Perimeter, inspection, event management, central policy, remote access, endpoint and admission control is most of a security program. Buying it as one platform is a different decision from buying a firewall, and it was made that way deliberately.
An SRX 3600 cluster sat at the core with redundant Ethernet groups into the Catalyst VSS pair. An IDP 8200 intrusion prevention pair ran inline with smaller sensors distributed behind it, an STRM 5000 collected security event data from both, and Network and Security Manager pushed intrusion and application rulebases centrally. An SA 6500 SSL VPN pair carried remote access and an IC 6500 Infranet Controller carried network access control, with Junos Pulse and Odyssey on the endpoint including iOS clients from 2011. The branch estate ran from the SRX 650 down to the SRX 100, including the pair on the Florida LambdaRail internet edge.
Inline insertion of the sensors was engineered with external hardware bypass units on the cluster path rather than trusting the appliance to fail safely on its own. By 2015 twenty-six separate equipment line items were carried under a single annual maintenance agreement.
The instrument came before the answer
The 2009 selection was decided on an Enterprise Security Manufacturer Category Scoring Matrix and a category list written here — the same instrument first built to rank capital funding requests the year before — circulated with the Gartner Magic Quadrant for enterprise network firewalls ahead of a three-way evaluation of Cisco, Juniper and Check Point in June 2009: revision 2 on the 5th, “Final” on the 8th, the PDF package out on the 8th and the 10th. The workbook it was scored in had been created that March and went on to decide four more things over the following fourteen years. The incumbent and the platform being displaced were scored on the same sheet as the eventual winner, against criteria written before anyone knew which way the numbers would fall.
Vendor neutrality is not a claim about intent. It is a property of the instrument, and the only way to demonstrate it afterward is to have written the criteria down first.
Holding the design position against the manufacturer
When the cluster would not behave as drawn, Juniper’s systems engineer acknowledged that the original design discussions had never covered Layer 2 switching on the SRX in cluster mode, and apologized for not having raised the limitation.
The answer given was that aggregate interfaces inside a redundant Ethernet group had been unsupported until the code release that shipped the previous Friday — so no version of the platform had existed against which the design could have been drawn differently — and that a manufacturer needs to bring its clustering limitations to the table before describing what the platform can do. The design had come from inside the department, and the vendor put that in writing.
Implementation labor came from a systems integrator, and the manufacturer supplied support, classroom training and demonstration units. Neither of them authored the architecture.
What holds the boundary when the appliance holding it is gone
A core intrusion prevention hardware failure in January 2016 took both core sensors out in a single night, and the separation between the Public Defender, the state criminal justice network and the State Attorney had to be re-landed on switch access control lists before the building opened. The exception change order and the notice that went with it were written here.
The lesson was applied to every security platform afterward: know in advance what holds the boundary when the appliance holding it is gone, because you find out either way.
Taking it down
The platform was retired in stages across five years, on a plan the same team wrote. Remote access users moved to Palo Alto Networks GlobalProtect and the Clerk of Courts appliance connections migrated in the same program. Then internal routing, the Head Start program’s virtual private network and the cellular access point names moved across in September 2021; the cluster was powered off on the twenty-second, and the chassis, the SSL VPN pair and the event manager came out of the data center on the twenty-ninth.
Standing a platform up and taking it down are the same skill separated by a decade, and the second one is where the dependencies nobody documented finally surface.
Outcome
Most of a security program bought as one platform and run in-house for twelve years — then taken down deliberately, which is where the undocumented dependencies finally surface.