A Juniper firewall analyzer for SRX and Junos.
SAMURAI is a self-hosted Juniper firewall analyzer for SRX. It reads the Junos configuration directly: zone-based security policies, source and destination NAT, the address book, applications, security zones and IPsec VPNs. You see the rules as configured and every committed change with its author, in the same dashboard as your Palo Alto, FortiGate and Cisco firewalls.
Updated July 2026
What it reads from SRX
Security policies by zone pair
Search Junos security policies by from-zone, to-zone, source, destination, application and action, across all your SRX devices.
Source, destination and static NAT
Junos NAT rule sets with address-book entries resolved to real prefixes, so you read the translation instead of a pool name.
Address and application sets, opened up
Sets are expanded recursively at sync time, so you see “HTTPS (tcp/443)” and the prefixes behind each group.
Zones and interfaces
Which interfaces belong to which zone, so you can tell what a policy actually applies to.
IPsec VPNs
IKE gateways and IPsec VPNs beside the security policies that allow the tunnel traffic.
Commits with an author
Each Junos configuration change is diffed and tied to the admin who committed it, on the same timeline as your other vendors.
More than a single-vendor SRX tool
Junos Space Security Director is good at managing Juniper policy inside a Juniper network. SAMURAI does something different. It reads SRX configuration and shows it next to your Palo Alto, FortiGate and Cisco firewalls and the routers, switches and ACI fabrics around them, with effective access, rule hygiene and per-rule risk scoring on top.
Scope
SAMURAI
SRX plus Palo Alto, FortiGate, Cisco FMC, routers, switches and ACI in one view
Single-vendor managers
Juniper only
Deployment
SAMURAI
One self-hosted Docker container, works air-gapped, data in about five minutes
Single-vendor managers
Dedicated management appliance or VM
Analysis
SAMURAI
Effective access, shadowed, redundant and overly broad rules, per-rule risk, across vendors
Single-vendor managers
Policy authoring and push for Juniper
Change visibility
SAMURAI
One change timeline across vendors, with commit authors
Single-vendor managers
Juniper commit history on its own
If you author and push Junos policy, Security Director is the tool for it. SAMURAI never pushes configuration. It reads SRX state, analyzes it and shows it beside every other vendor you run, with a record of who changed what.
Frequently asked questions
Which Juniper devices does SAMURAI support?
SRX Series firewalls running Junos OS. It reads security policies, NAT, the address book, applications, security zones and IPsec VPNs, next to your Palo Alto, FortiGate and Cisco FMC firewalls.
Is SAMURAI a Juniper log analyzer?
No. It reads configuration from each SRX and doesn’t parse traffic logs or syslog, so you’re analyzing the rules and their changes. It can forward its own events as RFC 5424 syslog, but SRX log analytics isn’t its job.
How does SAMURAI read the SRX configuration?
Through the structured configuration Junos already exposes, read-only. SAMURAI never modifies or pushes Junos config. It keeps syncing and diffs each snapshot against the last one.
Can it resolve address sets and applications?
Yes. Address sets and application sets are expanded recursively, so a policy shows real prefixes and “HTTPS (tcp/443)” instead of a set name.
Does it work across Juniper and other vendors at once?
Yes. SRX policies share a search and a change timeline with Palo Alto, FortiGate and Cisco FMC, and path tracing crosses the routers, switches and ACI fabrics between them.
Is there a free option?
Yes. A free test license ships with the Docker image, no email needed, so you can try it on your own SRX firewalls first. Production licenses are per deployment and priced by device count.
Can SAMURAI run air-gapped?
Yes. It’s one self-contained Docker image with no telemetry, and nothing leaves your network.