Description

Can we configure SRX as a gateway for VXLANs subnets? Or can we directly connect SRX to the switch hosting VXLANs and use the SRX interface as a gateway?

Solution

Currently, only two VXLAN-related features are supported on SRX Series Firewalls:

  1. Security policy enhancement for EVPN-VXLAN tunnel inspection - Starting with Junos OS Release 20.4R1, SRX Series Firewalls can perform stateful inspection of VXLAN-encapsulated overlay traffic passing through them. The SRX is deployed at the network border in an Enhanced Border Leaf (EBL) role, sitting between VTEP devices to inspect transit traffic. Upon a policy match, it decapsulates the packet, applies the tunnel inspection profile, and performs stateful inspection on the inner session. From Junos OS Release 21.1R1 onwards, Layer 4/Layer 7 security services - including Application Identification, IDP, Juniper ATP Cloud, and Content Security - can also be applied to this tunnel traffic. 
  2. Pure EVPN Type 5 routes with EVPN-VXLAN - The SRX supports EVPN Type 5 routes within the EVPN-VXLAN framework. When the ingress and egress sides of a Type 5 VXLAN tunnel use different VRFs, both VRF IDs should be placed into the same VRF group ID to ensure correct security policy matching.

Key limitation: The SRX cannot act as a VXLAN gateway - it does not perform VTEP functions such as VXLAN encapsulation or decapsulation on behalf of end clients. That role is handled by other devices such as QFX Series switches. The SRX's role in an EVPN-VXLAN fabric is strictly inline security inspection of tunnel traffic in transit.

 

For complete details and documents, please refer to:
Juniper Networks Feature Explorer – VXLAN Gateway Support
Juniper Networks – What is VXLAN?
Juniper Networks Technical Documentation – Tunnel Inspection for EVPN-VXLAN by SRX Series Devices

Modification History

2025-04-23 : Article Created