LICENSEWARE
Contribute

Juniper vSRX and cSRX licensing

From the LICENSEWARE WikiLast edited 11 ReferencesCited

This article is about licensing Juniper's virtual and containerized network software: vSRX Virtual Firewall, cSRX Container Firewall, cRPD containerized routing and the Juniper Secure Connect remote access licences they use. Hardware SRX firewalls are covered in Juniper Flex and Junos feature licensing. It is not legal advice.

On This Page

Juniper vSRX and cSRX licensing covers Juniper’s firewall and routing software for hypervisors, public clouds and containers. vSRX Virtual Firewall runs as a virtual machine, cSRX as a container, and cRPD is the containerized Junos routing daemon.[1][2][3] All three belong to the “virtual and cloud platforms” group of the Juniper Flex model.[5] In that group every tier, including Standard, is a subscription.[6] vSRX is licensed per instance at a fixed vCPU size. cSRX is licensed by tier. cRPD is licensed in bundles of instances or by routing-table and forwarding capacity.[1][2][3] Remote access VPN on vSRX is licensed separately by concurrent users.[4]

Editions

vSRX Virtual Firewall

vSRX Flex SKUs follow the pattern S-VSRX-2C/5C/9C/17C-S/A1/A2/A3/P1/P2/P3-1/3/5. In it, nC is the number of vCPUs, the letter and digit give the tier, and the final digit gives the subscription term in years.[1]

Tier Use case (vendor description) Security content 
Standard Standard firewall and secure branch routers Firewall, NAT, site-to-site VPN, routing (BGP, OSPF, MPLS), CoS, management[1] 
Advanced 1 Data center security Standard plus IPS and application security[1] 
Advanced 2 Next-generation firewall with cloud-based antivirus Sophos antivirus, web filtering, antispam, content filtering[1] 
Advanced 3 Next-generation firewall with on-box antivirus Avira antivirus, web filtering, antispam, content filtering[1] 
Premium 1 to 3 As Advanced 1 to 3 Adds Juniper ATP Cloud[1] 

Advanced 3 and Premium 3 are supported only on vSRX3.0.[1] The SKU table lists them only in the 5, 9 and 17 vCPU sizes.[1]

cSRX Container Firewall

cSRX supports only subscription licences. The SKUs are S-CSRX-S/A1/A2-1/3/5.[2] Standard covers the standard firewall and includes Containerized RPD Advanced. Advanced 1 adds IDP and application signatures for data center security. Advanced 2 adds antispam, Sophos antivirus and Enhanced Web Filtering for next-generation firewalling.[2] A Secure Cell Site Router variant, S-SCSR-1G/5G/10G/20G-S-1/3/5, is sold by throughput.[2] Catalog row: cSRX Flex subscription.

cRPD

cRPD licences come in three shapes.[3]

  • Host routing. Bundles of 10, 25, 50, 100, 1K or 10K instances, in the Standard or Advanced tier (S-CRPD-…-A/S-HR).
  • Route reflector. Sold by routing table capacity of 4 million routes, 10 million routes or no limit (S-CRPD-4M/10M/NL-A-RR).
  • Performant forwarding. Sold by data-plane throughput of 10 to 100 Gbps (S-CRPD-…-A1-PF).

Standard covers BGP, IS-IS, OSPF, telemetry and automation with limited BGP peers, up to a 4 million-route RIB. Advanced adds enhanced MPLS and BGP sharding, with no specified limit on peers, ECMP or RIB scale.[3] Catalog row: cRPD host routing subscription.

Legacy vSRX licences

Earlier vSRX licences were built on application packages combined with throughput tiers.[1]

  • Cloud packages. Throughput of 1, 2 or 4 Gbps in STD, ASCB, CSB and ATP-B packages.
  • Contrail, KVM, Hyper-V and VMware packages. Throughput from 100 Mbps to 20 Gbps in STD, ASCB/ASECB and CS-B packages, with à la carte antivirus, web filtering and AppSecure add-ons.
  • Remote access. Legacy remote access packs (VSRX-RA1) of 5 to 500 concurrent users.

Metrics

  • vCPU (vSRX). SKUs are sized at 2, 5, 9 or 17 vCPUs. The licence tables also name a 32-vCPU size.[1] In public cloud, pricing is “based on the number of vCPU cores, with a minimum of 2 vCPU cores”.[1]
  • Instance (cRPD). Host-routing SKUs are bundles of instances.[3] The November 2020 EULA defines an Instance as “each time the Software runs on any device”.[8]
  • Bandwidth (Gbps). Legacy vSRX throughput and cRPD performant forwarding are sold by throughput.[1][3]
  • Concurrent user (Secure Connect). Juniper Secure Connect on vSRX is sold in packs of 5 to 500 concurrent users (S-RA3-xCCU-S).[4]

Counting / floors

One size per instance (as retrieved 2026-09-30). A vSRX Flex licence applies to one instance at the vCPU size in the SKU. The retrieved pages publish no rule for combining two smaller vCPU licences on a single larger instance. For legacy throughput licences, stacking is explicitly allowed. For example, a 3 Gbps STD instance can be licensed with a 1G licence plus a 2G licence. A throughput licence cannot be split across multiple instances.[1] Catalog proof: Throughput licences stack on one instance and cannot be split.

Scale quantities. When a licence includes a scale component, such as bandwidth or CPU cores, the JAL portal can activate several units at once. It then issues a single key that contains the combined scale.[10] Software licence keys are not tied to the serial number of the product they are used on.[10]

Remote access. vSRX includes two concurrent Secure Connect users. Additional users need licence keys.[4] Catalog proof: SRX and vSRX include two concurrent remote access users.

cRPD key regeneration. From Junos OS 23.2R1, cRPD uses a new licence management system. Keys must be regenerated before upgrading, because keys from the older system will not work.[3] Catalog proof: cRPD licence keys must be regenerated for Junos OS 23.2R1 and later.

Floors. The only published floor is the 2-vCPU minimum in public cloud.[1] cRPD host-routing bundles start at 10 instances.[3]

Virtualization & partitioning

vSRX perpetual licences, which are still found in older estates, are not portable. They are tied to the node or platform they run on, “cannot be moved to a cloud environment”, and can be used only on that x86 hardware until it reaches end of life. Any deployment on a new server needs new vSRX SKUs.[1] Subscriptions do not carry this restriction. Juniper subscriptions are portable across like-device classes, and software licence keys are not tied to a product serial number.[5][10] The retrieved documents give no host-based or hypervisor-level licensing option. They also say nothing about counting vSRX by physical host cores, so each running instance is licensed at its own vCPU size.[1] Both the November 2020 EULA and the JPLA allow copies only as reasonably needed for archival purposes. The EULA adds that archival and cold back-up copies are allowed but failover or warm back-up copies are not.[8][9] Catalog proof: vSRX perpetual licences cannot move to a cloud or a new server.

Cloud / BYOL

For public cloud, vSRX supports two models: Pay-As-You-Go (PAYG) and Bring Your Own License (BYOL).[1] The retrieved page does not say how PAYG is billed. Oracle Cloud Infrastructure supports BYOL, and BYOL licences can be bought from Juniper or an authorized reseller.[1] Under the November 2020 EULA, software reached through a commercial cloud provider acting as an Authorized Reseller may be used only as the instances provisioned in that cloud environment.[8] When vSRX is managed from Mist, WAN Assurance is sold per vSRX class: C2 for 2 cores, C3 for 5, C4 for 9 and C5 for 17. Marvis for WAN uses the same classes.[7] Catalog proof: vSRX public cloud: PAYG or BYOL priced per vCPU, minimum 2.

Programs

  • Trials. Trial or evaluation licence keys are available for vSRX, cRPD and cSRX.[5]
  • Migration. Moving from a legacy licence SKU to a Flex SKU is possible only when a subscription is renewed. Moving from an on-premise product to a cloud-hosted SaaS service counts as a new purchase.[11] Catalog proof: Legacy to Flex migration and co-terming only at renewal.

Out of scope

  • Cloud marketplace pricing and marketplace end-user terms for PAYG listings.
  • vMX and other virtual routers, Juniper Cloud Workload Protection and Security Director Cloud, which have their own licensing pages.
  • Hardware SRX Series firewalls.

References

  1. Software Licenses for vSRX Virtual FirewallPage undated. Catalog: Software Licenses for vSRX Virtual FirewallRetrieved 2026-09-30.
  2. Software Licenses for cSRXPage undated. Catalog: Software Licenses for cSRXRetrieved 2026-09-30.
  3. Software Licenses for cRPDPage undated. Catalog: Software Licenses for cRPDRetrieved 2026-09-30.
  4. Legacy Licenses for Juniper Secure ConnectPage undated. Catalog: Legacy Licenses for Juniper Secure ConnectRetrieved 2026-09-30.
  5. Juniper Software License Model OverviewPage undated. Catalog: Juniper Software License Model OverviewRetrieved 2026-09-30.
  6. Juniper Flex Three-Tier License ModelPage undated. Catalog: Juniper Flex Three-Tier License ModelRetrieved 2026-09-30.
  7. Subscription Types for Juniper MistWAN Assurance for vSRX. Page undated. Catalog: Subscription Types for Juniper MistRetrieved 2026-09-30.
  8. Juniper Networks End User License Agreement (November 2020 Release)Catalog: Juniper Networks End User License Agreement (November 2020 Release)Effective 2020-11-01. Retrieved 2026-09-30.
  9. Juniper Purchase and License Agreement 2024Catalog: Juniper Purchase and License Agreement 2024Retrieved 2026-09-30.
  10. Activate Licenses for Juniper Software ProductsPage undated.Retrieved 2026-09-30.
  11. Upgrade Juniper License Keys During Software UpgradesPage undated. Catalog: Upgrade Juniper License Keys During Software UpgradesRetrieved 2026-09-30.

See also

Catalog Rows Cited

4SKUs4Metrics6Rules

Esc