Juniper Networks SA4000 SSL VPN Appliance

SA4000 Overview:

Juniper Networks SA Series appliances lead the SSL virtual private network (VPN) market with a complete range of remote access appliances, including the SA200, SA400, and SA6000. Juniper Networks SA Series appliances combine the security of SSL with standards-based access controls, granular policy creation, and unparalleled flexibility. The result provides ubiquitous security for all enterprise tasks with options for increasingly stringent levels of access control to protect the most sensitive applications and data. Juniper Networks SA Series appliances deliver lower total cost of ownership over traditional IPsec client solutions and unique end-to-end security features.

The Juniper Networks SA2000, SA4000, and SA6000 SSL VPN Appliances meet the needs of companies of all sizes. SA Series appliances are based on the Instant Virtual Extranet (IVE) platform, which uses SSL, the security protocol found in all standard Web browsers. The use of SSL eliminates the need for pre-installed client software deployment, changes to internal servers, and costly ongoing maintenance and desktop support. SA Series appliances also offer sophisticated partner/customer extranet features that enable controlled access to differentiated users and groups with no infrastructure changes, no DMZ deployments, and no software agents.

Architecture and Key Components

The Juniper Networks SA4000 SSL VPN Appliance enables mid-to-large size organizations to provide cost effective remote employee and partner extranet access using only a Web browser. The SA4000 features rich access privilege management functionality that can be used to create secure customer/partner extranets. This functionality also allows the enterprise to secure access to the corporate intranet, so that different employee and visitor populations can utilize exactly the resources that they need while adhering to enterprise security policies. Built-in compression for all traffic types speeds performance, and hardware-based SSL acceleration is available for more demanding environments. The SA4000 also offers HA with seamless user failover.

 

 

Features & Benefits:

End-to-End Layered Security

The SA2000, SA4000, and SA6000 provide complete end-to-end layered security, including endpoint client, device, data, and server layered security controls. These include:

 

Lower Total Cost of Ownership

In addition to enterprise-class security benefits, the SA2000, SA4000, and SA6000 have a wealth of features that enable low total cost of ownership.

 

Rich Access Privilege Management Capabilities

The SA2000, SA4000, and SA6000 provide dynamic access privilege management capabilities without infrastructure changes, custom development, or software deployment/maintenance. This facilitates the easy deployment and maintenance of secure remote access, as well as secure extranets and intranets. When a user logs in to the SA Series appliance, they pass through a pre-authentication assessment, and are then dynamically mapped to the session role that combines established network, device, identity, and session policy settings. Granular resource authorization policies further ensure exact compliance to security strictures.

 

User Self-Service

The SA2000, SA4000, and SA6000 offer comprehensive password management features. These features increase end user productivity, greatly simplify administration of large diverse user resources, and significantly reduce the number of help desk calls.

 

Provision by Purpose

The SA2000, SA4000 and SA6000 include three different access methods. These different methods are selected as part of the user’s role, so the administrator can enable the appropriate access on a per-session basis, taking into account user, device, and network attributes in combination with enterprise security policies.

 

Product Options:

The SA2000, SA4000, and SA6000 have several hardware and software options that can be added to the products.

Advanced Endpoint Defense: Integrated Malware Protection Option

Advanced Endpoint Defense: Malware Protection is an endpoint security software module that integrates with Host Checker and provides protection from unwanted malware, such as trojan horses and key loggers residing on an endpoint from which an end user is looking to start a remote access session. The malware module is configured as a Host Checker module and is dynamically delivered to the end-user’s PC, with no software to pre-install. All SA Series appliances include a license for 25 concurrent users, free of charge. Customers must purchase additional licenses in order to increase this functionality to support more users.

The Advanced Endpoint Defense: Integrated Malware Protection upgrade is available for the SA2000, SA4000, and SA6000.

Secure Application Manager and Network Connect Upgrade Option

The SAM and NC upgrade is a companion to Juniper Networks Core Clientless access for SSL VPNs. SAM and NC provide cross-platform support for client/server applications using SAM, as well as full network-layer access using the adaptive dual transport methods found in NC. The combination of SAM and NC with Core Clientless access will provide secure access to virtually any audience, from remote/mobile workers to partners or customers, using a wide range of devices from any network.

Although SAM and NC deliver two different access methods, administrators can specify exactly which access method, or combination of access methods, they wish to assign for each user in every deployment scenario. This allows administrators to provision by purpose, balancing security concerns with access requirements. Dynamic access controls enable the access to change as user, endpoint, and network criteria change.

The SAMNC upgrade is available for the SA2000, SA4000, and SA6000 appliances.

Advanced Feature Set

The SA Series appliances are offered with either baseline or advanced feature sets, designed to create an affordable solution that meets the needs of every company, from SMB employee remote access deployments to the largest global enterprise extranet. The baseline features that come with the appliance provide the functionality that an enterprise would need to deploy secure remote access, as well as a provision a basic customer/partner extranet or intranet. The advanced feature set provides additional sophisticated capabilities that will meet the needs of more complex deployments with diverse audiences and use cases, including SA Series Central Manager, a robust product with an intuitive Web-based UI designed to facilitate the task of configuring, updating, and monitoring a single SA Series appliance or a single cluster deployment. Both feature sets provide remote access, extranet, and intranet capabilities with little to no need for client software, server changes, DMZ build-outs, or software agent deployments. The advanced feature set includes:

• Advanced PKI support including ability to import multiple root and intermediate CAs, OCSP, and multiple server certificates
• User self service
• Access management integration
• Multiple hostname support
• Customizable UI
• Combine attributes using Boolean expressions, for flexible, dynamic, “per-session” policies
• Advanced role definition and role mapping rules combine attributes using Boolean expressions
• Advanced resource authorization policies combine attributes using Boolean expressions
• Role-based delegation, configurable at the individual task level
• Flexible role definition
• Juniper Networks Central Manager
• Secure Virtual Workspace

The Advanced Feature upgrade is available for the SA2000, SA4000, and SA6000.

Secure Meeting Option

The Secure Meeting upgrade license extends the capabilities of the SA Series appliances by providing secure anytime, anywhere, cost effective online Web conferencing and remote control PC access. Secure Meeting enables real-time application sharing so authorized employees and partners can easily schedule online meetings or activate instant meetings through an intuitive Web interface that requires no training or special deployments. Help desk staff or customer service representatives can provide remote assistance to any user or customer by remotely controlling their PC without requiring the user to install any software. Best-in-class authentication, authorization, and accounting (AAA) capabilities enable companies to easily integrate Secure Meeting with their existing internal authentication infrastructure and policies. Juniper’s market-leading, hardened, and Common Criteria certified SSL VPN appliance architecture and SSL/HTTPS transport security for all traffic means that administrators can rest assured that their Web conferencing and remote control solution adheres to the highest levels of enterprise security requirements.

The Secure Meeting upgrade is available for the SA2000, SA4000, and SA6000.

Instant Virtual System Option

Juniper Networks Instant Virtual System (IVS) option is designed to enable administrators to provision 255 logically independent SSL VPN gateways within a single appliance/cluster. This enables service providers to offer network-based SSL VPN managed services to multiple customers from a single device or cluster, as well as enabling enterprises to completely segment SSL VPN traffic between multiple groups. IVS enables complete customer separation and provides segregation of traffic between multiple customers using granular role based VLAN (802.1Q) tagging. This enables the secure segregation of end users’ traffic, even if two customers have overlapping IP addresses and enables provisioning of specific VLANs for different user constituencies, such as remote employees and partners of customers. DNS/WINS, AAA, log/accounting servers and application servers such as Web mail, file shares, etc. can reside either in the respective customers’ intranets or in the service provider network. Service providers can provision an overall concurrent number of users on a per customer basis with the flexibility to distribute further amongst different user audiences such as remote employees, contractors, partners, etc.

The IVS upgrade is available for the SA4000 and SA6000.

High Availability Option

Juniper Networks has designed a variety of HA clustering options to support the SA Series appliances, ensuring redundancy and seamless failover in the rare case of a system failure. These clustering options also provide performance scalability to handle the most demanding usage scenarios. The SA2000 and SA4000 can be purchased in Cluster Pairs and the SA6000 can be purchased in a Multi-Unit Clusters or Cluster Pairs, to provide complete redundancy and expansive user scalability. Both Multi-Unit Clusters and Cluster Pairs feature stateful peering and failover across the LAN and WAN, so in the unlikely event that one unit fails, system configurations (including authentication server, authorization groups, bookmarks, etc.), user profile settings (including user-defined bookmarks, cookies, etc.), and user sessions are preserved. Failover is seamless, so there is no interruption to user/enterprise productivity, no need for users to log in again, and no downtime. Multi-Unit Clusters are automatically deployed in Active/Active mode, while Cluster Pairs can be configured in either Active/Active or Active/Passive Mode.

The HA option is available for the SA2000, SA4000, and SA6000.

ICE Option

SSL VPNs can help to keep organizations and businesses functioning by connecting people even during the most unpredictable circumstances – hurricanes, terrorist attacks, transportation strikes, pandemics or virus outbreaks, the result of which could mean the quarantine or isolation of entire regions or groups of people for an extended period of time. With the right balance of risk and cost, the Juniper Networks SA Series ICE offering delivers a timely solution for addressing a dramatic peak in demand for remote access to ensure business continuity whenever a disastrous event strikes. ICE provides licenses for a large number of additional users on a SA Series SSL VPN Appliance for a limited time. With ICE, businesses can:

• Maintain productivity by enabling ubiquitous access to applications and information for employees from anywhere, anytime, and any device
• Sustain partnerships with around the clock real-time access to applications and services while knowing resources are secured and protected
• Continue to deliver exceptional service to customers and partners with online collaboration
• Meet federal and government mandates for contingencies and continuity of operations (COOP) compliance
• Balance risk and scalability with cost and ease of deployment

The ICE license is available for the SA4000 and the SA6000 and includes all of the following features:

• Baseline
• Advanced
• Secure Application Manager and Network Connect
• Secure Meeting
• SSL Acceleration

Technical Specifications:

 

Performance-Enabling Services and Support

Juniper Networks is the leader in performance-enabling services and support, which are designed to accelerate, extend, and optimize your high-performance network. Our services allow you to bring revenue-generating capabilities online faster so you can realize bigger productivity gains, faster rollouts of new business models and ventures, and greater market reach, while generating higher levels of customer satisfaction. At the same time, Juniper Networks ensures operational excellence by optimizing your network to maintain required levels of performance, reliability, and availability.

Documentation:

Download the Juniper Networks SA2000, SA4000, and SA6000 SSL VPN Appliance Datasheet (PDF).