Juniper Networks SA2500 SSL VPN Appliance

SA2500 Overview:

Juniper Networks SA Series SSL VPN Appliances lead the SSL VPN market with a complete range of remote access appliances, including the new, next-generation Juniper Networks SA2500, SA4500, and SA6500 SSL VPN Appliance with its high scalability and redundancy capabilities that are specifically designed for large enterprises and service providers. The SA Series combines the security of SSL with standards-based access controls, granular policy creation, and unparalleled flexibility. The result provides ubiquitous security for all enterprise tasks with options for increasingly stringent levels of access control to protect the most sensitive applications and data. Juniper Networks SA Series SSL VPN Appliances deliver lower total cost of ownership over traditional IPsec client solutions and unique end-to-end security features.

The Juniper Networks SA2500, SA4500, and SA6500 SSL VPN Appliances meet the needs of companies of all sizes. With the SA6500, Juniper continues to demonstrate its SSL VPN market leadership by delivering a highly scalable solution based on real-world performance testing. SA Series SSL VPN Appliances use SSL, the security protocol found in all standard Web browsers. The use of SSL eliminates the need for pre-installed client software, changes to internal servers, and costly ongoing maintenance and desktop support. Juniper Networks SA Series also offers sophisticated partner/customer extranet features that enable controlled access to differentiated users and groups without requiring infrastructure changes, demilitarized zone (DMZ) deployments, or software agents.

The SA Series now includes Juniper Networks Junos® Pulse, a dynamic, integrated, multiservice network client for mobile and non-mobile devices. Junos Pulse enables optimized, accelerated, anytime, anywhere access to corporate data. Pulse enables secure SSL access from a wide range of mobile and non-mobile devices, including smartphones, netbooks, notebooks, Wi-Fi, or 3G-enabled devices. Junos Pulse delivers enterprises improved productivity and secure, ubiquitous access to corporate data and applications— anytime, anywhere.

Architecture and Key Components

The SA2500 SSL VPN Appliance enables small- to medium-size businesses (SMBs) to deploy cost-effective remote and extranet access, as well as intranet security. Users can access the corporate network and applications from any machine over the Web. The SA2500 offers high availability (HA) with seamless user failover. And because the SA2500 runs the exact same software as the larger SA4500 and SA6500, even smaller organizations gain the same high-performance, administrative flexibility, and end user experience.

Because each of the SA Series SSL VPN Appliances runs on the same software, there is no need to compromise user or administrator experience based on which one you choose. All devices offer leading performance, stability, and scalability. Therefore, deciding which device will best fit the needs of your organization is easily determined by matching the required number of concurrent users, and perhaps system redundancy and large-scale acceleration options, to the needs of your growing remote access user population.

• SA2500: Supports SMBs as a cost-effective solution that can easily handle up to 100 concurrent users on a single system or two-unit cluster.

Features & Benefits:

Features	Benefits
Layer 3 SSL VPN (Network Connect)	Layer 3 VPN connectivity with granular access control is provided. Only SSL mode is available; there is no Encapsulating Security Payload (ESP) mode.
Location awareness	Seamless roaming from remote access (to SA Series) to local LAN access (via Juniper Networks Unified Access Control) is provided. Junos Pulse can be preconfigured by admins to automatically prompt end users for credentials to authenticate to the SA Series when they are remote.
Endpoint security	Seamless roaming from remote access (to SA Series) to local LAN access (via Juniper Networks Unified Access Control) is provided. Junos Pulse can be preconfigured by admins to automatically prompt end users for credentials to authenticate to the SA Series when they are remote.
Split tunneling options (enable or disable with overriding route capability and route monitoring)	Key split tunneling options of Network Connect are supported. Secure, granular access control is enforced.
Flexible launch options (standalone client, browser-based launch)	Users can easily launch Junos Pulse via the Web from the SA Series landing page Remote users can simply launch Junos Pulse from their desktop
Preconfiguration options (pre-configured installer to contain list of SA Series appliances)	Admins can pre-configure a Junos Pulse deployment with a list of corporate SA Series appliances for end-users to choose from
Connectivity options (max/idle session timeouts, automatic reconnect, logging)	Admins can set up flexible connectivity options for remote users.
Authentication options (hardware token, smart cards, or soft token)	Admins can deploy Junos Pulse for remote user authentication by using a hardware token or smart cards. Junos Pulse supports integration with RSA SoftID, allowing automatic access to the user’s RSA passcodes using the PIN entered by the user.

End-to-End Layered Security

The SA2500, SA4500, and SA6500 provide complete end-to-end layered security, including endpoint client, device, data, and server layered security controls.

Ease of Administration

In addition to enterprise-class security benefits, the SA2500, SA4500, and SA6500 have a wealth of features that make it easy for the administrator to deploy and manage.

Rich Access Privilege Management Capabilities

The SA2500, SA4500, and SA6500 provide dynamic access privilege management capabilities without infrastructure changes, custom development, or software deployment/maintenance. This facilitates the easy deployment and maintenance of secure remote access, as well as secure extranets and intranets. When users log into the SA Series SSL VPN Appliance, they pass through a pre-authentication assessment, and are then dynamically mapped to the session role that combines established network, device, identity, and session policy settings. Granular resource authorization policies further ensure exact compliance to security restrictions.

Flexible Single Sign-On (SSO) Capabilities

The SA2500, SA4500, and SA6500 offer comprehensive single sign-on features. These features increase end user productivity, greatly simplify administration of large diverse user resources, and significantly reduce the number of help desk calls.

Provision by Purpose

The SA2500, SA4500, and SA6500 include three different access methods. These different methods are selected as part of the user’s role, so the administrator can enable the appropriate access on a per-session basis, taking into account user, device, and network attributes in combination with enterprise security policies.

Product Options:

The SA2500, SA4500, and SA6500 appliances include various license options for greater functionality.

User License

With the release of the SA2500, SA4500, and SA6500 appliances, purchasing has been simplified, thanks to a combination of features that were once separate upgrades. Now, there is only one license that is needed to get started: the user licenses. Current customers with the older generation hardware (Juniper Networks SA2000, SA4000, and SA6000) will also benefit from these changes as systems are upgraded to version 6.1 (or higher) software.

User licenses provide the functionality that allows the remote, extranet, and intranet user to access the network. They fully meet the needs of both basic and complex deployments with diverse audiences and use cases, and require little or no client software, server changes, DMZ build-outs, or software agent deployments. And for administrative ease of user license counts, each license only enables as many users as specified in the license and are additive. For example, if a 100 user license was originally purchased and the concurrent user count grows over the next year to exceed that amount, simply adding another 100 user license to the system will now allow for up to 200 concurrent users. Key features enabled by this license include:

• SAM and Network Connect provide cross-platform support for client/server applications using SAM, as well as full network-layer access using the adaptive dual transport methods found in Network Connect. The combination of SAM and Network Connect with Core Clientless access provides secure access to virtually any audience, from remote/mobile workers to partners or customers, using a wide range of devices from any network. 
• Provision by purpose goes beyond role-based access controls and allows administrators to properly, accurately, and dynamically balance security concerns with access requirements.
• Advanced PKI support includes the ability to import multiple root and intermediate certificate authorities (CAs), Online Certificate Status Protocol (OCSP), and multiple server certificates.
• User self-service provides the ability for users to create their own favorite bookmarks, including accessing their own workstation from a remote location, and even changing their password when it is set to expire.
• Multiple hostname support (for example, https://employees.company.com, https://partners.company.com and https://employees.company.com/engineering) can all be made to look as though users are the only ones using the system, complete with separate logon pages and customized views that uniquely target the needs and desires of that audience.
• User interfaces are customizable for users and delegated administrative roles.
• Advanced endpoint security controls such as Host Checker, Cache Cleaner, and Secure Virtual Workspace work to ensure that users are dynamically provisioned to access systems and resources only to the degree that their remote systems are compliant with the organization’s security policy, after which remnant data is scrubbed from the hard drive so that nothing is left behind.
• Provides support of up to 240 VLANs.

Secure Meeting License (Optional)

The Juniper Networks Secure Meeting upgrade license extends the capabilities of the SA Series SSL VPN Appliances by providing secure any time, anywhere, cost-effective online Web conferencing and remote control PC access. Secure Meeting enables real-time application sharing so that authorized employees and partners can easily schedule online meetings or activate instant meetings through an intuitive Web interface that requires no training or special deployments. Help desk staff or customer service representatives can provide remote assistance to any user or customer by remotely controlling his/her PC without requiring the user to install any software. Best-in-class Authentication, Authorization, and Accounting (AAA) capabilities enable companies to easily integrate Secure Meeting with their existing internal authentication infrastructure and policies. Juniper’s market-leading, hardened, and Common Criteria-certified SSL VPN appliance architecture, and SSL/HTTPS transport security for all traffic, means that administrators can rest assured that their Web conferencing and remote control solution adheres to the highest levels of enterprise security requirements.

The Secure Meeting upgrade is available for the SA2500, SA4500, and SA6500.

Instant Virtual System License (Optional)

Juniper Networks Instant Virtual System (IVS) option is designed to enable administrators to provision 240 logically independent SSL VPN gateways within a single appliance/cluster. This allows service providers to offer network-based SSL VPN managed services to multiple customers from a single device or cluster, as well as enabling enterprises to completely segment SSL VPN traffic between multiple groups. IVS enables complete customer separation and provides segregation of traffic between multiple customers using granular role based VLAN (802.1Q) tagging. This enables the secure segregation of end user traffic even if two customers have overlapping IP addresses, and enables provisioning of specific VLANs for different user constituencies such as remote employees and partners of customers.

Domain Name Service (DNS)/Windows Internet Name Service (WINS), AAA, log/accounting servers, and application servers such as Web mail and file shares to name a few, can reside either in the respective customer’s intranets or in the service provider network. Service providers can provision an overall concurrent number of users on a per-customer basis with the flexibility to distribute further to different user audiences such as remote employees, contractors, partners, and others. The SA Series extends programmatic support to configure and manage IVS. This enables service providers to integrate IVS management into their own operations support systems (OSS). It also enables enterprises that use Instant Virtual Systems to leverage XML import/export capabilities for management of the individual virtual systems.

The IVS upgrade is available for the SA4500 and SA6500.

High Availability License (Optional)

Juniper Networks has designed a variety of HA clustering options to support the SA Series, ensuring redundancy and seamless failover in the rare case of a system failure. These clustering options also provide performance scalability to handle the most demanding usage scenarios. The SA2500 and SA4500 can be purchased in cluster pairs, and the SA6500 can be purchased in multi-unit clusters or cluster pairs to provide complete redundancy and expansive user scalability. Both multi-unit clusters and cluster pairs feature stateful peering and failover across the LAN and WAN, so in the unlikely event that one unit fails, system configurations (like authentication server, authorization groups, and bookmarks), user profile settings (like user-defined bookmarks and cookies), and user sessions are preserved. Failover is seamless, so there is no interruption to user/enterprise productivity, no need for users to log in again, and no downtime. Multi-unit clusters are automatically deployed in active/active mode, while cluster pairs can be configured in either active/active or active/passive mode.

High availability licenses allow you to share licenses from one SA Series appliance with one or more additional SA Series appliances (depending on the platform in question). These are not additive to the concurrent user licenses. For example, if a customer has a 100 user license for the SA4500 and then purchases another SA4500 with a 100 user cluster license, this will provide a total of 100 users that are shared across both appliances, not per appliance.

The HA option is available for the SA2500, SA4500, and SA6500.

ICE License (Optional)

SSL VPNs can help keep organizations and businesses functioning by connecting people even during the most unpredictable circumstances—hurricanes, terrorist attacks, transportation strikes, pandemics, or virus outbreaks—the result of which could mean the quarantine or isolation of entire regions or groups of people for an extended period of time. With the right balance of risk and cost, the new Juniper Networks SA Series ICE offering delivers a timely solution for addressing a dramatic peak in demand for remote access to ensure business continuity whenever a disastrous event strikes. ICE provides licenses for a large number of additional users on an SA Series SSL VPN Appliance for a limited time. With ICE, businesses can:

• Maintain productivity by enabling ubiquitous access to applications and information for employees from anywhere, at any time, and on any device.
• Sustain partnerships with around-the-clock, real-time access to applications and services while knowing resources are secured and protected.
• Continue to deliver exceptional service to customers and partners with online collaboration.
• Meet federal and government mandates for contingencies and continuity of operations (COOP) compliance.
• Balance risk and scalability with cost and ease of deployment.

The ICE license is available for the SA4500 and the SA6500 and includes the following features:

• Baseline
• Secure Meeting

Antispyware Support with Enhanced Endpoint Security (EES) (Optional)

The amount of newly discovered malicious programs that can harm endpoint devices such as PCs continues to grow. According to the 1985-2008 AV-test.org report, there were over seven million new malware programs discovered in 2008, and just over five million were discovered in 2007. Malware and spyware are known to cost enterprises an increasing amount of money every year in terms of efforts involved to quarantine and remediate appropriate endpoints.

In order to prevent endpoints from being infected with spyware, Juniper Networks offers the Enhanced Endpoint Security license option. This license is a full-featured, dynamically deployable antispyware/antimalware module that is an OEM of Webroot’s industry-leading Spy Sweeper product. This dynamic antispyware/antimalware download capability is also available with Unified Access Control. With this new capability, organizations can ensure that unmanaged and managed Microsoft Windows endpoint devices conform to corporate security policies before they are allowed access to the network, applications, and resources. For example, potentially harmful keyloggers can be found and removed from an endpoint device before the user enters sensitive information such as their user credentials. The Enhanced Endpoint Security license protects endpoints from infection in real-time and ensures only clean endpoints are granted access to the network. Enhanced Endpoint Security licenses are available as 1-year, 2-year, and 3-year subscription options (see the Ordering Information section for more details).

Technical Specifications:

Front View

Rear View

Performance-Enabling Services and Support

Juniper Networks is the leader in performance-enabling services and support, which are designed to accelerate, extend, and optimize your high-performance network. Our services allow you to bring revenue-generating capabilities online faster so you can realize bigger productivity gains, faster rollouts of new business models and ventures, and greater market reach, while generating higher levels of customer satisfaction. At the same time, Juniper Networks ensures operational excellence by optimizing your network to maintain required levels of performance, reliability, and availability.

SA Series Comparison Matrix:

Model:	SA700	SA2500	SA4500, SA4500 FIPS	SA6500, SA6500 FIPS
Market Segment	Small to mid-size enterprises <250 total employees	Small to mid-size enterprises	Mid-size to large enterprises, government agencies	Large enterprises, service providers, large government agencies
Users	Remote or mobile employees, business partners, customers	Remote or mobile employees, business partners, customers	Remote or mobile employees, business partners, customers	Remote or mobile employees, business partners, customers
Access Method	Clientless Core Web Access Network Connect	Clientless Core Web Access Secure App. Manager Network Connect	Clientless Core Web Access Secure App. Manager Network Connect	Clientless Core Web Access Secure App. Manager Network Connect
Interfaces	Two RJ-45 Ethernet 10/100 Full or Half-Duplex (Auto-Negotiation) IEEE 802.3u Compliant One 9-Pin Serial Console Port	Two RJ-45 Ethernet 10/100/1000 full or half-duplex (auto-negotiation) IEEE 802.3u compliant IEEE 802.3z or IEEE 802.3ab compliant One RJ-45 serial console port	Two RJ-45 Ethernet 10/100/1000 Full or Half-Duplex (Auto-Negotiation) IEEE 802.3u Compliant IEEE 802.3z or IEEE 802.3ab compliant One RJ-45 Serial Console Port	Two RJ-45 Ethernet 10/100/1000 Full or Half-Duplex (Auto-Negotiation) Two SFP ports - Gig-E Two RJ-45 Ethernet 10/100/1000 Full or Half-Duplex (Auto-Negotiation) IEEE 802.3u Compliant IEEE 802.3z or IEEE 802.3ab compliant One RJ-45 Serial Console Port
High Availability	N/A	A/P, A/A, Stateful Peering, Clustering	A/P, A/A, Stateful Peering, Clustering	Plus redundant power supply, hard drive w/ real-time data mirroring, & additional memory

 

Documentation:

Download the Juniper Networks SA2500, SA4500, and SA6500 SSL VPN Appliance Datasheet (PDF).