cloud edges, vSRX runs the same Junos security stack as a virtual appliance and is sized by allocated vCPU/RAM rather than fixed hardware, useful for elastic or cloud-native deployments. Browse current models on our products and catalog pages, or run a side-by-side on the compare tool.
How to choose the right SRX
Work from the deployment role inward:
- Branch and teleworker: Start with the SRX300 line. Match the specific model (SRX300 through SRX380) to your port count and PoE needs, then verify IPS throughput covers your internet circuit, not just the firewall number. The SRX380 sits at the top of this line for larger branches.
- Campus / regional HQ: The SRX1500 is the workhorse fixed 1U for the enterprise campus edge where you want full Layer 7 services on a 1 to several Gbps circuit. If you expect to grow past ~3 Gbps of inspected traffic, look at the SRX2300.
- Mid-range enterprise edge or smaller data center: The SRX2300 roughly triples SRX1500 firewall throughput and adds 25GbE, a good step-up when SRX1500 runs hot with security services on.
- Large data center, cloud edge, or service provider: The SRX4700 delivers very high NGFW/IPS throughput, large session scale, and 100/400GbE with MACsec in 1U, for high east-west and encrypted workloads.
Two rules that prevent expensive mistakes: size HA nodes individually to carry the full load during failover, and re-validate against the live datasheet for your target Junos version before you cut a PO, since performance and supported optics change over time.
SRX300 vs SRX1500 (the most common crossover)
The SRX300 vs SRX1500 decision trips up the most buyers. The SRX300 line is a branch platform: fanless or compact, lower session counts, IPS measured in the hundreds of Mbps to low Gbps. The SRX1500 is a 1U campus/edge firewall with materially higher session capacity and IPS throughput around 3 Gbps, built to run the full security stack at a regional headquarters or as a campus internet edge. If your site has a sub-1 Gbps circuit and a handful of users, SRX300 line. If you are terminating a multi-Gbps circuit, running IPS plus TLS inspection, or expect heavy session growth, jump to the SRX1500 (or SRX2300 for headroom).
How Uniqcli helps
Uniqcli is an authorized HPE / HPE Juniper Networking reseller, and SRX sizing is exactly where a good partner earns its keep. We will:
- Scope and right-size the platform from your real traffic data (peak throughput with services on, concurrent and new sessions, interface mix, HA model) so you do not over- or under-buy.
- Quote the exact appliances, optics, licenses (IPS/Content Security/ATP subscriptions), and support tiers, request one through our quote page.
- Procure on the right vehicle for your organization: TAA-compliant configurations, GSA, SEWP, and E-Rate pathways for federal, SLED, healthcare, and education buyers.
- Deploy and support: zero-touch provisioning, chassis-cluster build-out, Junos hardening, and lifecycle/renewal management.
Tell us the site role and circuit, and we will come back with a sized SRX bill of materials and a clean quote.
FAQ
What throughput number should I size a Juniper SRX on? Size on IPS/NGFW throughput with IMIX traffic and your security services enabled, not the headline firewall throughput. Then confirm concurrent and new-session capacity covers your peak.
How is the SRX4700 different from the rest of the line?
The SRX4700 is a 1U data center / service-provider firewall with very high NGFW (100 Gbps) and IPS (110 Gbps) throughput, session scale up to roughly 60 million, and 100/400GbE interfaces with MACsec, far beyond branch and campus models.
When do I move from SRX1500 to SRX2300? When inspected (IPS/NGFW) traffic approaches the SRX1500's ceiling (~3 Gbps IPS) or you need 25GbE and more session headroom. The SRX2300 roughly triples SRX1500 firewall throughput.
Do I size each HA node for full load? Yes. In an active/passive or active/active chassis cluster, each node must carry the entire load during a failover, so size both as if they run alone, plus growth headroom.