Juniper SRX vs. WatchGuard XTM - Discontinued Product

Juniper vSRX is an excellent edge gateway device. The combination of Tunneling protocols supported and the advanced routing & security features makes it perfect for this kind of deployment. It is available in physical, virtual appliances as well as support on multiple clouds so you can have the same box be your edge gateway in multiple environments for consistency.

It can also work as a Internet Gateway, DMZ Firewall/Router and it would function just fine.

While it can also work as a DC firewall (North-South), the poor GUI will make it harder in the day to day administration for the multiple policies in a DC.

Incentivized

The web filter is complicated when you don't have a server to log in users.
Companies using static IPs.
They have to be clear about the number of users that the company has in order to obtain the correct model since each one has its resources according to the number of users.

• The Juniper SRX platform is easy to set up (out of the box).
• The support team responds to tickets quickly and with good solutions.

Incentivized

• They are simple to set up and configure. With just a few months of experience you can easily deploy any series of XTM in mid to small environments in minutes. I can deploy clustered M5600 in an enterprise within 30 minutes straight from the box, that's easy.
• They are very reasonably priced and competitive in the market. For small and mid-sized businesses it's hard to beat the bang for the buck.
• After setting them up, it's also very easy to fine tune and manage them. The packet monitor is very useful in troubleshooting and I use it to tighten down rule sets.
• Dimension is a great packet analyzer and I think they still offer it as a free tool.

Incentivized

• Some of the more complex setups (clustered HA, etc.) can be a little difficult to configure.
• The lowest-end model that supports true multi-site HA is relatively expensive. It would be nice to have that option in lower models.
• Some configuration options (particularly the way address book entries are done) can get tedious and make for very long configs.

Incentivized

• Obviously discontinued
• Difficult to replace without upgrading
• Security bundle is a yearly commitment

This is the one area where I have a beef with Juniper. When I called into Cisco TAC, 90% of the time, the first person I spoke with was able to resolve my issue. With Juniper TAC, 90% of the time, the first person I speak with is not able to resolve my issue, seems to almost be reading from a script, and must escalate my ticket. All of which takes time.

Incentivized

Equipment prices ran about the same. Performance and management were also more or less equal. The biggest deciding factors for going with Juniper were (1) fewer security incidents related to SRX firewalls and (2) technical support costs were significantly less.

Incentivized

WatchGuard XTM is easier to use, has more features in one device, can have better and more specific policies, has a much lower cost, and is stable.

Incentivized

• It is a workhorse for our field operations. It provides the last touch for an ISP to the customer. The customer has no view of the device, but with the repeatability of the device, they do not need to.
• The ability to roll out a dynamic routing protocol attached to a security zone allows elasticity to the environment that supports growth.
• VLAN support on the inside interfaces allow this to be the only device in some smaller deployments we install these in.

Incentivized

• Great value per dollar
• Easy rule management
• Simplifies management of remote boxes

Incentivized