Juniper Licensing User Guide

Published

2024-08-26

Table of Contents

Licenses for Juniper Soware

Soware Licenses for ACX Series

Soware Licenses for ATP Appliance

Soware Licenses for Contrail Service Orchestraon

Soware Licenses for cRPD

Soware Licenses for cSRX

Soware Licenses for EX Series Switches

Soware Licenses for Juniper Apstra

Soware Licenses for Juniper Coherent Opcs

Soware Licenses for Juniper Secure Connect

Soware Licenses for Juniper Security Director Cloud

Soware Licenses for Juniper Security Director On-Premises

Soware Licenses for MX Series Routers and MPC Service Cards

Soware Licenses for NFX Series

Soware Licenses for Northstar Controller

Soware Licenses for Northstar Planner

Soware Licenses for Paragon Automaon

Soware Licenses for Paragon Insights

Soware Licenses for PTX Series Routers

Soware Licenses for QFX Series Switches

Soware Licenses for SRX Series Firewalls

Soware Licenses for Subscriber Services

Soware Licenses for vSRX Virtual Firewall

Juniper Agile Licensing for License Management

Juniper Agile Licensing Overview | 138

Juniper Agile Licensing Workow for Procuring and Managing Licenses | 140

Juniper Agile Licensing Videos | 141

Acvate Your Licenses

Acvate Licenses | 142

Acvate Junos OS Licenses | 144

Acvate Contrail Insights Licenses | 145

Acvate CSO and Juniper Sky Enterprise Licenses | 146

Acvate Juniper ATP Appliance Licenses | 147

Acvate Juniper Cloud Workload Protecon Licenses | 149

Generate Voucher Cercate | 151

Generate Voucher Cercate for One Device | 151

Generate Voucher Cercates for Mulple Devices | 152

Monitor Your Licenses | 153

Overview | 153

View License | 153

View Installed Licenses | 154

View License Usage | 155

Save License | 156

Delete License | 157

Using the Operaonal Command to Delete Licenses | 157

Using a Conguraon Command to Delete Licenses | 158

System Log for License | 160

request system license add | 160

request system license autoupdate | 162

iii

request system license delete | 164

request license renew | 165

Viewing Licenses with Network Director | 167

Install VCF Soware Licenses | 168

Junos Space License Installaon | 169

Exporng the License Inventory | 170

Juniper Connected Security for VMware NSX Licensing | 173

License Duraon | 175

License Procurement and Installaon | 175

Example: Content Security License Acvaon Video | 176

Soware License Model Overview

SUMMARY

In this topic, you’ll learn in detail about the soware

license model.

IN THIS SECTION

Soware License Model Overview | 0

Soware License Model Overview

The Soware License Model is a framework, set of policies, and tools that help unify and thereby

simplify Juniper product-driven licensing and packaging.

Soware License Model

The major components of the framework are:

• A focus on customer segments (enterprise, service provider, and cloud) and use cases for Juniper

Networks hardware and soware products.

• The introducon of subscripon licenses and subscripon portability for all Juniper Networks

products including Junos OS, Contrail, and Juniper cloud-based services.

• The introducon of a common, three-ered model (standard, advanced, and premium) for all Juniper

Networks soware products.

Three-Tier Soware License Model

As a customer ordering a Juniper Networks product under the Soware License Model that includes

hardware, you order:

• The hardware plaorm that includes the standard license.

• The customer support package that ts your needs.

• The advanced or premium subscripon licenses, according to your use case. These subscripon

licenses include embedded customer support.

As a customer ordering a Juniper Networks soware product, you order:

• The standard, advanced, or premium subscripon license, according to your use case. These

subscripon licenses include embedded customer support.

Three-Tier Model

As new hardware plaorms become available under the Soware License Model, you can customize

your purchase using one of the following three models:

• Standard License

The standard license includes the hardware plaorm and a license to use the soware with the

standard feature set. Standard Return Material Authorizaon (RMA) policies apply with no changes in

case of hardware failure. Customer support is ordered separately as you select your preferred

hardware support policy and support for the standard soware features. For more informaon about

support policy, see Contact Support. The hardware plaorm does not require a separate license, and

the soware right-to-use (RTU) license is perpetual for the licensed features.

• Advanced License

The advanced license includes the subscripon-based license to use the advanced soware features.

The license term is 1 year, 3 years, or 5 years. Customer support for the soware features is

included. These features dier by use case and plaorm. For example, to view the list of features for

the QFX devices, see QFX device class and SKUs.

• Premium License

The premium license includes the subscripon-based license to use the Junos OS soware features.

The license term is 1 year, 3 years, or 5 years. Customer support for the soware features is

included. These features dier by use case and plaorm. The premium license is a superset and

includes all the features from the advanced license and addional features. For example, to view the

list of features for the QFX devices, see QFX device class and SKUs.

Figure 1: Three-Tier Model for the Soware License Model

Understanding Perpetual Licenses

All advanced and premium licenses are oered as perpetual licenses under the Soware License Model.

Perpetual licenses include the following aributes:

• The perpetual licenses are locked to the chassis on which it is acvated.

• Perpetual licenses are not portable.

• You must purchase support separately.

• Premium licenses include all the features in the premium and advanced licenses.

• Perpetual licenses are available in full bandwidth and pay as you grow model (PAYG).

• In case of RMA, you can exchange the perpetual license keys to the RMA device. You must contact

Juniper Customer Care to exchange the license keys for RMA devices.

Understanding Subscripon Licenses

All advanced and premium licenses are oered as subscripons under the Soware License Model.

Subscripon licenses are available in 1-year, 3-year, or 5-year terms. Aer the order fullment, the

subscripon period begins aer the compleon of a 30-day grace period.

Table 1 describes the subscripon terms for purchase and number of months to use the license.

Table 1: Subscripon Terms Details

Subscripon Terms Number of Months for the License

1-year 13 months

3-year 37 months

5-year 61 months

Soware Subscripon licenses include the following aributes:

• Specic products might oer a subset of these licenses. At the end of the term, you have three

opons:

• You can renew the subscripon, to connue to use the features and scale granted under the

license.

• You can order a replacement subscripon.

Upgrading and downgrading the subscripon models is supported. In both cases, subscripon

models are processed as a new order, and you might use the features and scale granted under the

new license. For example, you have a 5-year subscripon, and you want to downgrade to a 3-year

subscripon or the other way around.

• You might decline to renew or purchase a replacement subscripon. In this case, you may no

longer use the features and scale granted under the expired subscripon. You can connue to use

the hardware and any soware features which are granted under the perpetual license.

• Alternavely, when an advanced subscripon term expires, your needs may require an upgrade to

the premium subscripon term.

• Subscripon licenses include Juniper customer support for soware features as part of the

subscripon license, unless customer support is provided by a Juniper partner directly. There is no

need to order a separate customer support policy for the advanced and premium licenses.

• Premium licenses include all the features in the premium and advanced licenses.

• Subscripons may be ordered at any me.

• New soware features may be available over me with new soware versions.

• Subscripon licenses are portable for similar devices.

• Subscripons are cancelable at the end of the term.

• Renewals are not automac.

License Portability

Subscripon licenses are portable. This means that if you buy a new similar hardware plaorm, then you

can port the subscripon license. You can stop using the license on one hardware plaorm and move it

to another hardware plaorm. This portability allows you to balance features across hardware plaorms

in the network without having to buy extra feature licenses.

Licenses for Juniper Soware

In this topic, you can view the licensing informaon for Juniper products.

License informaon for Juniper products is as follows:

• Soware Licenses for ACX Series

• Soware Licenses for ATP Appliance

• Soware Licenses for Contrail Service Orchestraon

• Soware Licenses for cRPD

• Soware Licenses for cSRX

• Soware Licenses for EX Series Switches

• Soware Licenses for Juniper Apstra

• Soware Licenses for Juniper Coherent Opcs

• Soware Licenses for Juniper Secure Connect

• Soware Licenses for Juniper Security Director Cloud

• Soware Licenses for Juniper Security Director On-Premises

• Soware Licenses for MX Series Routers and MPC Service Cards

• Soware Licenses for NFX Series

• Soware Licenses for Northstar Controller

• Soware Licenses for Northstar Planner

• Soware Licenses for Paragon Automaon

• Soware Licenses for Paragon Insights

• Soware Licenses for PTX Series Routers

• Soware Licenses for QFX Series Switches

• Soware Licenses for SRX Series Firewalls

• Soware Licenses for Subscriber Services

• Soware Licenses for vSRX Virtual Firewall

Soware Licenses for ACX Series

ACX Series Routers support subscripon and perpetual licenses.

Go through the following tables:

• ACX Series SKUs Denion on page 7

• ACX Series Soware Licenses Use Case and Scale Informaon on page 7

• ACX Series Soware Licenses for Metro on page 8

• ACX Series Soware Licenses for Data Center on page 10

• ACX Series License SKUs on page 12

• Legacy ACX Series License SKUs on page 14

Table 2: ACX Series SKUs Denion

SKU SKU Character Descripon

S-ACX-100GE/400GE-A/A1/P/P1-P/1/3/5

S-EACX-400G/100G-A/A1/P/P1-1/3/5/P

S—Soware

ACX—Product name: ACX

400G/100G—Bandwidth

100GE/400GE—Bandwidth

A/A1—Advanced license Model

P/P1—Premium license Model

1/3/5—Subscripon term: 1 year, 3 years, or 5 years

P—Perpetual

Table 3: ACX Series Soware Licenses Use Case and Scale Informaon

ACX Series Use Case Scale

Premium Metro and Service Edge 32+ VRFs and 2+ million FIBs

Advanced Metro Service over MPLS or SR 32 VRFs and up to 2 million FIBs

Standard Basic Layer 2 only. Layer 3 (with

IGP only) for management

connecvity

Default Layer 2 scale and 8 queues

per port

Table 4: ACX Series Soware Licenses for Metro

Features with

License

ACX710 ACX5448,

ACX5448-

D/M

ACX7100-32

C/48L

ACX7024,

ACX7024X

ACX7509 ACX7348

Pseudowire

Headend

Terminaon

(PWHT) and

all available

features* in

the router

other than

those

requiring

standalone

licenses with

full plaorm

scale of FIB

and VPNs

Premium Premium Premium Premium Premium Premium

All Layer 2

features*

(ERPS, LAG,

MCLAG, Q-

in-Q, Layer 2

lters, Layer

2 QoS,

Ethernet

OAM,

VXLAN,

CFM, IRB)

Advanced Advanced Advanced Advanced Advanced Advanced

Layer 2 VPN

(PWE, VPLS,

E-VPN)

Advanced Advanced Advanced Advanced Advanced Advanced

Layer 3 VPN Advanced Advanced Advanced Advanced Advanced Advanced

Table 4: ACX Series Soware Licenses for Metro

(Connued)

Features with

License

ACX710 ACX5448,

ACX5448-

D/M

ACX7100-32

C/48L

ACX7024,

ACX7024X

ACX7509 ACX7348

Timing

(SYNCE and

PTP)

Advanced Advanced Advanced Advanced Advanced Advanced

H-QoS Advanced Advanced Advanced Advanced Advanced Advanced

Telemetry Advanced Advanced Advanced Advanced Advanced Advanced

RFC2544 Advanced Advanced Advanced Advanced Advanced Advanced

LFM Advanced Advanced Advanced Advanced Advanced Advanced

CFM Advanced Advanced Advanced Advanced Advanced Advanced

Layer 2 or

Layer 3

Filters

(CIR/EIR/

storm

control)

Advanced Advanced Advanced Advanced Advanced Advanced

All roung

protocols for

IPv4 and

IPv6 (OSPF,

BGP, LDP,

ISIS, RIP,

PCEP, EVPN)

Advanced Advanced Advanced Advanced Advanced Advanced

Timing

features (PTP

and SYNCE)

Advanced Advanced Advanced Advanced Advanced Advanced

Table 4: ACX Series Soware Licenses for Metro

(Connued)

Features with

License

ACX710 ACX5448,

ACX5448-

D/M

ACX7100-32

C/48L

ACX7024,

ACX7024X

ACX7509 ACX7348

Segment

Roung

Advanced Advanced Advanced Advanced Advanced Advanced

SR-TE Advanced Advanced Advanced Advanced Advanced Advanced

SRv6 Advanced Advanced Advanced Advanced Advanced Advanced

Layer 2 (basic

VLAN)

Standard Standard Standard Standard Standard Standard

Perpetual

MACsec

(100-Gigabit

MACsec,

400-Gigabit

MACsec)

Not

supported

Not

supported

Perpetual

Support only

ACX7100-32

Not

supported

Perpetual Perpetual

Soware License for ACX Series Routers for Data Center

Table 5: ACX Series

Soware Licenses for Data Center

Features with License ACX7100 Series

Use Case for Advanced 2 (includes Advanced 1 features): Data Center EVPN-VXLAN fabric

CFM Advanced 2

EVPN-VXLAN Advanced 2

Layer 3 mulcast Advanced 2

Table 5: ACX Series Soware Licenses for Data Center

(Connued)

Features with License ACX7100 Series

OAM Advanced 2

PTP Advanced 2

Q-in-Q Advanced 2

Virtual Chassis Advanced 2

Use Case for Advanced 1 (includes Standard features): Data Center IP fabric

BGP Advanced 1

FBF Advanced 1

GRE Advanced 1

IS-IS Advanced 1

JTI Advanced 1

OSFP Advanced 1

ROCEv2 Advanced 1

sFlow Advanced 1

VRF Advanced 1

VRRP Advanced 1

Use Case for Standard: Basic Layer 2 switching or basic Layer 3 forwarding

Table 5: ACX Series Soware Licenses for Data Center

(Connued)

Features with License ACX7100 Series

BFD

Standard

Layer 2 (xSTP, 802.1Q, LAG) Standard

Layer 2 and Layer 3 lters Standard

Layer 2 and Layer 3 QoS Standard

Layer 3 stac Standard

MC-LAG Standard

SNMP Standard

Table 6: ACX Series License SKUs

ACX Series Device Standard Advanced Premium MACsec Licenses

ACX710 ACX710DC S-ACX-100GE-A1-

P/A-1*3/5

S-ACX-100GE-P1-

P, P-1*/3/5

ACX5448,

ACX5448- D,

ACX5448-M

ACX5448-AC-AFI,

AFO, DC-AFI, AFO

ACX5448-D-AC-

AFO, DC-AFO, AC-

AFI, DC-AFI

ACX5448-M-AC-

AFO, DC-AFO, AC-

AFI, DC-AFI

S-ACX-400GE-A1-

P, A-1*/3/5

S-ACX-400GE-P1-

P, P-1*/3/5

Table 6: ACX Series License SKUs

(Connued)

ACX Series Device Standard Advanced Premium MACsec Licenses

ACX7100-32C ACX7100-32C-AC-

AO, DC-AO

S-EACX-400G-

A-1/3/5, A1-P

S-EACX-100G-

A-1 /3/5, A1-P

Data Center -

Advanced 1

S-ACXCLDDC32C-

A1-1/3/5/P

Data Center -

Advanced 2

S-ACXCLDDC32C-

A2-1/3/5/P

S-EACX-400G-

P-1/3/5, P1-P

S-EACX-100G-

P-1/3/5, P1-P

S-

ACXEVO100GMSE

C-P

S-

ACXEVO400GMSE

C-P

ACX7100-48L

ACX7024

ACX7348

ACX7100-48L-AC-

AI, AC-AO, DC-AI,

DC- AO

S-EACX-400G-

A-1/3/5, A1-P

S-EACX-100G-

A-1/3/5, A1-P

Data Center -

Advanced 1

S-ACXCLDDC48L-

A1-1/3/5/P

Data Center -

Advanced 2

S-ACXCLDDC48L-

A2-1/3/5/P

S-EACX-400G-

P-1/3/5, P1-P

S-EACX-100G-

P-1/3/5, P1-P

S-

ACXEVO100GMSE

C-P

S-

ACXEVO400GMSE

C-P

Support only on

ACX7100-48L and

ACX7348

*1 year subscripon term is for renewal only.

Legacy Licensing for ACX Series Routers

Table 7: Legacy ACX Series License SKUs

Features with License ACX5448-D and

ACX5448-M

Scale SKUs

IP, MPLS, ming, CoS, E-

OAM, telemetry,

RFC2544

Advanced 32 Layer 3 VPN and 8

NG- MVPN

S-ACX-400G-A-1/3/5

All advanced soware

subscripon license

features with full-scale.

Premium Full-scale S-ACX-400G-P-1/3/5

Soware Licenses for ATP Appliance

ATP Appliance supports subscripon licenses.

Go through the following tables:

• ATP Appliance SKU Denion on page 15

• ATP Appliance Soware Licenses on page 15

• ATP Appliance Soware Licenses SKUs on page 16

Table 8: ATP Appliance SKU Denion

SKU SKU Character Descripon

S-JATP-100M/500M/1G/5G/10G-S1/S2/A1/

A2-1/3/5

S—Soware

JATP—Product name: ATP Appliance

100M—100 Mbps

500M—500 Mbps

1G—1 Gbps

5G—5 Gbps

10G—10 Gbps

S1—Standard 1

S2—Standard 2

A1—Advanced 1

A2—Advanced 2

1/3/5—Subscripon term 1, 3, or 5 years

Table 9: ATP Appliance Soware Licenses

Features with Licenses ATP Appliance Use Case

Threat analycs and threat

migaon using third-party

products

Advanced 2 (includes standard 2

features)

ATP Appliance as an on-premises

appliance with third-party

integraons, ATP Appliance Core

with an SRX Series Firewall, ATP

Appliance collectors, analycs, and

threat migaon

Threat analycs and threat

migaon using third-party

products

Advanced 1 (includes standard 1

features)

ATP Appliance as an on-premises

appliance with third-party

integraons, ATP Appliance Core

with an SRX Series Firewall, ATP

Appliance collectors, analycs, and

threat migaon

Table 9: ATP Appliance Soware Licenses

(Connued)

Features with Licenses ATP Appliance Use Case

Malware analysis, SecIntel, and

McAfee anvirus

Standard 2 ATP Appliance as an on-premises

appliance with ATP Appliance Core

and an SRX Series Firewall device

as the collector

Malware analysis, SecIntel, and

Avira anvirus

Standard 1 ATP Appliance as an on-premises

appliance with ATP Appliance Core

and an SRX Series Firewall device

as the collector

Table 10: ATP Appliance Soware Licenses SKUs

ATP Appliance SKUs

Advanced 2 S-JATP-100M/500M/1G/5G/10G-A2-1/3/5

Advanced 1 S-JATP-100M/500M/1G/5G/10G-A1-1/3/5

Standard 2 S-JATP-100M/500M/1G/5G/10G-S2-1/3/5

Standard 1 S-JATP-100M/500M/1G/5G/10G-S1-1/3/5

License stacking is allowed. You can combine individual or bundled licenses to combine features or

increase the total throughput. For example, you can combine a 5-Gbps license and another 5-Gbps

license to supply 10-Gbps throughput to the ATP Appliance.

Supported bandwidth are 100 Mbps, 500 Mbps, 1 Gbps, 5 Gbps, and 10 Gbps.

Soware Licenses for Contrail Service Orchestraon

Contrail Service Orchestraon supports subscripon licenses.

Go through the following tables:

• CSO Soware Licenses on page 17

• CSO Supported Devices on page 19

• "Legacy Licenses for Contrail Service Orchestraon" on page 21

Table 11: CSO Soware Licenses

Features with License Advanced: A, B, and C

class devices

Standard: A, B, and C

class devices

Standard: D and E class

devices

Use Case Hybrid WAN, next-

generaon rewall

management, and SD-

WAN

Hybrid WAN, next-

generaon rewall

management, and SD-

LAN

Hybrid WAN, next-

generaon rewall

management, and SD-

LAN

Authencaon for VPNs Supported Supported Not Supported

Firewall Supported Supported Not Supported

Hybrid WAN-dual WAN

links (acve/backup)

Supported Supported Not Supported

NAT Supported Supported Not Supported

Security event logs and

reporng

Supported Supported Not Supported

Single-WAN link-

managed CPE

Supported Supported Not Supported

User rewall Supported Supported Not Supported

Content Security Supported Supported Not Supported

Zero-touch provisioning

(ZTP) for CPE devices

Supported Supported Not Supported

Automated switch

deployment through ZTP

Not Supported Not Supported Supported

Table 11: CSO Soware Licenses

(Connued)

Features with License Advanced: A, B, and C

class devices

Standard: A, B, and C

class devices

Standard: D and E class

devices

LAN conguraon and

monitoring

Not Supported Not Supported Supported

Mist Wi-Fi integraon Not Supported Not Supported Supported

Switch management Not Supported Not Supported Supported

Virtual chassis (VC) Not Supported Not Supported Supported

APBR Supported Not Supported Not Supported

AppQoE Supported Not Supported Not Supported

AWS cloud endpoint Supported Not Supported Not Supported

Bandwidth-opmized SLA

(RPM)

Supported Not Supported Not Supported

Dual CPE Supported Not Supported Not Supported

Full mesh or dynamic

VPN

Supported Not Supported Not Supported

Hub mulhoming Supported Not Supported Not Supported

Internet Zscaler breakout Supported Not Supported Not Supported

Network segmentaon Supported Not Supported Not Supported

Real-me-opmized SLA

(AppQoE)

Supported Not Supported Not Supported

Table 11: CSO Soware Licenses

(Connued)

Features with License Advanced: A, B, and C

class devices

Standard: A, B, and C

class devices

Standard: D and E class

devices

SD-WAN up to four WAN

links (acve/acve)

Supported Not Supported Not Supported

SLA-based dynamic path

selecon

Supported Not Supported Not Supported

For more informaon on device categories, see Table 12 on page 19 CSO supported Device

Classicaon.

Table 12: CSO Supported Devices

Device Class Supported Devices

A SD-WAN Supported Devices Next-Generaon Firewall

CPE/Spoke (<250)

SRX300 line of devices with Junos

Soware Enhanced (JSE)

NFX150

vSRX (2 vCPUs)

Next-Generaon Firewall Devices

Next-Generaon Firewall services

with Junos Soware Enhanced

(JSE)

SRX300 line of devices

vSRX (2 vCPUs)

Table 12: CSO Supported Devices

(Connued)

Device Class Supported Devices

B CPE/Spoke (<1Gbps)

NFX250

SRX550 with Junos Soware

Enhanced (JSE)

vSRX (5 vCPUs)

Enterprise Hub Devices (Gateway)

(<1Gbps)

SRX1500 (CSO release 5.0x

onwards)

Services gateways with Junos

Soware Enhanced (JSE)

Cloud Hub Devices (<1Gbps)

SRX1500

Services gateways with Junos

Soware Enhanced (JSE)

Next-Generaon Firewall Devices

Next-Generaon Firewall services

with Junos Soware Enhanced

(JSE)

vSRX (5 vCPUs)

C Enterprise Hub Devices (Gateway)

(>1Gbps)

SRX4100 and SRX4200

Services gateways with Junos

Soware Enhanced (JSE)

Cloud Hub Devices (>1Gbps)

Services gateways with Junos

Soware Enhanced (JSE)

SRX4100 and SRX4200

vSRX (7 or 19 vCPUs)

Next-Generaon Firewall Devices

Next-Generaon Firewall services

with Junos Soware Enhanced

(JSE)

vSRX (7 or 19 vCPUs)

Table 12: CSO Supported Devices

(Connued)

Device Class Supported Devices

D Class D does not support any SD-

WAN devices

SD-LAN Devices

EX2300, EX3400, and EX4300

switches

E Class E does not support any SD-

WAN devices

SD-LAN Devices

EX4600 and EX4650 switches

Legacy Licenses for Contrail Service

Orchestraon

To access this page, click Administraon > Licenses> Device Licenses.

You can use the Device License Files page to upload licenses for devices and virtual network services

from your local le system. Each device license le should contain only one license key. A license key is

required to enable various features including virtual network services such as applicaon-based roung,

applicaon monitoring, and vSRX Virtual Firewall security features.

Tasks You Can Perform

You can perform the following tasks from this page:

• Add device license les. See Uploading a License File.

• Edit and delete device license entries.

• Push licenses to devices.

• View details of a device license. Click the details icon that appears when you mouse over the row for

each license le or click More > Details. See Viewing Object Details.

• Show or hide columns about the device license les.

• Sort the device license les. See Sorng Objects.

• Search an object about the device license les. See Searching for Text in an Object Data Table.

Field Descripons

describes the elds on the License Files page.

Table 13: Fields on the License Files Page

Field Descripon

File Name Displays the lename of the license.

Example: license_Image_v1.txt

Descripon Displays the descripon of the license.

Example: License le for applicaon roung.

Tenant Displays the name of the tenant if the license is associated with a

tenant.

Example: Tenant 1

Uploaded By Displays the administrator who uploaded the license.

Example: test_admin

Uploaded Displays the date and me when the license was uploaded.

Example: Jun 5, 2018, 12:41:08 PM

Devices Displays the number of devices to which the license is pushed.

Click the number to view the devices to which the license is pushed.

Uploading a Device License File

To upload a device license le:

1. Click Administraon > Licenses > Device Licenses.

The Device License Files page appears.

2. Click the plus icon (+).

The Add Device Licenses page appears.

3. In the Device License File eld, specify the locaon of the license le that you want to upload.

Alternavely, you can click Browse to navigate to the le locaon and select the le.

NOTE: Each license le should contain only one license key.

4. (Oponal) From the Tenants list, select the tenant to which you want to associate the license le.

If you associate a license with a tenant, you can apply that license only to devices that belong to that

tenant. If a tenant has licenses associated with the tenant, when a device is acvated during ZTP, a

matching license from the licenses associated with the tenant is downloaded to the device.

You can apply a license that is not associated with a tenant to any device of any of the tenants.

During ZTP, when a device is acvated for a tenant that does not have any license associated with it,

a matching license from the licenses that are not associated with any tenant is downloaded to the

device.

5. In the Descripon eld, enter a descripon for the license that you want to upload.

6. Click OK to upload the license.

You are returned to the Device License Files page.

Eding a Device License Entry

You can edit a device license entry to modify the descripon for the license le.

1. Click Administraon > Licenses > Device Licenses.

The Device License Files page appears.

2. Select the device license for which you want to modify the descripon and click the Edit icon.

The Update Device License page appears.

3. Update the descripon.

4. Click OK to save the changes. To discard the changes, click Cancel.

If you click Cancel, a conrmaon message appears. Click Yes to conrm that you want to cancel the

update.

Deleng a Device License

To delete a device license:

1. Click Administraon > Licenses > Device Licenses.

The Device License Files page appears.

2. Select the device license that you want to delete and click the delete icon.

3. In the conrmaon message, click Yes to delete the device license.

To cancel the delete operaon, click No.

Pushing a License to Devices

You can push licenses on to devices from the Licenses page of the Administraon portal. If a license is

associated with a tenant, you can push that license only to devices associated with that tenant.

However, if no tenant is associated with a license, you can apply the license to any device that belongs

to any tenant.

When a license is applied to a device, the license informaon is added to the device object. When the

same license is pushed to the device again, a device-level error message is created. Similarly, if a pushed

license does not match a device, the device generates an error message.

To push a license to a device:

1. Click Administraon > Licenses > Device Licenses.

The License Files page appears.

2. Select the license that you want to push to a device.

The Push License buon is enabled.

3. Click the Push License buon.

The Push License page appears.

4. From the Tenants list, select the tenant associated with the site and devices to which you want to

apply the license.

NOTE: If the license has already been associated with a tenant, you cannot select a dierent

tenant. You can apply the license only to the sites and devices associated with the tenant.

Sites and devices associated with the selected tenant appear.

5. Select the sites and devices to which you want to apply the license and click Push Licenses.

CSO applies the license to the selected devices.

About the CSO Licenses Page

To access this page, click Administraon > Licenses > CSO Licenses.

Users with the OpCo Administrator role can use the CSO Licenses page to view informaon about the

CSO licenses issued by the SP administrator, assign the licenses to one or more tenants, and update or

unassign license assignments.

Tasks You Can Perform

You can perform the following tasks from this page:

• Assign CSO licenses to one or more tenants.

• View the tenants previously assigned to a CSO license—Click

assigned-number

corresponding to a

license. The View Assigned page appears displaying the tenants and quanty assigned to each

tenant.

• Update or unassign CSO license assignments.

• Search for CSO licenses by using keywords—Click the search icon and enter the search term in the

text box and press Enter. The search results are displayed on the same page.

You can search using license SKU, sales order, type, er, or device class.

• Sort CSO licenses—Click a column name to sort based on the column name.

NOTE: Sorng is applicable only to some elds.

• Show or hide columns—Click the Show Hide Columns icon at the top right corner of the page and

select the columns that you want displayed on the CSO Licenses page.

Field Descripons

Table 14: Fields on the CSO Licenses Page

Field Descripon

License SKU Displays the license SKU name; for example, S-CSO-C-

S1-A-3.

Sales Order Sales order number; for example, 15563238.

Type Type of site—on-premise or cloud.

Tier Support er associated with the license; for example,

Standard.

Table 14: Fields on the CSO Licenses Page

(Connued)

Field Descripon

Device Class Class of the Juniper device associated with the license;

for example, B-class.

SSRN Soware support reference number, which is necessary

to idenfy your purchase order when you contact

Juniper Networks for support

Start Date Date (in MMM DD, YYYY format) from which the

license is valid; for example, Aug 29, 2019.

End Date Date (in MMM DD, YYYY format) up to which the

license is valid. CSO calculates the end date based on

the validity of the license SKU.

Device Quanty Total number of devices (that the tenant can add) that

you can assign for a license.

Available Available number of devices (that the tenant can add)

that you can assign to tenants.

Assigned Number of devices (that the tenant can add) that are

already assigned to one or more tenants:

• Click

assigned-number

to view the tenants and

quanty assigned for each tenant. The View

Assigned page appears displaying the tenants and

quanty assigned to each tenant.

• If the CSO license is not assigned to any tenants,

click Assign to assign the license to one or more

tenants.

Assign CSO Licenses, and Update or Unassign CSO License Assignments

Users with the Operang Company (OpCo) Administrator role can:

• Assign a CSO license to one or more tenants.

• Update the assignment of a CSO license that was previously assigned to one or more tenants.

• Unassign a CSO license that was previously assigned to a tenant.

Assign CSO Licenses to Tenants

To assign a CSO license that is not yet assigned to a tenant:

1. Select Administraon > Licenses > CSO Licenses.

The CSO Licenses page appears.

2. Click the Assign link corresponding to the license that you want to assign (in the Assigned column).

The Assign CSO License page appears.

3. Congure the elds according to the guidelines.

4. Click Assign.

CSO validates the quanes that you assigned against the total quanty for the license:

• If the sum of assigned quanes is greater than the total quanty, an error message is displayed.

You must then modify the assigned quanes to proceed.

• If the sum of assigned quanes is less than or equal to the total quanty, a job is triggered. You

are returned to the CSO Licenses, and a conrmaon message is displayed on the top of the page.

Aer the job completes successfully, the CSO Licenses page displays the updated informaon in

the Available and Assigned columns.

Table 15: Fields on the Assign CSO License Page

Field Descripon

License

Informaon

Displays the following informaon for the license:

• Sales Order

• License SKU

• Start Date

License Assignment

Device Quanty Displays the total quanty that can be assigned to tenants.

Table 15: Fields on the Assign CSO License Page

(Connued)

Field Descripon

Available Displays the available quanty that can be allocated to tenants.

Tenants List To assign the license to one or more tenants:

1. Click the + icon.

A row is added to the grid and selected.

2. In the Tenant column, select the tenant to which you want to assign the license.

3. In the Device Quanty column, enter the quanty that you want to assign to the

tenant.

4. Click √ (check mark) to save your changes.

5. (Oponal) Click the pencil icon to modify the tenant name or the quanty and click √

(check mark) to save your changes.

6. (Oponal) Repeat the steps if you want to assign the license to addional tenants.

Update or Unassign CSO License Assignments

For a CSO license that is already assigned to one or more tenants, to update or unassign the license

assignment:

1. Select Administraon > Licenses > CSO Licenses.

The CSO Licenses page appears.

2. Select the license for which you want to update or unassign the license assignment and click the

Update Assignment buon.

The Assign CSO License page appears.

3. From the list of tenants displayed in the grid, select the tenant (row) and do one of the following:

• To update the license assignment:

a. Click the edit (pencil) icon.

b. In the Device Quanty column, modify the device quanty.

c. Click √ (check mark) to save your changes.

The modicaon that you made is displayed in the grid.

• To unassign the license assignment:

a. Click the delete (trash can) icon.

A popup appears asking you to conrm the unassign operaon.

b. Click Yes.

The license is unassigned from the tenant that you selected, and the tenant is removed from

the grid.

4. (Oponal) If the available quanty is non-zero, you can assign the license to addional tenants.

5. Click Assign.

CSO validates the modicaons against the total device quanty for the license:

• If the sum of assigned quanes is greater than the total quanty, an error message is displayed.

You must then modify the assigned quanes to proceed.

• If the sum of assigned quanes is less than or equal to the total quanty, a job is triggered, and

you are returned to the CSO Licenses page. A conrmaon message is displayed on the top of the

page.

Aer the job completes successfully, the CSO Licenses page displays the updated informaon in

the Available and Assigned columns.

Soware Licenses for cRPD

cRPD supports subscripon licenses.

Starng in Junos OS Release 23.2R1, cRPD uses a dierent licensing management system from earlier

releases. You must regenerate your license keys before you upgrade cRPD to Junos OS Release 23.2R1

or later. License keys generated through the older licensing management system will not work. See

Acvate Junos OS Licenses for instrucons to generate your new license keys.

Go through the following tables:

• cRPD SKU Denion on page 30

• Roung Stack for Host and Route Reector Soware Licenses on page 31

• cRPD License SKUs on page 31

Table 16: cRPD SKU Denion

SKU SKU Character Descripon

S-CRPD-AAA-B-CC-D S—Soware

CRPD—Product name cRPD

AAA—Bundle of 10/25/50/100 licenses

A—Advanced Soware features

S—Standard Soware features

CC—HR – Host Roung

D—Subscripon term 1, 3, or 5 years

S-CRPD-AAA-BB-CC-D S—Soware

CRPD—Product name cRPD

AAA—4M/10M/NL – Roung Table Capacity

A—Advanced Soware features

CC—RR – Route Reector

D—Subscripon term 1, 3, or 5 years

S-CRPD-AAA- B -CC-D S—Soware

CRPD—Product name cRPD

AAA—100/1K/10K – Soware Bundle Licenses

A—Advanced Soware features

S—Standard Soware features

CC—HR – Host Roung

D—Subscripon term 1, 3, or 5 years

Table 17: Roung Stack for Host and Route Reector Soware Licenses

Features with Licenses cRPD Roung Stack for Host cRPD Route Reector

BGP sharding Advanced Advanced

Enhanced MPLS Advanced Advanced

Automaon Not Supported Advanced

Programmability Standard Advanced

BGP Standard Advanced

IS-IS Standard Advanced

OSPF Standard Advanced

Telemetry Standard Advanced

Automaon with limited BGP peers Standard Not Supported

Equal-cost mulpath (ECMP) Standard Not Supported

Table 18: cRPD License SKUs

cPRD Use Case SKUs Scale

Roung Stack Host

Advanced

Layer 3 deployments with

MPLS or SR starng at

the host

S-CRPD-A-HR-1/3/5

S-CRPD-100/1K/10K-A-

HR-1/3/5

Without scale restricons

on BGP peers and RIB

Roung Stack Host

Standard

Layer 3 to the IP host S-CRPD-S-HR-1/3/5

S-CRPD-100/1K/10K-S-

HR-1/3/5

16 BGP Peers and 4M

RIB

Table 18: cRPD License SKUs

(Connued)

cPRD Use Case SKUs Scale

Route Reector Advanced Route Reector S-CRPD-4M/10M/NL-A-

RR-1/3/5

4M/10M/No limit RIB

No FIB

To add, delete, and managing licenses, refer Soware License Model Overview and Managing Licenses.

Soware Licenses for cSRX

cSRX supports subscripon licenses.

Go through the following tables:

• cSRX SKU Denion on page 32

• cSRX Soware Licenses on page 33

• cSRX License SKUs on page 34

Table 19: cSRX SKU

Denion

SKU SKU Character Descripon

S-CSRX-S/A1/A2-1/3/5 S—Soware

CSRX—Product name cSRX

S—Standard soware subscripon

A1—Advanced 1 soware subscripon

A2—Advanced 2 soware subscripon

1/3/5—Subscripon term 1, 3, or 5 years

Table 20: cSRX Soware Licenses

Features with Licenses cSRX

Use Case for Advanced 2 (includes standard features): Next-generaon rewall with cloud-based anvirus

IPS, Applicaon Security, cloud-based anvirus, and

URL ltering

Advanced 2

Use Case for Advanced 1 (includes standard features): Data center security

IPS and Applicaon Security Advanced 1

Use Case for Standard: Standard rewall

Firewall Standard

ALG Standard

Screens Standard

User rewall Standard

NAT Standard

Stac roung Standard

Logging Standard

Management Standard

Table 21: cSRX License SKUs

cSRX SKU

Advanced 2 S-CSRX-A2-1/3/5

Advanced 1 S-CSRX-A1-1/3/5

Standard S-CSRX-S-1/3/5

Soware Licenses for EX Series Switches

EX Series Switches support subscripon and perpetual licenses.

Go through the following tables:

• EX Series Switches SKUs Denion on page 35

• EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches Soware Licenses on page

• EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches License SKUs on page 40

• Legacy Feature Licenses for EX2300, EX3400, EX4300, and EX4600 Series Switches on page 42

• Legacy Feature Licenses for EX4650 Switch on page 44

• Legacy Feature Licenses for EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200,

EX9204, EX9208, EX9214, and EX9250 Switches on page 47

• Legacy License SKUs for EX2300, EX3200, EX3400, EX4200, EX4300, EX4500, EX4550, EX6200,

EX8200, EX9200, EX9204, EX9214, EX9208, and EX9250 Switches on page 49

Table 22: EX Series Switches SKUs Denion

SKU SKU Character Descripon

S-EX-A/P-C1/C2/C3-1/3/5 S—Soware

EX-Product name EX Series Switches

C1/C2/C3 - Device class

A—Advanced

P—Premium

1/3/5—Subscripon term 1, 3, or 5 years

Licenses are oered in standard, advanced, and premium ers. Read this table to understand the license

oering suitable for your deployment.

Table 23: EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches Soware Licenses

Features with

Licenses

EX2300 EX3400 EX4100 and

EX4100-F

EX4300 EX4400

Use Case for Premium: Campus and Access Layer 3

BGP and

mulprotocol

BGP (MBGP)

Not supported Premium Premium Premium Premium

IS-IS Not supported Premium Premium Premium Premium

EVPN-VXLAN

(requires BGP)

Not supported Not supported Premium Premium on

EX4300-48MP

Premium

Juniper Mist

Wired

Assurance and

VNA or Marvis

subscripons

Premium

(Subscripon

License only)

Premium

(Subscripon

License only)

Premium

(Subscripon

License only)

Premium

(Subscripon

License only)

Premium

(Subscripon

License only)

Table 23: EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches Soware Licenses

(Connued)

Features with

Licenses

EX2300 EX3400 EX4100 and

EX4100-F

EX4300 EX4400

Use Case for Advanced: Campus and Access Layer 2 or Layer 3

Bidireconal

Forwarding

Detecon (BFD)

Advanced Advanced Advanced Advanced Advanced

EZ-LAG (Single

EVPN Peer)

Not supported Not supported Not supported Not supported Advanced

IEEE 802.1ag Advanced Advanced Advanced Advanced Advanced

IGMP version 1,

IGMP version 2,

and IGMP

version 3

Advanced Advanced Advanced Advanced Advanced

IPv6 roung

protocols: MLD

version 1 and

MLD version 2

Advanced Advanced Advanced Not supported Advanced

Juniper Mist

Wired

Assurance and

VNA or Marvis

subscripons

Advanced

(Subscripon

license only)

Advanced

(Subscripon

license only)

Advanced

(Subscripon

license only)

Advanced

(Subscripon

license only)

Advanced

(Subscripon

license only)

PIM mulcast Advanced Advanced Advanced Not supported Advanced

VRRP version 3 Advanced Advanced Advanced Advanced Advanced

Table 23: EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches Soware Licenses

(Connued)

Features with

Licenses

EX2300 EX3400 EX4100 and

EX4100-F

EX4300 EX4400

Mulcast

Source

Discovery

protocol

(MSDP)

Advanced Advanced Advanced Advanced Advanced

Virtual router

support for

Unicast

Not supported Advanced Advanced Not supported Advanced

Filter-based

forwarding

(FBF)

Not supported Advanced Advanced Advanced Advanced

OAM and

Maintenance

CFM

Advanced Advanced Advanced Advanced Advanced

OSPF version 2

or OSPF version

Advanced Advanced Advanced Advanced Advanced

Protocol

Independent

Mulcast (PIM)

dense mode

Advanced Advanced Advanced Advanced Advanced

PIM source-

specic mode

Advanced Advanced Advanced Advanced Advanced

PIM sparse

mode

Advanced Advanced Advanced Advanced Advanced

Table 23: EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches Soware Licenses

(Connued)

Features with

Licenses

EX2300 EX3400 EX4100 and

EX4100-F

EX4300 EX4400

Real-me

performance

monitoring

(RPM)

Advanced Advanced Advanced Advanced Advanced

RIPIPv6 (RIPng) Advanced Advanced Advanced Advanced Advanced

Unicast reverse-

path forwarding

(unicast RPF)

Not supported Advanced Advanced Advanced Advanced

Virtual Router Not supported Advanced Advanced Advanced Advanced

VRRP Advanced Advanced Advanced Advanced Advanced

Use Case for Standard: Campus and Access Layer 2 or Layer 3

Layer 2 and

Layer 3 lters

Standard Standard Standard Standard Standard

Layer 2 (

STP,

802.1Q, and

LAG)

Standard Standard Standard Standard Standard

Layer 2 and

Layer 3 QoS

Standard Standard Standard Standard Standard

Layer 3 (stac) Standard Standard Standard Standard Standard

IGMP snooping Standard Standard Standard Standard Standard

Table 23: EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches Soware Licenses

(Connued)

Features with

Licenses

EX2300 EX3400 EX4100 and

EX4100-F

EX4300 EX4400

MLD snooping Standard Standard Standard Standard Standard

OAM link fault

management

(LFM)

Standard Standard Standard Standard Standard

Q-in-Q Standard Standard Standard Standard Standard

sFlow Standard Standard Standard Standard Standard

SNMP Standard Standard Standard Standard Standard

Junos telemetry

interface (JTI)

Standard Standard Standard Standard Standard

Virtual Chassis* Standard Standard Standard Standard Standard

Virtual Chassis*—We've included Virtual Chassis license in the Standard license model on EX2300-C 12-

port Switches. However, we don't include the Virtual Chassis license on EX2300 24-port and 48-port

Switch Models. You need to purchase the license separately. Every VC member requires a subscripon

feature license or perpetual feature license.

On EX3400, EX4100, and EX4400 Switches, the ow-based telemetry and MACsec features are

supported. A separate license is required to use these features.

• On EX4400 Switch, use the S-EX-FBT-P license SKU for ow-based telemetry feature.

• On EX4100 and EX4100-F Switches, use the S-EX4100-FBT-P license SKU for ow-based telemetry

feature.

• Use the S-EX-MACSEC-C2-P and S-EX-MACSEC-C3-P for MACsec feature.

Table 24: EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches License SKUs

EX Device Models Subscripon SKUs with

SVC CORE or Next Day

or Same Day hardware

customer support

Subscripon SKUs

without customer support

Perpetual SKU

Class 1: 12 Ports

EX2300-C-12P/T

(TAA/VC)

S-EX-A-C1-1/3/5

(COR/ND/SD)

S-EX-A-C1-1/3/5 S-EX-A-C1-P

EX4100-F-12P/T S-EX-A-C1-1/3/5

(COR/ND/SD)

S-EX-P-C1-1/3/5

(COR/ND/SD)

S-EX-A-C1-1/3/5

S-EX-P-C1-1/3/5

S-EX-A-C1-P

S-EX-P-C1-P

Class 2: 24 Ports

EX2300-24MP/P/T

(TAA/VC/DC)

S-EX-A-C2-1/3/5

(COR/ND/SD)

S-EX-A-C2-1/3/5 S-EX-A-C2-P

EX3400-24P/T (TAA/DC) S-EX-A-C2-1/3/5

(COR/ND/SD)

S-EX-P-C2-1/3/5

(COR/ND)

S-EX-A-C2-1/3/5

S-EX-P-C2-1/3/5

EX4100-24P/T (DC),

EX4100-F-24P/T

S-EX-A-C2-P

S-EX-P-C2-P

EX4300-24P/T

EX4400- 24P/T/MP/X

(TAA/AFI-TAA/DC/DC-

AFI/DC-TAA)

Class 3: 32 Ports or 48 Ports

EX2300-48MP/P/T

(TAA/VC)

S-EX-A-C3-1/3/5

(COR/ND/SD)

S-EX-A-C3-1/3/5 S-EX-A-C3-P

Table 24: EX2300, EX3400, EX4100, EX4100-F, EX4300, and EX4400 Switches License SKUs

(Connued)

EX Device Models Subscripon SKUs with

SVC CORE or Next Day

or Same Day hardware

customer support

Subscripon SKUs

without customer support

Perpetual SKU

EX2300-48MP/P/T

(TAA/VC)

S-EX-A-C3-1/3/5

(COR/ND/SD)

S-EX-P-C3-1/3/5

(COR/ND/SD

S-EX-A-C3-1/3/5

S-EX-P-C3-1/3/5

S-EX-A-C3-P

S-EX-P-C3-P

EX3400-48P/T (TAA/AFI/

AFI-TAA)

EX4100-48P/T (AFI/DC),

EX4100-F-48P/T

EX4300-32F, EX4300-

48MP/P/T (TAA/AFI/DC)

EX4400-48MP/F/P/T

(AFI/AFI-TAA/DC/DC-

AFI/DC-TAA/TAA)

Legacy Licensing for EX Series Switches

Legacy Feature Licenses for EX2300, EX3400, EX4300, and EX4600 Series Switches

EX2300, EX3400, EX4300 Series Switches support the new soware license model as well as the legacy

licenses.

Licenses are oered in Enhanced feature license (EFL) and Advanced feature license (AFL) modes. Read

this table to understand the license oerings suitable for your deployment.

Table 25: Legacy Feature Licenses for EX2300, EX3400, EX4300, and EX4600 Series Switches

Features with

Licenses

EX2300 EX3400 EX4300 EX4600

Bidireconal

Forwarding

Detecon (BFD)

EFL EFL EFL Base

Border Gateway

Protocol (BGP) and

mulprotocol BGP

(MBGP)

Not supported AFL AFL AFL

Connecvity fault

management (IEEE

802.1ag)

Not supported Not supported EFL Base

Ethernet VPN

(EVPN) with Virtual

Extensible LAN

(VXLAN)

Not supported Not supported AFL

EX4300-48MP only

AFL

Filter-based

forwarding (FBF)

EFL EFL EFL Base

IGMP (Internet

Group Management

Protocol) version 1

(IGMPv1), IGMPv2,

and IGMPv3

EFL EFL EFL AFL

Intermediate

System-to-

Intermediate

System (IS-IS)

Not supported AFL AFL AFL

Mulprotocol Label

Switching (MPLS)

Not supported Not supported Not supported AFL

Table 25: Legacy Feature Licenses for EX2300, EX3400, EX4300, and EX4600 Series Switches

(Connued)

Features with

Licenses

EX2300 EX3400 EX4300 EX4600

OSPF and

OSPFv2/v3

EFL EFL EFL Base

Protocol

Independent

Mulcast (PIM)

dense mode, PIM

source- specic

mode, PIM sparse

mode

EFL EFL EFL AFL

Real-me

performance

monitoring (RPM)

Not supported EFL EFL Base

RIPng (RIPng is for

RIP IPv6)

EFL EFL EFL Base

IPv6 roung

protocols: Mulcast

Listener Discovery

version 1 and 2

(MLD v1/v2),

OSPFv3, PIM

mulcast, VRRPv3,

virtual router

support for unicast

EFL EFL Not supported Base

Mulcast Source

Discovery protocol

(MSDP)

EFL EFL EFL Base

Table 25: Legacy Feature Licenses for EX2300, EX3400, EX4300, and EX4600 Series Switches

(Connued)

Features with

Licenses

EX2300 EX3400 EX4300 EX4600

Operaons

Administraon

Management (OAM)

(Connecvity Fault

Management (CFM)

EFL EFL EFL Base

Unicast reverse-

path forwarding

(RPF)

Not supported EFL EFL Base

Virtual Router Not supported EFL EFL Base

Virtual roung and

forwarding (VRF)

BGP

Not supported Not supported EFL AFL

Virtual Router

Redundancy

Protocol (VRRP)

EFL EFL Not supported Base

VXLAN Not supported Not supported Not supported AFL

Licenses for EX4650 Switch are oered in premium and advanced license modes. Read this table to

understand the license oerings suitable for your deployment.

Table 26: Legacy Feature Licenses for EX4650 Switch

Features with Licenses EX4650-PFL EX4650-AFL

BGP and MBGP Premium Premium

Ethernet VPN Premium Premium

Table 26: Legacy Feature Licenses for EX4650 Switch

(Connued)

Features with Licenses EX4650-PFL EX4650-AFL

IPv6 for BGP or MGBP Premium Premium

IS-IS or IPv4 and IPv6 Premium Premium

VRF Premium Premium

VXLAN Premium Premium

MPLS Advanced Advanced

MPLS based Circuit cross-connect

(CCC)

Advanced Advanced

Resource Reservaon Protocol

(RSVP) label- switched path (LSP)

Advanced Advanced

Segment Roung

MACsec is not supported on

EX4650 Switch

Advanced Advanced

Basic IPv6 Base Base

BFD Base Base

CFM (IEEE 802.1ag) Base Base

Class of service (COS)/ Policing/

Shaping/Marking

Base Base

EZ-LAG (Single EVPN Peer) Base Base

Table 26: Legacy Feature Licenses for EX4650 Switch

(Connued)

Features with Licenses EX4650-PFL EX4650-AFL

Filtering Base Base

IGMPv1/v2/v3 (includes IGMP

Snooping)

Base Base

Junos Telemetry Interface Base Base

MC-LAG Base Base

MLDv1/v2 and MSDP Base Base

OSPFv2 and OSPFv3 Base Base

PIM-DM/SM/SSM and PIMv6 Base Base

Q-in-Q tunneling (IEEE 802.1ad) Base Base

RIPng and RPM Base Base

Timing –Boundary Clock and

Timing - Transparent Clock

Base Base

Unicast reverse-path forwarding

(RPF)

Base Base

Virtual Chassis Base Base

Virtual Router Base Base

VRRP, VRRPv6 Base Base

Table 26: Legacy Feature Licenses for EX4650 Switch

(Connued)

Features with Licenses EX4650-PFL EX4650-AFL

Zero Touch Provisioning (ZTP) Base Base

Table 27: Legacy Feature Licenses for EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200,

EX9204, EX9208, EX9214, and EX9250 Switches

Features

with

Licenses

EX3200 EX4200 EX4500 EX4550 EX6200 EX8200 EX9200,

EX9204,

EX9208,

and

EX9214

EX9250

Border

Gateway

Protocol

(BGP) and

mulprot

ocol BGP

(MBGP)

AFL AFL AFL AFL AFL AFL AFL AFL

Ethernet

VPN

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

AFL AFL

EZ-LAG

(Single

EVPN

Peer)

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Base

EX9200

only

Not

supporte

Intermedi

ate

System-

to-

Intermedi

ate

System

(IS-IS)

AFL AFL AFL AFL AFL AFL AFL AFL

Table 27: Legacy Feature Licenses for EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200,

EX9204, EX9208, EX9214, and EX9250 Switches

(Connued)

Features

with

Licenses

EX3200 EX4200 EX4500 EX4550 EX6200 EX8200 EX9200,

EX9204,

EX9208,

and

EX9214

EX9250

IPv6

roung

protocols:

IS-IS for

IPv6,

IPv6 BGP,

IPv6 for

MBGP

AFL AFL AFL AFL AFL AFL AFL AFL

Logical

systems

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

AFL Not

supporte

MPLS

with

RSVP-

based

label-

switched

paths

(LSPs)*

AFL AFL AFL AFL AFL AFL AFL AFL

MPLS-

based

circuit

cross-

connects

(CCCs)

Not

supporte

AFL Not

supporte

AFL Not

supporte

Not

supporte

Not

supporte

Not

supporte

Open

vSwitch

Database

(OVSDB)

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

AFL Not

supporte

Table 27: Legacy Feature Licenses for EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200,

EX9204, EX9208, EX9214, and EX9250 Switches

(Connued)

Features

with

Licenses

EX3200 EX4200 EX4500 EX4550 EX6200 EX8200 EX9200,

EX9204,

EX9208,

and

EX9214

EX9250

Virtual

Extensibl

e LAN

(VXLAN)

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

Not

supporte

AFL AFL

*Starng with Junos OS Release 17.3R1, you can enable up to 200 RSVP-TE sessions in the EX9200

advanced feature license (AFL).

Table 28: Legacy License SKUs for EX2300, EX3200, EX3400, EX4200, EX4300, EX4500, EX4550,

EX6200, EX8200, EX9200, EX9204, EX9214, EX9208, and EX9250 Switches

EX Series Switch Models SKU

EX2300-C-12P, T

On purchasing the EFL license, then addional

EX2300- VC license purchase is not required

EX-12-EFL

Includes the EX2300-VC (Virtual Chassis feature

license)

EX2300-24T, 24P, 24MP EX-24-EFL

EX2300-48T, 48P, 48MP EX-48-EFL

EX2300-24T,24P, 24MP, EX2300-48T, 48P, 48MP do not include the EX2300-VC (Virtual Chassis feature). To

use Virtual Chassis feature, purchase a separate EX2300-VC license for each EX2300 Switch

EX3400-24T, 24P EX-24-EFL

EX3400-48P, 48T, 48T-AFI

EX3400-48T-DC, DC-AFI

EX-48-EFL

Table 28: Legacy License SKUs for EX2300, EX3200, EX3400, EX4200, EX4300, EX4500, EX4550,

EX6200, EX8200, EX9200, EX9204, EX9214, EX9208, and EX9250 Switches

(Connued)

EX Series Switch Models SKU

EX3400-24T

EX3400-24P

EX-24-AFL

EX3400-48P,48T, 48T-AFI, 48T-DC, DC-AFI EX-48-AFL

EX3400 EX-QFX-MACSEC-ACC

EX4300-24T,24P EX4300-24-EFL

EX4300-48MP, 48P, 48T

EX4300-48T-AFI, DC, DC-AFI

EX4300-48-EFL

EX4300-32F

EX4300-32F-DC

EX4300-32F-EFL

EX4300-24T, 24P EX4300-24-AFL

EX4300-48MP,48P

EX4300-48T, 48T-AFI, 48T-DC

EX4300-48T-DC-AFI

EX4300-48-AFL

EX4300-32F, DC EX4300-32F-AFL

EX4300 EX-QFX-MACSEC-ACC

EX4600 EX4600-AFL

EX4600-40F

Table 28: Legacy License SKUs for EX2300, EX3200, EX3400, EX4200, EX4300, EX4500, EX4550,

EX6200, EX8200, EX9200, EX9204, EX9214, EX9208, and EX9250 Switches

(Connued)

EX Series Switch Models SKU

EX4600-40F

EX-QFX-MACSEC-AGG

EX4650-48Y-AFI/AFO

EX4650-48Y-DC-AFI/AFO

EX4650-PFL (Premium)

EX4650-AFL (Advanced)

EX3200-24P/T

EX4200-24F/P/PX/T

EX-24-AFL

EX3200-48P/T

EX4200-48F/P/PX/T

EX-48-AFL

EX4500-40F-BF/BF-C

EX4500-40F-FB/FB-C

EX-48-AFL

EX4550 EX4550-AFL

EX9204 EX9204-AFL

EX9208 EX9208-AFL

EX9214 EX9214-AFL

Soware Licenses for Juniper Apstra

Juniper Apstra supports subscripon licenses.

Go through the following tables:

• Juniper Apstra SKUs Denion on page 52

• Juniper Apstra Soware Licenses on page 52

• Juniper Apstra License SKUs on page 54

You can see the detailed list of features supported on Juniper Apstra at Juniper Apstra Datasheet.

Table 29: Juniper Apstra SKUs Denion

SKU SKU Character Descripon

S-APSTRA-VM-S-1/3/5 S—Soware

APSTRA—Product name

VM—VMware

S—Standard

1/3/5—Subscripon term 1, 3, or 5 years

S-APSTRA-S/A/P-1 /3/5 S—Soware

APSTRA—Product name

S—Standard

A—Advanced

P—Premium

1/3/5—Subscripon term 1, 3, or 5 years

Table 30: Juniper Apstra Soware Licenses

Features with Licenses Juniper Apstra

Use Case for Premium (includes advanced features): Large scale, mul-vendor, and policy control

More than 3 blueprints Premium

Third party vendor fabrics* Premium

Policy assurance Premium

Table 30: Juniper Apstra Soware Licenses

(Connued)

Features with Licenses Juniper Apstra

Flow Data Premium

Use Case for Advanced (includes standard features): Full operaon, assurance, and intent-based analycs

Up to 3 blueprints per instance Advanced

Advanced Intent Based Analycs (IBA) Advanced

Apstra telemetry streaming Advanced

Custom Telemetry Collecon Advanced

Root cause idencaon and analysis (RCI/RCA) Advanced

Data Center Interconnect (over-the-top (OTT) Data

Center Interconnect (DCI))

Advanced

Use Case for Standard: Basic conguraon and operaons

1 blueprint per instance Standard

Basic Telemetry or Intent Based Analycs (IBA) Standard

3 or 5 stage IP Clos fabric Standard

Collapsed fabric Standard

Device management Standard

Freeform Standard

Table 30: Juniper Apstra Soware Licenses

(Connued)

Features with Licenses Juniper Apstra

Plaorm management Standard

Juniper Apstra Connector for VMware

50 server hosts per license pack Standard

VMware vCenter Standard

VMware NSX-T Standard

• *Third party vendor fabrics—Fabrics with non-juniper devices requires Premium license.

• The Standard license includes six months of Advanced trial license with Standard license purchase.

You need addional licenses to use the connector for VMware on Juniper Apstra for integraons with

VMware vCenter and NSX-T.

Table 31: Juniper Apstra License SKUs

Juniper Apstra SKUs

Premium S-APSTRA-P-1 /3/5

Advanced S-APSTRA-A-1/3/5

Standard S-APSTRA-S-1/3/5

Standard (Connector for VMware) S-APSTRA-VM-S-1/3/5

Soware Licenses for Juniper Coherent Opcs

Juniper Coherent Opcs support bundle and perpetual licenses. License bundle includes a set of

soware features dened for a use case.

Go through the following tables:

• Juniper Coherent Opcs SKUs Denion on page 55

• Juniper Coherent Opcs and Third-party Coherent Opcs Soware Licenses on page 55

You’ll require a license to use coherent opcs 400ZR and 400G OpenZR+ on a Juniper Networks device

port.

Table 32: Juniper Coherent Opcs SKUs Denion

SKU SKU Character Descripon

QDD-4C-ZR/ZRM-HP-P-B

JCO-4C-ZR/ZRM-P-B

QDD—Generic Qualied Juniper Product

JCO—Juniper Coherent Opcs-Co-Developed

4C—Speed 400 GBPS

ZR—OIF 400ZR Implementaon Agreement (IA)

ZRM/ZR-M—OpenZR+ MSA

HP—High Power (0dBm)

P—Perpetual

B—Bundle

Right to use license purchase does not include customer support. See KB69868.

Table 33: Juniper Coherent

Opcs and Third-party Coherent Opcs Soware Licenses

Opcs Juniper Orderable SKUs License Bundle

OIF 400ZR QDD-4C-ZR-P-B QDD-400G-ZR (Generic Qualied)

S-JCO-400-A1-ZR-P (400ZR

license)

Table 33: Juniper Coherent Opcs and Third-party Coherent Opcs Soware Licenses

(Connued)

Opcs Juniper Orderable SKUs License Bundle

JCO-4C-ZR-P-B JCO400-QDD-ZR (Juniper Co-

Developed)

S-JCO-400-A1-ZR-P (400ZR

license)

400G OpenZR+ QDD-4C-ZRM-P-B QDD-400G-ZR-M (Generic

Qualied)

S-JCO-400-A1-ZRM-P (OpenZR+

license)

JCO-4C-ZRM-P-B JCO400-QDD-ZR-M (Juniper Co-

Developed)

S-JCO-400-A1-ZRM-P (OpenZR+

license)

400G OpenZR+ (0dBM) QDD-4C-ZRM-HP-P-B QDD-400G-ZR-M-HP (Generic

Qualied)

S-JCO-400-A1-ZRM-P (OpenZR+

license)

To use a third-party 400G coherent opcs, you must purchase the third-party coherent right to use

license through the S-JCO-4C-RTU-DCO-P SKU.

Soware Licenses for Juniper Secure Connect

Juniper Secure Connect supports subscripon licenses.

Go through the following tables:

• Juniper Secure Connect SKUs Denion on page 57

• Juniper Secure Connect Soware Licenses on page 57

Table 34: Juniper Secure Connect SKUs Denion

License SKU SKU Character Descripon

S-RA3-SRX3

-S-

1/3/5

S—Subscripon

RA3—Juniper Secure Connect

SRX3

—SRX300 line of devices (only supported on

SRX300 line of devices)

CCU—

is the number of total connected concurrent

users (supported on SRX Series Firewalls and vSRX

Virtual Firewall)

S—Standard soware subscripon

1/3/5

—Subscripon term 1 or 3 or 5 years

Table 35: Juniper Secure Connect Soware Licenses

Supported Devices License

SKUs

Descripon

SRX300 S-RA3-

SRX300-

S-1/3/5

concurrent

users with

soware

support

SRX320 S-RA3-

SRX320-

S-1/3/5

concurrent

users with

soware

support

SRX340 S-RA3-

SRX340-

S-1/3/5

150

concurrent

users with

soware

support

Table 35: Juniper Secure Connect Soware Licenses

(Connued)

Supported Devices License

SKUs

Descripon

SRX345 S-RA3-

SRX345-

S-1/3/5

250

concurrent

users with

soware

support

SRX380 S-RA3-

SRX380-

S-1/3/5

500

concurrent

users with

soware

support

SRX300, SRX320, SRX340, SRX345, SRX380, SRX1500, SRX1600, SRX2300,

SRX4100, SRX4200, SRX4600, SRX5400, SRX5600, SRX5800, and vSRX Virtual

Firewall

S-

RA3-5CCU-

S-1/3/5

5 concurrent

users with

soware

support

SRX300, SRX320, SRX340, SRX345, SRX380, SRX1500, SRX1600, SRX2300,

SRX4100, SRX4200, SRX4600, SRX5400, SRX5600, SRX5800, and vSRX Virtual

Firewall

S-

RA3-25CCU

-S-1/3/5

concurrent

users with

soware

support

SRX320, SRX340, SRX345, SRX380, SRX1500, SRX1600, SRX2300, SRX4100,

SRX4200, SRX4600, SRX5400, SRX5600, SRX5800, and vSRX Virtual Firewall

S-

RA3-50CCU

-S-1/3/5

concurrent

users with

soware

support

SRX340, SRX345, SRX380, SRX1500, SRX1600, SRX2300, SRX4100, SRX4200,

SRX4600, SRX5400, SRX5600, SRX5800, and vSRX Virtual Firewall

S-

RA3-100CC

U-S-1/3/5

100

concurrent

users with

soware

support

Table 35: Juniper Secure Connect Soware Licenses

(Connued)

Supported Devices License

SKUs

Descripon

SRX345, SRX380, SRX1500, SRX1600, SRX2300, SRX4100, SRX4200, SRX4600,

SRX5400, SRX5600, SRX5800, and vSRX Virtual Firewall

S-

RA3-250CC

U-S-1/3/5

250

concurrent

users with

soware

support

SRX380, SRX1500, SRX1600, SRX2300, SRX4100, SRX4200, SRX4600,

SRX5400, SRX5600, SRX5800, and vSRX Virtual Firewall

S-

RA3-500CC

U-S-1/3/5

500

concurrent

users with

soware

support

SRX1500, SRX1600, SRX2300, SRX4100, SRX4200, SRX4600, SRX5400,

SRX5600, and SRX5800

S-

RA3-1KCCU

-S-1/3/5

1000

concurrent

users with

soware

support

SRX4600, SRX5400, SRX5600, and SRX5800 S-

RA3-5KCCU

-S-1/3/5

5000

concurrent

users with

soware

support

SRX Series Firewalls and vSRX Virtual Firewall include two built-in concurrent user/devices licenses. You

need new license keys to acvate addional concurrent user/devices than the two built-in concurrent

user licenses on SRX Series Firewalls and vSRX Virtual Firewall. Contact your Juniper Account Team or

Juniper Partner for purchasing addional license.

Soware Licenses for Juniper Security Director

Cloud

Juniper Security Director Cloud supports subscripon licenses.

Go through the following tables:

• Juniper Security Director Cloud SKUs Denion on page 60

• Juniper Security Director Cloud Licenses on page 60

Table 36: Juniper Security Director Cloud SKUs Denion

SKU SKU Character Descripon

S-SDC-SRX-S-C-1/3/5 S—Soware

SDC-SRX—SRX Series Firewall on Juniper Security

Director Cloud

S—Standard

C—Customer Support

1/3/5—Subscripon term: 1 year, 3 years, or 5 years

S-SD-LOG-1TB-C-1/3/5 S—Soware

SD-LOG—Juniper Security Director Log

1TB—Storage space of 1 TB

C—Customer Support

1/3/5—Subscripon term: 1 year, 3 years, or 5 years

Table 37: Juniper Security Director Cloud Licenses

Features with Licenses SKU

Logging and reporng applicaon S-SDC-SRX-S-C-1/3/5

Log storage S-SD-LOG-1TB-C-1/3/5

Soware Licenses for Juniper Security Director On-

Premises

Juniper Security Director On-Premises supports perpetual licenses.

Go through the following tables:

• Juniper Security Director On-Premises SKUs Denion on page 61

• Juniper Security Director On-Premises Licenses on page 62

Table 38: Juniper Security Director On-Premises SKUs Denion

SKU SKU Character Descripon

S-JSPLT-S2-P S—Soware

JSPLT—Junos Space Plaorm

S2—Mulnode

P—Perpetual

JS-SECDIR-5/10/100 JS—Junos Space

SECDIR—Juniper Security Director

5/10/100—Number of devices

JS-LOGDIRECTOR-500/1K/5K/10K JS—Junos Space

LOGDIRECTOR—Junos Space Log Director

500/1K/5K/10K—Events per second

SDSN-PE-ADD-ON-5/50/100/500/1K SDSN-PE—Soware-Dened Secure Networks Policy

Enforcer

ADD-ON—Add-on for users with Juniper Security

Director

5/50/100/500/1K—Number of devices

Table 38: Juniper Security Director On-Premises SKUs Denion

(Connued)

SKU SKU Character Descripon

SDSN-PE-5/50/100/500/1K SDSN-PE—Soware-Dened Secure Networks Policy

Enforcer

5/50/100/500/1K—Number of devices

Table 39: Juniper Security Director On-Premises Licenses

Product with Licenses SKU

Junos Space Plaorm S-JSPLT-S2-P

Junos Space Security Director for SRX Series Firewall JS-SECDIR-5/10/100

Junos Space Log Director JS-LOGDIRECTOR-500/1K/5K/10K

Policy Enforcer with exisng Security Director SDSN-PE-ADD-ON-5/50/100/500/1K

SDSN-PE-5/50/100/500/1K

Soware Licenses for MX Series Routers and MPC

Service Cards

MX Series Routers support subscripon and perpetual licenses.

Go through the following tables:

• MX Series SKU Denion on page 63

• MX Series Routers Soware Licenses on page 63

• MX-SPC3 Soware Licenses on page 66

• MX Series Routers and MX-SPC3 License SKUs on page 68

Table 40: MX Series SKU Denion

SKU SKU Character Descripon

S-MXSPC3-A1/A2/A3/P1/P2/P3-1/3/5/P

S-MXSPC3-1/2-IPSEC-1/3/5/P

S—Soware

MXSPC3— Product name: MXSPC3 line card

A1/A2/A3—Advanced 1 or advanced 2 or advanced 3

soware features

P1/P2/P3—Premium 1 or premium 2 or premium 3

soware features

1/2-IPSEC—Supported IPsec VPN features list

1/3/5—Subscripon term 1 or 3 or 5 years

P—Perpetual license

Table 41: MX Series Routers Soware Licenses

Features with Licenses MX Series Routers

Use Case for Premium (includes Advanced features): Services

Scale: 32+IP VPNs and 8+mulcast VPNs

Highscale IP-VPNs Premium

IP fabrics (SRv6 and SRm6) Premium

PWHT for Layer 3 VPNs or BNG Premium

Inline NAT and inline MDI Premium

1:1 inline J-Flow Premium

Use Case for Advanced (includes Standard features): Transport

Scale: 32 IP VPNs – all address families and 8 next-generaon MVPN

Table 41: MX Series Routers Soware Licenses

(Connued)

Features with Licenses MX Series Routers

IP roung

Advanced

IGP (OSFP and IS-IS) Advanced

IP-FRR Advanced

PIM variants Advanced

IGMP Advanced

Internet eBGP peering Advanced

BGP mulhoming (add path and mul-path) Advanced

EPE Advanced

BGP PIC Advanced

BGP ow specicaon Advanced

All Layer 2 services—E-LINE (Layer 2 VPNs, Layer 2

circuit, EVPN VPWS, EVPN FXC), E-LAN (bridging, H-

VPLS, EVPN, and IRB), E-TREE (H-VPLS, EVPN, and

IRB), Layer 2 mulcast (snooping included)

Advanced

All MPLS transport—LDP, RSVP-TE, SR, SR-TE, and

MPLS-FRR (including TI-LFA)

Advanced

IP fabrics (GRE, MPLSoUDP, VxLAN, and IPinIP) Advanced

Streaming telemetry Advanced

Table 41: MX Series Routers Soware Licenses

(Connued)

Features with Licenses MX Series Routers

SNMP Advanced

Policers Advanced

ACLs Advanced

J-Flow (sampled) Advanced

sFlow Advanced

Port mirroring Advanced

VLAN queuing Advanced

Timing (all variants) Advanced

OAM—BFD Advanced

Ethernet CFM or LFM Advanced

MPLS or SR (ping and traceroute) Advanced

Services OAM Advanced

RPM Advanced

TWAMP Advanced

HQoS Advanced

Table 41: MX Series Routers Soware Licenses

(Connued)

Features with Licenses MX Series Routers

Logical Systems Advanced

Use Case for Standard: Basic Layer 2 features

Bridging with port and single level VLAN (dot1Q) Standard

LAG Standard

The Junos Fusion Technology feature requires an addional license in addion to Advanced license.

The subscriber management (BNG or CUPS) feature requires an addional license in addion to

Premium license.

Features that are not explicitly listed in Premium license are included in Advanced license, except for the

following:

• Junos Fusion Technology requires an addional license in addion to Advanced or Premium license.

• Premium soware er is a prerequisite for running subscriber services (BNG (PL), BNG CUPS, MX

Mobile User Plane (SAEGW-U, 5G AGF or UPF)).

Table 42: MX-SPC3

Soware Licenses

Features with Licenses MX-SPC3

Use Case for Premium 3: Advanced threat intelligence

DNS sinkhole, IDS, and URL ltering Premium 3

Use Case for Premium 2: Service provider edge; Gi rewall for mobile operators; enterprise edge and data center

CGNAT, DNS sinkhole, IDS, stateful rewall, and URL

ltering

Premium 2

Use Case for Premium 1: Enterprise data center and edge; service provider edge

Table 42: MX-SPC3 Soware Licenses

(Connued)

Features with Licenses MX-SPC3

CGNAT, DNS sinkhole, IDS, stateful rewall, and URL

ltering

Premium 1

Use Case for Advanced 3: Advanced threat intelligence

Intrusion detecon system (IDS) Advanced 3

Use Case for Advanced 2: Advanced threat intelligence

Stateful rewall Advanced 2

Use Case for Advanced 1: Enterprise data center and edge; service provider edge

Carrier-grade NAT (CGNAT) Advanced 1

Use Case for Standard: Enterprise data center; service provider edge and data center

Trac Load Balancer (TLB) Standard

IPsec– Full card for Site-to-Site VPN, Dynamic Endpoint, and AutoVPN, use S-MXSPC3-2-IPSEC-

1/3/5/P.

IPsec– Half card for Site-to-Site VPN, Dynamic Endpoint, and AutoVPN, use S-MXSPC3-1-IPSEC-

1/3/5/P.

IPsec* – Group VPN, Intra HA, policy-based VPN, passive mode, IPsec tunnel trace route are not

supported.

Table 43: MX Series Routers and MX-SPC3 License SKUs

MX Series Routers and MX-SPC3 Subscripon Perpetual

MX304 MX304-BASE/PREM

MX304-LMIC16-BASE

S-MX-1C/16C-A1/P1-

C1-3/5/7/1*

MX304-BASE/PREM

MX304-LMIC16-BASE

S-MX-1C/16C-A1/P1-C1-P

MX204 MX204-HW-BASE

S-MX-4C-A1/P1-C1-3/5/7/1*

MX204-HW-BASE

S-MX-4C-A1/P1-C1-P

MX10K3-L2103

Supported on MX10003 device

MX10K3-L2103-BASE

S-MX-12C-A1/P1-C1-3/5/7/1*

MX10K3-L2103-BASE

S-MX-12C-A1/P1-C1-P

MPC5E

Supported on MX240, MX480,

MX960, MX2008, MX2010, and

MX2020

MPC5E/Q-40G10G/100G10G

S-MX-2C4-A1/P1-3/5/7/1*

MPC5E/Q-40G10G/100G10G

S-MX-2C4-A1/P1-P

MPC7E-10G

Supported on MX240, MX480,

MX960, MX2008, MX2010, and

MX2020

MPC7E-10G

S-MX-4C-A1/P1-3/5/7/1*

MPC7E-10G

S-MX-4C-A1/P1-P

MPC7E-MRATE

Supported on MX240, MX480,

MX960, MX2008, MX2010, and

MX2020

MPC7E-MRATE

S-MX-4C8-A1/P1-3/5/7/1*

MPC7E-MRATE

S-MX-4C8-A1/P1-P

MPC10E-10C

Supported on MX240, MX480, and

MX960 devices

MPC10E-10C-P-BASE

S-MX-10C-A1/P1-3/5/7/1*

MPC10E-10C-P-BASE

S-MX-1C/10C-A1/P1-P

Table 43: MX Series Routers and MX-SPC3 License SKUs

(Connued)

MX Series Routers and MX-SPC3 Subscripon Perpetual

MPC10E-15C

Supported on MX240, MX480, and

MX960 devices

MPC10E-15C-P-BASE

S-MX-15C-A1/P1-3/5/7/1*

MPC10E-15C-P-BASE

S-MX-15C-A1/P1-P

MX2K-MPC6E

Supported on MX2008, MX2010,

and MX2020 devices

MX2K-MPC6E

S-MX-2C/2C4/4C-A1/

P1-3/5/7/1*

MX2K-MPC6E

S-MX-2C/2C4/4C-A1/P1-P

MX2K-MPC8E

Supported on MX2008, MX2010,

and MX2020 devices

MX2K-MPC8E

S-MX-4C8/8C-A1/P1-3/5/7/1*

MX2K-MPC8E

S-MX-4C8/8C-A1/P1-P

MX2K-MPC9E

Supported on MX2008, MX2010,

and MX2020 devices

MX2K-MPC9E

S-MX-8C-A1/P1-3/5/7/1*

MX2K-MPC9E

S-MX-8C-A1/P1-P

MX10K-LC2101

Supported on MX10004,

MX10008, and MX10016 devices

MX10K-LC2101-BASE

S-MX-24C-A1/P1-3/5/7/1*

MX10K-LC2101-BASE

S-MX-24C-A1/P1-P

MX10K-LC480

Supported on MX10004,

MX10008, and MX10016 devices

MX10K-LC2101-BASE

S-MX-24C-A1/P1-3/5/7/1*

MX10K-LC2101-BASE

S-MX-24C-A1/P1-P

MX10K-LC480

Supported on MX10004,

MX10008, and MX10016

MX10K-LC480-BASE

S-MX-4C8-A1-3/5/7/1*

MX10K-LC480-BASE

S-MX-4C8-A1-P

Table 43: MX Series Routers and MX-SPC3 License SKUs

(Connued)

MX Series Routers and MX-SPC3 Subscripon Perpetual

MX10K-LC4800

Supported on MX10004 and

MX10008

MX10K-LC4800-BASE

S-MX-48C-A1/P1-3/5/7/1*

S-MX-4C-A1/P1-D-3/5/7/1*

MX10K-LC4800-BASE

S-MX-48C-A1/P1-P

S-MX-4C-A1/P1-D-P

MX10K-LC9600

Supported on MX10004 and

MX10008

MX10K-LC9600-BASE

S-MX-96C-A1/P1-3/5/7/1*

S-MX-4C-A1/P1-D-3/5/7/1*

MX10K-LC9600-BASE

S-MX-96C-A1/P1-P

S-MX-4C-A1/P1-D-P

MX2K-MPC11E

Supported on MX2010 and

MX2020 devices

MX2K-MPC11E-BASE

S-MX-40C-A1/P1-3/5/7/1*

MX2K-MPC11E-BASE

S-MX-40C-A1/P1-P

MX-SPC3 MX-SPC3

S-MXSPC3-A1/A2/A3/P1/P2/

P3-1/3/5

S-MXSPC3-1/2-IPSEC-1/3/5

MX-SPC3

S-MXSPC3-A1/A2/A3/P1/P2/P3-P

S-MXSPC3-1/2-IPSEC-P

*1 year subscripon term is for renewal only.

MPC10E-10C and MPC10E-15C line cards are supported on MX240, MX480, and MX960 devices.

MX2K-MPC11E line cards are supported on MX2010 and MX2020 devices.

MX10K3-L2103 line card is supported on MX10003 device.

MX10K-LC2101, MX10K-LC480, MX10K-LC9600 line cards are supported on MX10004, MX10008,

and MX10016 devices.

The show system macsec license command displays the total MACsec bandwidth used by the line cards.

The MACsec feature is supported on MX204, MX240, MX304, MX480, MX960, MX2008, MX2010,

MX2020, MX10003, MX10004, MX10008, and MX10016 device. These licenses are perpetual.

The minimum number of MACsec bandwidth licenses installed must be greater than or equal to the

congured bandwidth of MACsec enabled ports.

The MACsec feature licenses are available in the following variants:

• S-MX-1C-MSEC-P - 100-Gigabit Ethernet MACsec bandwidth license

• S-MX-4C-MSEC-P - 400-Gigabit Ethernet MACsec bandwidth license

• S-MX-4C8-MSEC-P - 480-Gigabit Ethernet MACsec bandwidth license

• There will be no alarms or syslog messages for the following line cards if the license is not installed.

However, the MACsec bandwidth usage on these line cards will be tracked.

• MX10K-LC2101

• MPC5E-100G10G

• MPC5EQ100G10G

• MPC5E-40G10G

• MPC5EQ-40G10G

• MX2K-MPC6E

• MPC7E-10G

• MPC7E-MRATE

• MX2K-MPC8E

• MX2K-MPC9E

• The following line cards require MACsec bandwidth license. Junos OS displays a warning when you

commit the conguraon and generates alarms, if the MACsec bandwidth license is not installed or

the MACsec bandwidth usage is more than the installed value.

• MPC10E-10C

• MPC10E-15C

• MX2K-MPC11E

• MX10KM-LC9600-BASE

• MX10KM-LC480-BASE

Soware Licenses for NFX Series

NFX Series support subscripon and perpetual licenses.

Go through the following tables:

• NFX Series SKU Denion on page 72

• NFX Series Soware Licenses on page 72

• NFX Series Soware License SKUs on page 74

Table 44: NFX Series SKU Denion

SKU SKU Character Descripon

NFX150/250/350-C/S-ATP/CS-BUN/ATP-BUN/IPS/

THRTFEED/W-EWF-1/3/5

NFX150/250/350—Product name: NFX150, NFX250,

and NFX350

ATP/CS-BUN/ATP-BUN/IPS/THRTFEED/W-EWF

• ATP—Advanced Threat Prevenon

• CS-BUN—Content Security bundle

• ATP-BUN—Advanced Threat Prevenon bundle

•

IPS—Intrusion Prevenon Signature

•

THRTFEED—Threat Intelligence Feeds

•

W-EWF—Enhanced Web Filtering

1/3/5—Subscripon term: 1 year, 3 years, or 5 years

Table 45: NFX Series Soware Licenses

Features with Licenses NFX Use Case

IPS, Applicaon Security, URL

ltering, on-box anvirus, and ATP

Cloud

Premium 3 Data center security or SD-WAN +

Cloud ATP

Table 45: NFX Series Soware Licenses

(Connued)

Features with Licenses NFX Use Case

IPS, Applicaon Security, URL

ltering, Sophos anvirus and

anspam, and ATP Cloud

Premium 2 Next-generaon rewall + Cloud

ATP

IPS, Applicaon Security, and ATP

Cloud

Premium 1 Data center security or SD-WAN +

Cloud ATP

IPS, Applicaon Security, URL

ltering, and on-box anvirus

Advanced 3 Next-generaon rewall with Avira

IPS, Applicaon Security, URL

ltering, and Sophos anvirus and

anspam

Advanced 2 Next-generaon rewall with

Sophos

IPS and Applicaon Security Advanced 1 Data center security + SD-WAN

Junos Base JSB (roung, rewall,

switching, NAT, VPN, and MPLS)

Standard (includes hardware) Basic rewall and secure branch

routers

Table 46: NFX Series Soware License SKUs

NFX Series NFX150 NFX250 NFX350

SKUs NFX150-C-CS-

BUN-1/3/5

NFX150-C-ATP-

BUN-1/3/5

NFX150C-

THRTFEED-1/3/5

NFX150-C-W-

EWF-1/3/5

NFX150-C-ATP-1/3/5

NFX150-C-IPS-1/3/5

NFX150-S-CS-

BUN-1/3/5

NFX150-S-ATP-

BUN-1/3/5

NFX150S-

THRTFEED-1/3/5

NFX150-S-W-

EWF-1/3/5

NFX150-S-ATP-1/3/5

NFX150-S-IPS-1/3/5

NFX150C-

THRTFEED-1/3/5

NFX250-S-ATP-1/3/5

NFX250-S-ATP-

BUN-1/3/5

NFX250-S-CS-

BUN-1/3/5

NFX250-S-IPS-1/3/5

NFX250S-

THRTFEED-1/3/5

NFX250-S-W-

EWF-1/3/5

S-NFX350S1/S2/S3-

A1-1/3/5

S-NFX350S1/S2/S3-

A2-1/3/5

S-NFX350S1/S2/S3-

A3-1/3/5

S-NFX350S1/S2/S3-

P1-1/3/5

S-NFX350S1/S2/S3-

P2-1/3/5

S-NFX350S1/S2/S3-

P3-1/3/5

Soware Licenses for Northstar Controller

Northstar Controller supports subscripon licenses.

Go through the following tables:

• Northstar Controller SKU Denion on page 75

• NorthStar Controller Soware Licenses on page 75

• NorthStar Controller License SKUs on page 77

Table 47: Northstar Controller SKU Denion

SKU SKU Character Descripon

S-NSC-1/10/100-S1/A1/P1-C1/C2/C3/C4-1/3/5 S—Soware

NSC—Product name: NorthStar Controller

1/10/100—Licenses metrics for 1, 10, or 100 devices

S1/A1/P1—Standard 1, Advanced 1, or Premium 1

soware subscripon

C1/C2/C3/C4—Device class

1/3/5—Subscripon term: 1 year, 3 years, or 5 years

Table 48: NorthStar Controller Soware Licenses

Features with Licenses Northstar Controller

Use Case for Premium (includes advanced features): Advanced transport engineering

Egress peering engineering Premium

Ingress peering engineering Premium

Mullayer packet-opcal support Premium

Network slicing management Premium

Use Case for Advanced (includes standard features): LSP provisioning

Auto-bandwidth LSPs (NorthStar managed) Advanced

Table 48: NorthStar Controller Soware Licenses

(Connued)

Features with Licenses Northstar Controller

Diverse LSPs Advanced

High availability Advanced

LSP opmizaon (bandwidth and delay) Advanced

LSP provisioning (RSVP and SR) Advanced

LSP templates Advanced

Maintenance events Advanced

P2MP LSP provisioning Advanced

Standby and secondary LSPs Advanced

Symmetric pair groups Advanced

TE++ LSPs Advanced

Time-based LSP scheduling Advanced

Use Case for Standard: Network visualizaon and monitoring

Collecon using Paragon Insights Standard

cRPD support Standard

Delay visualizaon Standard

Table 48: NorthStar Controller Soware Licenses

(Connued)

Features with Licenses Northstar Controller

Demand visualizaon (LDP FEC and ow based) Standard

Dynamic topology acquision Standard

Flow collecon Standard

Interface stascs visualizaon Standard

JTI telemetry collecon Standard

LSP reporng, stascs visualizaon (RSVP and SR) Standard

P2MP LSP visualizaon Standard

SNMP based collecon Standard

Topology visualizaon Standard

Table 49: NorthStar Controller License SKUs

Northstar Controller SKU

Premium S-NSC-100-P1-C1-1/3/5

S-NSC-10-P1-C2-1/3/5

S-NSC-1-P1-C3-1/3/5

S-NSC-1-P1-C4-1/3/5

Table 49: NorthStar Controller License SKUs

(Connued)

Northstar Controller SKU

Advanced S-NSC-100-A1-C1-1/3/5

S-NSC-10-A1-C2-1/3/5

S-NSC-1-A1-C3-1/3/5

S-NSC-1-A1-C4-1/3/5

Standard S-NSC-100-S1-C1-1/3/5

S-NSC-10-S1-C2-1/3/5

S-NSC-1-S1-C3-1/3/5

S-NSC-1-S1-C4-1/3/5

Soware Licenses for Northstar Planner

Northstar Planner supports subscripon licenses.

Go through the following tables:

• Northstar Planner SKUs Denion on page 79

• NorthStar Planner Soware Licenses on page 79

• Northstar Planner License SKUs on page 81

• NorthStar Controller and NorthStar Planner Devices Support on page 81

Table 50: Northstar Planner SKUs Denion

SKU SKU Character Descripon

S-NSP-1/10/100-S1/A1-C1/C2/C3/C4-1/3/5 S—Soware

NSP—Product name: NorthStar Planner

1/10/100—Licenses metrics for 1, 10, or 100 devices

S1/A1—Standard 1, or Advanced 1 soware

subscripon

C1/C2/C3/C4—Device class

1/3/5—Subscripon term: 1 year, 3 years, or 5 years

Table 51: NorthStar Planner Soware Licenses

Features with Licenses Northstar Planner

Use Case for Advanced (includes standard features): Advanced capacity planning

Compliancy assessment Advanced

Cost based design Advanced

Fast reroute planning Advanced

GRE tunnels Advanced

Hardware inventory and reports Advanced

Integrity check and reports Advanced

Mulcast planning Advanced

Network slicing planning Advanced

Table 51: NorthStar Planner Soware Licenses

(Connued)

Features with Licenses Northstar Planner

P2MP planning Advanced

Trac matrix solver Advanced

VPN analysis and planning Advanced

Use Case for Standard: Basic network planning

BGP analysis Standard

Capacity planning Standard

CoS analysis and planning Standard

Data collecon from Northstar Controller Standard

Detailed reporng Standard

ECMP analysis Standard

Failure simulaon Standard

File based data inseron (conguraon, operaonal,

tunnels, delays, and demands)

Standard

Path assignments Standard

Policy based routes Standard

Roung protocols Standard

Table 51: NorthStar Planner Soware Licenses

(Connued)

Features with Licenses Northstar Planner

Stac routes Standard

Table 52: Northstar Planner License SKUs

Northstar Planner SKU

Advanced S-NSP-100-A1-C1-1/3/5

S-NSP-10-A1-C2-1/3/5

S-NSP-1-A1-C3-1/3/5

S-NSP-1-A1-C4-1/3/5

Standard S-NSP-100-S1-C1-1/3/5

S-NSP-10-S1-C2-1/3/5

S-NSP-1-S1-C3-1/3/5

S-NSP-1-S1-C4-1/3/5

Table 53: NorthStar Controller and NorthStar Planner Devices Support

Device Class Descripon Supported Devices

C1 Extra-small devices such as mobile

backhaul access devices, and small

or remote CPE devices

ACX500, ACX710, ACX1000,

ACX1100, ACX2100, ACX2200,

cSRX, EX2300, and SRX300

Table 53: NorthStar Controller and NorthStar Planner Devices Support

(Connued)

Device Class Descripon Supported Devices

C2 Small devices such as compact,

xed-form-factor switches, metro

access switches, and top-of-rack

switches

ACX4000, ACX5048, ACX5096,

ACX5448, ACX6160, ACX6360,

EX4300, EX4600, EX4650,

EX9250, MX5, MX10, MX40,

MX80, MX104, MX150, MX204,

vMX, PTX1000, PTX10001,

QFX5110, QFX5120, QFX5200,

QFX5210, QFX5220, QFX10002,

SRX550, SRX1500, SRX4100,

SRX4200, and vSRX

C3 Small chassis-based switches,

routers, and rewalls (chassis with

less than or equal to six slots)

EX9204, M Series, MX Series

GNFs, MX240, MX480, MX10003,

PTX10002, PTX10003, SRX3400,

SRX3600, SRX4600, and SRX5400

C4 Large chassis-based systems

(chassis with more than six slots)

EX9208, EX9214, MX960,

MX2008, MX2010, MX2020,

MX10008, MX10016, PTX3000,

PTX5000, PTX10008, PTX10016,

QFX10008, QFX10016, SRX5600,

SRX5800, and T Series

Soware Licenses for Paragon Automaon

Paragon Automaon supports subscripon licenses.

Go through the following tables:

• Paragon Automaon SKU Denion on page 83

• Paragon Automaon Soware Licenses on page 83

• Paragon Automaon License SKUs on page 86

Table 54: Paragon Automaon SKU Denion

SKU SKU Character Descripon

S-PA-PLATFORM-S-1/3/5

S-PA-BASE/ORCH/ASSR-100/400-S-1/3/5

S-PA-LAB-S-1

S—Soware

S—Subscripon

PA—Paragon Automaon

PLATFORM—On-Premises plaorm

BASE/ORCH/ASSR—Base, Orchestraon, or

Assurance

LAB—Lab for non-producon

100/400—License capacity 100 Gbps or 400 Gbps

1/3/5—Subscripon term 1, 3 or 5 years

Table 55: Paragon Automaon Soware Licenses

Features with Licenses Paragon Automaon

Service Orchestraon

Customizable service designs Service Orchestraon

Customer management Service Orchestraon

Service management Service Orchestraon

Order management Service Orchestraon

Resource management Service Orchestraon

Layer 2 and Layer 3 VPN model Service Orchestraon

Assurance part of workows Service Orchestraon

Acve Assurance

Table 55: Paragon Automaon Soware Licenses

(Connued)

Features with Licenses Paragon Automaon

Test and monitors

Acve Assurance

Test agents (list and drill-in) Acve Assurance

Results (list and drill—in) Acve Assurance

Template builder Acve Assurance

Alerts Acve Assurance

Test agent on ACX and as a container Acve Assurance

Dashboard Acve Assurance

RPM support Acve Assurance

Test agent appliance Acve Assurance

Base

Trust score Trust

Compliance Trust

Vulnerability – SIRT Trust

Integrity – Soware EOL Trust

Integrity – Hardware EOL Trust

Up to 71 KPIs monitored Observability

Graphing and drill-in Observability

AI or ML (dynamic thresholding, device health, and bad

cable detecon)

Observability

Table 55: Paragon Automaon Soware Licenses

(Connued)

Features with Licenses Paragon Automaon

Alert Observability

Nocaon (webhook and email) Observability

Inventory management Device Management

Intent based LCM Device Management

Soware management Device Management

Conguraon management Device Management

Backup and restore Device Management

License management Device Management

Alarms Device Management

Onboarding workow Device Onboarding

Intent plans Device Onboarding

Device proles Device Onboarding

Interface proles Device Onboarding

Guided workow for eld technician Device Onboarding

Conguraon, device, and network Device Onboarding

Assurance (Trust, Acve Assurance tests, and device

health)

Device Onboarding

Table 56: Paragon Automaon License SKUs

Paragon Automaon SKUs

On-premises plaorm license S-PA-PLATFORM-S-1/3/5

Base S-PA-BASE-100/400-S-1/3/5

Service Orchestraon S-PA-ORCH-100/400-S-1/3/5

Acve Assurance S-PA-ASSR-100/400-S-1/3/5

Lab S-PA-LAB-S-1

Soware Licenses for Paragon Insights

Paragon Insights supports subscripon licenses. Licenses can be deployed in standalone mode.

Go through the following tables:

• Paragon Insights SKUs Denion on page 87

• Paragon Insights Soware Licenses on page 87

• Paragon Insights Soware License SKUs on page 89

• Paragon Insights Devices on page 89

Table 57: Paragon Insights SKUs Denion

SKU SKU Character Descripon

S-PIN-S1/A1-1/-3/-5

S-PIN-1/10/100-S1/A1-C1/C2/C3/C4-1/-3/-5

S-PIN-1-S1/A1-C3/C4-1/3/5

S—Soware

PIN—Product name: Paragon Insights

S1—Standard

A1—Advanced

C1/C2/C3/C4—Device class

1/3/5—Subscripon term: 1 year, 3 years, or 5 years

Table 58: Paragon Insights Soware Licenses

Detailed Features Paragon Insights Standard Paragon Insights

Advanced

Paragon Insights Lab

Applicaon high

availability and elasc

scale

Supported Supported Supported

External Kaa data

publishing

Supported Supported Supported

Generang nocaons Not Supported Supported Supported

Generang reports Not Supported Supported Supported

GUI and API data access Supported Supported Supported

Mulvendor telemetry

data collecon

Supported Supported Supported

Number of devices

allowed is based on the

device licenses purchased

Supported Supported Supported

Table 58: Paragon Insights Soware Licenses

(Connued)

Detailed Features Paragon Insights Standard Paragon Insights

Advanced

Paragon Insights Lab

Subscripon licenses with

included support

Supported Supported Supported

Unlimited standard

default and custom rules

Supported Supported Supported

Default and custom rules

with user-dened

funcons.

Not Supported Supported Supported

Default and custom rules

with machine learning

features such as dynamic

thresholds, outlier

detecon, median

predicon, and

microburst.

Not Supported Supported Supported

Time Inspector for

advanced troubleshoong

Not Supported Supported Supported

Time Series Database

(TSDB) data redundancy

Not Supported Supported Supported

Unlimited custom

playbooks

Supported Supported Supported

Table 59: Paragon Insights Soware License SKUs

Use Case SKUs

Paragon Insights Standard

• S-PIN-S1-1/3/5

• S-PIN-1/10/100-S1-C1-1/3/5

• S-PIN-1-S1-C3-1/3/5

• S-PIN-1-S1-C4-1/3/5

Paragon Insights Advanced

• S-PIN-A1-1/3/5

• S-PIN-1/10/100-A1-C1-1/-3/-5

• S-PIN-1-A1-C3-1/3/5

• S-PIN-1-A1-C4-1/3/5

Paragon Insights Lab

Bundle also includes access to 50 device licenses. Non-

producon use only.

S-PIN-NONPROD-BB-1/3/5

Standalone mode allows you to acvate a license on a soware instance and can be used only by the

instance on which it is acvated. You cannot share a license with mulple instances.

*For informaon about Paragon Insights product opons or to obtain a trial license, contact your local

sales representave.

Enforcement of device license counts is based on the total number of all C1-C4 licenses installed minus

the total number of licenses used. This enforcement model might change in future releases of Paragon

Automaon.

Table 60: Paragon Insights Devices

Device Feature Name Descripon

C1 Extra small devices such as small remote CPEs, small

branch SRX Series Firewalls and small ACX Series

Table 60: Paragon Insights Devices

(Connued)

Device Feature Name Descripon

C2 Small switches such as xed form factor EX Series,

ACX Series, and QFX Series

C3 Small chassis-based switches, routers, and rewalls

such as MX10003 router and PTX10K3 router

C4 Large chassis-based systems like the MX10000 router,

PTX Series, and large SRX Series Firewalls

Soware Licenses for PTX Series Routers

PTX Series Routers support subscripon and perpetual licenses.

Starng in 22.4R3 and 23.4R1 Junos OS Evolved releases, the license counts only the Resource

Reservaon Protocol-Trac Engineering (RSVP-TE) and Segment Roung Trac Engineering (SR-TE)

LSPs. Prior to the 22.4R3 and 23.4R1 Junos OS Evolved releases, license counts all Trac Engineering

(TE) such as RSVP-TE and SR-TE and non-TE such as LDP, BGP-LU, L-ISIS, L-OSPF LSPs.

Go through the following tables:

• PTX Series Routers SKU Denion on page 91

• PTX Series Routers Soware Licenses on page 91

• PTX Series Scale Informaon on page 94

• PTX Series Routers License SKUs on page 95

• MACsec Feature License SKUs on page 96

Table 61: PTX Series Routers SKU Denion

SKU SKU Character Descripon

S-PTX10K-144C/108C-A1/A2/P1/P2-P

S-PTX10K-144C/108C-A1/A2/P1/P2-3/5

S-PARPTX10K144C

A1/A2/P1/P2/3/5

S-PAR-PT10K108CA1/A2/P1/P2/3/5

S—Soware

PTX10K—Product name: PTX10000 line of routers

144C—14.4 Tbps

108C—10.8 Tbps

PAR—Partner

A1/A2—Advanced 1 or advanced 2 soware features

P1/P2—Premium 1 or premium 2 soware features

3/5—Subscripon term 3 or 5 years

S-PTX10K3-16T/8T-A1/A2/P1/P2-P/3/5 S—Soware

PTX10K3—Product name: PTX10003 line of routers

16T—16 Tbps

8T—8 Tbps

A1/A2—Advanced 1 or advanced 2 soware features

P1/P2—Premium 1 or premium 2 soware features

P—Perpetual license

3/5—Subscripon term 3 or 5 years

Table 62: PTX Series Routers Soware Licenses

Features with Licenses PTX Series Routers

Premium 2 (includes Premium 1 features)

H-QoS Premium 2

Premium 1 (includes Advanced 2 features)

Table 62: PTX Series Routers Soware Licenses

(Connued)

Features with Licenses PTX Series Routers

BIER

Premium 1

EVPN-MPLS Premium 1

IPFIX Premium 1

Layer 2 circuit Premium 1

LDP Premium 1

RSVP Premium 1

SR-MPLS Premium 1

SR-MPLS-TE Premium 1

SRv6 Premium 1

VPLS Premium 1

VRF/Layer 3 VPN (MPLS) Premium 1

Advanced 2 (includes Advanced 1 features)

Connecvity fault management (CFM) Advanced 2

EVPN-VXLAN Advanced 2

Layer 3 VPN/VRF (VXLAN) Advanced 2

Table 62: PTX Series Routers Soware Licenses

(Connued)

Features with Licenses PTX Series Routers

VXLAN Advanced 2

VRF/Layer 3 VPN (VXLAN) Advanced 2

Q-in-Q Advanced 2

ESI-LAG Advanced 2

Precision Time Protocol (PTP) Advanced 2

PTP-BC Advanced 2

Synchronous Ethernet (SyncE) Advanced 2

Advanced 1 (includes Standard features)

BGP Advanced 1

FBF Advanced 1

GRE Advanced 1

IS-IS Advanced 1

Junos telemetry interface (JTI) Advanced 1

OSPF Advanced 1

VR Advanced 1

VRRP Advanced 1

Table 62: PTX Series Routers Soware Licenses

(Connued)

Features with Licenses PTX Series Routers

Standard

Filters (Layer 2 and Layer 3) Standard

Layer 2 (

STP, 802.1Q, LAG) Standard

Layer 3 (stac) Standard

Quality of Service or QoS (Layer 2 and Layer 3) Standard

SNMP Standard

VLAN Standard

In addion, you can install addional port bandwidth usage license to increase the port bandwidth

usage.

Table 63: PTX Series Scale

Informaon

PTX Series Routers Scale (Maximum Allowed)

Premium 2 4 million FIBs, IP tunnels are up to the device capacity,

80 million RIBs, 128,000+ LSPs, 4000 BGP peers,

1000+ VRFs (VXLAN), 4000 VRFs (MPLS Layer 3

VPN), 100,000 PIMs, 64,000 rewall lters and terms

Premium 1 2 million FIBs, 6 million RIBs, 32,000 LSPs, 2000 BGP

peers, 5000 IP tunnels, 1000 VRFs (VXLAN), 32 Layer

3 VPN/VRF(MPLS/SR), 32,000 PIMs, 16,000 rewall

lters, and 64,000 rewall terms

Advanced 2 256,000 FIBs, 3 million RIBs, 1000 LSPs, 1000 BGP

peers, 3000 IP tunnels, 1000 Layer 3 VPN/

VRF(VXLAN), 32,000 PIMs, 16,000 rewall lters, and

64,000 rewall terms

Table 63: PTX Series Scale Informaon

(Connued)

PTX Series Routers Scale (Maximum Allowed)

Advanced 1 256,000 FIBs, 3 million RIBs, 1000 BGP peers, 1000 IP

tunnels, 16,000 PIMs, 4000 rewall lters, and 16,000

rewall terms

Standard 64,000 forwarding informaon bases (FIBs) and 64,000

roung informaon bases (RIBs), 1000 rewall lters,

and 4000 rewall terms

Table 64: PTX Series Routers License SKUs

PTX Series Routers Perpetual SKUs

with customer

support

Perpetual SKUs

without customer

support

Subscripon SKUs

with customer

support

Partner SKUs with

customer support

PTX10000 PTX10K-

LC1201-36CD

PTX10K-

LC1202-36MR

S-PTX10K-144C-

A1/A2-P

S-PTX10K-144C-

P1/P2-P

S-PTX10K-144C-

A1/A2-3/5

S-PTX10K-144C-

P1/P2-3/5

S-

PARPTX10K144CA

13/15/23/25

S-

PARPTX10K144CP

13/15/23/25

PTX10001-36MR PTX10001-36MR-

PTX10001-36MR-

S-PTX10K-108C-

A1/A2-P

S-PTX10K-108C-

P1/P2-P

S-PTX10K-108C-

A1/A2-3/5

S-PTX10K-108C-

P1/P2-3/5

S-PAR-

PT10K108CA13/15

/23/25

S-PAR-

PT10K108CP13/15

/23/25

PTX10003 PTX10003-160C-

PTX10003-160C-

PTX10003-80C-AC

PTX10003-80C-DC

S-PTX10K3-16T-

A1/A2-P

S-PTX10K3-16T-

P1/P2-P

S-PTX10K3-8T-

A1/A2-P

S-PTX10K3-8T-

P1/P2-P

S-PTX10K3-16T-

A1/A2-3/5

S-PTX10K3-16T-

P1/P2-3/5

S-PTX10K3-8T-A1/

A2-3/5

S-PTX10K3-8T-P1/

P2-3/5

Not Supported

The PTX10001-36MR, PTX10003, PTX10004, PTX10008 and PTX10016 supports MACsec, but you

must purchase a license to use the MACsec feature. MACsec licenses are perpetual. The licenses are

available in two variants, see Table 65 on page 96.

Table 65: MACsec Feature License SKUs

MACsec License SKU Descripon

S-PTX10K100GMSEC-P 100-Gigabit Ethernet MACsec license; can be applied to one 100-Gigabit Ethernet

port or two 40-Gigabit Ethernet ports

S-PTX10K400GMSEC-P 400-Gigabit Ethernet MACsec license; can be applied to one 400-Gigabit Ethernet

port or four 100-Gigabit Ethernet ports

The installed MACsec licenses must be equal to the congured bandwidth of MACsec enabled ports. If

you enable MACsec on two 400G ports, then two S-PTX10K400GMSEC-P licenses or eight S-

PTX10K100GMSEC-P must be installed.

Soware Licenses for QFX Series Switches

QFX Series Switches support subscripon and perpetual licenses.

Go through the following tables:

• QFX Series Soware Licenses on page 97

• QFX Series Devices Class and SKUs on page 100

• Legacy Feature Licenses for QFX5100, QFX5110, QFX5120, QFX5200-32C, QFX5210-64C and

QFX10000 Line of Switches on page 103

• Legacy Feature Licenses for QFX5200-48Y and QFX5200-32C-L switches on page 104

• Legacy Feature Licenses Scale and License SKUs on page 106

• Junos Fusion License Model Numbers for Satellite Devices on page 109

• Legacy Feature Licenses for Disaggregated QFX5200-32C Switch and License SKUs on page 110

Table 66: QFX Series Soware Licenses

Features with Licenses QFX Series Switches

Use Case for Premium (includes Advanced 2 features): Data Center Edge

Data packet mestamping Premium

Layer 2 circuit Premium

Layer 3 VPN Premium

LDP Premium

MPLS Premium

RSVP Premium

Segment Roung (SR)** Premium

SR-TE Premium

Use Case for Advanced 2 (includes Advanced 1 features): Cloud fabric

dot1Q-tunneling Advanced 2

ESI-LAG Advanced 2

Ethernet OAM Advanced 2

EVPN-VXLAN Advanced 2

IGMP Advanced 2

Layer 3 mulcast Advanced 2

PCEP Advanced 2

Table 66: QFX Series Soware Licenses

(Connued)

Features with Licenses QFX Series Switches

PTP Advanced 2

Q-in-Q* Advanced 2

Stac MPLS Advanced 2

Stac unicast VXLAN** Advanced 2

Timing Advanced 2

Selecve DLB Advanced 2

Cognive roung Advanced 2

Use Case for Advanced 1 (includes Standard features): Cloud fabric

BGP Advanced 1

EZ-LAG Advanced 1

FBF Advanced 1

GRE tunnel Advanced 1

IGMP mulcast Advanced 1

IS-IS Advanced 1

JTI Advanced 1

OSPF Advanced 1

Table 66: QFX Series Soware Licenses

(Connued)

Features with Licenses QFX Series Switches

PIM Advanced 1

RIFT Advanced 1

RIP Advanced 1

ROCEv2 Advanced 1

sFlow Advanced 1

Type-5 VRF* Advanced 1

VRF Advanced 1

VRF lite Advanced 1

VRRP Advanced 1

Virtual Chassis* Advanced 1

Use Case for Standard: Base

BFD Standard

Filters (Layer 2 and Layer 3) Standard

Layer 2 (xSTP, 802.1Q, 802.1AD, LAG) Standard

Layer 3 (stac) Standard

QoS (Layer 2 and Layer 3) Standard

Table 66: QFX Series Soware Licenses

(Connued)

Features with Licenses QFX Series Switches

MC-LAG Standard

IGMP snooping Standard

SNMP Standard

Virtual Chassis*— Virtual Chassis is available in Advanced 1 for all soware versions from Junos OS

Release 20.3 onwards. The Virtual Chassis feature is supported on QFX5120-48T, QFX5120-48Y, and

QFX5120-32C up to 2 members, QFX5200-32C up to 3 members, QFX5120-48YM up to 4 members.

Advanced Telemetry Features such as ATF and Inband Flow Analyzer are supported on QFX5120

plaorms.

For more informaon about the feature support on your QFX Series devices, see Feature Explorer and

Product Informaon.

Starng in Junos OS Release 22.3R1, the MC-LAG feature moved to the standard er.

On QFX5120-48YM and QFX5700 switches, MACsec feature is hard-enforced. You'll need a license to

use this feature on these switches.

Table 67: QFX Series Devices Class and SKUs

QFX Series Switches SKUs

Class 1: 32 Ports and 48 Ports

QFX5110-32Q/48S/48S-D (AFO2/AFI2/AFI-T2/AFO-

T2)

S-QFX5K-C1-A1-3/5/P

S-QFX5K-C1-A2-3/5/P

S-QFX5K-C1-P1-3/5/P

100

Table 67: QFX Series Devices Class and SKUs

(Connued)

QFX Series Switches SKUs

QFX5120-48Y/YM/T (AFO2/AFI2/AFO/DC-AO/DC-

AI/AFO/AFI/DC-AFO/DC-AFI)

S-QFX5KC1-MACSEC-3/5/P

S-QFX5K-C1-ATF-P

S-QFX5K-C1-A1-3/5/P

S-QFX5K-C1-A2-3/5/P

S-QFX5K-C1-P1-3/5/P

Class 2: 32 Ports

QFX5120-32C (AFO/AFI/AFI-T/AFO-T/DC-AFO/DC-

AFI)

QFX5200-32C (AFO2/AFI2/D-AFO2/D-AFI2/AFO-

T2/AFI-T2)

S-QFX5K-C2-A1-3/5/P

S-QFX5K-C2-A2-3/5/P

S-QFX5K-C2-P1-3/5/P

S-QFX5K-C2-ATF-P

Class 3: 32 Ports, 36 Ports, 64 Ports, 72 Ports, and 128 Ports; QFX5700 Line Cards (16C,4CD,20Y)

QFX5130-32CD (AFI/AFO/D-AFI/D-AFO) 32CD-AFO

QFX5130-48C (AFO/AFI/D-AFO/D-AFI)

QFX5220-32CD-AFO

QFX5210-64C (AFO2/AFI2/D-AFO2/D-AFI2/AFO-

T2/AFI-T2)

QFX5220-32CD/128C (AFO/AFI/D-AFO/D-AFI)

S-QFX5K-C3-A1-3/5/P

S-QFX5K-C3-A2-3/5/P

S-QFX5K-C3-P1-3/5/P

QFX5700-BASE-AC/DC

QFX5K-FPC-16C/4CD/20Y

S-QFX5KC3-MACSEC-3/5/P

S-QFX5K-C3-A1-3/5/P

S-QFX5K-C3-A2-3/5/P

S-QFX5K-C3-P1-3/5/P

101

Table 67: QFX Series Devices Class and SKUs

(Connued)

QFX Series Switches SKUs

QFX10002-36Q S-QFX10K2-36Q-A2-3/5/P

S-QFX10K2-36Q-P1-3/5/P

QFX10002-60C S-QFX10K2-60C-A2-3/5/P

S-QFX10K2-60C-P1-3/5/P

QFX10002-72Q S-QFX10K2-72Q-A2-3/5/P

S-QFX10K2-72Q-P1-3/5/P

QFX10008 S-QFX10K8-A2-3/5/P

S-QFX10K8-P1-3/5/P

QFX10016 S-QFX10K16-A2-3/5/P

S-QFX10K16-P1-3/5/P

Class 4: 64 Ports

QFX5230-64CD-(AFI/AFO/D-AFI/D-AFO) S-QFX5K-C4-A1/-3/5/P

S-QFX5K-C4-A2-3/5/P

S-QFX5K-C4-P1-3/5/P

Class 5: 64 Ports

QFX5240-64QD/64OD-AO S-QFX5K-C5-A1/-3/5/P

S-QFX5K-C5-A2-3/5/P

S-QFX5K-C5-P1-3/5/P

102

Legacy Licenses for QFX Series

The standard Junos OS soware shipped on the hardware plaorm for QFX Series switches except the

QFX5200-32C, includes a perpetual base license. This license is valid for the life of the hardware

plaorm.

Table 68: Legacy Feature Licenses for QFX5100, QFX5110, QFX5120, QFX5200-32C, QFX5210-64C

and QFX10000 Line of Switches

Base Features Premium Features Advanced Features

Basic IPv6 BGP MPLS

BFD Ethernet VPN MPLS-based CCC

CFM (IEEE 802.1ag) IPv6 for BGP/MBGP RSVP-based LSP

Class of service (COS)/Policing/Shaping/Marking IS-IS Segment Roung

Filtering IS-IS for IPv6

IGMPv1/v2/v3 (includes IGMP Snooping) MBGP

Junos Telemetry Interface OVSDB

MC-LAG VRF(BGP)

MLDv1/v2 VXLAN

OSPFv2

OSPFv3

PIM-DM/SM/SSM

PIMv6

103

Table 68: Legacy Feature Licenses for QFX5100, QFX5110, QFX5120, QFX5200-32C, QFX5210-64C

and QFX10000 Line of Switches

(Connued)

Base Features Premium Features Advanced Features

Q-in-Q tunneling (IEEE 802.1ad)

RIPng

RPM

PTP – Boundary Clock

PTP – Transparent Clock

Unicast reverse-path forwarding (RPF)

Virtual Chassis (VC)

Applicable also for QFX5200-48Y switches.

Virtual Router

VRRP

VRRPv6

Zero Touch Provisioning (ZTP)

Table 69: Legacy Feature Licenses for QFX5200-48Y and QFX5200-32C-L switches

Base Features Premium Features Advanced Features

Basic IPv6 BGP MPLS

BFD Ethernet VPN MPLS-based CCC

104

Table 69: Legacy Feature Licenses for QFX5200-48Y and QFX5200-32C-L switches

(Connued)

Base Features Premium Features Advanced Features

CFM (IEEE 802.1ag) IPv6 for BGP/MBGP RSVP-based LSP

Class of service (COS)/Policing/Shaping/Marking IS-IS Segment Roung

Filtering IS-IS for IPv6

IGMPv1/v2/v3 (includes IGMP Snooping) MBGP

Junos Telemetry Interface OVSDB

MLDv1/v2 MC-LAG

OSPFv2 VXLAN

OSPFv3 Virtual Chassis (VC)

Except for QFX5200-48Y switches.

PIM-DM/SM/SSM

PIMv6

Q-in-Q tunneling (IEEE 802.1ad)

RIPng

RPM

PTP – Boundary Clock

PTP – Transparent Clock

105

Table 69: Legacy Feature Licenses for QFX5200-48Y and QFX5200-32C-L switches

(Connued)

Base Features Premium Features Advanced Features

Unicast reverse-path forwarding (RPF)

Virtual Router

VRRP

VRRPv6

Zero Touch Provisioning (ZTP)

• If you try to congure a feature that is not licensed, you will receive syslog messages saying that you

are using a feature that is licensable and that you do not possess a license for the feature. If you try

to commit conguraon changes for a feature that is not licensed, you will receive a commit warning

saying that you have exceeded the allowed license limit for the feature. The feature will commit and

be usable, but this acon violates EULA agreement.

• On QFX5100 and QFX5110, there is no separate license for Virtual Chassis like there is for Virtual

Chassis Fabric.

• Premium Feature Licenses (PFL) include the Base License Features. Advanced Feature Licenses (AFL)

include the Base and Premium License Features.

Table 70: Legacy Feature Licenses Scale and License SKUs

License Descripon Number of Licenses

Required

QFX Devices Supported

Base Features included with the

switch - No License required

- -

QFX-JSL-EDGE-ADV1 QFX Series Edge Advanced

Feature License

One per switch, two

per Virtual Chassis,

and two per Virtual

Chassis Fabric

QFX3500, QFX3600,

QFX5100-48S,

QFX5100-48T

106

Table 70: Legacy Feature Licenses Scale and License SKUs

(Connued)

License Descripon Number of Licenses

Required

QFX Devices Supported

QFX5100-HDNSE-LIC QFX5100-24Q and

QFX5100-96S Advanced

Feature License

One per switch, two

per Virtual Chassis,

and two per Virtual

Chassis Fabric

QFX5100-24Q,

QFX5100-96S

QFX5K-C2-PFL QFX5000 Class 2 Premium

Feature License

One per switch QFX5210-64C

QFX5K-C2-AFL QFX5000 Class 2 Advanced

Feature License

One per switch QFX5210-64C

QFX-JSL-EDGE-FC QFX Series Edge feature license

for Fibre Channel

One per switch on

which bre channel

ports are congured

QFX3500

EX-QFX-MACSEC-

AGG

QFX and EX Series feature

license for enabling Media

Access Control security

(MACsec).

One per switch, two

per Virtual Chassis

QFX switches that support

MACsec

QFX10000-30C-LFIB 1 million (v4 or v6) Forwarding

Informaon Base (FIB) entries

license

One per line card QFX10000-30C,

QFX10000-30C-M line

cards

QFX10000-36Q-LFIB 1 million (v4 or v6) Forwarding

Informaon Base (FIB) entries

license

One per line card QFX10000-36Q,

QFX10K-12C-DWDM line

cards

QFX10000-60S-LFIB 1 million (v4 or v6) Forwarding

Informaon Base (FIB) entries

license

One per line card QFX10000-60S-6Q line

card

107

Table 70: Legacy Feature Licenses Scale and License SKUs

(Connued)

License Descripon Number of Licenses

Required

QFX Devices Supported

QFX10002-36Q-LFIB 1 million (v4 or v6) Forwarding

Informaon Base (FIB) entries

license

One per switch QFX10002 36-port 40GbE

QSFP+/12-port 100GbE

QSFP28 switch

QFX10002-60C-LFIB 1 million (v4 or v6) Forwarding

Informaon Base (FIB) entries

license

One per switch QFX10002-60C

QFX10002-72Q-LFIB 1 million (v4 or v6) Forwarding

Informaon Base (FIB) entries

license

One per switch QFX10002-72Q

Understanding Junos Fusion Licenses

New deployments for Mulchassis link aggregaon groups (MC-LAG) or Ethernet VPN (EVPN) based

Junos Fusion Data Center are not recommended.

Starng with Junos OS Release 17.2R1, you need to install a Junos Fusion license in addion to any

other feature licenses that you install to track and acvate certain QFX5100-48SH and QFX5100-48TH

models that are shipped with satellite soware. These models can only be used as satellite devices. For

these models, you need to install a Junos Fusion license in addion to any other feature licenses that

you install. See Table 71 on page 109 for a list of satellite devices that require Junos Fusion licenses.

You do not need Junos Fusion licenses for satellite device models that were purchased as Junos OS-

based top-of-rack switches.

Install the Junos Fusion licenses on the aggregaon device because the aggregaon device is the single

point of management in a Junos Fusion. If your Junos Fusion is operang in a topology with mulple

aggregaon devices, you only need to install the licenses on one aggregaon device because the license

keys are synchronized between the two aggregaon devices.

You can install a single-pack license to acvate one satellite device, or you can install mul-pack

licenses, which can acvate up to 128 satellite devices. If the number of satellite devices in a Junos

Fusion exceeds the number of Junos Fusion licenses you have installed, the satellite devices are

provisioned, but the system will issue a warning saying that there is a license limit violaon. If the

satellite device does not have a corresponding Junos Fusion license installed, the satellite device is

provisioned, but the system will issue a warning.

108

Table 71 on page 109 lists the supported aggregaon and satellite devices as well as the model numbers

of the Junos Fusion license packs.

For informaon about how to purchase a soware license, contact your Juniper Networks sales

representave. For informaon on standard Junos OS feature licenses, see Table 68 on page 103.

Table 71: Junos Fusion License Model Numbers for Satellite Devices

Aggregaon Devices

Supported

Satellite Devices Requiring

Licenses

Model Numbers of License Packs

QFX10002, QFX10008 and

QFX10016 switches

• QFX5100-48SH-AFO

• QFX5100-48SH-AFI

• QFX5100-48TH-AFO

• QFX5100-48TH-AFI

QFX10K-C1-JFS-1

QFX10K-C1-JFS-4

QFX10K-C1-JFS-8

QFX10K-C1-JFS-16

QFX10K-C1-JFS-32

QFX10K-C1-JFS-64

Disaggregated Soware Feature Licenses on QFX5200 Switches

The disaggregated soware feature licenses are only applicable for QFX5200-32C devices. For

QFX5200-48Y devices, the base soware features are included with the device. Addional licenses are

required only for premium and advanced features.

The Junos OS soware is disaggregated from the hardware. With disaggregated Junos OS, you can

purchase the following feature licenses, which are available on a perpetual basis:

• Junos Base Soware (JBS) license:

Includes basic layer 2 switching, basic layer 3 roung, mulcast, automaon, programmability, Zero

Touch Provisioning (ZTP) and basic monitoring.

You must purchase the JBS license to use basic funcons, but you do not need to install the license

key in Junos OS Release 15.1X53-D30. JBS basic funcons work with this release without installing

the license key. However, you will need to install the license key in a future release of Junos OS to be

determined, so make sure to retain the authorizaon code you received from the license portal to

generate a license key for the JBS license. If the license is not installed, the system triggers the log

messages.

• Junos Advanced Soware (JAS) license:

109

Includes features supported in JBS license and Border Gateway Protocol (BGP), Intermediate System-

to-Intermediate System (IS-IS), and Virtual Extensible Local Area Network (VXLAN). You need to

install the license key to use these features.

• Junos Premium Soware (JPS) license:

Includes features supported in JAS license and Mul-protocol Label Switching (MPLS) feature set.

You need to install the license key to use these features.

For informaon about how to purchase a soware feature license, contact your Juniper Networks sales

representave.

Table 72: Legacy Feature Licenses for Disaggregated QFX5200-32C Switch and License SKUs

License SKU Descripon Number of Licenses Required QFX Devices Supported

QFX5000-35-

JBS

Junos base soware (JBS)

license

One per switch QFX5200-32C

Soware Features That Require Licenses on the QFX5200-32C Switch

The standard Junos OS soware shipped on the hardware plaorm for QFX5200-32C switch does not

include a perpetual base license.

You must purchase the perpetual base license on the disaggregated Junos OS feature licenses on the

QFX5200-32C. This license is valid for the life of the hardware plaorm.

For informaon about how to purchase any soware license, contact your Juniper Networks sales

representave, or an approved Juniper Partner.

If you try to congure a feature that is not licensed, you will receive syslog messages saying that you are

using a feature that is licensable and that you do not possess a license for the feature. If you try to

commit conguraon changes for a feature that is not licensed, you will receive a commit warning saying

that you have exceeded the allowed license limit for the feature. The feature will commit and be usable,

but this acon violates EULA agreement.

Premium Feature Licenses (PFL) include the Base License Features. Advanced Feature Licenses (AFL)

include the Base and Premium License Features.

Use the QFX5000-35-JBS SKU for Junos base soware (JBS) licenses.

Generang License Keys

Before generang the license keys for a device:

110

• Purchase the required licenses for the device. See Table 68 on page 103 and Licenses for

QFX5200-32C Switch.

• Note down the authorizaon code in the e-mail you received from Juniper Networks when you

purchased the license. Determine the serial number of the device. For instrucons, see Download

and Acvate Your Soware

When you purchase a Junos OS soware feature license for a device, you receive an e-mail containing

an authorizaon code for the feature license from Juniper Networks. You can use the authorizaon code

to generate a unique license key (a combinaon of the authorizaon code and the device’s serial

number) for the device, and then add the license key on the device.

To generate the license keys for a device:

This procedure shows you how to generate license keys on a QFX Series device, but you can follow the

same procedure for any device.

1. In a browser, log in to the Juniper Networks License Management System.

The Manage Product Licenses page appears.

To access the licensing site, you must have a service contract with Juniper Networks and an access

account. If you need help obtaining an account, complete the registraon form at the Juniper

Networks website hps://www.juniper.net/registraon/Register.jsp .

2. On the Generate Licenses tab, select QFX Series Product from the drop-down list, and click Go.

The Generate Licenses - QFX Series Product page appears.

3. In the Device Serial Number eld, enter the serial number for the device.

4. In the Authorizaon Code eld, enter the authorizaon code in the e-mail you received from Juniper

Networks when you purchased the license.

5. (Oponal) If you want to enter another authorizaon code for the same device, click Enter More

Authorizaon Codes to display a new authorizaon code eld. Enter the authorizaon code in this

eld.

6. Click Conrm.

The Conrm License Informaon page appears, displaying a summary of the informaon you

submied to the License Management System.

7. Review the informaon to ensure everything is correct and then click Generate License.

The Generate Licenses - QFX Series Product Devices page appears, displaying a summary of your

license keys, including a link that displays the details of your new license keys.

8. Select the le format in which you want to obtain your new license keys.

111

9. Select the delivery method you want to use to obtain your new license keys.

To download the license keys:

• Select the Download to this computer opon buon and click OK.

To e-mail the license keys:

• Select the Send e-mail to

e-mail ID

opon buon and click OK.

Generang the License Keys for a QFabric System

Before generang the license keys for a QFabric system:

• Purchase the required licenses for the QFabric system. See Table 68 on page 103.

• Note down the authorizaon code in the e-mail you received from Juniper Networks when you

purchased the license.

• Perform the inial setup of the QFabric system on the Director group.

• Log in to the QFabric system, issue the show version command, and note down the soware serial

number and QFabric system ID for the QFabric system.

user@qfabric> show version

Hostname: qfabric

Model: qfx3000-g

Serial Number: qfsn-0123456789

QFabric System ID: f158527a-f99e-11e0-9fbd-00e081c57cda

JUNOS Base Version [12.2I20111018_0215_dc-builder]

When you purchase a Junos OS soware feature license for a QFabric system, you receive an e-mail

containing an authorizaon code for the feature license from Juniper Networks. You can use the

authorizaon code to generate a unique license key (a combinaon of the authorizaon code and the

QFabric system ID) for the QFabric system, and then add the license key on the QFabric system.

To generate the license keys for a QFabric system:

1. In a browser, log in to the license portal.

The Manage Product Licenses page appears.

To access the licensing site, you must have a service contract with Juniper Networks and an access

account. If you need help obtaining an account, complete the registraon form at the Juniper

Networks website hps://www.juniper.net/registraon/Register.jsp .

112

2. On the Generate Licenses tab, select QFX Series Product from the drop-down list, and click Go.

The Generate Licenses - QFX Series Product page appears.

3. Select the QFX Series Product Fabric opon buon and then click Connue.

The Generate Licenses - QFX Series Product Fabrics page appears.

4. In the Soware Serial No eld, enter the soware serial number for the QFabric system.

5. In the QFabric System ID eld, enter the QFabric system ID for the QFabric system.

6. In the Authorizaon Code eld, enter the authorizaon code in the e-mail you received from

Juniper Networks when you purchased the license.

7. (Oponal) If you want to enter another authorizaon code for the same device, click Enter More

Authorizaon Codes to display a new authorizaon code eld. Enter the authorizaon code in this

eld.

8. Click Conrm.

The Conrm License Informaon page appears, displaying a summary of the informaon you

submied to the license portal.

9. Review the informaon to ensure everything is correct and then click Generate License.

The Generate Licenses - QFX Series Product Fabrics page appears, displaying a summary of your

license keys, including a link that displays the details of your new license keys.

10. Select the le format in which you want to obtain your new license keys.

11. Select the delivery method you want to use to obtain your new license keys.

To download the license keys:

• Select the Download to this computer opon buon and click OK.

To e-mail the license keys:

• Select the Send e-mail to

e-mail ID

opon buon and click OK.

Soware Licenses for SRX Series Firewalls

SRX Series Firewalls support subscripon and perpetual licenses.

Go through the following tables:

113

• SRX Series Firewalls SKU Denion on page 114

• SRX300, SRX320, SRX340, SRX345, SRX380, SRX1500, SRX4100, SRX4200, SRX4600, SRX5400,

SRX5600, and SRX5800 Soware Licenses on page 115

• SRX1600, SRX2300, and SRX4300 Soware Licenses on page 116

• Subscripon Licenses for SRX Series Firewalls on page 117

• SRX Series Firewall Soware License SKUs on page 117

• Legacy Feature Licenses for SRX Series Firewalls on page 119

• Legacy Feature Licenses for Content Security Features on page 122

Table 73: SRX Series Firewalls SKU Denion

SKU SKU Character Descripon

S-SRX3XX/SRX1500/SRX1600DP/EP/

SRX2300DP/EP/SRX4XXX/SRX5XXX-

A1/A2/A3/P1/P2/P3-1/3/5

S—Soware

SRX3XX/SRX1500/SRX1600/SRX2300/SRX4XXX/

SRX5XXX—Product name

DP—Data center protecon security

EP—Enterprise edge protecon security

A1—Advanced 1

A2—Advanced 2

A3—Advanced 3

P1—Premium 1

P2—Premium 2

P3—Premium 3

1/3/5—Subscripon term 1, 3, or 5 years

114

Table 74: SRX300, SRX320, SRX340, SRX345, SRX380, SRX1500, SRX4100, SRX4200, SRX4600,

SRX5400, SRX5600, and SRX5800 Soware Licenses

Features Bundle Licenses SRX Series Firewalls Use Case

IDP, Applicaon Security*, URL

ltering, On-box anvirus, and ATP

Cloud

Premium 3 Next-generaon rewall or ATP

Cloud with SecIntel

IDP, Applicaon Security*, URL

ltering, Cloud anvirus and

anspam, and ATP Cloud

Premium 2 Next-generaon rewall or ATP

Cloud with SecIntel

IDP, Applicaon Security*, and ATP

Cloud

Premium 1 Data center security or SD-WAN or

ATP Cloud with SecIntel

SecIntel, IDP, Applicaon Security*,

URL ltering, On-box anvirus and

anspam

Advanced 3 Next-generaon rewall with On-

box anvirus

SecIntel, IDP, Applicaon Security*,

URL ltering, Cloud anvirus and

anspam

Advanced 2 Next-generaon rewall with Cloud

based anvirus and anspam

SecIntel, IDP, and Applicaon

Security*

Advanced 1 Data center security or SD- WAN

Junos Base JSB (roung, rewall,

switching, NAT, VPN, and MPLS)

Standard (includes hardware) Basic rewall and secure branch

routers

115

Table 75: SRX1600, SRX2300, and SRX4300 Soware Licenses

Features Bundle Licenses SRX1600, SRX2300, and SRX4300 Use Case

Applicaon Security*, IPS, AI-

Predicve Threat Prevenon,

SecIntel, URL ltering, ATP Cloud,

DNS security, Encrypted Trac

Insights, Threat Proling, and

Security Director Cloud

Premium 2 Enterprise edge protecon security

and ATP Cloud

Applicaon Security*, IPS, AI-

Predicve Threat Prevenon,

SecIntel, ATP Cloud, DNS Security,

Encrypted Trac Insights, Threat

Proling, and Security Director

Cloud

Premium 1 Data center protecon security and

ATP Cloud

Applicaon Security*, IPS, AI-

Predicve Threat Prevenon,

SecIntel, URL ltering and Security

Director Cloud

Advanced 2 Enterprise edge protecon security

Applicaon Security*, IPS, AI-

Predicve Threat Prevenon,

SecIntel, and Security Director

Cloud

Advanced 1 Data center protecon security

Junos Base JSB (roung, rewall,

switching, NAT, VPN, and MPLS)

Standard (includes hardware) Basic rewall and secure branch

routers

*Applicaon Security includes applicaon visibility and control through unied policy for next-gen

rewall capabilies as well as enables SD-WAN capabilies with Advanced policy-based roung (APBR)

and Applicaon Quality of Experience (AppQoE).

SD-WAN Soware Subscripon license includes features supported in Junos OS.

116

Table 76: Subscripon Licenses for SRX Series Firewalls

SRX Series

Firewalls

Premium 1 Premium 2 Premium 3 Advanced

Advanced

Standard

SRX300,

SRX320

Supported Not

Supported

Not

Supported

Supported Supported Not

Supported

SRX340,

SRX345,

SRX380

Supported Supported Not

Supported

Supported Supported Not

Supported

SRX1600,

SRX2300,

and

SRX4300

Supported Supported Not

Applicable

Supported Supported Not

Applicable

Supported

SRX1500,

SRX4100,

SRX4200,

SRX4600,

SRX5400,

SRX5600,

SRX5800

Supported Supported Supported Supported Supported Supported Supported

Table 77: SRX Series Firewall Soware License SKUs

Subscripon

Licenses

SRX300,

SRX320,

SRX340,

SRX345, and

SRX380

SRX1500 SRX1600,

SRX2300, and

SRX4300

SRX4100,

SRX4200, and

SRX4600

SRX5400,

SRX5600, and

SRX5800

Premium 3 Not Applicable S-SRX1500-

P3-1/3/5

Not Applicable S-SRX4XXX-

P3-1/3/5

S-SRX5XXX-

P3-1/3/5

Premium 2 S-SRX3XX-

P2-1/3/5

S-SRX1500-

P2-1/3/5

S-SRX1600EP/

SRX2300EP/

SRX4300EP-

P2-1/3/5

S-SRX4XXX-

P2-1/3/5

S-SRX5XXX-

P2-1/3/5

117

Table 77: SRX Series Firewall Soware License SKUs

(Connued)

Subscripon

Licenses

SRX300,

SRX320,

SRX340,

SRX345, and

SRX380

SRX1500 SRX1600,

SRX2300, and

SRX4300

SRX4100,

SRX4200, and

SRX4600

SRX5400,

SRX5600, and

SRX5800

Premium 1 S-SRX3XX-

P1-1/3/5

S-SRX1500-

P1-1/3/5

S-SRX1600DP/

SRX2300DP/

SRX4300DP-

P1-1/3/5

S-SRX4XXX-

P1-1/3/5

S-SRX5XXX-

P1-1/3/5

Advanced 3 Not Applicable S-SRX1500-

A3-1/3/5

Not Applicable S-SR4XXX-

A3-1/3/5

S-SR5XXX-

A3-1/3/5

Advanced 2 S-SRX3XX-

A2-1/3/5

S-SRX1500-

A2-1/3/5

S-SRX1600EP/

SRX2300EP/

SRX4300EP-

A2-1/3/5

S-SRX4XXX-

A2-1/3/5

S-SRX5XXX-

A2-1/3/5

Advanced 1 S-SRX3XX-

A1-1/3/5

S-SRX1500-

A1-1/3/5

S-SRX1600DP/

SRX2300DP/

SRX4300DP-

A1-1/3/5

S-SRX4XXX-

A1-1/3/5

S-SRX5XXX-

A1-1/3/5

Legacy Soware Licenses for SRX Series Firewalls

Each feature license is ed to exactly one soware feature, and the license is valid for one device. You

can use the license to acvate the specied advanced soware features on a single device. Plaorm

support depends on the Junos OS release in your installaon.

NOTE: To understand more about Junos OS Soware Licensing, see the Juniper Licensing Guide.

Please refer to the product Data Sheets accessible from Products & Services for details, or

contact your Juniper Account Team or Juniper Partner.

ATP Cloud, SecIntel, and Enhanced Web Filtering individual license are available. This is not a

complete list of licenses. For the most up-to-date license models available, contact your Juniper

Networks representave for license informaon.

118

Table 78: Legacy Feature Licenses for SRX Series Firewalls

Features with

Licenses

SRX300 SRX320 SRX340 SRX345 SRX1500,

SRX4100,

SRX4200,

SRX4600,

SRX5400,

SRX5600, and

SRX5800

Enhanced Web

Filtering

Supported Supported Supported Supported Supported

Intrusion

Detecon and

Prevenon

Supported Supported Supported Supported Supported on

SRX5400,

SRX5600, and

SRX5800

Intrusion

Prevenon

Signature

Not supported Not supported Not supported Not supported Supported on

SRX1500,

SRX4100,

SRX4200, and

SRX4600

Juniper

Advanced

Threat

Prevenon

Cloud

Supported Supported Supported Supported Supported

SecIntel Supported Supported Supported Supported Supported

Remote Access

(5, 10, 25, 50,

100, 150, 250,

500, 1000,

2000, 5000, and

10K Concurrent

users, NCP)

Not supported Not supported Not supported Not supported Supported

119

Table 78: Legacy Feature Licenses for SRX Series Firewalls

(Connued)

Features with

Licenses

SRX300 SRX320 SRX340 SRX345 SRX1500,

SRX4100,

SRX4200,

SRX4600,

SRX5400,

SRX5600, and

SRX5800

Logical System

License (1, 5,

and 25

Incremental)

Not supported Not supported Not supported Not supported Supported

SRX4100 support enhanced performance (upgrade to rewall IMIX performance up to 20G IMIX to the

base 20G IMIX rewall throughput supported and applicaon security)

Understanding Chassis Cluster Licensing Requirements

There is no separate license required for chassis cluster. However, some Junos OS soware features

require a license to acvate the feature. To congure and use the licensed feature in a chassis cluster

setup, you must purchase one license per feature per device and the license needs to be installed on

both nodes of the chassis cluster. Both devices (which are going to form a chassis cluster) must have

valid, idencal features licenses installed on them. If both devices do not have an idencal set of

licenses, then aer a failover, a parcular feature (that is, a feature that is not licensed on both devices)

might not work or the conguraon might not synchronize in chassis cluster formaon. Licensing is

usually ordered when the device is purchased, and this informaon is bound to the chassis serial

number. For example, Intrusion Detecon and Prevenon (IDP) is a licensed feature and the license for

this specic feature is ed to the serial number of the device.

For informaon about how to purchase soware licenses, contact your Juniper Networks sales

representave at hps://www.juniper.net/in/en/contact-us/.

Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Firewall

Devices

This topic provides licensing informaon for SRX Series Firewalls running logical systems and tenant

systems.

Starng in Junos OS Releases 20.3R3, 20.4R2, 21.1R2, and 21.2R1, you can use the features for logical

systems and tenant systems without a license.

120

Starng in Junos OS Release 18.3R1, an SRX Series Firewall running logical systems or tenant systems

includes three licenses by default. One license for a primary logical system and the other two licenses

for user-dened logical system or tenant system. The system does not allow you to congure addional

logical systems or tenant systems if the number of logical systems and tenant systems exceeds the

number of available licenses. In the earlier releases, the system allowed you to congure an addional

logical system even if the number of logical systems exceeds the number of available licenses, but with a

warning message of non-licensed logical-systems do not pass trac. You can purchase licenses for

addional logical systems and tenant systems that you intend to create. If you intend to congure an

interconnect logical system or interconnect tenant system to use as a switch, it also requires separate

licenses.

We enforce that you do not congure more logical systems or tenant systems than the number of

licenses you have purchased. If the number of logical systems or tenant systems that you aempt to

congure exceeds the number of licenses that you have purchased, then the system displays an error

message similar to the following:

user@host# commit

error: 2 more multitenancy license(s) are needed!

error: configuration check-out failed

You can use the show system license status all-logical-systems-tenants or show system license usage

commands to view the acve logical systems and tenant systems on the device.

user@host> show system license status all-logical-systems-tenants

logical system name license status

root-logical-system enabled

LSYS2 enabled

LSYS0 enabled

LSYS11 enabled

LSYS12 enabled

LSYS23 enabled

TSYS1 enabled

TSYS2 enabled

TSYS3 enabled

user@host> show system license usage

Licenses Licenses Licenses Expiry

Feature name used installed needed

logical-system 9 11 0 2019-05-18

08:00:00 CST

121

When you use SRX Series Firewalls running logical systems or tenant systems in a

chassis cluster

, you

must purchase and install the same number of licenses for each node in the chassis cluster. Logical

systems or tenant systems licenses pertain to a single chassis, or node, within a chassis cluster and not

to the cluster collecvely.

Understanding Content Security Licensing

The majority of Content Security features funcon as a subscripon service requiring a license. You can

redeem this license once you have purchased your subscripon license SKUs. You redeem your license

by entering your authorizaon code and chassis serial number into the Customer Service license portal

interface. Once your entlement is generated, you can use the CLI from your device to send a license

update request to the license portal. The license portal then sends your subscripon license directly to

the device.

NOTE: Content Security requires 1 GB of memory.

Table 79: Legacy Feature Licenses for Content Security Features

Content Security Feature Requires License

Anspam Yes

Anvirus: sophos Yes

Content Filtering No

Web Filtering: integrated Yes

Web Filtering: redirect No

Web Filtering: local No

Web Filtering: enhanced Yes

122

NOTE: License enforcement is supported on all SRX Series Firewalls. Licensed features including

an-virus or Enhanced Web Filtering will not funcon unl a license has been installed. The

license must be installed aer installing or upgrading to a new Junos OS Release version.

Unlicensed features such as Content Security blocklists and allowlists will connue to funcon

without a license.

Installing and Verifying Licenses for an Applicaon Signature Package

The Junos OS applicaon signature package update is a separately licensed subscripon service. You

must install the applicaon signature package update license key on your device to download and install

the signature database updates provided by Juniper Networks. If your license key expires, you can

connue to use the locally stored applicaon signature package content.

Licensing is usually ordered when the device is purchased, and this informaon is bound to the chassis

serial number. These instrucons assume that you already have the license. If you did not order the

license during the purchase of the device, contact your account team or Juniper customer care for

assistance. For more informaon, refer to the Knowledge Base arcle KB9731 at hps://kb.juniper.net/

InfoCenter/index?page=home.

Junos Soware Base (JSB) package does not include applicaon signatures. Please refer to the product

Data Sheets at SRX Series Services Gateways for details, or contact your Juniper Account Team or

Juniper Partner.

You can install the license on the SRX Series Firewall devices using either the automac method or

manual method as follows:

• Install your license automacally on the device.

To install or update your license automacally, your device must be connected to the Internet.

user@host> request system license update

Trying to update license keys from https://ae1.juniper.net, use 'show system license' to

check status.

123

• Install the licenses manually on the device.

user@host> request system license add terminal

[Type ^D at a new line to end input,

enter blank line between each license key]

Paste the license key and press Enter to connue.

• Verify the license is installed on your device.

Use the show system license command to view license usage, as shown in the following example:

License usage:

Licenses Licenses Licenses Expiry

Feature name used installed needed

logical-system 4 1 3 permanent

License identifier: JUNOSXXXXXX

License version: 2

Valid for device: AA4XXXX005

Features:

appid-sig - APPID Signature

date-based, 2014-02-17 08:00:00 GMT-8 - 2015-02-11 08:00:00 GMT-8

The output sample is truncated to display only license usage details.

Soware Licenses for Subscriber Services

The Subscriber Services support subscripon or perpetual licenses.

Go through the following tables:

• Subscriber Services SKUs Denion on page 125

• Product and Plaorm Support on page 125

• Subscriber Services Licenses for Wireline Broadband on page 126

124

• Subscriber Services Licenses for Mobile Broadband on page 126

• Subscriber Services Licenses SKUs on page 127

Table 80: Subscriber Services SKUs Denion

SKU SKU Character Descripon

S-WB-APM-10-A1-1/3/5

S-WB-1K/10K-A1/P1-P/1*/3/5

S-WB-UP/CP/CB-1K/10K-A1-P/1*/3/5

S-MB-UP-1K/10K-A1-P/1*/3/5

S—Soware

WB—Wireline broadband

MB—Mobile broadband

CP—Control plane

UP—User plane

CB— CUPS bundle (CP and UP)

APM—Address pool manager

1K/10K—Subscriber (wireline) or Session (mobile) scale

A1—Advanced license model

P1—Premium license model

P/1/3/5—Term: Perpetual, Subscripon term: 1 year, 3

years, or 5 years

Table 81: Product and Plaorm Support

Plaorm Access

Gateway

Funcon

(AGF)

Address Pool

Manager

(APM)

BNG BNG CUPS

(Control

Plane)

BNG CUPS

(User Plane)

Mobile Edge

MX Yes No Yes No Yes Yes

Cloud No Yes No Yes No No

125

Table 82: Subscriber Services Licenses for Wireline Broadband

Features with Licenses Wireline Broadband Wireline Broadband Advanced

CUPS (Control and User Plane)

AGF Premium Not applicable

Layer 2 Tunneling Protocol (L2TP),

IPoE, PPPoE, WAG and PWHT

Advanced and Premium Advanced

Radius and diameter AAA and

policy management

Advanced and Premium Advanced

Lawful intercept for wireline Advanced and Premium Advanced

BNG CUPS controller Not applicable Advanced

BNG CUPS user plane Not applicable Advanced

BNG CUPS interface Not applicable Advanced

Table 83: Subscriber Services Licenses for Mobile Broadband

Features with Licenses Mobile Broadband User Plane

SGW-U, PGW-U, SAEGW-U and UPF Advanced

Session preservaon - HA Advanced

Lawful intercept for mobile Advanced

126

Table 84: Subscriber Services Licenses SKUs

Subscriber Services Use Case SKUs Plaorms

Wireline broadband

(Advanced)

Residenal, business

services, and

wholesale (LAC and

LNS)

S-WB-1K-A1-P/1*/3/5

S-WB-10K-A1-P/1*/3/5

MX5, MX10, MX40,

MX80, MX104,

MX150, MX204,

MX304, MX240,

MX480, MX960,

MX10K3, MX2008,

MX2010, MX2020,

and MX10K8

Wireline broadband

(Premium)

Residenal, business

services, and

wholesale (LAC and

LNS) and AGF

S-WB-1K-P1-P/1*/3/5

S-WB-10K-P1-P/1*/3/5

MX960, MX480,

MX240, MX304,

MX204, MX10K3,

MX10K4, and

MX10K8

APM APM for integrated

BNG

S-WB-APM-10-A1-1/3/5 MX204, MX240,

MX304, MX480,

MX960, MX10003,

MX10004 and

MX10008

Wireline broadband

advanced CUPS control

plane

Advanced broadband

architectures for

wireline (BNG only)

S-WB-CP-1K-A1-1*/3/5

S-WB-CP-10K-A1-1*/3/5

Cloud

Wireline broadband

advanced CUPS user

plane

Advanced broadband

architectures for

wireline (BNG only)

S-WB-UP-1K-A1-1*/3/5

S-WB-UP-10K-A1-1*/3/5

MX204, MX304,

MX240, MX480,

MX960, MX10K3,

MX10K4, and

MX10K8

Wireline broadband

advanced CUPS bundle

Advanced broadband

architectures for

wireline (BNG only)

S-WB-CB-1K-A1-1*/3/5

S-WB-CB-10K-A1-1*/3/5

Cloud, MX204,

MX304, MX240,

MX480, MX960,

MX10K3, MX10K4,

and MX10K8

127

Table 84: Subscriber Services Licenses SKUs

(Connued)

Subscriber Services Use Case SKUs Plaorms

Mobile broadband user

plane

Mobile broadband

and xed wireless

access

S-MB-UP-1K-A1-P/1*/3/5

S-MB-UP-10K-A1-P/1*/3/5

MX960, MX480,

MX240, MX304,

MX204, MX10K3,

MX10K4, and

MX10K8

AGF and Mobile Edge support is available on MX204, MX10K3, MX960, MX480, and MX240 with

MPC7 and MK10K4, MX10K8 with LC480.

Soware Licenses for vSRX Virtual Firewall

vSRX Virtual Firewall supports subscripon licenses.

Go through the following tables:

• vSRX Virtual Firewall SKU Denion on page 129

• vSRX Virtual Firewall with 2, 5, 9, 17, or 32 virtual CPUs (vCPUs) Soware Licenses on page 129

• vSRX Virtual Firewall License SKUs on page 132

• Legacy Soware Features for vSRX Virtual Firewall on page 133

• Legacy Soware Features for vSRX Virtual Firewall on Contrail, KVM, Microso Hyper-V, and

VMware on page 135

• Legacy Soware Features for Remote Access on vSRX Virtual Firewall on page 137

128

Table 85: vSRX Virtual Firewall SKU Denion

SKU SKU Character Descripon

S-VSRX-2C/5C/9C/17C-S/A1/A2/A3/P1/P2/

P3-1/3/5

S—Soware

VSRX—Product name vSRX Virtual Firewall

2C/5C/9C/17C—Number of vCPUs

S/A1/A2/A3/P1/P2/P3

• S = Standard

• A1 = Advanced 1

•

A2 = Advanced 2

•

A3 = Advanced 3

•

P1 = Premium 1

•

P2 = Premium 2

•

P3 = Premium 3

1/3/5—Subscripon term 1, 3, or 5 years

For public cloud, vSRX Virtual Firewall soware license supports—Pay-As-You-Go (PAYG) and Bring Your

Own License (BYOL) license model. Pricing is based on the number of vCPU cores, with a minimum of 2

vCPU cores.

NOTE: Advanced 3 and Premium 3 licenses are supported only on vSRX3.0.

Table 86: vSRX Virtual Firewall with 2, 5, 9, 17, or 32 virtual CPUs (vCPUs)

Soware Licenses

Features with Licenses vSRX Virtual Firewall

Use Case for Premium 3 (includes Advanced 3 features): Next-generaon rewall and Juniper ATP Cloud

Juniper ATP Cloud Premium 3

129

Table 86: vSRX Virtual Firewall with 2, 5, 9, 17, or 32 virtual CPUs (vCPUs) Soware Licenses

(Connued)

Features with Licenses vSRX Virtual Firewall

Use Case for Premium 2 (includes Advanced 2 features): Next-generaon rewall and Juniper ATP Cloud

Juniper ATP Cloud Premium 2

Use Case for Premium 1 (includes Advanced 1 features): Data center security and Juniper ATP Cloud

Juniper ATP Cloud Premium 1

Use Case for Advanced 3 (includes Standard features): Next-generaon rewall with on-box anvirus

Avira anvirus, Web ltering, anspam, and content

ltering

Advanced 3

Use Case for Advanced 2 (includes Standard features): Next-generaon rewall with cloud-based anvirus

Sophos anvirus, Web ltering, anspam, and content

ltering

Advanced 2

Use Case for Advanced 1 (includes Standard features): Data center security

IPS and Applicaon Security Advanced 1

Use Case for Standard: Standard rewall and secure branch routers

Applicaon Layer Gateways (ALGs) Standard

BGP Standard

Class of service (CoS) Standard

DHCP Standard

130

Table 86: vSRX Virtual Firewall with 2, 5, 9, 17, or 32 virtual CPUs (vCPUs) Soware Licenses

(Connued)

Features with Licenses vSRX Virtual Firewall

Diagnoscs Standard

Firewall Standard

GRE Standard

IP tunneling Standard

IPv4 and IPv6 Standard

J-Flow Standard

Management (J-Web, CLI, and NETCONF) Standard

MPLS Standard

Mulcast Standard

NAT Standard

On-box logging Standard

OSPF Standard

Screens Standard

Site-to-site VPN Standard

Stac roung Standard

User rewall Standard

131

Table 87: vSRX Virtual Firewall License SKUs

vSRX SKUs

Premium 3 S-VSRX-2C/5C/9C/17C-P3-1/3/5

Premium 2 S-VSRX-2C/5C/9C/17C-P2-1/3/5

Premium 1 S-VSRX-2C/5C/9C/17C-P1-1/3/5

Advanced 3 S-VSRX-2C/5C/9C/17C-A1-1/3/5

Advanced 2 S-VSRX-2C/5C/9C/17C-A2-1/3/5

Advanced 1 S-VSRX-2C/5C/9C/17C-A3-1/3/5

Standard S-VSRX-2C/5C/9C/17C-S-1/3/5

Oracle Cloud Infrastructure (OCI) supports Bring Your Own License (BYOL) licensing model. The BYOL

license model allows you to customize your license, subscripon and support to t your needs. You can

purchase BYOL from Juniper Networks or Juniper Networks authorized reseller.

Legacy vSRX Virtual Firewall Licenses

The licenses used by all Juniper Networks instances are based on SKUs, which represent lists of

features. Each license includes a list of features that the license enables along with informaon about

those features.

For informaon about purchasing soware licenses, contact your Juniper Networks sales representave

at hps://www.juniper.net/in/en/contact-us/.

vSRX Virtual Firewall licenses are based on applicaon packages and processing capacity.

vSRX Virtual Firewall provides bandwidth in the following capacies (throughput per instance): 1 Gbps,

2 Gbps, and 4 Gbps. Each of these bandwidth ers is oered with three dierent packages.

132

Table 88: Legacy Soware Features for vSRX Virtual Firewall

License

Type

Descripon SKUs

STD Includes the following features:

• Core security—rewall, ALG, screens, user rewall

• IPsec VPN (site-to-site VPN)

• NAT

• CoS

•

Roung services—BGP, OSPF, DHCP, J-Flow, IPv4

•

Foundaon—Stac roung, management (J-Web, CLI, and NETCONF),

on-box logging, diagnoscs

VSRX-1G/2G/4G-

STD-CLD-1/3

ASCB Includes all STD features bundled with IPS and AppSecure signatures,

along with the following features:

• AppID

• AppFW

• AppQoS

• AppTrack

VSRX-1G/2G/4G-

ASB-CLD-1/3

CSB Includes all STD features, along with the features bundled with ASCB,

including the addion of the following Content Security features:

• Anvirus

• Content ltering

• Web ltering

VSRX-1G/2G/4G-

CSB-CLD-1/3

133

Table 88: Legacy Soware Features for vSRX Virtual Firewall

(Connued)

License

Type

Descripon SKUs

ATP-B vSRX-1G-ATP-B bundle includes:

• Juniper ATP Cloud +

• Content Security +

• ASEC (IDP + AppFW) +

• STD

VSRX-1G-ATP-B-1

License stacking is allowed. So, for example, to license 3 Gbps of throughput for the standard (STD)

feature set for 1 year, use a VSRX-1G-STD-CLD-1 license and a VSRX-2G-STD-CLD-1.

Legacy vSRX Virtual Firewall Licenses for Contrail, KVM, Microso Hyper-V, and VMware

The licenses used by all Juniper Networks instances are based on SKUs, which represent lists of

features. Each license includes a list of features that the license enables along with informaon about

those features.

For informaon about purchasing soware licenses, contact your Juniper Networks sales representave

at hps://www.juniper.net/in/en/contact-us/.

vSRX Virtual Firewall licenses are based on applicaon packages and processing capacity.

Bandwidth (throughput) licenses allow you to use a single instance of the soware for up to the

maximum throughput specied in the license entlement. Throughput licenses can be combined on a

single instance of the soware so that the maximum throughput for that instance is the aggregate of all

the throughput licenses assigned to that instance. A throughput license cannot be split across mulple

instances. Throughput licenses are idened in the license entlement in megabits per second (Mbps),

or gigabits per second (Gbps).

vSRX Virtual Firewall provides bandwidth in the following capacies (throughput per instance): 100

Mbps, 1 Gbps, 2 Gbps, 4 Gbps, 10 Gbps, and 20 Gbps. Each of these bandwidth ers is oered with four

dierent packages along with bandwidth based, a la carte, advanced Layer 7 security services SKUs.

134

Table 89: Legacy Soware Features for vSRX Virtual Firewall on Contrail, KVM, Microso Hyper-V, and

VMware

License Type Descripon Bandwidth SKUs

STD Includes the following features:

• Core security – rewall, ALG,

screens, user rewall

• IPsec VPN (site-to-site VPN)

• NAT

• CoS

•

Mulcast services – IP Mulcast

(PIM, IGMP)

•

Roung services – BGP, OSPF,

DHCP, J-Flow, IPv4, and IPv6

•

High availability

•

Foundaon – Stac roung,

management (J-Web, CLI, and

NETCONF), on-box logging,

diagnoscs

• Soware plaorm – KVM,

Openstack, ESXi 6.0, Contrail

100M/1G/2G/4G/10G/20G

throughput—vSRX Virtual

Firewall standard package (1

year, 3 years, and perpetual)

VSRX-100M/1G/2G

/4G/10G/20G-

STD-1/3

ASCB and

ASECB

Includes all STD features bundled

with the following addional

AppSecure features:

• AppID

• AppFW

• AppQoS

•

AppTrack

100M/1G/2G/4G/10G/20G

throughput—vSRX Virtual

Firewall AppSecure package

includes all features in the STD

package with IPS and AppSecure

(1-year or 3-year subscripon)

VSRX-100M-

ASCB-1/3

VSRX-1G/2G/4G/10

G/20G-ASECB-1/3

VSRX-100M/1G/2G

/4G/10G/20G-

ASEC-1/3

135

Table 89: Legacy Soware Features for vSRX Virtual Firewall on Contrail, KVM, Microso Hyper-V, and

VMware

(Connued)

License Type Descripon Bandwidth SKUs

CS-B Includes all STD features bundled

with ASEC features and the addion

of Content Security capabilies:

• Anspam

• Anvirus

• Content ltering

•

Web ltering

100M/1G/2G/4G/10G/20G

throughput—vSRX Virtual

Firewall CS package includes all

features in STD, IPS, and

AppSecure, enhanced Web

ltering, Sophos anvirus,

anspam, content ltering, (1-

year or 3-year subscripon).

VSRX-100M/1G/2G

/4G/10G/20G-CS-

B-1/3

ATP-B vSRX-1G-ATP-B bundle includes:

• ATP Cloud +

• Content Security +

• ASEC (IDP + AppFW) +

• STD

1G Throughput, 1 year

Subscripon License for vSRX

Virtual Firewall ATP package,

including features in Content

Security (CS) package, and ATP

Cloud.

This license is not supported for

Contrail deployments.

vSRX-1G-ATP-B-1

Individual (a

la carte)

Advanced

Security

Services

(ASEC, S-AV,

W-EWF, CS)

Individual (a la carte) Layer 7

security services licenses including:

• Sophos anvirus

• Websense enhanced Web

ltering

• AppSecure and IPS

• Content Security (CS)

100M/1G/2G/4G/10G/20G

throughput—vSRX Virtual

Firewall S-AV license (1-year or

3-year subscripon).

100M/1G/2G/4G/10G/20G

throughput—vSRX W-EWF

license (1-year or 3-year

subscripon).

VSRX-100M/1G/2G

/4G/10G/20G-

CS-1/3

VSRX-100M/1G/2G

/4G/10G/20G-S-

AV-1/3

VSRX-100M/1G/2G

/4G/10G/20G-

WEWF-1/3

License stacking is allowed. For example, to license 3 Gbps of throughput for the standard (STD) feature

set for 1 year, use a VSRX-1G-STD-1 license and a VSRX-2G-STD-1.

136

Table 90: Legacy Soware Features for Remote Access on vSRX Virtual Firewall

Remote Access Licenses SKUs

Remote Access (5 Concurrent users, NCP) VSRX-RA1-5

Remote Access (10 Concurrent users, NCP) VSRX-RA1-10

Remote Access (25 Concurrent users, NCP) VSRX-RA1-25

Remote Access (50 Concurrent users, NCP) VSRX-RA1-50

Remote Access (100 Concurrent users, NCP) VSRX-RA1-100

Remote Access (150 Concurrent users, NCP) VSRX-RA1-150

Remote Access (250 Concurrent users, NCP) VSRX-RA1-250

Remote Access (500 Concurrent users, NCP) VSRX-RA1-500

Juniper Agile Licensing for License Management

SUMMARY

Learn about Juniper Agile Licensing, an improved

license management system to acvate, install,

manage, and monitor licenses on Juniper Networks

devices.

IN THIS SECTION

Juniper Agile Licensing Overview | 138

Juniper Agile Licensing Workow for

Procuring and Managing Licenses | 140

Juniper Agile Licensing Videos | 141

137

Juniper Agile Licensing Overview

IN THIS SECTION

Benets of Juniper Agile Licensing | 138

Understand Juniper Agile Licensing | 138

Components of Juniper Agile Licensing | 139

Benets of Juniper Agile Licensing

• Provides an intuive user experience and simplied operaonal processes.

• Provides seamless lifecycle management of licenses.

• Oers exible license administraon and deployment.

• Enables monitoring of soware usage through centralized administrator and reporng.

• Allows users to proacvely adjust usage based on real-me reporng.

• Provides consistent license management workow for all Juniper products.

Understand Juniper Agile Licensing

Juniper Networks introduced the Juniper Agile Licensing soluon to provide an ecient way for

customers and partners to manage licenses for hardware and soware features. To use a licensed

feature, you need to purchase and acvate a license that corresponds to that feature and deploy that

license so that it can be ulized by the soware during normal operaon. You can administer and

manage the licenses through the Juniper Agile Licensing Portal. The portal provides an intuive task-

based user interface that provides full lifecycle management of licenses.

Juniper Agile Licensing ensures that features are used in compliance with Juniper's End User License

Agreement.

• Standalone mode allows you to acvate a license on a single hardware device or soware instance.

Such a license can only be used by the instance on which it is acvated. Sharing a license with

mulple instances is not permissible.

138

Support for each deployment mode varies by product. Both deployment modes enable ecient

management of both subscripon and perpetual licenses and may enable combinaons of features and

capacity depending on the specic license purchased.

Components of Juniper Agile Licensing

1. Juniper Agile Licensing Portal

The Juniper Agile Licensing Portal provides the features shown in Figure 2 on page 139.

Figure 2: Juniper Agile Licensing Portal Features

You use the Juniper Agile Licensing Portal to acvate and deliver the required license keys for

products you have purchased.

Depending on the type of license, the fulllment e-mail you receive from Juniper aer purchase of a

license indicates whether your device can be used without installing license keys. If you need to

install license keys, you can view and acvate the purchased entlements in the Agile Licensing

Portal.

NOTE: In some cases, the fulllment e-mail might include a license key, in which case it is not

necessary to manage the entlement through the Agile Licensing Portal.

2. Juniper Entlement Management System

The Juniper Agile Entlement Management System is a repository of all your entlements. It

simplies the licensing life cycle by providing a centralized license management interface that you

can access using the Agile Licensing Portal.

139

Juniper Agile Licensing Workow for Procuring and Managing Licenses

IN THIS SECTION

Procuring and Managing Licenses | 140

Procuring and Managing Licenses

For procuring and managing licenses, Juniper Agile Licensing comprises the following phases:

The phases of the licensing life cycle are shown in Figure 3 on page 140.

Figure 3: Licensing Phases

140

Purchase Licenses from Juniper Networks

Licenses to use Juniper soware are purchased through Juniper’s standard sales order process. Aer

meeng with your Sales Representave or Juniper Partner, submit a sales order to Juniper. License sales

order lines will send you an e-mail that includes your acvaon code and Soware Support Reference

Number (SSRN) relang to your entlements. The system creates entlements associated with your user

account (e-mail ID) that you can subsequently manage through the Juniper Agile Licensing Portal.

Depending on the type of license, access the Agile Licensing Portal to acvate license keys or send the

keys by e-mail to yourself.

NOTE: Keep a record of your SSRN, which is used as a proof of purchase and for support

entlement purposes.

Manage Entlements using the Agile Licensing Portal

You use the informaon from the fulllment e-mail to acvate your entlements. This process generates

soware license acvaon keys (license keys) that you can install on devices directly, or automacally

synchronize to previously installed licenses.

NOTE: Some soware licenses can be only acvated, and do not generate or require a license

acvaon key to be installed on the device. Refer to the fulllment e-mail that you receive aer

purchase for this informaon.

Juniper Agile Licensing Videos

See the following videos to learn about the JAL portal, single license acvaon, bulk licenses acvaon,

revoking license key, and so on.

• See JAL Overview video to learn about the JAL portal features.

• See Revoking a License Key video to learn about how to revoke the license key.

• See RTU Licenses video to learn about how to acvate RTU licenses.

• See Bulk License Key Acvaon video to learn how to acvate bulk licenses.

• See Hardware and Soware License Acvaon video to learn about hardware and soware license

acvaon.

141

• See RMA Overview video to learn about Return Materials Authorizaon.

• See Mulple Entlement Quanes in a Single Acvaon video to learn how to acvate mulple

licenses.

Acvate Your Licenses

SUMMARY

In this topic, we describe how to acvate license on

dierent Juniper Networks products.

IN THIS SECTION

Acvate Licenses | 142

Acvate Junos OS Licenses | 144

Acvate Contrail Insights Licenses | 145

Acvate CSO and Juniper Sky Enterprise

Licenses | 146

Acvate Juniper ATP Appliance

Licenses | 147

Acvate Juniper Cloud Workload Protecon

Licenses | 149

Generate Voucher Cercate | 151

Monitor Your Licenses | 153

Example: Content Security License

Acvaon Video | 176

You're now set to acvate the purchased license.

Acvate Licenses

To acvate license, perform the following steps:

1. Log in to the Juniper Agile Licensing Portal.

2. Navigate to the My Entlements secon on the landing page.

If you are unable to view your entlements in the JAL Portal, contact Juniper Customer Care.

142

3. Click the Acvate.

4. In the Product Acvaon screen, select the Soware Version and the quanty to acvate. You can

add any useful informaon in the Notes eld.

5. Click Acvate. Once complete, the screen will display as shown below:

To add license, perform the following steps:

1. Issue the set system license keys key

statement.

2. The

parameter includes the license ID and the license key. For example:

[edit]

user@device# set system license keys key "JUNOS_TEST_LIC_FEAT xxxxxx xxxxxx xxxxxx xxxxxx

xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx"

To add mulple license keys in the Junos OS CLI, issue the set system license keys key

name

statement

for each license key to add. For example:

[edit]

user@device# set system license keys key "key_1"

set system license keys key "key_2"

set system license keys key "key_4"

143

3. Issue the commit command.

[edit]

user@device# commit

commit complete

4. Verify that the added license key.

For example:

user@device# run show system license

License usage:

Licenses Licenses Licenses Expiry

Feature name used installed needed

sdk-test-feat1 0 1 0 permanent

Licenses installed:

License identifier: JUNOS_TEST_LIC_FEAT

License version: 2

Features:

sdk-test-feat1 - JUNOS SDK Test Feature 1

permanent

Alternavely, you can issue the show system license command from operaonal mode.

Reboot the device aer adding license on the SRX300, SRX320, SRX320-POE, SRX340, SRX345,

SRX380, SRX550, and SRX550-M devices. Reboong the device sets system resources to support

session capacity of the license.

Acvate Junos OS Licenses

In case of Junos OS upgrade, you might need the new license keys. See the "Step 2" on page 145 to

generate license keys. If you have any problem in generang license keys, contact Juniper Customer

Care.

1. Gather your acvaon codes.

144

Acvaon Code: The 17-digit alphanumeric acvaon code is sent through email in response to your

order and is used to generate license capacity / feature acvaon keys for your Juniper Networks

soware. The acvaon code is used to generate your license acvaon key—it is not the license

acvaon key itself.

2. Generate license keys and acvaon keys.

Upon inial setup, a base acvaon key might be required to acvate the soware. If further

capacity or feature(s) were purchased and are being added to the soware, each capacity increment

and feature needs to be added via another acvaon key. Generate license acvaon keys using the

Juniper Agile Licensing Portal. At the top of the portal, enter your acvaon code, and click Acvate.

Then follow the instrucons on screen. Juniper provides license acvaon keys in one of two ways:

• Download: You can download acvaon keys from the Juniper Agile Licensing Portal.

• Email: You receive an email that contains the license acvaon keys.

3. Add license.

To add and manage licenses, see Managing Licenses.

Acvate Contrail Insights Licenses

This topic describes how to obtain the appropriate product keys and soware required for your

Juniper® Contrail® Insights product.

1. Create a user account.

To download your soware, you need an approved user account with Juniper Networks. If you do

not already have one, you can create an account through the User Registraon Portal.

2. Forward your fulllment e-mail to the Juniper account acvaon team.

Locate the fulllment e-mail(s) that you received and forward it to mailto:appformix-key-

request@juniper.net. (These e-mails verify that you purchased the product.) Idenfy the subject as

“AppFormix Product Keys Needed.” Add the following informaon to the e-mail:

• Company name

• Primary contact name

• Full company address

• Contact e-mail address

• Contact phone number

145

You will receive an e-mail conrmaon acknowledging your acvaon request. The Juniper product

acvaon team will complete the acvaon request within two business days.

3. Retrieve your soware serial number.

The soware serial number is a unique 14-digit number that Juniper uses to idenfy your Juniper

Networks soware installaon (or purchased capacity). You can nd this number in the Soware

Serial Number Cercate aached to the e-mail sent when you ordered your Juniper Networks

Service. Store the Soware Serial Number in a safe place, as it will be necessary to idenfy your

installaon when engaging Juniper for support.

4. Download your Soware.

Find your product soware on the Juniper Soware Downloads page. You will need to sign in with

your Juniper user account and provide your Soware Serial Number.

5. Install your Soware.

Install your soware according to the instrucons in the soware documentaon at Contrail Insights.

Make sure to enter the license key as instructed during installaon.

Need Help?

For addional assistance, you may contact Juniper Networks by opening a case online through the

Juniper Customer Support Center (CSC) Service Request Manager.

Acvate CSO and Juniper Sky Enterprise Licenses

This topic describes how to acvate Juniper Contrail Service Orchestraon and Juniper Sky Enterprise.

Note: These instrucons are wrien for the customer who will be using the product. If you are a partner,

reseller, or distributor who is seng up Contrail Service Orchestraon and Juniper Sky Enterprise for an

end customer, please ll in the details about the customer.

1. Create a user account.

If you don’t already have a Juniper user account, go to the User Registraon Portal to create one. (For

detailed instrucons, see KB 9946: Create a New User Login Account with Juniper Networks.)

Important: When creang your account, do not select

Guest User Access

Use your Cloud

Marketplace or Cloud Service Provider credenals

. If you choose either of these opons, you will not

be able to use the resulng user account to acvate your licenses in the next step.

2. Locate your license cercate.

146

When you purchased your Juniper product, you should have received an e-mail containing

informaon about your soware license. Locate that e-mail and the aached cercate, which

contains details you need to acvate your product.

3. Enter your acvaon code.

Sign into the Juniper Agile Licensing Portal. At the top of the screen, enter the acvaon code (also

somemes called an authorizaon code) located in your license cercate, and click Acvate.

4. Acvate your licenses.

Choose one of the following opons in the Product Acvaon screen:

• Add devices to an exisng account instance: Select this opon if you are simply adding addional

licenses to an exisng Contrail Service Orchestraon or Juniper Sky Enterprise account. Then,

select your preexisng account.

• Register a new account instance: Select this opon if you are acvang Contrail Service

Orchestraon or Juniper Sky Enterprise for the rst me. Then, provide relevant account details.

Note: When creang an account, you will be asked to select an account type (Enterprise or Service

Provider). If you are a partner, distributor, or reseller lling in this form for a customer, specify your

customer’s business type, not your own.

5. Complete your request.

Juniper will complete the request and e-mail you the details you need to acvate your new product

within two (2) business days.

Need Help?

For addional assistance, you may contact Juniper Networks by opening a case online through the

Juniper Customer Support Center (CSC) Service Request Manager.

Acvate Juniper ATP Appliance Licenses

This topic describes how to obtain the appropriate license keys and soware required for your Juniper

Networks Advanced Threat Prevenon Appliance.

1. Create a user account.

To download your soware, you need an approved user account with Juniper Networks. If you do

not already have one, you can create an account through the User Registraon Portal.

Note: Compliance approval typically takes two hours following the creaon of a new Juniper User

Account.

147

2. Retrieve your soware serial number.

The soware serial number is a unique 14-digit number that Juniper uses to idenfy your Juniper

Networks soware installaon (or purchased capacity). You can nd this number in the Soware

Serial Number Cercate aached to the e-mail sent when you ordered your Juniper Networks

Service. Store the Soware Serial Number in a safe place, as it will be needed to idenfy your

installaon when engaging Juniper for support. Note that this number is dierent than the license

key described in Step 3.

3. Request your license key.

Open an admin service request (case) using our Service Request Manager on the Juniper Customer

Support Center (CSC) and enter the following informaon to facilitate your request. You may also call

Customer Care via telephone if you prefer:

• Subject Line: Juniper ATPA Soware License Request

• Descripon:

• Sales order number

• Soware product SKU

• UUID (for assistance nding your UUID, see kb.juniper.net\kb32301)

• Serial Number/SSRN (enter the soware serial number provided in your license fulllment e-

mail). If available, please aach the soware serial number cercate (PDF) to the admin

service request.

Once your service request is processed, your license key will be sent to you.

4. Download your soware.

If you need to download your soware, you can nd it on the Juniper Soware Downloads page. You

will need to sign in with your Juniper user account and provide your Soware Serial Number.

Note: If you receive an account privileges error, please contact Customer Care to have your account

upgraded. Be prepared to provide your Soware Serial Number as proof of purchase.

5. Install your soware.

Install your soware according to the instrucons in the soware documentaon at JATP400

Advanced Threat Prevenon Appliance and JATP700 Advanced Threat Prevenon Appliance. Make

sure to enter the license key as instructed during installaon.

Need Help?

For addional assistance, you may contact Juniper Networks by opening a case online through the

Juniper Customer Support Center (CSC) Service Request Manager.

148

Acvate Juniper Cloud Workload Protecon Licenses

This topic describes how to obtain the appropriate license keys and soware required for your Juniper

Networks Cloud Workload Protecon soware.

1. Create a user account.

To access your soware, you need an approved user account with Juniper Networks. If you do not

already have one, you can create an account through the User Registraon Portal.

Note: Compliance approval typically takes two hours following the creaon of a new Juniper User

Account.

2. Retrieve your soware serial number.

The soware serial number is a unique 14-digit number that Juniper uses to idenfy your Juniper

Networks soware installaon (or purchased capacity). You can nd this number in the Soware

Serial Number Cercate aached to the e-mail sent when you ordered your Juniper Networks

Service. Store the Soware Serial Number in a safe place, as you'll need it later to idenfy your

installaon when engaging Juniper for support.

3. Request your licensed soware.

Open an admin case by going to support on hps://www.juniper.net/ and then selecng Juniper

Support Portal. Under cases, you can now open a case and enter the following informaon to

facilitate your request. You may also call Customer Care via telephone if you prefer:

• Subject Line: Juniper Cloud Workload Protecon Soware Request

• Descripon:

• Sales order number

• Soware product SKU

• Serial Number/SSRN (enter the soware serial number provided in your license fulllment e-

mail). If available, please aach the soware serial number cercate (PDF) to the admin

service request.

• Email address for the master admin account – this can be the same as the Juniper user account

or a dierent email address if preferred. Ensure that the incoming email from outside your

organizaon is allowed.

Temporary login details are emailed automacally once your account is set up. Once your service

request is processed, you'll receive an email with your account informaon. Your product is

automacally licensed.

4. Access Juniper Cloud Workload Protecon portal.

149

1. Go to Juniper Cloud Workload Protecon.

NOTE: If you have purchased the on-prem version of the soware, you'll sll need to login

inially to the SaaS portal in order to download the full soware.

2. Enter your log in details. Use the log in informaon you received in the email to sign into your

account for the rst me.

Click Login to connue. Upon successful authencaon, you'll be directed to the Juniper Cloud

Workload Protecon dashboard.

5. Navigate to the Installaon tab.

150

6. Use Agent installaon opon for both the SaaS and on-prem opons. The Portal installaon opon is

only accessible if you purchase on-prem opon. Follow the instrucons on the screen to download

and install agents.

Generate Voucher Cercate

IN THIS SECTION

Generate Voucher Cercate for One Device | 151

Generate Voucher Cercates for Mulple Devices | 152

The Juniper Agile Licensing (JAL) Portal generates voucher cercate for your network device. This

voucher cercate validates that a device with serial number belongs to the correct owner.

Generate Voucher Cercate for One Device

Let's generate voucher cercate for your network device using the JAL Portal.

1. To onboard a device, open a Web browser and log in to JAL Portal.

2. Click My Entlements, nd the S-ALL-S-DV-P SKU, and click Acvate.

3. On the Product Acvaon page, ll the following details:

a. Select the Soware Version.

b. Enter the Device Serial Number. Use the device serial number menoned in your purchase order

or sale order. To nd the device serial number, see Locang my Product Serial Number or

Soware Support Reference Number (SSRN).

c. Select the Voucher Cercate expiraon date.

d. Enter the Email ID to which you want to receive the conrmaon mail.

e. Upload the Pinned Domain Cercate or select the previously uploaded Pinned Domain. On your

device, generate an X509 standard based cercate with cercate authority ag. Use the

generated cercate as Pinned Domain cercate.

f. Read the agreement and select I Agree with Terms and Condions.

a. Click Acvate.

151

4. On the Acvaon Complete page, you can download or email the acvaon code using the

Download and E-Mail opons. Click I’m Done to acvate the SKU.

Use the downloaded voucher in Secure ZTP bootstrap response messages.

5. You have successfully onboarded your device. You can see the acvated SKU in My Acvaons

secon.

Generate Voucher Cercates for Mulple Devices

Let's generate voucher cercates for mulple network devices using the JAL Portal.

1. To onboard mulple devices, open a Web browser and log in to JAL Portal.

2. Click Bulk Tool.

3. On the Bulk License Acvaon Tools page click Bulk Acvaon Tool.

4. On the Bulk Voucher Cercate Entlement Acvaon page, click Download Excel File. A voucher

cercate template le gets downloaded.

5. Open the voucher cercate template le and enter the acvaon code, serial number, soware

version, and expiraon date.

a. To nd the acvate code, navigate to My Entlements and nd the S-ALL-S-DV-P SKU.

b. Use the device serial number menoned in your purchase order or sale order. To nd the device

serial number, see Locang my Product Serial Number or Soware Support Reference Number

(SSRN).

c. You can choose a date up to when you want the Secure ZTP to be acve.

6. Save the voucher cercate template.

7. Upload the saved voucher cercate template le.

8. Upload the Pinned Domain Cercate or select the previously uploaded Pinned Domain. On your

device, generate an X509 standard based cercate with cercate authority ag. Use the

generated cercate as Pinned Domain cercate.

9. Enter the Email ID to which you want to receive the conrmaon mail.

10. Read the agreement and select I Agree with Terms and Condions.

11. Click Upload File.

12. Aer the voucher cercate template le is uploaded, you receive two mails.

a. First mail informs about the submission of SKUs for acvaon.

a. Second mail to conrm the acvaon of the SKUs, you can nd the acvaon code in the

aached le.

13. You have successfully onboarded your device. You can see the acvated SKU in My Acvaons

secon.

152

Monitor Your Licenses

SUMMARY

This topic helps you to manage your licenses.

IN THIS SECTION

Overview | 153

View License | 153

Save License | 156

Delete License | 157

System Log for License | 160

request system license add | 160

request system license autoupdate | 162

request system license delete | 164

request license renew | 165

Viewing Licenses with Network

Director | 167

Install VCF Soware Licenses | 168

Junos Space License Installaon | 169

Exporng the License Inventory | 170

Juniper Connected Security for VMware

NSX Licensing | 173

License Duraon | 175

License Procurement and Installaon | 175

Overview

Aer you acvate and add the license, you can view, save, and delete the licenses.

View License

IN THIS SECTION

View Installed Licenses | 154

View License Usage | 155

153

To verify Junos OS license management, perform the following tasks:

View Installed Licenses

IN THIS SECTION

Purpose | 154

Acon | 154

Meaning | 155

Purpose

Verify that the expected licenses are installed and acve on the device.

Acon

From the CLI, enter the show system license command.

Sample Output

command-name

user@host> show system license

License usage:

Licenses Licenses Licenses Expiry

Feature name used installed needed

subscriber-acct 0 1 0 permanent

subscriber-auth 0 1 0 permanent

subscriber-addr 0 1 0 permanent

subscriber-vlan 0 1 0 permanent

subscriber-ip 0 1 0 permanent

scale-subscriber 0 1000 0 permanent

scale-l2tp 0 1000 0 permanent

scale-mobile-ip 0 1000 0 permanent

Licenses installed:

License identifier: E000185416

License version: 2

154

Features:

subscriber-acct - Per Subscriber Radius Accounting

permanent

subscriber-auth - Per Subscriber Radius Authentication

permanent

subscriber-addr - Address Pool Assignment

permanent

subscriber-vlan - Dynamic Auto-sensed Vlan

permanent

subscriber-ip - Dynamic and Static IP

permanent

Meaning

The output shows a list of the license usage and a list of the licenses installed on the device. Verify the

following informaon:

• Each license is present. Licenses are listed in ascending alphanumeric order by license ID.

• The state of each license is permanent.

A state of invalid indicates that the license key is not a valid license key. Either it was entered

incorrectly, or it is not valid for the specic device.

• The feature for each license is the expected feature. The features enabled are listed by license. An

all-inclusive license has all the features listed.

• All congured features have the required licenses installed. The Licenses needed column must show

that no licenses are required.

View License Usage

IN THIS SECTION

Purpose | 156

Acon | 156

Meaning | 156

155

Purpose

Verify that the licenses fully cover the feature conguraon on the device.

Acon

From the CLI, enter the show system license usage command.

Sample Output

command-name

user@host> show system license usage

Licenses Licenses Licenses Expiry

Feature name used installed needed

subscriber-addr 1 0 1 29 days

scale-subscriber 0 1000 0 permanent

scale-l2tp 0 1000 0 permanent

scale-mobile-ip 0 1000 0 permanent

Meaning

The output shows any licenses installed on the device and how they are used. Verify the following

informaon:

• Any congured licenses appear in the output. The output lists features in ascending alphabecal

order by license name. The number of licenses appears in the third column. Verify that you have

installed the appropriate number of licenses.

• The number of licenses used matches the number of congured features. If a licensed feature is

congured, the feature is considered used. The sample output shows that the subscriber address

pooling feature is congured.

• A license is installed on the device for each congured feature. For every feature congured that

does not have a license, one license is needed.

For example, the sample output shows that the subscriber address feature is congured but that the

license for the feature has not yet been installed. The license must be installed within the remaining

grace period to comply.

Save License

To save the licenses installed on a device:

156

From operaonal mode, do one of the following tasks.

• To save the installed license keys to a le or URL, enter the following command:

user@host> request system license save

filename

url

For example, the following command saves the installed license keys to a le named license.cong:

user@host> request system license save license.config

• To output installed license keys to the terminal, enter the following command:

user@host> request system license save terminal

Delete License

IN THIS SECTION

Using the Operaonal Command to Delete Licenses | 157

Using a Conguraon Command to Delete Licenses | 158

Before deleng a license, ensure that the features enabled by the license will not be needed.

You can use the request system license delete operaonal command, or the delete or deactivate

conguraon command to delete a license:

Using the Operaonal Command to Delete Licenses

To delete licenses using the request system license delete command:

1. Display the licenses available to be deleted.

user@host> request system license delete license-identifier-list?

Possible completions:

E00468XXX4 License key identifier

JUNOS10XXX1 License key identifier

JUNOS10XXX2 License key identifier

157

JUNOS10XXX3 License key identifier

JUNOS10XXX4 License key identifier

[ Open a set of values

2. To delete a license key or keys from a device using the CLI operaonal mode, select one of the

following methods:

• Delete a single license by specifying the license ID. Using this opon, you can delete only one

license at a me.

user@host> request system license delete

license-identifier

• Delete all license keys from the device.

user@host> request system license delete all

• Delete mulple license keys from the device. Specify the license idener for each key and

enclose the list of ideners in brackets.

user@host> request system license delete license-identifier-list [

JUNOS10XXX1 JUNOS10XXX3

JUNOS10XXX4 ...

]

Delete license(s) ?

[yes,no] (no) yes

3. Verify the license was deleted by entering the show system license command.

Using a Conguraon Command to Delete Licenses

Starng in Junos OS Release 16.1, to remove licenses from the conguraon, you can use either the

delete or deactivate conguraon command. The delete command deletes a statement or idener, and all

subordinate statements and ideners contained within the specied statement path are deleted with it.

The deactivate command adds the inactive: tag to a statement, eecvely commenng out the statement

or idener from the conguraon. Statements or ideners marked as inacve do not take eect when

you issue the commit command. To remove the inactive: tag from a statement, issue the activate command.

Statements or ideners that have been acvated take eect when you next issue the commit command.

The following procedure uses the delete command, but you could use the deactivate command as well.

To delete one or all licenses using the delete command:

158

You can use the deactivate command instead of the delete command in this procedure.

1. Display the licenses available to be deleted.

Issue the run request system license delete license-identifier-list? command from the conguraon

mode of the CLI.

[edit]

user@host# run request system license delete license-identifier-list?

A list of licenses on the device is displayed:

Possible completions:

E00468XXX4 License key identifier

JUNOS10XXX1 License key identifier

JUNOS10XXX2 License key identifier

JUNOS10XXX3 License key identifier

JUNOS10XXX4 License key identifier

[ Open a set of values

2. Delete the license or licenses you want.

• To delete a single license, for example:

[edit]

user@host# delete system license keys key [License key]

• To delete all licenses, for example:

[edit]

user@host# delete system license keys

3. Commit the conguraon by entering the commit command.

4. Verify the license was deleted by entering the show system license command.

159

System Log for License

NOTE: Aer you add or delete a license, the system might take up to one minute to synchronize

license between master and backup. You must allow one minute interval before performing any

acons such as switchover or reboot.

Junos OS generates alarms for capacity (scale) features such as bandwidth to indicate the license

requirement if the feature usage on a device exceeds the added license. The alarm detail shows the

current feature usage informaon.

You can see the list of alarms at System Log Explorer.

For example, see the below scenarios where alarms are generated for license requirement:

• Scenario 1

If a device is congured with a 100G bandwidth license and current usage is 200G bandwidth, the

Junos OS generates an alarm as the bandwidth usage exceeded the added license.

The alarm species that the current usage of 200G bandwidth requires a license.

• Scenario 2

If a device is congured with a 128K RIB license and uses 130K RIB, the Junos OS generates an

alarm as the RIB feature scale exceeded the added licenses.

The alarm species 130K RIB requires a license.

request system license add

IN THIS SECTION

Syntax | 161

Descripon | 161

Opons | 161

Addional Informaon | 161

Required Privilege Level | 162

Output Fields | 162

Sample Output | 162

Release Informaon | 162

160

Syntax

request system license add (

filename

| terminal)

Descripon

Adding a license key to the Junos OS devices to acvate the feature.

Starng in Junos OS Release 18.3R1, the display xml rpc CLI opon is supported for request system license

add and request system license save commands while installing licenses on Juniper Networks devices.

Opons

lename

License key from a le or URL. Specify the lename or the URL where the key is located.

terminal

License key from the terminal.

Addional Informaon

The | display xml rpc lter returns “xml rpc equivalent of this command is not available,” the following

RPC is supported for license installaon:

The following RPC is supported for license installaon:

<rpc>

<request-license-add>

<key-data> key </key-data>

</request-license-add>

</rpc>

Where

key-data

is the license key data.

<rpc>

<request-license-add>

</request-license-add>

</rpc>

Where

source

is the URL of the source license key le.

161

Required Privilege Level

maintenance

Output Fields

When you enter this command, you are provided feedback on the status of your request.

Sample Output

request system license add

user@host> request system license add terminal

XXXXXXXXXX xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx

xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx

xxxxxx xxxxxx xxx

XXXXXXXXXX: successfully added

add license complete (no errors)

Release Informaon

Command introduced before Junos OS Release 7.4.

Added addional informaon secon on XML RPC in Junos OS Release 17.4.

request system license autoupdate

IN THIS SECTION

Syntax | 163

Descripon | 163

Required Privilege Level | 164

Output Fields | 164

Release Informaon | 164

162

Syntax

set system license autoupdate url

<URL>

Descripon

Before autoupdate licenses, complete the following tasks:

• Purchase the required licenses.

• Establish basic network connecvity with the router or switch. For instrucons on establishing basic

connecvity, see the

Geng Started Guide

Quick Start Guide

for your device.

To autoupdate licenses using a conguraon command:

• From the CLI conguraon mode, enter the following CLI command:

set system license autoupdate url

<URL>

• You must commit the conguraon using the commit command.

You can autoupdate the license using the proxy server available in the private network to be able to

connect to the EMS server and download the license updates. The devices in the private network

connect to the proxy server to download the license or license updates.

set system proxy server

IP address

set system proxy port

port number

set system proxy username

user name

set system proxy password

password

The license-check process reads the URL from the above conguraon and validates it.

• For hardware products, the URL query uses the device chassis serial number to fetch the required

license key. The physical products support rst me license fetching and license renewal.

• For virtual soware products, you need to do the rst-me installaon. Subsequent fetching and

renewal of the license key from the EMS portal can be done based on Soware Serial Number (SSN).

By default, the autoupdate command sets renew before-expiraon day as 60 days and renew me interval

as 24 hours. The last devices are allowed to contact the EMS server 60 days before the current license

expiry and check for an automac update every 24 hours.

163

Required Privilege Level

maintenance

Output Fields

When you enter this command, you are provided feedback on the status of your request.

Release Informaon

Command introduced in Junos OS Release 21.4R1.

request system license delete

IN THIS SECTION

Syntax | 164

Descripon | 164

Opons | 164

Required Privilege Level | 165

Output Fields | 165

Sample Output | 165

Release Informaon | 165

Syntax

request system license delete (all | license-identifier-list)

Descripon

Delete a license key from the Junos OS device.

Opons

all

Deletes all the licenses from Junos OS device.

164

license-idener-list

Deletes the license idener feature from Junos OS device.

Required Privilege Level

maintenance

Output Fields

When you enter this command, you are provided feedback on the status of your request.

Sample Output

request system license delete

user@host> request system license delete license-identifier-list?

Possible completions:

E00468XXX4 License key identifier

JUNOS10XXX1 License key identifier

JUNOS10XXX2 License key identifier

JUNOS10XXX3 License key identifier

JUNOS10XXX4 License key identifier

[ Open a set of values

Release Informaon

Command introduced before Junos OS Release 7.4.

request license renew

IN THIS SECTION

Syntax | 166

Descripon | 166

Opons | 166

Required Privilege Level | 166

Release Informaon | 166

165

Syntax

set system license renew

{

before-expiration

days

interval

hours

}

Descripon

Before renewing licenses, complete the following tasks:

• Purchase the required licenses.

• Establish basic network connecvity with the router or switch. For instrucons on establishing basic

connecvity, see the

Geng Started Guide

Quick Start Guide

for your device.

To renew licenses using a conguraon command:

• From the CLI conguraon mode, enter the following CLI command:

set system license renew before-expiration

days

set system license renew interval

hours

• You must commit the conguraon using the commit command.

Opons

before-expiraon

days

interval

hours

Required Privilege Level

maintenance

Release Informaon

Command introduced in Junos OS Release 21.4R1.

166

Viewing Licenses with Network Director

To view the license for a Juniper Networks device on your network:

1. Select the Build icon in the Network Director banner.

2. In the View pane, select wired device.

3. In the Tasks pane, select View License Informaon.

Table 91: Viewing Licenses with Network Director

Field Descripon

Feature Name Name of the licensed SKU or feature. It can be used to look up the

license with Juniper Networks. Not all devices support this.

License Count Number of mes an item has been licensed. This value can have

contribuons from more than one licensed SKU or feature.

Alternavely, it can be 1, no maer how many mes it has been

licensed.

Used Count Number of mes the feature is used. For some types of licenses, the

license count will be 1, no maer how many mes it is used. For

capacity-based licensable items, if infringement is supported, the

license count can exceed the given count, which has a corresponding

eect on the need count.

Need Count Number of mes the feature is used without a license. Not all

devices can provide this informaon.

Given Count Number of instances of the feature that are provided by default.

If a device does not have a license, a blank page is displayed with the message, No license is installed

on this device. If you are sure the device has a license, try resynchronizing the device before

displaying the license again.

4. Oponally, expand the license informaon by feature name to view the feature SKU informaon.

167

Table 92: Addional Licensing Informaon

Field Descripon

Validity Type Validity type can be Databased (license expires on end date),

Permanent, Countdown (license expires when me remaining is

zero), or Trial. If the validity type is either Databased or Countdown,

more informaon is displayed—License Name, License Version,

License State, and Time Remaining. Addional informaon can be

added in the details grid based on the SKU type (SKU or Feature)—

Start Date, End Date, or Original Time Allowed.

License Name If the validity type is either Databased or Countdown, the idener

associated with a license key is displayed.

License Version If the validity type is either Databased or Countdown, the version of

a license is displayed. The version indicates how the license is

validated, the type of signature, and the signer of the license key.

License State If the validity type is either Databased or Countdown, the state of

the license is displayed—Valid, Invalid, or Expired.

Time Remaining If the validity type is either Databased or Countdown, the remaining

me le on the license is displayed. For a trial license, the number of

days remaining aer you installed the device is displayed. For a

commercial license, the me remaining is unlimited.

Start Date Based on the SKU type, the start date of the license can be

displayed in the details grid.

End Date Based on the SKU type, the end date of the license can be displayed

in the details grid.

Original Time Allowed Based on the SKU type, the original license meframe can be

displayed here.

Install VCF Soware Licenses

To install a VCF soware license:

168

1. Purchase two VCF soware license keys (QFX-VCF-LIC) from your Juniper Networks sales

representave.

The sales representave will provide you with the feature license les and license keys. You will be

asked to supply the chassis serial number of your switch; you can obtain the serial number by issuing

the show virtual-chassis command.

2. Install the rst soware license on one device in the VCF (for example, the device acng in the

primary role):

user@device> request system license add (

filename

url

)

3. Install the second soware license on a second device in the VCF (for example, the device acng in

the backup role):

user@device> request system license add (

filename

url

)

Junos Space License Installaon

Junos Space Network Management Plaorm comes with a 60-day full-featured trial license. You must

procure and install a valid license during this period to ensure connued operaon beyond the trial

period.

If you fail to upload a valid license during the 60-day trial period, the Junos Space user interface displays

an error message when you log in indicang that the license has expired. Your access is limited to the

Licenses page (Administraon > Licenses) from where you can execute the Import License task to enter

a valid license.

For Junos Space Plaorm licensing details, see Generang and Uploading the Junos Space License Key

File and Viewing Junos Space Licenses.

You can use either of the following opons to install a valid license for Junos Space Plaorm:

• If you plan to use the Junos Space Plaorm with only the Support Automaon applicaons (Service

Now and Service Insight), you can navigate to the Add Organizaon page (Service Now >

Administraon > Organizaons > Add Organizaon) in the Service Now user interface to acvate

these applicaons. However, to acvate these applicaons, you must have a valid support contract

for your Juniper Networks devices and valid credenals to access the Juniper Support System (JSS)

back end.

If you choose this opon and if you want to use other Junos Space applicaons beyond the trial

period, you must purchase a license for Junos Space Plaorm (as explained in the bulleted item that

follows).

169

• If you want to use Junos Space applicaons other than Service Now and Service Insight, or if you do

not have a valid support contract for your Juniper Networks devices, you must purchase a license for

Junos Space Plaorm. Aer you obtain the license le, you can install the license from the Import

License page (Administraon > Licenses > Import License). For more informaon about installing a

valid license for Junos Space Plaorm, see the Generang and Uploading the Junos Space License

Key File topic (in the

Junos Space Network Management Plaorm

Workspaces Feature Guide).

Exporng the License Inventory

The Device License Inventory feature enables you to display the currently installed license inventory

informaon for all DMI schema-based devices under Junos Space Network Management Plaorm

management.

The license inventory is generated when the device is rst discovered and synchronized in Junos Space

Network Management Plaorm.

The licenses used by all Juniper Networks devices are based on SKUs, which represent lists of features.

Each license includes a list of features that the license enables and informaon about those features.

Somemes the license informaon also includes the inventory keys of hardware or soware elements

upon which the license can be installed.

To view the license(s) for Junos Space Network Management Plaorm itself, see Viewing Junos Space

Licenses.

This topic also covers:

• Absence of license

• Trial informaon

• Count-down informaon

• Date-based informaon

DMI enables each device family to maintain its own license catalog in the DMI Update Repository. The

license catalog is a at list of all the licenses used by a device family. The key for a license element is its

SKU name. Each license element in the catalog includes a list of features that the license enables and

informaon about each feature (that is, its name and value). Oponally, the license element can also list

the inventory keys of hardware or soware elements and where it can be installed.

If the license inventory on the device is changed, the result depends on whether the network is the

system of record or Junos Space Network Management Plaorm is the system of record. See Systems of

Record in Junos Space Overview.

If the network is a system of record, Junos Space Network Management Plaorm automacally

synchronizes with the managed device. You can also manually resynchronize the Junos Space Network

170

Management Plaorm license database with the device by using the Resynchronize with Network

acon. See Resynchronizing Managed Devices with the Network.

If Junos Space Network Management Plaorm is the system of record, neither automac nor manual

resynchronizaon is available.

Viewing device license inventory does not include pushing license keys to devices. You can, however,

push licenses with the Conguraon Editor to any device that has license keys in its conguraon. You

can export device license inventory informaon to a CSV le for use in other applicaons.

License inventory informaon shows individually installed licenses as well as a license usage summary,

with stascs for various features.

To export the license inventory for a device:

1. On the Network Management Plaorm user interface, select Devices > Device Management.

The Device Management page displays the devices managed in Junos Space Network Management

Plaorm.

2. Select Device Inventory > View License Inventory from the Acons menu.

Need Counts in red indicate violaons. In other words, entries in red indicate that you are using

features that you are not licensed to use. You may also encounter the message that you have no

licenses installed.

3. (Oponal) View the list of licensed features for the selected license by double-clicking a license usage

summary or clicking on the forward acon icon to the le of a license usage summary.

4. (Oponal) Click Return to Inventory View at the top of the inventory page.

5. (Oponal) Click Export at the top of the inventory page, to export the license inventory informaon.

The Export Device License Informaon dialog box appears, displaying a link: Download license le for

selected device (CSV format).

6. (Oponal) Click the download link.

The Opening Device License-

xxxxxx

CSV dialog box appears, where

xxxxxx

represents a number.

7. Open the le with an applicaon of your choice or download the le by clicking Save.

Exporng device license informaon generates an audit log entry.

171

Table 93: License Usage Summary Fields

Field Descripon

Feature name Name of the licensed SKU or feature. It can be used to look up the license with

Juniper Networks. Not all devices support this.

License count Number of mes an item has been licensed. This value may have contribuons from

more than one licensed SKU or feature. Alternavely, it may be 1, no maer how

many mes it has been licensed.

Used count Number of mes the feature is used. For some types of licenses, the license count

will be 1, no maer how many mes it is used. For capacity-based licensable items,

if infringement is supported, the license count may exceed the given count, which

has a corresponding eect on the need count.

Need count Number of mes the feature is used without a license. Not all devices can provide

this informaon.

Given count Number of instances of the feature that are provided by default.

Table 94: License Feature or SKU Fields

Field Descripon

Feature Name Name of the licensed SKU or feature. It can be used to look up the license with

Juniper Networks. Not all devices support this.

Validity Type The SKU or feature is considered permanent if it is not trial, count-down, or data-

based.

Table 95: Addional Fields in CSV Files

Field Descripon

State Status of the license: valid, invalid, or expired. Only licenses marked as valid are

considered when calculang the license count.

172

Table 95: Addional Fields in CSV Files

(Connued)

Field Descripon

Version Version of the license.

Type Permanent, trial, and so on.

Start Date Licensed feature starng date.

End Date Licensed feature ending date.

Time Remaining Licensed feature me remaining.

Juniper Connected Security for VMware NSX Licensing

VMware NSX is VMware’s network virtualizaon plaorm for the Soware Dened Data Center

(SDDC). You can add the vSRX Virtual Firewall Virtual Services Gateway as a partner security service in

the VMware NSX environment. The vSRX Virtual Firewall security service is managed by the Junos

Space Security Director and VMware NSX Manager to deliver a complete and integrated virtual security

soluon for your SDDC environment. The vSRX Virtual Firewall provides advanced security services

(Layer 7 services), including intrusion detecon and prevenon (IDP), and applicaon control and

visibility services through AppSecure.

The Juniper Connected Security for VMware NSX licensing includes support for Juniper’s virtual rewall

(vSRX Virtual Firewall), Network Security services (AppSecure, IDP) and the Juniper Connected Security

and Security Management soluons (Policy Enforcer and Security Director) for VMware NSX-based

private cloud advanced security.

Juniper Connected Security for VMware NSX Advanced Security Licenses

The Juniper Connected Security for NSX Advanced Security (ADS) licenses that are available from

Juniper Networks provide entlement for protecon of one physical CPU socket, with one vSRX Virtual

Firewall instance key provided for each license. Typically, a VMware ESXi server has mulple CPU

sockets, and each CPU socket has mulple cores.

All Juniper Connected Security for NSX ADS licenses have an associated me duraon; you purchase

licenses as subscripon based for a 1-year, 3-year, or 5-year duraon.

A Juniper Connected Security for NSX ADS license cannot be purchased as a perpetual (never expire)

license. Each license is only available on a subscripon basis.

173

Each license includes support for the following:

• Juniper vSRX Virtual Firewall Series Virtual Services Gateway, including:

• Stateful L3-L4 rewall

• Advanced Applicaon Security (ASEC) features (such as AppID, AppFW, AppQoS, and AppTrack)

• Intrusion Detecon and Prevenon (IDP)

• Juniper Security Management soluons, including:

• Junos Space Security Director

• Juniper Connected Security Policy Enforcer

The licenses available in the Juniper Connected Security for VMware NSX ADS licensing model are

based on SKUs which represent the terms of subscripon and the supported features.

Table 96: Juniper Connected Security for VMware NSX ADS Licensing Packages

License Model

Number

Descripon

JNSX-ADS-1-1Y Juniper Connected Security for NSX Advanced Security with vSRX Virtual Firewall for 1

physical CPU socket - 1 Year Subscripon

The 1-year subscripon license includes support for Security Director, Policy Enforcer, 1 vSRX

Virtual Firewall entlement for 1 physical CPU socket protecon with AppSecure and IDP

feature support

JNSX-ADS-1-3Y Juniper Connected Security for NSX Advanced Security with vSRX Virtual Firewall for 1

physical CPU socket - 3-year Subscripon

The 3-year subscripon license includes support for Security Director, Policy Enforcer, 1 vSRX

Virtual Firewall entlement for 1 physical CPU socket protecon with AppSecure and IDP

feature support

JNSX-ADS-1-5Y Juniper Connected Security for NSX Advanced Security with vSRX Virtual Firewall for 1

physical CPU socket - 5 Year Subscripon

The 5-year subscripon license includes support for Security Director, Policy Enforcer, 1 vSRX

Virtual Firewall entlement for 1 physical CPU socket protecon with AppSecure and IDP

feature support

174

License Duraon

The Juniper Connected Security for NSX ADS license model is subscripon based. A subscripon license

is an annual license that allows you to use the licensed soware for the matching duraon. Subscripons

might involve periodic downloads of content (such as for IDP threat signature les). At the end of the

license period, you need to renew the license to connue using it.

Subscripon licenses start when you retrieve the license key or 30 days aer purchase if you have not

retrieved the license key. All subscripon licenses are renewable.

License Procurement and Installaon

To enable a Juniper Connected Security for NSX ADS license, you must purchase, install, and manage

the license key that corresponds to the specic terms of each license. The presence of the appropriate

soware unlocking key on your virtual instance allows you to congure and use that license.

Licenses are usually ordered when the soware applicaon is purchased, and this informaon is bound

to a customer ID. If you did not order the licenses when you purchased your soware applicaon,

contact your account team or Juniper Networks Customer Care for assistance. Licenses can be procured

from the Juniper Networks License Management System (LMS).

From the Junos Space Security Director, you discover the NSX Manager and perform service registraon

of the vSRX Virtual Firewall VM with the NSX Manager. The NSX Manager is added as a device in

Security Director and its inventory is synchronized with Security Director. Discovering the NSX Manager

and registering vSRX Virtual Firewall as a security service in Security Director are described in detail in

Deploying the vSRX as an Advanced Security Service in a VMware NSX Environment.

As part of the service registraon procedure, in the Service Manager Registraon secon of the Add

NSX Manager page, you enter the license key.

175

Figure 4: Service Manager Registraon: Entering the License Key

Example: Content Security License Acvaon Video

Use the License Acvaon video for a walkthrough of license acvaon and basic management using

the J-Web.

Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper

Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered

marks, or registered service marks are the property of their respecve owners. Juniper Networks assumes

no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change,

176