Customer Network Design Requirements
Customer Network Design Requirements
This domain tests whether you can turn business intent into a defensible security design: scope, constraints, capacity, availability, compliance and operations. The exam favors structured discovery over early product selection.
Core rules
- Separate business drivers from technical requirements. A PCI-DSS obligation is a driver; "segment cardholder data, retain 12 months of logs, inspect inbound traffic" are requirements.
- Capture current state, desired state and the gap. Record users, sites, flows, applications, the existing Junos estate and staff skills.
- Size on services-enabled throughput, not firewall-only throughput. SRX datasheet figures vary by packet size and feature mix; AppSecure, IDP, SSL proxy and IPsec reduce the usable number.
- Design availability from the requirement: link, device, path and site redundancy; active/passive versus active/active cluster; session sync; target failover time.
- Record operational constraints: rack space, power, cooling, management network, change windows, budget and team certification.
Worked example
A retailer has 400 stores, 150 Mbps peak internet, PCI scope, two small data centers and two network engineers. Reasoning: 150 Mbps with IDP and TLS inspection needs an SRX with headroom above 300 Mbps services-enabled, not a branch box rated only on raw firewall throughput. Two units per store would break the budget, so use one SRX per store plus dual ISP where payment traffic matters, and concentrate resilience at the data-center hubs. Centralize policy with Security Director and send logs to a collector. This meets the driver (PCI segmentation and logging) while respecting the constraint (two engineers, 400 sites).
Traps that cost marks
- Sizing from the headline firewall number and ignoring encryption or inspection.
- Treating a compliance framework as a design.
- Forgetting management, logging and telemetry bandwidth.
- No growth assumption for TLS 1.3 and video.
- Designing active/active clusters without a session-sync and asymmetric-path story.