Juniper vSRX: Firewall and Router Ledger 2026 Scorecard

Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product (subscription)
Owner: Hewlett Packard Enterprise (public, NYSE: HPE) since 2025-07-02; the acquisition of Juniper Networks was announced 2024-01-09 and closed after a US Department of Justice settlement
Licence: Proprietary. Junos Flex Software subscriptions for vSRX 3.0 since Junos 21.1R1: tiers Standard, Advanced 1 to 3 and Premium 1 to 3, priced per vCPU (sizes 2, 5, 9, 17 and 32) for 1, 3 or 5 year terms; PAYG and BYOL in public clouds. No public price; a 60 day trial is reported but was not confirmed
Latest release: Junos OS 25.4R1 (2025-12-22 per a third-party tracker; Juniper's document date is 2026-09-24); 25.2R1 and 24.4R1 remain current trains
Support lifecycle: Junos trains get about three years; 24.4 is an extended end-of-engineering release with end of engineering 2029-12-29 and end of support 2030-06-29. Official dates for 25.2 and 25.4 were not found. Junos 22.4 was the last release for vSRX 2.0, so vSRX 3.0 is the only line
Next milestone: none published with a date
Hypervisors: VMware ESXi, KVM, Microsoft Hyper-V and Nutanix AHV, with SR-IOV on KVM and ESXi; clouds AWS, Azure and Google Cloud. The hypervisor tables date from the 19.x era, so current ESXi 8 and Hyper-V versions were not verified. Proxmox VE, XCP-ng and ARM are not listed
Security record: Three SRX entries on the CISA KEV catalogue since 2023, all J-Web flaws added 2023-11-13: CVE-2023-36845, CVE-2023-36846 and CVE-2023-36851. Counted separately: CVE-2023-36844 and CVE-2023-36847 (EX Series, same date) and CVE-2025-21590 (2025-03-13, Junos OS improper isolation, MX Series per the advisory). Advisories: https://supportportal.juniper.net/s/ (security advisories)
Tier: Enterprise virtual appliance
Archetype: Dependable builder under a new owner
Evidence grade: C. The HPE closing press release, the vSRX licensing guide, the vSRX hypervisor tables, the Junos end-of-life page and the CISA KEV catalogue were read from primary sources. Release dates conflict between Juniper document dates and third-party trackers, the vSRX feature sections of the 24.4 to 25.4 release notes were not read, and feature content before 2023 is attributed from secondary sources.

Scorecard

Dimension	Score	Direction
Capability today	75.6 / 100	higher is better
Momentum since end of 2022	-3.0 points (2015 to 2022: +12.4)	higher is better
Credibility	15.5 / 25	higher is better
Commercial risk	15.0 / 25	lower is better
Technical lock-in	12.0 / 25	lower is better
Integrator fit	15.0 / 20	higher is better
AI leverage	5.0 / 20	higher is better
Ledger Index	58.1 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Routing and WAN (12)	3.5	4	4.5	4.5
Firewall and NAT core (12)	3.5	4	4	4
VPN and remote access (12)	3.5	4	4	4
Threat protection (12)	3	4	4	4
Network services (8)	2.5	3	3	3
Platform and hypervisor freedom (10)	2.5	3.5	3.5	3.5
High availability and performance (8)	3.5	3.5	4	4
Management, API and automation (10)	4	4	4.5	4.5
Observability (6)	3.5	3.5	4	4
Platform security and lifecycle (10)	3.5	3.5	3.5	2
Total / 100	66.2	75.0	78.6	75.6

Year by year: 2015: 66.2 · 2016: 66.2 · 2017: 68.6 · 2018: 68.6 · 2019: 75.0 · 2020: 75.0 · 2021: 76.6 · 2022: 78.6 · 2023: 75.6 · 2024: 75.6 · 2025: 75.6 · 2026: 75.6

What moved the score

Year	Domain	Change	Points	Trigger
2017	Firewall and NAT core	3.5 → 4	+1.2	17.x: AppSecure application firewall and integrated user firewall, policy hit counts; no shared policy objects without Security Director
2017	Threat protection	3 → 3.5	+1.2	17.x: Sky ATP cloud sandbox
2019	Network services	2.5 → 3	+0.8	19.x: captive portal for the user firewall beside DHCP, DNS proxy and RADIUS; no DHCP failover, DNS over TLS or voucher portal
2019	Platform and hypervisor freedom	2.5 → 3.5	+2.0	19.1R1 and 19.3R1: vSRX 3.0 on KVM, ESXi, Hyper-V, Nutanix, AWS, Azure and GCP with SR-IOV; no ARM, Proxmox VE or XCP-ng
2019	Routing and WAN	3.5 → 4	+1.2	19.x: vSRX 3.0 with advanced policy-based routing and application-aware path selection with probes
2019	Threat protection	3.5 → 4	+1.2	19.x: ATP Cloud with SecIntel feeds and SSL proxy on vSRX 3.0; no sandboxing on the appliance itself
2019	VPN and remote access	3.5 → 4	+1.2	By 19.x: Auto Discovery VPN dynamic mesh, and remote access through Juniper Secure Connect with RADIUS MFA (dating inferred)
2021	Management, API and automation	4 → 4.5	+1.0	Security Director Cloud and the junipernetworks.junos Ansible collection; Terraform provider is community maintained
2021	Observability	3.5 → 4	+0.6	Security Director Cloud dashboards and Junos streaming telemetry; packet capture from the CLI
2022	High availability and performance	3.5 → 4	+0.8	By 22.4: Multinode High Availability beside chassis clusters; throughput scales with the vCPU tier
2022	Routing and WAN	4 → 4.5	+1.2	By 22.4: full BGP and OSPF policy language, VRFs, APBR with SLA probes and limited MPLS on vSRX; no EVPN or segment routing on the virtual firewall
2023	Platform security and lifecycle	3.5 → 2	-3.0	2023: three KEV entries, CVE-2023-36845, CVE-2023-36846 and CVE-2023-36851 (all 2023-11-13, J-Web); score lowered 1.5 (cap)

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-11	Three SRX J-Web flaws added to the KEV catalogue	Security and lifecycle	C
2024-01	HPE announces the acquisition of Juniper Networks	Packaging	P
2025-02	Junos end-of-life page names 24.4 as an extended end-of-engineering release to 2029-12-29	Security and lifecycle	C
2025-03	CVE-2025-21590 Junos OS improper isolation added to the KEV catalogue	Security and lifecycle	C
2025-06	Junos 25.2R1 (feature items not read)	Routing	U
2025-07	HPE closes the acquisition; Juniper stock stops trading	Packaging	P
2025-12	Junos 25.4R1 (feature items not read)	Routing	U
2025-12	Open-source Junos MCP server published on GitHub; Routing Director 2.8 and 2.9 document their own MCP server	AI	V

Centre of gravity: Security and lifecycle (3), Packaging (2), Routing (2)
Blind spots (no items): Firewall core, VPN, Threat protection, Network services, Platform, High availability, Management and API, Observability, Licensing
Driver mix: Vision 13%, Customer need 38%, Market window 0%, Upstream 25%, Portfolio 25%
Idea-to-need index: 0.25 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 15.5 / 25

Criterion	Score	Basis
Cadence	4	Two Junos trains a year (24.4, 25.2, 25.4) on a published schedule with extended end-of-engineering releases
Roadmap transparency	2.5	Public release notes and end-of-life dates; no public roadmap; HPE integration plans not published for vSRX
Say-do	3	Trains ship on cadence; too few vSRX announcements were found to check against delivery
Velocity	3	Maintenance and incremental features on the vSRX line; the release notes' vSRX sections were not read
Lifecycle stability	3	Long trains and in-place upgrades, but vSRX 2.0 was retired at 22.4 and the owner changed in 2025

Commercial risk: 15.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2	Flex subscription since 2021 with no change found since 2023; no public price to check
Purchase constraints	3.5	Subscription only, per vCPU and tier, minimum 2 vCPU; quote based
Channel and access	3.5	Juniper and HPE partners; downloads need a support account and contract
Owner stability	3	Acquired by HPE on 2025-07-02; portfolio integration in progress
Cost of staying supported	3	Three-year trains and 1, 3 or 5 year terms; a licence from before 21.1R1 expires after a 30 day grace period unless replaced

Technical lock-in: 12.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	2.5	Hierarchical Junos text configuration, exportable and loadable
Export path	2.5	Configuration is readable text; policy translation to another vendor is manual
Stack coupling	2.5	Runs alone; Security Director and ATP Cloud are optional subscriptions
Hardware / cloud coupling	1.5	Any listed hypervisor or cloud; licence bound to vCPU count
Skills and tooling coupling	3	Junos skills (JNCIS-SEC, JNCIP-SEC); NETCONF and Ansible content is standard but Junos specific

Integrator fit: 15.0 / 20

Criterion	Score	Basis
Partner programme openness	3.5	Juniper Partner Advantage; the merge with HPE's programme was not verified
Multi-tenancy and self-service	3.5	Logical systems and tenant systems; Security Director Cloud for fleets; no self-service portal
API and infrastructure-as-code	4	NETCONF and REST, vendor Ansible collection; Terraform provider community maintained
Skills and certification	4	Exam-based JNCIA to JNCIE security tracks

AI leverage: 5.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI in threat detection	2	2	2	2019: 19.x: ATP Cloud with SecIntel threat feeds on vSRX 3.0; vendor-described ML in the cloud service
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	2	2	3	2025: Open-source Junos MCP server on GitHub, which Juniper advises to deploy locally for testing until secured; preview grade

Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 4 · 2020: 4 · 2021: 4 · 2022: 4 · 2023: 4 · 2024: 4 · 2025: 5 · 2026: 5

AI say-do, 2023 to 2026: 1 AI items announced; 0 GA, 1 still preview, 0 pending, 0 dropped. The Junos MCP server is open source with a testing-only deployment note; the Routing Director MCP server is documented but belongs to a different product. Marvis covers Mist, and its SRX integration was not verified.

Juniper's AI story lives in Mist and Marvis on the wired and wireless side, and this edition found no verified AI feature inside vSRX itself. The open-source Junos MCP server gives agents a documented path onto the device, with the vendor's own note that it is not yet hardened.

Reading

vSRX scores on what Junos has always done well: routing policy, a clean text configuration with commit and rollback, and automation through NETCONF and Ansible, which also keeps its lock-in the lowest in the enterprise group. The lifecycle domain takes the full KEV penalty from one J-Web disclosure in November 2023 that produced three SRX entries at once. Commercial risk rose in 2025 because HPE now owns the product and has not published what the integration means for vSRX licensing or the partner programme. The buyer's check is the owner: confirm the vSRX roadmap and support terms under HPE before signing a five-year term.

Open questions and items to re-score

GA dates for 25.2R1 and 25.4R1: Juniper document dates and third-party trackers disagree; the vSRX what's new sections were not read.
Official end-of-life dates for 25.2 and 25.4 were not found.
Current ESXi 8 and Hyper-V versions for vSRX 3.0: the hypervisor tables read date from 19.x.
The 60 day trial licence, the Terraform provider's status and the merge of the partner programme into HPE's were not verified.
Features attributed to 15.1X49, 17.x and 19.x trains (AppSecure, Sky ATP, Auto Discovery VPN, Secure Connect, Multinode HA) were attributed from secondary sources and dated by train.
Whether CVE-2025-21590 affects SRX as well as MX; it was not counted.

	’17	’19	’21	’22
Routing and WAN		2		1
Firewall and NAT core	1
VPN and remote access		3
Threat protection	2
Network services
Platform and hypervisor freedom		1
High availability and performance				2
Management, API and automation			1
Observability			2
Platform security and lifecycle