Juniper Flex and Junos feature licensing is the set of rules for turning on licensed Junos OS features on Juniper hardware: SRX Series firewalls, EX and QFX Series switches, and MX and PTX Series routers. The hardware ships with the Standard tier. Additional features and scale come from Advanced and Premium tier licences, which are sold as perpetual licences tied to a chassis or as subscriptions.[1][2] The unit counted depends on the product family. SRX tiers are licensed per device, EX tiers per device class (defined by port count), and MX and PTX tiers per unit of bandwidth.[7][4][5] Older hardware and releases still use pre-Flex licences such as EFL, AFL and PFL. The licensing guide documents both schemes side by side.[4][12]
Editions
Juniper sells three tiers. Each higher tier includes every feature of the tiers below it.[2]
| Family | Tiers sold | Term | SKU pattern |
|---|---|---|---|
| SRX300 to SRX5800 | Standard (Junos Software Base, with hardware); Advanced 1 to 3; Premium 1 to 3 | Subscription 1, 3 or 5 years; next-generation SKUs 1, 3, 5 or 7 years[7] | S-SRX…-A1/A2/A3/P1/P2/P3-1/3/5[7] |
| SRX1500 to SRX4600 DP/EP | Data Protection and Edge Protection A1, A2, P1, P2 | Subscription[8] | S-SRX…DP/EP-A1/A2/P1/P2-1/3/5 |
| EX switches | Standard (with hardware); Advanced; Premium | Perpetual standalone; subscriptions only in bundles[4] | S-EX-A/P-C1/C2/C3-P[4] |
| MX routers | Standard; Advanced 1; Premium 1 | Subscription 1, 3, 5 or 7 years, or perpetual[5] | S-MX-nCm-A1/P1-1/3/5/7/P[5] |
| PTX routers | Advanced 1 and 2; Premium 1 to 3 | Subscription 1, 3 or 5 years, or perpetual (structure used before September 2025)[13] | S-PTX-800G/72C/144C/288C-… |
The numbered tiers on SRX differ in the security services they bundle. Advanced 1 covers IDP, application security and SecIntel. Advanced 2 adds URL filtering and cloud antivirus and antispam, while Advanced 3 uses on-box antivirus instead. Premium 1 to 3 add ATP Cloud to the matching Advanced tier.[8] Not every tier is sold for every model. For example, the SRX300 and SRX320 have no Premium 2 tier.[7] On MX, the Advanced tier covers transport features such as IGP, BGP peering, MPLS, EVPN and telemetry, up to 32 IP VPNs. Premium adds high-scale IP VPNs, SRv6 and SRm6 fabrics, and inline NAT. Subscriber management (BNG and CUPS) needs a separate licence on top of Premium.[6]
Metrics
- Device (chassis serial number). A perpetual licence is a “Chassis-based license tied to the serial number of the device”.[1] Legacy SRX feature licences are each tied to one software feature and are valid for one device.[8]
- Device class (switch port count). EX Flex SKUs carry a device class. Class 1 is 12 ports or fewer, Class 2 is 24 ports, and Class 3 is 32 or 48 ports.[4]
- Bandwidth (Gbps). MX Flex SKUs express bandwidth as nCm, where n is the number of 100G units and m the number of 10G units. The Advanced and Premium bandwidth features run from 10G to 9600G.[5] PTX SKUs are sized from 800 Gbps to 28.8 Tbps.[13] MACsec on MX is licensed separately as 100G, 400G or 480G perpetual bandwidth licences.[6]
- Logical system or tenant system and Concurrent user. These are add-on counts on SRX, for multitenancy and for Juniper Secure Connect remote access.[8][15]
Counting / floors
Portability. A perpetual licence stays on its chassis. The only exception is an RMA replacement.[1] A subscription can be moved, but only between like-device classes. Juniper’s example is moving a BGP feature licence between two devices of the same class.[1] Catalog proof: Perpetual licences are tied to the chassis serial number; Subscription licences are portable across like-device classes.
EX Virtual Chassis. The Virtual Chassis capability needs no licence of its own. However, each member switch of a Virtual Chassis that uses Advanced or Premium features needs its own licence key, and all members need the same licences. A four-member Virtual Chassis therefore needs four licences.[4] Catalog proof: EX Virtual Chassis needs a tier licence in every member.
SRX chassis clusters. A chassis cluster needs no separate licence. Each licensed feature, however, needs one licence per feature per device, installed on both nodes. If the two nodes hold different licences, a feature may stop working after failover.[8] Catalog proof: SRX chassis cluster needs identical licences on both nodes.
Logical and tenant systems. From Junos OS 18.3R1, an SRX that runs logical or tenant systems includes three licences: one for the primary logical system and two for user-defined systems. A commit fails if more systems are configured than licences are held. In a chassis cluster, each node needs the same number of licences.[8] The same page states that from Junos OS 20.3R3, 20.4R2, 21.1R2 and 21.2R1 these features can be used without a licence.[8] The applicable rule therefore depends on the release running on the device. Catalog proof: SRX logical system licences count per node.
MX MACsec. The installed MACsec bandwidth licences must be at least the configured bandwidth of MACsec-enabled ports. Some older line cards only track usage and raise no alarms. Newer cards raise commit warnings and alarms.[6] Catalog proof: MX MACsec bandwidth licences must cover configured MACsec ports.
Remote access. SRX and vSRX include two concurrent Secure Connect users. Additional users are bought as packs of 5 to 5,000 concurrent users, or as SRX300-line device SKUs with fixed counts.[15] Catalog proof: SRX and vSRX include two concurrent remote access users.
Enforcement. Juniper licences use soft enforcement by default.[3] The legacy QFX licensing page describes what that means in practice. An unlicensed feature commits and can be used, and the switch logs messages that it is licensable, “but this action violates EULA agreement”.[12] Junos OS raises alarms when capacity features such as bandwidth are used beyond the installed licence.[14] Catalog proof: Soft enforcement is the default for Juniper licences.
Floors. No general minimum is published. Under Scale on Demand, some hardware products require a minimum amount of software to be bought.[9]
Virtualization & partitioning
Juniper hardware is not licensed by processor or core, so the hard and soft partitioning rules of processor and core licensing do not apply. Partitioning inside a device (logical and tenant systems) and multi-chassis designs (Virtual Chassis, chassis cluster) are each counted per chassis, as described above.[4][8] Operating system software included with a hardware purchase may be used only on that hardware or a replacement.[11] Virtual platforms are covered in Juniper vSRX and cSRX licensing.
Cloud / BYOL
Hardware feature licences have no cloud or BYOL mapping. When EX switches are managed from the Mist cloud, Flex term subscriptions bundle Wired Assurance, Marvis and the Junos Advanced or Premium features. Adding the subscription in the Mist portal activates the Junos tier on the switch automatically.[16] See Juniper Mist AI subscriptions.
Programs
- Juniper Flex. Tier changes count as new purchases. Moving from a legacy SKU to a Flex SKU, and co-terming, are possible only at subscription renewal.[10] Catalog proof: Changing tier, licence type or delivery model is a new purchase; Legacy to Flex migration and co-terming only at renewal.
- Scale on Demand (terms dated November 2023). Scale on Demand was formerly called Pay as You Grow (PAYG). It sells Advanced or Premium capacity at a price in proportion to current capacity needs.[3] MX publishes separate Scale on Demand SKUs (S-MX-1C, S-MX-1X, and S-MX-4C-…-D on MX10K) alongside the full-bandwidth SKUs.[5] If more capacity is used than has been bought, the extra capacity must be purchased within 90 days. There are no partial purchases, credits or refunds.[9] Licence tracking must be deployed within 90 days, and Juniper may audit quarterly. Audit costs shift to the customer if actual use exceeds reported use by more than 5%.[9] Catalog proof: Scale on Demand: buy extra capacity within 90 days of use; Scale on Demand: quarterly audit and 5% cost-shifting.
Licence keys and renewals
Junos devices take licence keys through configuration mode, operational mode or RPC. They can also fetch keys automatically: for hardware the lookup uses the chassis serial number, and for virtual products the software serial number. By default, auto-update renews 60 days before expiry.[14] A software upgrade does not normally need a new key. When it does, the release notes say so, and the new key comes from the Upgrade function in the JAL portal.[10] Content Security features such as antivirus and Enhanced Web Filtering do not work until a licence is installed. The application signature subscription can keep using the signatures already stored on the device after it expires.[8]
Out of scope
- Feature lists for individual releases, which are in the Feature Explorer.
- ACX, NFX, QFX Flex, PTX after September 2025, subscriber services, coherent optics and security director products, which have their own pages in the licensing guide.
- Hardware, support contracts and prices.