Juniper SRX5400 Service manual

SRX5400, SRX5600, and SRX5800
Firewall Card Reference
Published
2023-10-13

Juniper Networks, Inc.
1133 Innovaon Way
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc.
in the United States and other countries. All other trademarks, service marks, registered marks, or registered service
marks are the property of their respecve owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right
to change, modify, transfer, or otherwise revise this publicaon without noce.
SRX5400, SRX5600, and SRX5800 Firewall Card Reference
Copyright © 2023 Juniper Networks, Inc. All rights reserved.
The informaon in this document is current as of the date on the tle page.
YEAR 2000 NOTICE
Juniper Networks hardware and soware products are Year 2000 compliant. Junos OS has no known me-related
limitaons through the year 2038. However, the NTP applicaon is known to have some diculty in the year 2036.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentaon consists of (or is intended for use
with) Juniper Networks soware. Use of such soware is subject to the terms and condions of the End User License
Agreement ("EULA") posted at hps://support.juniper.net/support/eula/. By downloading, installing or using such
soware, you agree to the terms and condions of that EULA.
ii

Table of Contents
1
SRX5400, SRX5600, and SRX5800 Firewall Cards and Modules
Overview | 2
SRX5400, SRX5600, and SRX5800 Firewall Card Overview | 2
Cards Supported on SRX5400, SRX5600, and SRX5800 Firewalls | 3
Services Processing Cards | 8
Services Processing Cards Specicaons | 8
Services Processing Card SRX5K-SPC-2-10-40 Specicaons | 8
Services Processing Card SRX5K-SPC-4-15-320 Specicaons | 14
Services Processing Card SRX5K-SPC3 Specicaons | 19
I/O Cards | 25
I/O Cards Specicaons | 25
I/O Card SRX5K-40GE-SFP Specicaons | 25
I/O Card SRX5K-4XGE-XFP Specicaons | 28
Flex I/O Cards and Port Modules | 32
Flex I/O Cards and Port Modules Specicaons | 32
Flex I/O Card (SRX5K-FPC-IOC) Specicaons | 32
Flex I/O Card Port Module SRX-IOC-16GE-SFP Specicaons | 34
Flex I/O Card Port Module SRX-IOC-16GE-TX Specicaons | 36
Flex I/O Card Port Module SRX-IOC-4XGE-XFP Specicaons | 38
Modular Port Concentrators and Interface Cards | 41
Modular Port Concentrators and Interface Cards Specicaons | 41
Modular Port Concentrator (SRX5K-MPC) Specicaons | 41
MIC with 20x1GE SFP Interfaces (SRX-MIC-20GE-SFP) | 44
MIC with 10x10GE SFP+ Interfaces (SRX-MIC-10XG-SFPP) | 50
MIC with 1x100GE CFP Interface (SRX-MIC-1X100G-CFP) | 54
MIC with 2x40GE QSFP+ Interfaces (SRX-MIC-2X40G-QSFP) | 56
SRX5K-MPC3-40G10G Specicaons | 58
SRX5K-MPC3-100G10G Specicaons | 62
SRX5K-IOC4-10G Specicaons | 66
iii

SRX5K-IOC4-MRAT Specicaons | 70
Switch Control Boards | 75
Switch Control Boards Specicaons | 75
Switch Control Board SRX5K-SCB Specicaons | 75
Switch Control Board SRX5K-SCBE Specicaons | 78
Switch Control Board SRX5K-SCB3 Specicaons | 81
Switch Control Board SRX5K-SCB4 Specicaons | 84
Roung Engines | 87
Roung Engine Specicaons | 87
Roung Engine SRX5K-RE-13-20 Specicaons | 87
Roung Engine SRX5K-RE-1800X4 Specicaons | 91
Roung Engine SRX5K-RE3-128G Specicaons | 94
2
Handling and Storing Cards
Handling and Storing SRX5400, SRX5600, and SRX5800 Firewall Cards | 101
SRX5400, SRX5600, and SRX5800 Firewall Card Terminology | 101
Handling an SRX5400, SRX5600, or SRX5800 Firewall Card | 102
Storing an SRX5600, SRX5600, or SRX5800 Firewall Card | 104
iv

1
PART
SRX5400, SRX5600, and SRX5800
Firewall Cards and Modules
Overview | 2
Services Processing Cards | 8
I/O Cards | 25
Flex I/O Cards and Port Modules | 32
Modular Port Concentrators and Interface Cards | 41
Switch Control Boards | 75
Roung Engines | 87

CHAPTER 1
Overview
IN THIS CHAPTER
SRX5400, SRX5600, and SRX5800 Firewall Card Overview | 2
Cards Supported on SRX5400, SRX5600, and SRX5800 Firewalls | 3
SRX5400, SRX5600, and SRX5800 Firewall Card Overview
The cards described in this guide let you upgrade and customize your SRX5400, SRX5600, or SRX5800
Firewall to suit the needs of your network. The following types of cards are available for the SRX5400,
SRX5600, and SRX5800 Firewalls:
• I/O cards (IOCs) provide addional physical network connecons to the rewall. Their primary
funcon is to deliver data packets arriving on the physical ports to the Services Processing Cards
(SPCs) and to forward data packets out the physical ports aer services processing.
• Flex IOCs have two slots for port modules that add addional physical network connecons to the
rewall. Like IOCs, their primary funcon is to deliver data packets arriving on the physical ports to
the SPCs and to forward data packets out the physical ports aer services processing.
• Modular Port Concentrators (MPCs) have slots on the front panel that accept smaller cards called
Modular Interface Cards (MICs). Each MIC has one or more physical interfaces on it. An MPC with
MICs installed funcons in the same way as a regular I/O card (IOC), but allows greater exibility in
adding dierent types of Ethernet ports to your rewall. MPCs and MICs are similar in form and
funcon to Flex IOCs and port modules. However, the two use dierent form-factors, so you cannot
install port modules in an MPC, nor can you install MICs in a Flex IOC.
• Services Processing Cards (SPCs) provide the processing power to run integrated services such as
rewall, IPsec and IDP. All trac traversing the rewall is passed to an SPC to have services
processing applied to it.
• Switch Control Boards (SCBs) power on and power o IOCs and SPCs; control clocking and system
resets; and control boong, monitor, and system funcons. Each SCB has a slot in the front panel for
a Roung Engine.
2

Although the following modules are not cards in the sense of having a form-factor that ts the card cage
of the SRX5400, SRX5600, and SRX5800 Firewall, this guide also addresses the following modules that
t into certain SRX5400, SRX5600, and SRX5800 Firewall cards:
•Roung Engines t into slots in SCBs and maintain the roung tables, manage the roung protocols
used on the device, control the device interfaces and some chassis components, and provide the
interface for system management and user access to the device.
• Port modules t into slots in Flex IOCs and add addional physical network interface ports to the
rewall.
• Modular Interface Cards (MICs) t into slots in MPCs and add addional physical network interface
ports to the rewall. MPCs and MICs are similar in form and funcon to Flex IOCs and port modules.
However, the two use dierent form-factors, so you cannot install port modules in an MPC, nor can
you install MICs in a Flex IOC.
Cards Supported on SRX5400, SRX5600, and SRX5800 Firewalls
Table 1 on page 3 describes the cards and other modules supported on the SRX5400, SRX5600, and
SRX5800 Firewalls.
Table 1: Supported Cards for SRX5400, SRX5600, and SRX5800 Firewalls
Card Name and Model
Number
Earliest Supported Junos OS Release Last Supported Junos
OS Release
SRX5400 SRX5600 and SRX5800 SRX5400, SRX5600, and
SRX5800
SPCs
Services Processing Card
SRX5K-SPC-2-10-40
Specicaons
Not supported 9.2 12.3X48
Services Processing Card
SRX5K-SPC-4-15-320
Specicaons
12.1X46-D10 12.1X44-D10
3

Table 1: Supported Cards for SRX5400, SRX5600, and SRX5800 Firewalls (Connued)
Card Name and Model
Number
Earliest Supported Junos OS Release Last Supported Junos
OS Release
SRX5400 SRX5600 and SRX5800 SRX5400, SRX5600, and
SRX5800
Services Processing Card
SRX5K-SPC3 Specicaons
18.2R1-S1 18.2R1-S1
Interface Cards
I/O Card SRX5K-40GE-SFP
Specicaons
Not supported 9.2 12.3X48
I/O Card SRX5K-4XGE-XFP
Specicaons
Not supported 9.2 12.3X48
Flex I/O Card (SRX5K-FPC-
IOC) Specicaons
Not supported 10.2 12.3X48
Modular Port Concentrator
(SRX5K-MPC) Specicaons
12.1X46-D10 12.1X46-D10
SRX5K-MPC3-40G10G
Specicaons
15.1X49-D10 15.1X49-D10
SRX5K-MPC3-100G10G
Specicaons
15.1X49-D10 15.1X49-D10
SRX5K-IOC4-10G
Specicaons
19.3R1 19.3R1
SRX5K-IOC4-MRAT
Specicaons
19.3R1 19.3R1
SCBs
4

Table 1: Supported Cards for SRX5400, SRX5600, and SRX5800 Firewalls (Connued)
Card Name and Model
Number
Earliest Supported Junos OS Release Last Supported Junos
OS Release
SRX5400 SRX5600 and SRX5800 SRX5400, SRX5600, and
SRX5800
Switch Control Board
SRX5K-SCB Specicaons
12.1X46-D10 9.2 12.3X48
Switch Control Board
SRX5K-SCBE Specicaons
12.1X47-D15 12.1X47-D15
Switch Control Board
SRX5K-SCB3 Specicaons
15.1X49-D10 15.1X49-D10
Switch Control Board
SRX5K-SCB4 Specicaons
Not supported 19.3R1
Other modules
Flex I/O Card Port Module
SRX-IOC-16GE-SFP
Specicaons
Not supported 10.2
Flex I/O Card Port Module
SRX-IOC-16GE-TX
Specicaons
Not supported 10.2
Flex I/O Card Port Module
SRX-IOC-4XGE-XFP
Specicaons
Not supported 10.2
MIC with 1x100GE CFP
Interface (SRX-
MIC-1X100G-CFP)
12.1X46-D10 12.1X46-D10
5

Table 1: Supported Cards for SRX5400, SRX5600, and SRX5800 Firewalls (Connued)
Card Name and Model
Number
Earliest Supported Junos OS Release Last Supported Junos
OS Release
SRX5400 SRX5600 and SRX5800 SRX5400, SRX5600, and
SRX5800
MIC with 2x40GE QSFP+
Interfaces (SRX-MIC-2X40G-
QSFP)
12.1X46-D10 12.1X46-D10
MIC with 10x10GE SFP+
Interfaces (SRX-MIC-10XG-
SFPP)
12.1X46-D10 12.1X46-D10
MIC with 20x1GE SFP
Interfaces (SRX-MIC-20GE-
SFP)
12.1X47-D10 12.1X47-D10
Roung Engine SRX5K-
RE-13-20 Specicaons
12.1X46-D10 9.2 12.3X48
Roung Engine SRX5K-
RE-1800X4 Specicaons
12.1X47-D15 12.1X47-D15
Roung Engine SRX5K-
RE3-128G Specicaons
19.3R1 19.3R1
Figure 1 on page 7 is an interoperability matrix that describes the compability between various
interface cards for the SRX5400, SRX5600, and SRX5800 Firewalls.
6

Figure 1: Interoperability Matrix for SRX5400, SRX5600, and SRX5800 Firewalls
7

CHAPTER 2
Services Processing Cards
IN THIS CHAPTER
Services Processing Cards Specicaons | 8
Services Processing Cards Specicaons
IN THIS SECTION
Services Processing Card SRX5K-SPC-2-10-40 Specicaons | 8
Services Processing Card SRX5K-SPC-4-15-320 Specicaons | 14
Services Processing Card SRX5K-SPC3 Specicaons | 19
Services Processing Card SRX5K-SPC-2-10-40 Specicaons
The SRX5K-SPC-2-10-40 Services Processing Card (SPC) contains two Services Processing Units (SPUs),
which provide the processing power to run integrated services such as rewall, IPsec, and IDP (see
Figure 2 on page 9). All trac traversing the rewall is passed to an SPU to have services processing
applied to it. Trac is intelligently distributed by I/O cards (IOCs) to SPUs for services processing.
The rewall must have at least one SPC installed. You can install addional SPCs to increase services
processing capacity.
You can install SPCs in any of the slots that are not reserved for Switch Control Boards (SCBs). If a slot is
not occupied by a card, you must install a blank panel to shield the empty slot and to allow cooling air to
circulate properly through the device.
Figure 2 on page 9 shows a typical SPC supported on the rewall.
8

Figure 2: Services Processing Card SRX5K-SPC-2-10-40
Each SPC consists of the following components:
• SPC cover, which funcons as a ground plane and a sener.
• Two small form-factor pluggable (SFP) chassis cluster control ports for connecng mulple devices
into a redundant chassis cluster. See Chassis Cluster User Guide for SRX Series Devices for more
informaon about connecng and conguring redundant chassis clusters.
CAUTION: The Juniper Networks Technical Assistance Center (JTAC) provides
complete support for Juniper-supplied opcal modules and cables. However, JTAC
does not provide support for third-party opcal modules and cables that are not
qualied or supplied by Juniper Networks. If you face a problem running a Juniper
device that uses third-party opcal modules or cables, JTAC may help you diagnose
host-related issues if the observed issue is not, in the opinion of JTAC, related to the
use of the third-party opcal modules or cables. Your JTAC engineer will likely request
9

that you check the third-party opcal module or cable and, if required, replace it with
an equivalent Juniper-qualied component.
Use of third-party opcal modules with high-power consumpon (for example,
coherent ZR or ZR+) can potenally cause thermal damage to or reduce the lifespan of
the host equipment. Any damage to the host equipment due to the use of third-party
opcal modules or cables is the users’ responsibility. Juniper Networks will accept no
liability for any damage caused due to such use.
• Fabric interfaces.
• Two Gigabit Ethernet interfaces that allow control informaon, route informaon, and stascs to be
sent between the Roung Engine and the CPU on the SPCs.
• Two interfaces from the SCBs that enable the boards to be powered on and controlled.
• Physical SPC connectors.
• Midplane connectors and power circuitry.
• Processor subsystem, which includes a 1.2-GHz CPU, system controller, and 1 GB of SDRAM.
• LEDs on the faceplate that indicate the SPC and SPU status.
Descripon SPC with two SPUs
Soware release •Junos OS Release 9.2 and later
Cables and
connectors
CHASSIS CLUSTER CONTROL 0 and CHASSIS CLUSTER CONTROL 1–SFP ports for
control links in chassis cluster conguraons.
Supported SFP transceivers:
1000BASE-LH (model numbers SRX-SFP-1GE-LH, SRX-SFP-1GE-LH-ET)
1000BASE-LX (model numbers SRX-SFP-1GE-LX, SRX-SFP-1GE-LX-ET)
1000BASE-SX (model numbers SRX-SFP-1GE-SX, SRX-SFP-1GE-SX-ET)
Controls None
Supported Slots •SRX5600–Any slot, except the boom slots 0 or 1 which are reserved for SCB/RE.
•SRX5800–Any slot, except the slots 0 or 1 which are reserved for SCB/RE.
10

Power Requirement Maximum 265 W
Weight Approximately 13 lb (5.9 kg)
11

LEDs OK/FAIL LED, one bicolor:
•Steady green–The SPC is operang normally.
•Red–The SPC has failed and is not operang normally.
•O–The SPC is powered down.
STATUS LED, one tricolor for each of the two SPUs SPU 0 and SPU 1:
•Green–The SPU is operang normally.
•Amber–The SPU is inializing.
•Red–The SPU has encountered an error or a failure.
•O–The SPU is oine. If all four SPUs are oine, it is safe to remove the SPC from the
chassis.
SERVICE LED, one bicolor for each of the two SPUs, SPU 0 and SPU 1:
•Green–Service is running on the SPU under acceptable load.
•Amber–Service on the SPU is overloaded.
•O–Service is not running on the SPU.
HA LED, one tricolor:
NOTE: The HA LED is lit only if the SPC has a control link, otherwise it is o.
Somemes even aer the control link is removed from the SPC, the HA LED would lit.
Power cycle both the nodes to turn o the LED,
•Green (bold)–Clustering is operang normally. All cluster members and monitored links
are available, and no error condions are detected.
•Green (blinking)–Data transfer between the nodes.
•Red–A crical alarm is present on clustering. A cluster member is missing or
unreachable, or the other node is no longer part of a cluster because it has been
disabled by the dual membership and detecon recovery process in reacon to a
control link or fabric link failure.
•Amber–All cluster members are present, but an error condion has compromised the
performance and resiliency of the cluster. The reduced bandwidth could cause packets
to be dropped or could result in reduced resiliency because a single point of failure
might exist. The error condion might be caused by:
12

•The loss of chassis cluster links which causes an interface monitoring failure.
•An error in an SPU or NPU.
•Failure of the spu-monitoring or cold-sync-monitoring processes.
•A chassis cluster IP monitoring failure.
LINK/ACT LED, one for each of the two ports CHASSIS CLUSTER CONTROL 0 and
CHASSIS CLUSTER CONTROL 1:
•Green (ickering)–Chassis cluster control port link is acve.
•O–No link.
ENABLE LED, one for each of the two ports CHASSIS CLUSTER CONTROL 0 and
CHASSIS CLUSTER CONTROL 1:
•Green–The chassis cluster control port is enabled.
•O–The chassis cluster control port is disabled.
Serial Number
Locaon
The serial number label is located as shown in Figure 3 on page 13.
Figure 3: Serial Number Label (IOC Shown, Other Cards Similar)
13

Services Processing Card SRX5K-SPC-4-15-320 Specicaons
The SRX5K-SPC-4-15-320 Services Processing Card (SPC) contains four Services Processing Units
(SPUs), which provide the processing power to run integrated services such as rewall, IPsec, and IDP
(see Figure 4 on page 15). All trac traversing the rewall is passed to an SPU to have services
processing applied to it. Trac is intelligently distributed by I/O cards (IOCs) to SPUs for services
processing.
The rewall must have at least one SPC installed. You can install addional SPCs to increase services
processing capacity.
You can install SPCs in any of the slots that are not reserved for Switch Control Boards (SCBs). If a slot is
not occupied by a card, you must install a blank panel to shield the empty slot and to allow cooling air to
circulate properly through the device.
If your rewall contains a mix of SRX5K-SPC-4-15-320 SPCs and earlier SRX5K-SPC-2-10-40 SPCs, an
SRX5K-SPC-4-15-320 SPC must occupy the lowest-numbered slot of any SPC in the chassis. This
conguraon ensures that the center point (CP) funcon is performed by the faster and higher-
performance SPC type.
14

Figure 4: Services Processing Card SRX5K-SPC-4-15-320
Each SPC consists of the following components:
• SPC cover, which funcons as a ground plane and a sener.
• Two small form-factor pluggable (SFP) chassis cluster control ports for connecng mulple devices
into a redundant chassis cluster. See Chassis Cluster User Guide for SRX Series Devices for more
informaon about connecng and conguring redundant chassis clusters.
CAUTION: The Juniper Networks Technical Assistance Center (JTAC) provides
complete support for Juniper-supplied opcal modules and cables. However, JTAC
does not provide support for third-party opcal modules and cables that are not
qualied or supplied by Juniper Networks. If you face a problem running a Juniper
device that uses third-party opcal modules or cables, JTAC may help you diagnose
host-related issues if the observed issue is not, in the opinion of JTAC, related to the
use of the third-party opcal modules or cables. Your JTAC engineer will likely request
15

that you check the third-party opcal module or cable and, if required, replace it with
an equivalent Juniper-qualied component.
Use of third-party opcal modules with high-power consumpon (for example,
coherent ZR or ZR+) can potenally cause thermal damage to or reduce the lifespan of
the host equipment. Any damage to the host equipment due to the use of third-party
opcal modules or cables is the users’ responsibility. Juniper Networks will accept no
liability for any damage caused due to such use.
• Fabric interfaces.
• Two Gigabit Ethernet interfaces that allow control informaon, route informaon, and stascs to be
sent between the Roung Engine and the CPU on the SPCs.
• Two interfaces from the SCBs that enable the boards to be powered on and controlled.
• Physical SPC connectors.
• Midplane connectors and power circuitry.
• Processor subsystem, which includes a 1.2-GHz CPU, system controller, and 1 GB of SDRAM.
• LEDs on the faceplate that indicate the SPC and SPU status.
Descripon SPC with four SPUs
Soware release •Junos OS Release 12.1X44-D10 and later
Cables and
connectors
CHASSIS CLUSTER CONTROL 0 and CHASSIS CLUSTER CONTROL 1–SFP ports for control
links in chassis cluster conguraons.
Supported SFP transceivers:
1000BASE-LH (model numbers SRX-SFP-1GE-LH, SRX-SFP-1GE-LH-ET)
1000BASE-LX (model numbers SRX-SFP-1GE-LX, SRX-SFP-1GE-LX-ET)
1000BASE-SX (model numbers SRX-SFP-1GE-SX, SRX-SFP-1GE-SX-ET)
Controls None
16