Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 1 of 20
`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 1 of 20
`
`(cid:55)(cid:53)(cid:44)(cid:36)(cid:47)(cid:3)(cid:40)(cid:59)(cid:17)(cid:3)345
`TRIAL EX. 345
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 2 of 20
`
`I .t
`
`'"<'t
`
`sr-1x Sen es Serv,ces Gateways for
`the hr,3nch are next-genPra t1on
`securi ty gateways H·at provide
`essen tial ca pab ili t ies tra t
`conrect. secure. and m anage
`workforce oca t ion'.; s,zed from
`hardfu ts to hurdreds of users. By
`consol,di;t 1ng fa st. highly available
`swit ch ng, rout ing, sec:ur ty,
`an:J next generat ion firewall
`ca pab 11i t1es r~ a single devic e.
`en terpr ses can protect H1e1r
`resources as we lt as econom ct:.lly
`de, ver Pew serv ces, sufe
`conrect v ty. and a sat sfy1ng er•d(cid:173)
`user ex11e>rierce. All sr-1x Series
`Se rvices Ga tewr1ys. 1ndud1ng
`products scaled for Fnterprise
`brilncr. cnterpr.se edge, and
`Dat,1 Cer· ter app I1cat Ions. are
`powe red by Junos OS-the proven
`operat ing sy~Jtem that provides
`unmatched cor'S st ency, better
`performance w t h services. and
`superior 1nfrilstruct ure protect ion
`at ,_, IDwer t c t al cost of owne rship.
`
`Produc t Descrip tio n
`The Juniper Networks~ SRX Series Services Ga teways for the branc h combine next
`generat ,on f irewa ll and ur•1f1ed t hreat managem ent (,JTM) services w th rout ng and
`sv✓1 tch ng ,n as ngle. t· 1gh-performance. cost -effec t ive network device.
`
`SRX ,,enes for the branch runs Jurnr,er Networks Ju nos•' opera ting system . the riroven
`O:', th, t Is used by cme Internet rcuters In a!I of H'e top 100 se,v ce prow Jers ioround the
`wond. -he ngorous.y te~;ted carr er-c lass rout ing fea tures of I°vt1/ IPv6. o 0;or, 3GP. arid
`m ult icast have been proven ,rover 15 yea rs of worldwide deploym ent s.
`
`SRX Series for the branch provides perim eter secunty. con tent security. appl1cat ,on
`v s1b I,tv. trackrng and pc l1cy enforcement. user role-based cont rol. threat 1nte,.1gence
`through Integr2t1nn w th Jun-per Networks Spot light Sernre~ and network-wide threilt
`v1s1b lily and control. Using zones and pc l1 ues. re twork adm 1r•1strators can configure
`and cJeploy brand' SRX Series gateways quickly and securely. Pol1cy-bi!secJ VP1\ ls
`support m ore complex secur ty arch tectures t ha t require dynam c address ng and
`spli t t urnel,rg. Tt'e SRX Ser es a1so ncludes w lilrds for firewall. IPsec VP\J, Network
`Address Trm1s ,a t,on (NAT). ilnd n1t1a. set up to s,mpl fy configurations out of tJ,e box.
`
`For content secu It y. SRX Ser es for the branch offers a complete sui te of next
`genera! on firewall. uni t ed threa t m nragement (UTM) and threa t 1nt eli gence
`services cons1st,ng of: intrusion prevent ior systern (l=>S). app.ication securi ty
`(App5ecurei. user role- based firewa ll co ntmls. on- box and cloud -based ant1vIrv;,
`an t ,sp am. an:1 enh,Jnced Web fHter,ng to protect your ne twork from t he ,,t est
`content-borne t hrea ts. Integrated t hreat 1nte,I gence v,a Spot ligh t Secure offers
`adapt ive threat protect 1or aga nst command and control (C&C) rel,:;t ed ho trets iJnd
`poli cy enforcem en t llasecJ on GeolP arrJ attac ker f ngerpnnt ng tec hr olngy (t he tatter
`for WPh i, J'lJ1.Icat Ion protect1on)-all o f whch are hil•;ed on J1 in1 per prov1deri feeds.
`Custolll ers may also .everage their own c1,stom and third-part y feeds for prc;tect,or'
`from advanced malware snd other threa ts. Tt,e ti ranch SRX Series Int egrcte;; w tr
`other Juniper securi ty products t o deli ver erterpri se -w1de u111f1ed access con tro l
`(U/IC) and adcpt 1ve threat m anagemen t.
`
`SRX Series for t he branch are secure rrniters t ha t bring high perform ance and proven
`depIoym n1t capab li t es tr, enterpri ses tt1at need to build a worldwide network of
`thous,•.nds of sit es. -he wide variety of opt ions all ow corfigurat ion of perform ance.
`fur ct ona l1ty, 2nd price sca led to support from a hand ful t o troLsands of 1,sers.
`Ethernet. ser al. Tl/El. :JS3/E3. xDSL. W1-;::I. and 3C,/4G LTE w reIess are all available
`opt 1or s for WA \I or Internet connec t1v1ty to ser1. re.y !1r•k your sites. Mul t pie form fnctors
`allow you to m ake cost-effec t ,ve d·rnces for lll1ss,on-crit1cal dep.oym en ts. Managing
`the etwork s easy using tre prover Junos OS command-I ne interface (CLI). script ing
`capab1l1t1es. a simple- to-use Web-based GU I. or Juniper Networks Jur,osn, Space
`SecImty D rector for cen tra!11Pd miU-il,'Pm ent.
`
`•/.va,iadeo·~ SRX550 ar·c ''l!g!1ei dev,ce<, e
`
`Q
`
`U NITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`
`Trial Exhibit 345
`
`Case No. 17-CV-05659-WHA
`
`Date Entered: _____ By: _ _ _ _ _ _
`Deputy Clerk
`
`FINJAN-JN 045192
`
`Repor:ed -:Jy: Charlotte Lacey
`RP R, CSR •14224
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 3 of 20
`
`'I,·;..,
`
`);,· _, •_-·•-.:.p [
`
`/\rc hitec ture and Key Compo11e11 l s
`Key Hardware Featu res of the Branch SRX Series Products
`
`Product
`
`Description
`
`SRXlOO Services
`Gateway
`
`SRXll O Services
`Gateway
`
`SRX210 Se1v1ces
`G,,teway
`
`SRX?70 Services
`Gateway
`
`~;RX/40 Services
`G,1tPw2.y
`
`SRXS50 Services
`Gateway
`
`SRX6'i0 Services
`Gateway
`
`Eight 10/100 Et hernet LAN ports and 1 USB port (support fo r 3G IJSB)
`Full UTM 1: antivirus1 a nti spa.m 1• enhanced Web fil tering1• and content filtering
`ntru sion preven:ion system 1. AppSecure1
`2 GB DRAM, 2 GB flash defa ult
`
`VDSL/ADSL)+ and Et hern et WAN in ter'aces
`Eight 70170 0 Et herne t LAN po rts and t wo USB port ( suppor: fo r 3G USB)
`
`i=uu UTM 1; anliv11us1
`• enhanced Web fil tenne1• int1usion preven uon systerri 1• AppSecur e1
`• a.n tispam 1
`Uni ' ied Access Control (UAC) a nd content fil tering
`7 G3 DRAM. 7 CB er defa ult
`Two 10/100/ 1000 Ethern et anrJ 6 10/100 Et hern et _AN por ts. 1 Mrn, -P, M slot and 2 USB pon s (support for 3G IJSB)
`cactorl' option of 1, dynarnic Power over Ethern et (PoE) poris 002.Jaf
`Support for Tl/El . seri al. ADSL/2/2+, VDS L. G.SHDSL.. a ncl Ether net srn alt for rn-foctor pluggable tra nscerver (SFP)
`Con tent Sec umy Accelerator hard ware for faster p erfor ma.nce 0 1 PS and Exp1essAV (with high mem ory version)
`f ull UTM1 anlivi,usl. antispa n11. en hanced Web fil tering1. and GJnten~ filter ing
`ntiusio n p, even:mn systerr11 Use, 1ole~based firewall . and AppSecu,e 1
`;, G'l DRAM. 2 GB flash defaulc
`
`:'rght 10/100/1000 Ethern et LA" p'.lrtS. 2 Mrnr -Pl 'v1 slots
`0 actory opn~n of 8 :>of ri orts: PoE - 00?.3at backwa rds c:,rnpatrble wrth 802.3a'
`Suppor t for Tl /El . serial. ADSL2/2+. VDSL. GSHDS L. anrl Et hernet SFP
`Con ten t Sec urity Acc.ete,ator ha. rdwa,e for faster pedrnrna nce o' IPS and Exr~ ressAV
`-=ull UTM1: anuvirus1 antisi:::a.m 1. enhanced Web fil teling1. and con tent fil tering
`ntru sion preven:ion syste1r' User ,ole based firewall and AppSec ure'
`2 G:l DRAM. 2 GB CF d efault
`
`16 10/100/1000 FthPrn et AN por's. L Minr -Pt '-~ slots
`<actory oprron of 16 Po = ports: Pof+ fl07.3a1. backward s compatible w ith 007 3a'
`Suf)port fo r Tl/El . seri al. AD'>t 71? • . VDSL. G SHDSL. anrl Ft hPrn et SFP
`Cnn tent Ser. 11rit~1 Acr.PlPra.tnr htnrlwnr@ f::J r t.-~~.t er per fn rrna.n cP n; PS anrl Fxr, ressAV
`r ull UTM1: a ntivi1usl anlispan, 1• enhanced Web fille,ing 1• and con ten : filtering
`ntrusio n p,even:,on systen, 1• AppSecure 1
`
`Te n ' ixed Ethernet por·,s (6 10/100/1000 copper." SFP). 2 Mini -Pl lv1 slots. 6 GP rv1 slots or rnul trple GPIM and XPIM
`cornbinat 1ons
`Support for Tl/El . serial. ADSI 21? • . VDSL. G SHDSL. DS3/E3. Crga brt Ether net ports: suppor ts up to G? Fthern et
`por ts including 5FP. 1,0 switch por ts wi:h optional PoE in cluding 802.3al. PoE-. ba:kwards compa:ible w il h fl02.3af
`(or 50 non .. Pof 10/100/1000 copper ports)
`Con ten t Sec urity Accelerator ha1dwa, e fo r fast ei perfo,rna nce o_. lPS an 8 Ex~:- ressAV
`
`=-ull LJTtv1 1: antivirus'. anti spam 1• en hance-rt Web filtering1• anrt r.ontent fil tering
`
`ntrusion preven :Ion systerr 1• User role -based firewa ll. and AppSPCL JJ e1
`Th, ea t intelligence frn p1 otect1c,n frnm cnmmand and cont,ol (C&C) bo:nP ts. Wel"; a.pplica: 1on th,ea t~. dnd adva nced
`ma h~,are. and poli::y enb rce1ren t based an GeoiP data
`2 G3 DRAlv1 defa ul t. 2 GB compact flas h default (SRX550)
`1, GB DRAM defa ul t. 0 GB compact flash clefa ult (SRX550 -ligh \Aern ory)
`Op ti onal redundant AC po 1Ne1: sta nda1d AC powe, supply that 1s PoF-ready: Pof power up to 250 wa: ;s single power
`supply or 500 wa tts d ual power sur: pl y
`
`•our fixe:I po, ts l()/10011000 =:he,n et , AN ri orts 8 CiP M slo:s or rnuhpte GP 'v1 and XPIM corrbinat ,ons
`Support for Tl . El. DS3/F3. Etherne: ports: support s up to 5? " thern et por ts including SFP: L8 switch p:irts wi:h
`opuonal PoE including 8023at. PoE- ba:kwarcls cor-Ppatible wi:h 802.3af (or 57 non · POE 10/100/1000 copper pons)
`Content Security Accelerator hardwa,e fo r faster performance o: ;rs and Exr ressAV
`
`. enhanced Web filtering\ and content filterinB ::ull UTtv1 1· antivirus1 d n tispain 1
`
`ntru sion preven ~ion syst21r' User role-•tJased firewa ll. and AppSecure 1
`Threat inte lligence for protectio n from comrna. nc1 and control (C&C) bo tne ts. Well appllca: 1on th, eats. and adv.J. ncerJ
`malware. and pok :y enfo,c:erren t based on CeolP d ata
`\Aodula., Se1vices and =?outing Engine. fu ture in ternal fa i\over and h::,t s...,.,ap
`2 G3 DRAM defa ult. 2 GB compact flas h rJefault. extern al co,rpact ' lash slot for additiona l storage
`Opt ional redundant AC power: standard AC power supp ly that ,s PoE- ready: "oE p ower up :o 250 wa c:s single po-,1er
`supply or 500 watts dual power suppl y
`
`T t·1p ,,ro< Serres Services (,at eways for tl1e branch are d ep loyed at rem ci t e, branc h anrl Enterprise edge locat rons rn tre network t o
`provide a ,t- rn - one secure WAN connect 1v 1t y, and connect ,ori to local ::ics and servers v a n tegriot ed Ett1erne t swrt ch 1rg.
`
`'Un f1('(J Threat 1/anagerncnt ant1v1ru:, cnt1..-;cc.rr M:-t 11 tcr1q:: r,;,pSc--cuie and r:, rC'QL-IC u subsc11pt1on .-cc,:-c on:or t0 use 1hr-fr..1tuie U TU .<; ,ot ':upponedtir' :he k11✓ ·11('--r10'\· ve'<cM_m
`P,ea~P see :t>e 0rde:r ng section 'o · o::,t ons Con ten: r11teT1~ anti U1\C aie pa·t o! the Lase soltuare nth no acJd t1ona. ce,se
`
`FINJAN-JN 045193
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 4 of 20
`
`r~ea tures and 13e'le fit s
`f,Jpd C-,er f-'fc.' ior1 I 11rJw--;ll
`
`t1d,wh1P
`
`'heat lr1telli/',E'II lc
`
`To address the evo!v ng t hrea t lardscc.pe !hilt has m ade ,t
`1111perat 1ve to int egrate external th rea t ,ntell gence ,nto the
`f rewa ll for t hwart ing edvanced m alwa re and other trreat s. scme
`S'<X Series Se1v1ces Gat ew;eys nclude threat intel li gence v,a
`integrat ion wit h Sp:it llght Secure. The Sp ot light Secure threat
`nt ell,gence p .atform aggrega tes threa t feeds from m ult iple
`srn,rces to de.,ver open. conso l dated. ilct ,onilhle 1ntel. 1gencP to
`S=<X Ser 1es Se rvices Gatewa.ys across n-e organ zation for policy
`enforcem ent. These sources include Jur per threat feeds. third
`party threa t feeds and threat detec t ion technologies tha t the
`customer can dep,oy.
`
`Adm n,strators are able to define enforcement po!1c1es from all
`feeds via a single. centra.,zed m cnagemert point. Junos Space
`Secunty O rector.
`
`SH l llP F-?outine
`Many organizat ions use bott1 a roLter and a f,rewa l.NPN at t heir
`nPtwork edge to fulfil l thP1r networking ,wd sernrity nePds. tor
`many rngan,za t1or1s. the SRX Series frn the branch can ful fill
`both ro les with one solut ion. Juniper built best- in-class rout ng,
`sw tch,rg and firewall capalJ .,t ,es in to :me pr:iduct.
`
`c,C/X :',pries for t he branch checks thp traffic t o see ,f 1t 1s
`.eg,t,rnde and perm issible. an,J only forwards t or' wher' 11 1s.
`Th is reduces the load on tt1e network. iillocates b2 ndw1dth for all
`ot her m ,ss1011-cnt1cal applica t ons. and secures tt1e network from
`m2. i1c1ous Lsers.
`
`Tt1e m ain purpose of a secure router ,s to prov, cJe f irewall
`protection ancJ apply pol1 c1es. Tt1e f1rewa !l (zone) funct ,ona !,t y
`nspPct s traffic flows 'lnd st ate to pnsrne tl1at or g1n1: t1ng and
`ret urn ng nform at on ,r a session ,s exp ect ed and p erm ,tted for
`2 patD Jlar zone. The security po licy determ ,nes ,t the session
`can or g,nate ,none 10ne ilnd t ravPrse to another ?one. Due to
`thP arrh tect ure. c,RX SPries rece1vPs pnckPts from ?. w1c1P vanPty
`of clien ts ard serve rs and keeps tr,,ck nf every sess,cn. of every
`app,1cat 1on. and of every user Th is al lows the enterprise t o m ake
`sure ttia t on ly ,eg ,t im ate traffic 1s on ,ts network and that traffic 1s
`f.ow,ng 1n the expected direct en.
`
`High Avai.d b H y
`Junos Serv ces Redundancy Protcco, ( JSRP) 1!: a ccre fe2 ture
`of the SRX Senes for the branc r . JSR? en;;bles a pa, r of SRX
`Series systems to be ea sily integrated 111 to a h1gl, avada b 1l1t y
`network arct11 tecture. w ,tt, redundant physical connec t ions
`between tt1e system s c1 r1:J tt1e adpcent network switches. W,th
`link rPrh,nd2ncy. J, m,per Networks Citn ;;rJ,Jress m iony common
`causes of system fail ures, such as a phys cal port go,n,: bad
`or a u ti,e gett ,r'g c1,sconr'ected. to ensure t ha t a connec t on
`1s cvai labie w I hm,! having to fail over th e ent ire system . This
`1s consist ent w ,th a typica l act ive/standby na tue o f rcut,ng
`res11 ency prot ocols.
`
`FINJAN-JN 045194
`
`SRX Series Serv ces Ga teways de liver next general on f,rewa ll
`pro tec t on w ,t h app !1cat 1on awareness and exter s,ve Lser rc le(cid:173)
`hilserl control opt ions plushest(cid:173)
`o f-breed UTM to protect and
`control your business assets.
`Next generat ion firewc,lls are
`2;ble to p erform fu .l p ac ket
`inspection and can app ly
`security po.ic,es ba,:e d or' layer 7
`1nformat on. Th15 mP.ans you r:;n
`creat e sernri ty pol, c,es basPd on
`thP. app .ication runr1ng 2-cross
`your network. the user who 1s
`rpcp,v,rg or sPr'd1ng nptwork
`lrd f,c or lhe con tent that ,s
`trave ling across your network
`to protect your environ ment
`c,ga,nst threa ts. m anage how
`yoLr r'etwork bandw,d lt' 1s allocc ted. and cont ro l who has access
`towtia t.
`
`I
`
`I
`
`I
`
`I
`
`I
`
`"CMZ~Z(cid:144)"le
`
`Figure l Firewalls. zones.
`a11d poli cies
`
`AppSecure
`
`/lpp Secure ,s a su te of ,1ppl1cat 1or' security capabli1 t1es for
`Jun per Networks SRX Series serv ces Gateways t hilt ident,f,es
`applicat ions for gre2tPr v,s h i.1 ty, enfr,rcem ent. cr:nt rol. and
`protect on of the netwcrk.
`
`-hp intrusion prever t,or' system (IPS) understands applicat,on
`l1ehav1ors and weakressPs to preven t appl1cat 1on-borne security
`threat s t hat are d1ff1cu,t to de tect and stop.
`
`lJ111fipcJ Th rE:'o.l l/1c1r1c1perT1e11t (L IT l.;11
`
`SRX Series can ,nclLde cr:mprehen s,ve cont ent securit y aga ,nst
`ma.ware. vi ruses. ph1sh1ng attacks. 1ntrus1ons. spam an d other
`thrP,tls w,th 1Jn,f 1Pd trrPil l miln;;gpm ent (UTv1) . Ge t a h est(cid:173)
`of-breed solution w ,tr an t,-v,rus. an t -spam. web fr tering and
`cant er! fil tering at a great valLe by easi ly adding these services
`to your S lX Se ries Services Gateway. Cloud- based ar,d on- b ox
`solut ions c.re bot h ava ,lab,e.
`
`US,·" r= 1rew<1ll
`Jun per o ffers ,1 rr.ngP of usPr ro.P- l1i1sed f,rewil.l cont rol sD lut ons
`that supp:irt dynam ic security p o.ic,es. c.Jser role- based f rewa.,
`capab 1l1t ,es are integrated w,t h tt1e Sf"./X Series Se rvices Gat eways
`for st andard next generat ion f,rewal. cont rols. More ext ersive.
`scala ble. granu lar access controls for creat ing dynam ic po licies
`are ava lable througt, th e 111tegrilt cw of St!X wi th a Juniper
`l Jn,f ed Access Control solut ion.
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 5 of 20
`
`'1,•
`
`)T
`
`'"'P l
`
`Act ive/ Standby
`
`Ac live/ Standby
`
`\
`
`IN TERNET )
`
`\
`
`INT ERN ET )
`
`SRX2t,o /
`/\c 1ve -
`::;::;;;:::i
`
`SRX2fo0
`-=:;:;;:, C.tandby
`
`EX~1:~rs
`I
`I
`I
`I
`,-,
`-, -,
`llhl llbl
`llino llkJ
`DD DD
`
`144&#6
`
`144046d
`
`•
`SRX2t,0
`Fail ure •-.K;~3
`
`SRX2l10
`-==:J- 7 /\c l ive
`
`EX Series '><" I EX Series
`~~ ~~
`ocS 06
`
`Act ive/ Active
`
`INTERN ET
`
`Active/ Active
`
`l INTERNET
`
`I
`
`I EX Serles
`LIJmJ Llirl uu
`
`I
`
`live
`
`EX Series
`
`I
`I
`-, -,-
`Llhi} LlfuJ
`ULJ
`
`S RX2fo0
`
`Ac .1ve
`
`I EX Series
`LJ u
`
`I
`Ll.bJ
`
`I
`ll!mJ
`
`FigurC" 2 High availabili ty
`
`When SRX Series Se rv ces Gat eways for n ,e brarct1 are
`co nfigured as iln ,1ct 1ve/act ,ve HA p,w. tra ffic and con ! gu rat 1on
`1s mirrored aut om at ically to provide act ive firewal. and VPN
`session ma ntenance 1n case o f a fa ilure. The branch SRX Series
`synch ror111es b oH· cor,f ;gc,rn t on and n,n t 1me 1nfcrmilt 1on. As a
`result. cJuring failcve r. sync t1ron1zat1on of the fo.low1 ~g 1nformat 1cn
`1s st,ared : connect 1cr,/sess1on stat e and f. ow informat ion. IPSec
`security assoc 1at ,ons. \Jet work Add ress Translat 1or (N/\T) traffic.
`address book ir form at 1cn . con f ,gurat 1on changes. and m ere. Ir,
`contrast to the t yp ca l rout er ac tive/stan dby resiliency protocols
`sc,ch as Virt ua l Rou ter Redur,dancy Protocol (VRRP) . a il dyr·am 1c
`flow and session nformat en 1s lost and m ust be reest ab . stied
`1n the event o f ,l fa1.over. Som e or a ll net work sess1or's w ill have
`to restart depending on the ror· vergence t ime o f the I nks o r
`nodes. By m ainta ining st ate, not only s the sess on preserved.
`hut secur ty 1s kept int act. In an unstab1e network, th is nct1v?/
`act ve con f 1gumt1on il.SC1 m t 1ga tes li nk f lappir-g ilff ect 1rg session
`p erform ance.
`
`,, ,,IIJn Ra·,r0 d f , I ,Vcl''ilrl1_\ N1thrnJl ti P
`p,_ ,fo1 ITiil.llU' I ·1 l
`
`In ord er to opt 1m 17e t he throughput and latency of the co mbined
`. h 1nnc; ns rnplements sess ion-based
`rni 1tPr rwd firpw;1
`forwa rd1rg, an nncvd •cn t hat combines the ses~;1on state
`nforma.tion of t! trrHj 1t on£: t fir?wal a.rd t r' P next-hor forvvr1rd ng
`of a. cla.ss1c router into a single operat ion. W ith Jur.os OS. a
`session that 1s perm itted bv the forward ing p olic:v 1s addecJ to
`
`the forward ng tab.e along w tt, a PD nter ID t he next -hop rou te.
`~st alJl1shecJ sessions have c1 single tab le lookup to veri fy that the
`sess1or has been permi tted and to fird the next hop. Th s effic ient
`algorithm improves throughp1,t and lowers l,;tercy for session
`traffic: wren com pared w t h ii classic router that performs m ult ip le
`tab le lookups to veri fy sessio n 1nformat 1on and then to find a next(cid:173)
`rop rDL IP.
`
`r 1g1,re 3 shows tre session-based forwa rd ing a.gm,thm. When a
`r'ew session 1s establisred. tre session-based architec ture w ithir(cid:173)
`Junos OS veri fi es th;,t the session sil l lowed by thf' forward ng
`pc! c: es. If the session 1s ;;!lowed. Jl ,nos OS w ol
`,ook up tre next(cid:173)
`rep ro1, te 1n the rou t ing t ab ,e. It then insert s t he session ilnd the
`r·ex t-hop rou te into tt,e sess1or and forwarcJ1ng t able and forward s
`the pac ket. Sub seciuert p ackets for the estab .1sred session
`reqt. ire as 11gle table tcokup 1P the sess 1or, and forwarding tab!e,
`ilnd ilre forwarded to the egress interface.
`
`n·1hl,""t
`J. ·01,
`
`nr
`
`hgress
`lf"\ ICr ldCe
`
`r orwnrcl ng for • •• • • Egress
`Pcrm·ttcd Trn llic
`I11e·face
`
`O saUowcd oy
`Po. cy: Droccecl
`
`Figure J Session basPr) fo rwardtng 1::ilgoriU-irn
`
`FINJAN-JN 045195
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 6 of 20
`
`.~
`
`'
`
`I , •
`
`,....
`
`D -=-
`
`~ 3G
`SRXllO .~ ) Connectivity
`Im!!!!!!!!!
`Small Office
`
`VDSL
`
`Ill
`SRX650
`jiidh 121 h&I :an;.;;
`
`;am um 1JM m:.;.;;
`
`EX4200
`
`re w-w
`WLCB00
`
`!
`~ RX650 ·-·•• 1 l
`EX4200 D D
`
`ODD
`
`UC
`SIP
`Server
`Server
`App Server
`Pri vate Data Center
`
`Internet
`
`SF.com
`Facebook
`Skype
`Google
`
`(
`
`Private WAN
`
`)
`
`Tl/El
`
`SRX210
`.-;;;;;;a
`
`4GLTE
`
`I
`
`£,, \
`
`"ml
`CXlll I
`(cid:143)
`·- [
`
`Small Branch with
`Cellular Backup
`
`J
`
`Hosted Web
`Large HA Office Server
`Server
`
`SFP
`
`~
`
`- I
`
`SRXS50
`
`EX3300
`
`• WLA532
`
`WLClO0
`
`(cid:143)(cid:143)
`
`Mid-sized HA Branch
`
`Tl/El
`
`VDSL
`
`L.--,
`... -
`SRX240
`
`~
`LIU
`
`EX3300 • u
`
`Figure 4 The dist ributed cntc rpn sc
`
`. - -------------
`
`---].;JunlSMtl
`
`• ••
`
`ULLi....LLL.LL.J
`SRX l OO
`
`SRXllO
`
`!i1_Junlpo1
`
`-
`
`O ' rf
`
`7 0 -~
`SRX210
`
`C
`
`SR:Q20
`
`5RX240
`
`SRX '\'iO
`
`--- - - - - - - -
`
`FINJAN-JN 045196
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 7 of 20
`
`'',r,pci fi cn t one;
`
`f"rotocols
`IPvl1, 1° vti. ISO Connect ionless Network ,,erv1ce (Cl.NS)
`
`F 1uting and 1/lultica'.,t
`Static routes
`
`Rl=>v7 +vl
`
`OSPF/OSPFvJ
`
`RGP
`
`RGP Rou ter Reflect or'
`
`IS-IS
`
`Mu,t1cast (Internet Group Managem ent Protocol
`(IGMPvl/2/3). PIM -SM/DM/SS M. Session Desrnpt 1011
`Pro tocol (SOP) , Distance Vec tor Mu.t1cast Rcu t1ng Protocol
`(DV MRP) . source-specific. Mult icast ns1de IPsec tunnel).
`MSDP
`
`MPLS ( RSV::>, LOP. Circuit Cross-connec t (CCC). Tr,ws.at1ona l
`Cross-connect (TCC). I ayer 7 VP'-! (V=>I S ). I ilyer 3 VPN.
`VPLS. NGMVPN)
`
`1
`
`,- JdrP,,s /.11anageme11\
`Static
`
`DHC:P, PPPo= client
`
`Int ern al DHC:P server. DHCP R<"lily
`
`Sm.rce '\JAT with Port Address - ,anslat ,Dn (PAT )
`
`Stat ic NAT
`
`Dest1r nt1on NAT w ith PAT
`
`Pers stent '\JAT, NATM
`
`E- n, ,1 ul..-ltic 1'1'.,
`
`FthPrnPt (MAC ?.nc1 V AN taggec1)
`
`Po nt-to- 0 rnrt Protoco. (?PP) (synch onous)
`
`- Mult il1nk Po nt-to-Point Protocol (M. PPP)
`
`f'rilmP Relily
`
`- Multil1nk r rame Relay ( 'v\UT<) (IRf',15. IRf'.16). 1°<1.P . Lei
`
`High-Level Datil Link Contro l ( -1 :JLC)
`
`:,ena, (RS-232, RS-1149. X.2' , V.35, EIA- 530)
`
`807.l q VI.AN support
`
`Po11° t-to-D01rt Protoco. over Ethernet (PPPoE)
`
`l_,
`
`1· 1tc h1rw,
`807.10. 80?.,D. ,STP, 'v\STP, 807.Jad ( AC:=>)
`802.lx, LL DP, 802.lad (Q-1r -Q) , IGMP SnoopIng
`Layer 2 switching w it h high ava ilab 1.1ty
`
`1"1i 1!1anagement Quality of Ser,,ce (QoS)
`802.l p, :JSCP, EXP
`
`Marking, pol icing, and shaping
`
`Class-basecJ queuing w ith pr on t1zat1or
`
`We ghterJ rand om early detect ion (WRED)
`
`Queu ing based ori VLAN. data- l1nl< connect ion 1dent1fier
`( lJ_U ). interface. bundles, or m ult i- field (M F) filt ers
`
`Guarant eed b andw dth
`
`Mi1x1m um tiandw 1dtr
`
`Ingress traffic pol cIng
`
`Pnonty-bar·dw dth ut 1.1zat1on
`
`:J1ff Serv m arking
`
`V rtual chanre .s
`
`Secun ty
`F11PNclll
`Firewa ll. zones. sc reens. pol1c es
`
`Stateful firewa ll. stateless filters
`
`Network 2ttack detect ion
`
`Screens dernal of se ,vce (DoS) an d prov cJes distributed
`denial of service (DDoS) protect ion (anom aly- based)
`
`Prevent replay attack: Ant i-Replay
`
`L.lniflecJ Access Control
`
`TCP reassemb,y for fragmented packet pro tection
`
`- 3rute fo rce attack m ,t gat,on
`
`SYN co::ik e protect ion
`
`Zone-based IF' sp oofing
`
`Mii lformed packet protect ion
`
`l•JG l-\1✓/ JTI./
`lntn,s1on Prevent1or System (P S)
`
`=>rot::icol ,mom ,1ly detect ,or,
`
`- Statefl;I protm:ol s gnatures
`
`lntrus on prevent Ior system (IPS) att ack patt err(cid:173)
`obfuscct on
`
`..Jser ro1e-based p ol1oes
`
`Custom er signatures erection
`
`Mult iple times a week and em er,iency updates
`App Secure
`
`Ar,pTrilrk (?.ppliril t,on v1s1bli ty ;,nrJ trilck1ng)
`
`App F1rewaL (policy enforcem er,t by applicat on nam e)
`
`Cu~~ton1 signatures
`
`AppQ::iS (network traffic pnont1z,, t ior1 and bandw idth
`m a.nagen1ent)
`
`')ynam 1c s gnature updates
`
`,Jser-based app 1cat1on po.icy enforcemen t
`
`Ant1virus
`
`Express AV (strea m-based AV, not i!valiab le on SRXlJ0
`and SRXr0)
`
`=-=-1.e-hased ant virus
`
`S1gru turc databa:;c
`
`Protoco ls scanned: POP3, HTTP, SM-P. IMAP, FT:,
`
`8GP Po.Jtc Pef!ec :or ~upr;orted cm sq>',550 c-.nd ~, PXb50 SeC' o•dc,r ,rn: ~ECt cv• 'o· mo•e 1•,1orrnator1
`;. r., of J..1"C·5 ·s lN,9-tv. ci. the SRX.550 H,Eh 'Aernoi, ,.n t does no: sJr;:poit :,sr· __ or 802h. Q-•1rH; !G' .1" $"1(1op,ngund L2 s1✓1 tc lli•1!.I ,: 1th Hl,
`i t;n f t:d Threat 1/anage:nern - <.1nt1\~ru<:. ar,t c,pa, n .'\'f•tJ f,1te1,ng r\:x :.Secw e a·1U 1PS rf'Q1.Nf' 1nd,,·1du,:i: 5d;sc1 ptrn k f"'l<.;f' u - t.~ 1~ nm cc.uocc•r ted Q'1 11e lo /.' rn •m QI,; \f'r•.,·c•·1 Plea~e ~f.-e l'·e
`rndc" ng ~ertcn fry cnt1cv1:,
`
`6
`
`FINJAN-JN 045197
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 8 of 20
`
`',.
`
`Ar t1spyware
`
`Ar•t,-adware
`
`Ar•t,keylogger
`
`Cloud-based ,,n t•virus
`
`An t,spam
`
`Integrated enhanced Web fi.terng
`
`Category gram.Im ty (90 + Gltegor es)
`
`- Rea l time tl, reat sco re
`
`Red11ec t Web fil tenng
`
`Conten t Security Acre,erd or 1n SRX?l O high memorv.
`SPX220, s r,x21, o. :,RX5::,0. and SRXb50'
`
`FxpressAV opt ion r ,, RX7C h1gr memory, SRX7?0 h gh
`m em ory. SRX2t,O, SRX550, and Sr,X(j50'·
`
`Content filter ng
`
`Based on 'v1I'v1 E type. file extens ion, and protocol
`co mmands
`
`Auto V:,N (Zero Touch Yuh)
`T1,nnels (Gr,E , IP- IP, 1°sec)
`IPsec, Cata Encrypt or Standard (DES) ( ",6-b1t ). t riple O"'t a
`Encrypt ion St andc.rd (:iDES) ("68-b,t). Advanced Ercrypt 1or
`Starda rrJ (AFS) (l?fl -l11t +) enc1y pt on
`
`Message Digest 5 (MDS).SHA-1. SYA-178, SYA-756
`c11Jthent1rr1 tion
`
`Junes Pulse Dynam ic VPN cl,er·t: browser-based remote
`access fea ture requ,rn·g a license
`l?v4 and IPv6 VPN
`Mdt ,-:>roxy ID for s t e-to-s,te V:>\J
`
`I/ l1" ned1ri T1 an .poi t
`• Compressed Rea l-Tim e Transport 0 rotoco l (CRTP)
`
`H1g11 /.v·,:i1<1h1lity
`VRR:>
`
`JSRP
`
`Statefu . fa dover and dLal t KJX clustenng
`
`SRX550/SRX650 :
`
`- Redundaf't power (opt ional)
`
`GPIM hot swap
`
`"ut ure ,r•terf'al failover 1:nd SRE hot swap (OIR) on
`SRX650
`Backup llf'k v a 3G//1G LTE w,re.ess or other 'NA \J
`
`Act ,ve/art ive- ... 3 m ode'
`
`Act :ve/pass,ve-L3 m ode'
`Configuration synchrm11zat ion'
`',ess1on synchron ?EetIon fer firewilll ,mrl VPN 5
`
`Session fa1.over for rOLJt>ng cl0 ange"•
`
`Oev,ce failure det ect,on 5
`
`I nk fa11L,re detPCI ,on'
`
`1° \1omtonng w th route and interface fill lover
`
`iP\,
`
`'<I Dng
`
`I°v6 Mull •cast Listener Discovery (MLO)
`
`BGP
`
`JSIS
`
`·Nlli-lP',.
`CXff Cel lular JG/t,G/l.TE BroarJbarnJ Da ta Bndge support ed
`on illl hmnch SRX Senes rlev,ces
`
`3G USB m odem support for S0,X70 0. ~,RX .. O. and S'<X2l0
`c l A lv1ed L11er,1cnt. ,-rnc.1 lvlonitor11w
`'<e,;l-t 1m e performance m onitc rr'g ('<PM)
`
`SPssons. pilcket s. and handw,dt h usage
`
`Jun p er J- rtow mon tor ng ar·d account f'g serw:es
`
`I? Morntonng
`
`LOi\i;lfll
`Syslog
`
`Traceroute
`
`=xtens1ve control- and da.ta -plane structu red arnJ
`Lnstruct ured syslog
`Adr, rw,tr-1t1C'.1
`Jun p er Netw:;rks Network a1cJ Security Manager s1.,ppcI1
`(~IS'v1)
`
`Jun per Netwo rks Junos Space SeCL,r ty Director support
`
`Jun per Networks STRM Series Sec1.,r1tv-I·1reat Response
`'v1aragers support
`
`Juniper ~letworks AcJvanced Insight Solut ions support
`
`external administrato r da tabase ('<AOILJS, DAP, SecurelD)
`
`/\1ito-config11rc1tror
`
`Ccnfigura t on ro llb ack
`
`=?esn_,e configurat ion w ith buttcn
`
`Ccmm,t confirm for ct1anges
`
`Auto- reco,d for d1agr·os t1cs
`
`Software upgrades (USS upgrade opt,on)
`
`Jun p er Networks J-WPb
`
`C:cmmand-I,ne ,nterhce
`
`Sm art ,m age downlo,;d
`
`Cl-'1 1'1cd111,r1,,
`\J EBS Crnnpl1ance for S'?X21,0. SRX65C'
`
`~Jepartment of Defer se [DoD) Cert ficat,or for S'?X Senes
`Services Gateways, 1nclud ng test ing and cert ,fi cat ,or by t he
`Jepartment cf Deferse Jc ,nt lnt eroperabil• ty ~est Comm ,;nd
`( JITC) for 1nteropP.rab1l1ty w ,t h Do:J nrtworks and ;;dd1t1an c f
`thP ,,RX Srr PS ,,P1v 1res Gn t PV✓r:ys to th P I Jn,fiPrl C:r: pah1l1t1rs
`Approved Product List (UC APL. )
`
`· Un,' eel .,..n,ea; ~.~a,,1Fc>fl1ert a.ntswus ant,sD~ 'l• W t>:: f1!tennp :'.\ppSccLreand IFS 'l'QU re, 1'Xl1v1:jL,1~ r,,,b~-cr, pt.cy, lic e nse- UTtA ,r. no: s,iµpoi1e::lon tt·'-l' Ol.'rr c~mf.lr,, \'('15,(v1 r'.c.·CISf' SC'£' the
`o·de•ing '.:-e<: t1cy1 for op:,O1~5
`~ SQt. ' On8n1<:tal'HI '/!1th l r;r:i nq1-1.i1 /1!{'1 ~l., ,.~r:i ,c,rr:f' ~<: 1t,p 0~1l1nnt'l! 11fl']!i"iCJP In . GR ()P/~~1,., i1\'?!1 1r'l!'1P ,\':{! nurtl"i'"·P of ' 11Pmri,\· c;nflv.'illfO' I C"f"~P kPY
`.,CP1 nng '"l'On fc_1, sq):110 and SR!. 55,'J
`-
`
`FINJAN-JN 045198
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 9 of 20
`
`,,.
`
`Product Compa ri son
`
`),,·
`
`,·. µp[
`
`S RXlOO
`
`S RXllO
`
`SRX210
`
`S RX 220
`
`S RX240
`
`S RX550
`
`S RX650
`
`Maximum Performance and Capacity
`
`Junos OS ver s1on lPSled
`
`JunosOS
`12.l X/,4 -::Jl5
`
`Junos OS
`12.1X4t,-D15
`
`Jun:JsOS
`12.1X4t,-D15
`
`JUllOSOS
`12.1X44-D15
`
`J11nosOS
`1JI-R5
`
`JunosOS
`12.1/ 15 1'
`
`JunosOS
`11.t+R:J
`
`Firewa ll pe1 forn1nnce
`(large p ackets)
`
`r irewa ll perform ance ( MIX)
`Fir ewa ll ""muting rrs (6 11 Byte)
`r 1rew2 II perfrnmance" (HTTP)
`
`!Psec VPN throughput {large
`packe'.s)
`
`700 Mbps
`
`700 Mbps
`
`fl50 Mbps
`
`950 Mbps
`
`18Cbps
`
`7Gbps
`
`7 Gbps
`
`200 v1bps
`
`200 Mbps
`
`250 lv1bps
`
`300 lv1bps
`
`600 iv1bps
`
`?Gbps
`
`2.5Gbps
`
`70 Kpps
`
`70 l< pps
`
`95 -<pps
`
`125 -<pps
`
`;JO0l<pp s
`
`700 l(pps
`
`850 l<pps
`
`100 Mbps
`
`100 Mbps
`
`290 Mbps
`
`350 Mbps
`
`65 Mbps
`
`65 tv1bps
`
`fl5 v1bps
`
`lO0 Mbps
`
`fJJ0 Mbps
`:;oo Mbps
`
`2Gbps
`
`2Gbps
`
`l 0 Gbps
`
`l 5Gbps
`
`lf'SPC vrN lunnPIS
`
`178
`
`178
`
`)56
`
`51?
`
`1000
`
`?.000
`
`3.000
`
`App Secu, e firewall throughput"
`
`90 Mbps
`
`90 Mbps
`
`250 Mbps
`
`300 Mbps
`
`750 Mbps
`
`2.0Gbps
`
`l .9Gbps
`
`IPS {1n trus1on pevern:1:in system ) 75 !v1bps·"
`
`75 Mbps
`
`65 \Abps
`
`80 Mbps
`
`230 Mbps
`
`800 v1bps
`
`l (jbps
`
`Ant1v1rus
`
`JO v1bps
`( Sc,pims AV)
`
`35 Mbps
`(SophosAV)
`
`B5 \ 1bps
`(Sopl10s AV)
`
`JOO lv1 bps
`(SophosAV)
`
`350 v1bps
`(SophosAV)
`
`75 \Abp s
`(SophosAV)
`
`25 Mbp(,
`(Sopl1c,s AV)
`
`Conn 8ct ions pe1 secon:i
`
`l.li00
`
`Maximurr con~urr ent sessions
`
`32 ,<"
`
`I.BOO
`
`32 K'
`
`2.200
`
`6t1 r·C
`
`2B00
`
`96 K'
`
`8.500
`
`256 I(
`
`D'lAM op: ions
`
`7GBDRA1v1
`
`2GB JRA'•A
`
`2GBDRAI-A
`
`2GBDRAlv1
`
`2G3DRAlv1
`
`77.000
`
`3751(
`
`2GB/l1 GB'
`DRAM
`
`35.000
`
`512 K
`
`2GB DRA M
`
`Maximu1,, se::uri ty policies
`
`3fJ!,
`
`384
`
`512
`
`20L(l
`
`4.096
`
`8.000
`
`8.192
`
`Max1 ff1u1T' use1s supporte:::l
`Network Connect1v1ty
`
`Unrestricte::J
`
`Uni es t,icLe cl
`
`U rn esl 11ct ed
`
`L rn est ric~ed
`
`l.Jrn est 11c!e~J
`
`U nrest 11ct ed
`
`U111 est 1i cted
`
`Fixed 1/0
`
`8 X 10/10 0
`
`8 X 10/10()
`VDSL/
`ADSL2-i-
`WM, (Annex
`Aor B)
`
`Bx
`?x
`10/100/1000 10/100/ 1000
`BASE - + 6x BASE T
`10/100
`
`6x
`16 X
`tix
`10/100/1000 10/ 100/1000 10/100/ 1000
`BAS'.: T - 1,
`BNjE T
`BAS= T
`srP
`
`1/Oslots
`
`NIA
`
`'J/A
`
`l x SRX Series 2 x SRX
`Mini -PIM
`Series
`lvlini -f'l vl
`
`1, x srix
`Ser ies
`Min, r1 ·v1
`
`8 x GP1 v1
`or ,nulliple
`Gf'I M
`andXPIM
`com binations
`
`l x SRX
`Seri es
`/v11rn °,M.
`6xGPM
`orrnulttple
`c;r1v1
`and XPI M
`co1r-bina.tions
`
`SPrvices an d Rnt 1~1ng F.ne1ne
`slots
`
`'\lo
`
`WAN/LAN in terface options
`
`N/A
`
`tv1a,.1rnu1r- number of f')of poi ls WA
`(PoF op tional on sorne SRX
`Seri es rnodels)
`
`\Jo
`
`\J/A
`
`\J/A
`
`USB
`
`2
`
`2
`
`2
`
`2
`
`2
`
`'A,) •,prf ()fl; GuF l tT P' l1 fl1\' (1Hl:1l+, /.' t" ( 11 IMIU•ff-' h ru"I', OS "71Y./il1~n15 ({•,( l '!)1Itll\, I.J•'(l', OS 1· ,,,7 ftlf SR10L,n t_wly\
`~Ttvough~~ut nu-nt:e~ lJ£1<:.f:d Or' I aTP t1df t u1t'1/1fi 1,ilob~·te a,:1n'.x:lct1on ~1.:e
`9Ust' softuare :Ja~ F'S eng,nc ,:ti,c, tl.Js r,gncr P<:r!or rrancc and less capac1tv
`SRX650 -:-u;:~n·t•·. c• ~"'Fie SPi\·1.:es and Ro.it rp f.,gme (S~[) a<:, o' so1tnare •<.'!<-'<)':f' 11 r,
`
`No
`
`1,0
`
`No
`
`No
`
`21-J
`
`See rndrring
`inb rrn at inn
`
`See ordering
`ln foin1~t1on
`
`See rncier1ng
`1nforma: 1on
`
`See ord ering
`info rrnat ion
`
`See ord ering
`in for m a ti:m
`
`Up to 1. ports
`of B07:laf
`wLh
`maximum
`50 vv
`
`t.,p toll ports
`o f B07.3af/
`a. t w ilh
`1T1a.xi1ru111
`120W
`
`t;p to 16
`poi:s o'
`802.Jaf/
`at ,✓1 th
`maxirn urn
`150W
`
`Up tO l;()
`p Ol tS':}i
`802.3af/
`a:wi:h
`rn oxirri um
`?47W
`
`Up to t,8
`p ortso '
`802.3af/
`a t w ith
`rn axirnurn
`?L.7W
`
`2 p e, SRE
`
`FINJAN-JN 045199
`
`

`

`Case 3:17-cv-05659-WHA Document 440-6 Filed 04/18/19 Page 10 of 20
`
`I,
`
`l·
`
`SRXlOO
`
`SRXllO
`
`SRX210
`
`SRX220
`
`SRX240
`
`SRX550
`
`SRX650
`
`Routing
`
`Rouling, {Packet 'v1:::,de) PPS
`
`100l(p ps
`
`100l(pps
`
`l'..i0l<pp s
`
`200'<pps
`
`300Kpr,s
`
`l 000Kpp s
`
`1000,<p ps
`
`BGP in s1ances
`
`BG'' peers
`
`BC.JP rOuie S
`
`OSPF instances
`
`OSDF mu:es
`
`RH') vl / v2 insta nces
`
`'j
`
`8
`
`BI<
`1,
`
`BK
`
`,,
`
`':
`
`8
`
`Bl<
`
`/4
`BK
`
`4
`
`10
`
`16
`
`16 K
`
`10
`
`16K
`
`10
`
`161<
`
`16
`
`16
`
`37<
`
`16
`
`17 ~
`
`16
`
`70
`
`32
`
`600 K
`
`20
`
`700 K
`
`70
`
`56
`
`192
`
`71? K
`
`56
`
`700 I<
`
`56
`
`61,
`
`256
`
`800 I<
`
`61,
`
`700 K
`
`6L,
`
`RIP v2 ,ou1.es
`
`Stat ic rou:es
`
`Source ba.serl rou ting
`
`Policy·· based routing
`
`Fq ual-cost ,rult,pat h {::OAP)
`
`Reverse path forwarding {R"F)
`
`IPsec VPN
`
`Concurren: VPI✓ tunnels
`
`Tunnel inter faces
`
`81<
`
`BK
`
`ves
`
`Yes
`
`ves
`
`ves
`
`128