Juniper J2320 Specifications page 4

Protocol (VRRP), all dynamic flow and session information is
lost and must be reestablished in the event of a failover. Some
or all applications sessions will have to restart depending on the
convergence time of the links or nodes. By maintaining state,
not only is the session preserved, but security is intact. In an
unstable network, this active/active configuration also mitigates
link flapping affecting session performance.
Session-Based Forwarding Without the Performance Hit
In order to optimize the throughput and latency of the combined
router and firewall, JUNOS implements session-based
forwarding, an innovation that combines the session state
information of a traditional firewall and the next-hop forwarding
of a classic router into a single operation. With JUNOS, a
session that is permitted by the forwarding policy is added to
the forwarding table along with a pointer to the next-hop route.
Established sessions have a single table lookup to verify that
the session has been permitted and to find the next hop. This
efficient algorithm improves throughput and lowers latency
for session traffic when compared with a classic router that
performs multiple table lookups to verify session information and
then to find a next-hop route.
SMALL OFFICE
Mobile SRX210
DSL
LARGE OFFICE
EX4200 EX3200
EX4200-24T
4
FIXED MOBILE SITE
(Mobile – 3G)
Cellular
POP
J4350
J6350
PBX
HQ
Figure 4: The distributed enterprise
Figure 3 shows the session-based forwarding algorithm. When
a new session is established, the session-based architecture
within JUNOS verifies that the session is allowed by the
forwarding policies. If the session is allowed, JUNOS will look
up the next-hop route in the routing table. It then inserts the
session and the next-hop route into the session and forwarding
table and forwards the packet. Subsequent packets for the
established session require a single table lookup in the session
and forwarding table, and are forwarded to the egress interface.
Session Initial
Packet Processing
Session and
Forwarding Table
Ingress
Interface
Figure 3: Session-based forwarding algorithm
SRX210
Wireless
Service Provider
SIP Softswitch
PSTN
POP
EX3200-24P
J2350
Fax
BRANCH
Security Policy Evaluation
and Next-Hop Lookup
Table
Update
Forwarding for
Permitted Traffic
Disallowed by
Policy: Dropped
INTERNET
Service Provider
SIP Softswitch
PSTN
POP
SRX210
Fax
BRANCH
Egress
Interface