That got your attention didn't it! It's the big topic these days and in the SRX we can apply in several ways.

In the Juniper world we have VSYS on ScreenOS and LSYS for high end SRXs both of which allow the creation of logical firewalls with different administrative rights within a single box.

There is also Firefly Perimter to consider (Eval for 60 day)

Even though we can't use LSYS on a branch SRX device we can still set up logical routers called Routing Instances on them and then apply specific zones/interfaces to those Routing Instances thereby gaining some degree or virtualisation in the branch SRX.

Lets look at a simple example of how to apply this..