juniper networks - présentation | juniper networks...

JUNIPER PRESENTATION

Virginie CHAPUIS-THIANT

12 Avril 2011

2 Copyright © 2010 Juniper Networks, Inc. www.juniper.net

AGENDA

1. Company Background

2. Juniper Networks Enterprise Strategy

3. Juniper Solutions Overview

4. Juniper Services and Support


JUNIPER : QUI SOMMES NOUS?

MODULES

– 1 –

– – 2 2 ––

– 3 –

– 4 –

– 5 –

– 6 –

– 8 –

– 7 –


SETTING THE AGENDA FOR THE NEXT DECADE

JUNIPER NETWORKS IS TRANSFORMING THE EXPERIENCE AND ECONOMICS OF NETWORKING


CLEAR MISSION AND FOCUSED STRATEGY

CONNECT EVERYTHING; EMPOWER EVERYONE

THROUGH HIGH-PERFORMANCE NETWORKING AND INDUSTRY INNOVATION

SILICON SYSTEMS SOFTWARE


UNE DÉCADE D’INNOVATION

$500M $1.3B $2B

4800Employees 1000 1500

Revenue

M Series

T SeriesSSG Series

IC Series

2500 3500

$2.8B$2.3B

5300+

$3.5B

6500+

EX Series

FORTUNE

1THOUSAND

#789

T1600

MX Series

Incorporated

SRX Series

20062006

20022002 20042004

19981998

20072007

20082008

19991999 20002000

20052005

19961996

20092009

$3.32B

7000+

TX Matrix Plus

JunosTrio

Chipset

J Series

n/a

8000+

20102010

VXA Series

EX4500

MX80

https://extranet.juniper.net/image-library/Image%20Library/Mseries_Family_HR.jpg

https://extranet.juniper.net/image-library/Image%20Library/T_Series_Fam1_LR.jpg


JUNIPER PORTFOLIO

RoutingSwitching Security

Software

Apps

Service Layer Technologies (SLT)

Junos Ready Software (JRS)

Fabric and SwitchingTechnologies (FST)

Infrastructure Products Group (IPG)

Foundation Technologies (FT)

• Campus (ESBU) • Data Center (DCBU)


JUNIPER NETWORKS: LEADER IN HIGH-PERFORMANCE NETWORKING

PUBLIC SECTORFORTUNE 100 ENTERPRISESTOP 100 SERVICE PROVIDERS

OPERATIONAL EXCELLENCEBEST IN CHOICE

$3.5BCash andInvestments

7000 DedicatedEmployees

$800MAnnual R&D Engine

http://www.brandsoftheworld.com/brands/0002/0874/T__Rowe_Price.eps


JUNIPER FRANCE

MODULES

– 1 –

– – 2 2 ––

– 3 –

– 4 –

– 5 –

– 6 –

– 8 –

– 7 –


Grands Comptes

Eric BORNET Directeur Grands Comptes

Thierry DESTREZ Secteur Public

TBH Banque, Assurances

Cyrille PIEL Industrie

Territory

Bruno ROSSI Territorry GB Région Sud

Hacen LEDAD Territorry GB Region Nord

Équipe Commerciale Entreprise France


Équipe Avant-vente Entreprise France

Olivier MELWIG Directeur Avant-Vente Entreprise

Ghaleb ZHEKRI SE Spécialiste Sécurité

Kelil SARTOR SE Spécialiste EX

Dhabbiah CHAREF SE Spécialiste Routage

Laurent PAUMELLE SE Spécialiste Securité


Guillaume CHEZEAUD Channel Director South EMEA

TBH Channel Sales Manager France

Virginie THIANT Distribution Manager, VERIZON, Nomios

TBH Partner Account Manager : TELINDUS, AXIANS,INTERDATA, INTEGRALIS DI-DATA, INNEO, BT

Loïc LE BOT Partner Account Manager : SPIE, NEXTIRAONE, NES,ALIONIS, EXAPROBE, INTEXAN

Pascal ALLOCHON Carrier Resale Account Manager OBS

Bruno RIOU Carrier Resale Account Manager OBS

Équipe Channel France


Équipe Sédentaire dédiée France

Jean-Paul ADAM Commercial Sédentaire Partenaires

Frédéric OSIW Commercial Sédentaire Partenaires

Yann TARDIVEL Commercial Sédentaire Clients Finaux(hors comptes Channel listés)


Commerciaux Alliances

Frédéric PETILLON DELL

Xavier DUFLOS IBM


Équipes SP

O.B.S.

Luc DUBOIS Directeur Compte OBS WW

Rémi POUCALOW Commercial OBS Infrastructure

Cedric DERUFFE Commercial OBS Infrastructure

Eric SICARD Directeur Avant-vente OBS France

Antoine SIBOUT SE OBS

Mickael MELLOUL SE OBS Infrastructure

Anne –Christine RANDRIANALIZAH Support Sales Specialist

S.P. ALTERNATES

Stéphane LESECQ

Stéphane GRASER


MODULE 3JUNIPER STRATEGYJUNIPER PORTFOLIO

MODULES

– 1 –

– 2 –

– – 3 3 ––

– 4 –

– 5 –

– 6 –

– 8 –

– 7 –


NETWORKS ENABLE IT BUSINESS INITIATIVESData CentersClients Global Network

Campus

Branch

Home

Mobile


THE DISTRIBUTED ENVIRONMENT IS EQUALLY COMPLEX

Router Firewall

Switch

Router IPS

AccessControl

Switches

Routers

IPS

AccessControl

Switches

FW/VPN

Anti-Spam

Content Filter

Too many devices, appliances, operating and management systems

Inconsistent features and services

Takes too long to deploy anything

WAN

WAN

WANFirewall

OS#1

Management Systems

SMALL OFFICEMID-SIZED OFFICELARGE OFFICE


JUNIPER DISTRIBUTED ENTERPRISE NETWORKS—SIMPLIFIED, INTEGRATED, CONSOLIDATED

SRX650

EX4200-48P

EX4200-24F

SRX210

SRX240

EX4200-48P

WAN

WAN

WAN



JUNIPER DISTRIBUTED ENTERPRISE NETWORKS—SIMPLIFIED, INTEGRATED, CONSOLIDATED

SRX650

EX4200-48P

EX4200-24F

SRX210

SRX240

WAN

WAN

WAN


Single Box Integration Router, Switch, PoEFirewall, IPS, VPN UTM, QoS, UAC

Consolidate LayersVirtual Chassis technology



Consolidate LayersVirtual Chassis technology

NSM

EX4200-48P


OUR HIGH-PERFORMANCE NETWORKING PORTFOLIO

DATA CENTER

BUILDING CAMPUS

BRANCH OFFICES

Juniper Network & Policy Mgmt

IC6500

REMOTE USERS

EX4200-48P

EX4200-24F

EX3200-48P

EX3200-48P

EX4200-24F

UAC Agent

EX3200-48P

EX4200-48P

EX4200-48P

EX4200-48P

EX4200-24F

EX4200-24F

EX8208

EX8208

EX8208

EX8208

EX8208

EX4200-48P

EX4200-48P

EX4200-48P EX8216

WAN

WX Series/WXC Series

SSG Series

J Series

SA Agent

WX Series/WXC Series

M Series

M Series

ISG Series/IDP Series

SA Series

WX/WXCISG Series/IDP Series

MX Series

T Series

UAC Agent

UAC Agent


UN SEUL OS : JUNOS

MODULES

– 1 –

– 2 –

– – 3 3 ––

– 4 –

– 5 –

– 6 –

– 8 –

– 7 –


One OS

branch core

One Release Track

Frequent Releases

9.6 10.0 10.1

One Architecture

–A

PI–

Modulex

SRX3000 Line

SRX5000 Line

SRX210

SRX240

SRX650

SRX100

JUNOS: POWER OF ONE

Junos Pulse

Junos Space NSMXpress

NSM

EX4200 Line

EX8208

EX8216

EX3200 Line

EX2200 Line

EX4500 Line

J Series

MX Series

T Series

M Series

LN1000


WHAT MAKES JUNOS BETTER?

One OS

Single source code base

Consistent implementation of features

Video: Why is Junos different?

SRX TX Matrix

Frequent Releases

10.0 10.1 10.2

Modulex

One Release

Single software release track of feature supersets

Stable, predictable development of new features

One Architecture

Modular software with resource separation

Highly available, secure and scalable software

http://www.juniper.net/company/mediacenter/products_101/prod101_ep2.html


ONE OPERATING SYSTEM

…

OS

PF B

GP

MG

MT

IP

v6

NSM

Single repository of source code

One implementation of control plane features Eases training

Streamlines testing, qualification and deployment

Consistent user experience Single common management

interface and tools

UNIX familiarity

Redeploy equipment to new needs

SERVICE PROVIDERACCESS/EDGE

BRANCH OFFICE

SERVICE PROVIDER CORE

DATA CENTERCORPORATE HQ


ONE RELEASE:STABLE, PREDICTABLE ENHANCEMENTS

Single release track

Quality and schedule are the highest priorities Releases are a superset of the previous

Achieve zero critical regression errors in each release

Fixed schedule; plan with confidence 4 new releases prescheduled per year*

All product lines follow the same release schedule

Streamlines upgrades and reduces upgrade issues

10.110.09.69.59.4

Q209 Q309 Q409 Q110Q109

10.2

Q210

* Junos release data is based on historical information and is not intended to guarantee future deliverables.


Product

Number of Release Trains

OS

Product

Number of Release Trains

OS

Aggregation/Core Security WAN Router

L2/L3Switch

L2 Switch

L2 Switch

Access Switch

IPS

Linux

CAT 4948 or NX2K/5K

IOS-SG, NX-OS

Too many releases;inconsistent

NX 7000CAT 6500

NX-OSIOS-SX, CAT-OS


ASA55xx

PIX-OS 7.x

FWSM

PIX-OS6.x


EX4200 EX8200 / MX M

Junos Junos Junos

SRX

Junos

1

7200 ASR

IOS-mainline

IOS-XE


DATA CENTER NETWORKING SOFTWARE COMPARISON

IPS

Linux


JUNIPER SOLUTIONS SECURITY PORTFOLIO

MODULES

– 1 –

– 2 –

– 3 –

– – 4 4 ––

– 5 –

– 6 –

– 8 –

– 7 –


THE FUTURE OF SECURITY

MobilityMobility ConsolidationConsolidation

VisibilityVisibility


Global High-Performance NetworkGlobal High-Performance Network

Da

ta

C

en

te

r

Data/App Consolidation

CONSOLIDATION

Branch

Campus

Mobile Clients

NAT

Firewall

IPS

IDS

UTM

VPN

NAT

Firewall

Anti-malware

IDS

IPS

VPN

LAN Acceleration

Anti-virus

Remote Access

Remote Lock/wipe

Backup & Restore

NAT

Anti-malware

IPS

Firewall

IDS

VPN

UAC

Firewall

Consolidation of security services (everywhere)


VISIBILITY



Comprehensive Application Visibility and Control Across Physical and Virtual

Source to DestinationSource to

Destination

Da

ta

C

en

te

r

What User

What Application

User Device

User Location

Branch

Campus

Mobile Clients

What VM


MOBILITY

Notebook

Netbook

Smartphone

Tablet

Campus

Branch



Comprehensive Application Visibility and Control

Secure Mobility


SRX Series

Physical

Hypervisor

vGW Series

VM VM VM VM

vGW Virtual Gateway

Services Virtual

Firewall

IPS

DoS Protection

AppSecure

DoS

SECURITY ACROSS PHYSICAL AND VIRTUAL ENVIRONMENTS

• Only solution to integrate physical and virtual network security at scale

• Secures any flow in the data center as a part of the fabric

• Adapts security to address changing and moving VMs

• Only solution to integrate physical and virtual network security at scale

• Secures any flow in the data center as a part of the fabric

• Adapts security to address changing and moving VMs


MODULE 5

SRX SERIES

MODULES

– 1 –

– 2 –

– 3 –

– 4 –

– – 5 5 ––

– 6 –

– 8 –

– 7 –


SMALL DATA CENTER

SRX PLATFORMTHE FOUNDATION FOR SERVICE INTEGRATION

Unprecedented Scale for Service Integration

100G

10G

1G

BRANCH

CAMPUSLARGE

DATA CENTER

SRX5600

SRX3600SRX3400

SRX5800

SRX650SRX1400


JUNIPER PASSERELLES DE SERVICES SERIE SRX

5 SERIES DE SRX : SRX 100 –SRX200-SRX600-SRX3000-SRX5000

Passerelle de services dynamique : routage + sécurité embarquée

Gestion UTM (Unified Threat Management) totalement intégrée

JUNOS : fiabilité de l’OS juniper de type Carrier Class depuis 11 ans

Performances évolutives : architecture de services dynamique

Résilience du système et du réseau : fiabilité de qualité opérateur

Flexibilité de l’interface: configuration souple et évolutive pour répondre aux besoins de pratiquement n’importe quel environnement réseau.

Segmentation du réseau : les administrateurs s'appuient sur une zone de sécurité, des réseaux locaux virtuels (VLAN) et des routeurs virtuels pour configurer les stratégies de sécurité et de réseau


SRX SERVICES GATEWAYS

Highly configurable– Fixed, semi-modular, and

modular form factors

– Choice of WAN, wireless, and LAN interfaces

– Available voice media gateway

Extensive integration– Full suite of JUNOS routing and

switching capabilities

– Unmatched security, including FW, VPN, UTM, UAC, and full IPS

Exceptional performance and availability

– Hardware-assisted Content Security Acceleration (CSA) for ExpressAV and IPS

– Control & data plane separation, redundant processing and power

Priced at $699, $1099, $2199, $2999, and $16000 (list)

Model Configuration SIPGateway

ContentSecurity

Acceleration

FW/IPSPerformance

SRX100 Fixed No No 600/60 Mbps

SRX210 1 mini PIM slot Optional Optional 750/80 Mbps

SRX220 2 mini PIM slots Optional Optional 950/100 Mbps

SRX240 4 mini PIM slots Optional Optional 1500/250 Mbps

SRX650 8 GPIM slots Future Standard 7000/900 Mbps


SRX BRANCH PORTFOLIO

Large Branch/Regional OfficeSmall OfficeSRX100

Small to Medium Office

SRX210

SRX650

WAN slot, 2 x GigE, PoE

+ More LAN slots, dual processors, dual P/S

SRX240+ 4 WAN slots, 16 x GigE, PoE

SRX220+ 2 WAN slots, 8 x GigE, PoE


SRX SERIES SPECIFICATION SUMMARYFEATURES SRX100 SRX210 SRX220 SRX240 SRX650

On-board Ethernet 8 x FE 2 x GE + 6 x FE 8 x GE 16 x GE 4 x GE

Power over Ethernet (802.3af, 802.3at) None 4 ports—50 W total

8 ports GE,

120 W

16 ports GE,

150 W

48 ports GE,

250 W or 500 W

WAN slots None 1 x mini PIM 2 x SRX mini PIM

4 x SRX mini PIM

8 x GPIM

USB ports (flash) 1 2 2 2 2 per processor

Content Security Acceleration—

ExpressAV and Intrusion Detection and Prevention No YES YES YES YES

JUNOS Software version support JUNOS 10.3 JUNOS 10.3 JUNOS 10.3 JUNOS 10.3 JUNOS 10.3

Routing Performance 75 Kpps 80 Kpps 120 Kpps 200 Kpps 900 Kpps

Firewall performance (Large Packets) 650 Mbps 750 Mbps 950 Mbps 1.5 Gbps 7.0 Gbps

Firewall performance (IMIX) 200 Mbps 250 Mbps 300 Mbps 500 Mbps 2.5 Gbps

VPN Performance—AES256+SHA-1 3DES+SHA 1 65 Mbps 75 Mbps 100 Mbps 250 Mbps 1.5 Gbps

Intrusion Prevention System 60 Mbps 80 Mbps 100 Mbps 250 Mbps 900 Mbps

Connections Per Second (CPS) 2K 2K 2.5K 9K 35K

Maximum Concurrent Sessions (512MB/1GB RAM) 16 K / 32K 32K / 64K 96K 64K / 128K 512 K

Antivirus 25 Mbps 30 Mbps 35 Mbps 85 Mbps 350 Mbps

High Availability A/A or A/P A/A or A/P A/A or A/P A/A or A/P

A/A or A/P,Hot swap GPIMs,

Dual processors, Dual power


SRX100

Ideal for small sites and managed telecommuters

Fixed I/O – 8 10/100 Ethernet ports

Full UTM features: Firewall, antivirus, anti-spam, anti-spyware, web filtering, IPS (IDP)

UTM requires High memory version

On-board Ethernet 8 x FE

Mini-PIM slot No

USB ports (flash) 1

Power over Ethernet No

PSTN voice ports No

Routing Performance 75 Kpps

Firewall Performance 200 Mbps (IMIX)

VPN Performance 65 Mbps

IDP Performance 60 Mbps

High Availability A/A or A/P


SRX210

Ideal for Small branches



Available voice version with mini-PIM options

Factory-configured voice model

On-board Ethernet 2 x GE + 6 x FE

Mini-PIM slot 1

USB ports (flash) 2

Power over Ethernet 4 ports—50 W total

PSTN voice ports Yes







SRX220

Ideal for small to medium branches


2 Mini-PIM slots for WAN fail-over

High memory version only Factory configured PoE version (Q4 2010)

Voice configuration (Q4 2010)

On-board Ethernet 8 x GE

Mini-PIM slot 2

USB ports (flash) 2

Power over Ethernet 8 ports GE, 120 W (Q4 2010)

PSTN voice ports Yes (Q4 2010)







SRX240

Ideal for Small branches



Available voice version with mini-PIM options

Factory-configured voice model

On-board Ethernet 16 x GE

Mini-PIM slot 4

USB ports (flash) 2

Power over Ethernet 16 ports GE, 150 W

PSTN voice ports Yes







SRX650

Ideal for regional sites, large branches

Modular LAN switching

Services Routing Processors with optional redundancy (Future)

Power supplies with optional redundancy (at FRS)

Voice configurations (Future)


Max GE 52 ports (2 x 24 GE PIM + 4 integrated ports)

On-board Ethernet 8 x FE

GPIM slot 8

USB ports (flash) 2 per SRE

Power over Ethernet Up to 48 ports GE, 247 W

PSTN voice ports Future

Routing Performance 900Kpps

Firewall Performance 2.5 Gbps (IMIX)

VPN Performance 1.5 Gbps




SRX SERIES—FIREWALL, ZONES, AND POLICIESZONE “UNTRUST”

Originating Zone

SRX

ZONE “Accounting”ZONE “Trust”

Default Policy—Deny AllDefault Policy—Allow All

INTERNET

Originating Zone

ZONE “Guest”

Originating Zone


UNIFIED THREAT MANAGEMENT (UTM) FEATURES

Websense to block to unapproved site accessWeb Filtering

Kaspersky Lab AV stops Viruses, file-based Trojans, Spyware, Adware, Keyloggers

Kaspersky Lab AV stops viruses, file-based trojans or spread of spyware, adware, keyloggers

Antivirus

Symantec stops Spam / Phishing

Antispam

Juniper IDP detects/stops Worms, Trojans, DoS (L4 & L7), Scans

IPS

Firewall, VPN, Unified Access ControlCore Security

Firewall, VPN, Unified Access Control

SRX Series blocks transmission of files for Data Loss Prevention

Content Filtering

Internal Threats

External ThreatsINTERNET

Juniper IDP detects/stops Worms, Trojans, DoS (L4 & L7), Scans


SRX3000 LINE FOR THE DATA CENTER

Dynamic Services Architecture™

Wide range of services: FW, IPS, NAT, IPSec VPN, DDoS, QoS, and Routing

Apply any service(s) per flow

Separation of control and data planes

No need for service specific hardware

Mid-plane modular chassis design

Front and rear expansion slots

SRX3600 - up to 12 slots

SRX3400 – up to 7 slots

Interface modules offer GbE and 10GbE

Service processing modules provide linear scalability

Powered by Junos Software

Multi-threaded

Modular

Scriptable

Module Description Max Ports Interface

16-port 10/100/1000 TX 72 or 104 RJ-45

16-port GbE 68 or 100 SFP

2-port 10GbE 8 or 12 XFP

Service Processing Cards SRX3400 – 4 SRX3600 – 7


SRX5000 LINE FOR THE DATA CENTER Industry’s highest performing firewall Dynamic Services Architecture™

Wide range of services: FW, IPS, NAT, IPSec VPN, DDoS, QoS, and Routing

Apply any service(s) per flow Separation of control and data planes No need for service specific hardware

Modular chassis design Expansion slots

SRX5600 – 6 slots SRX5800 – 12 slots

Interface modules offer GbE and 10GbE

Service processing modules provide linear scalability

Powered by Junos Software

Multi-threaded

Modular

Scriptable


40-port GbE 200 or 440 SFP

4-port 10GbE 20 or 44 SFP

16-port GbE FlexIOC 160 or 352 SFP/RJ45

4-port 10GbE FlexIOC 40 or 88 SFP

Max SPCs 5 – SRX560011 – SRX5800


SRX3400 SRX3600 SRX5600 SRX5800

Max FW Throughput 20 Gbps 30 Gbps 60 Gbps 150 Gbps

Max VPN Throughput 6 Gbps 10 Gbps 15 Gbps 30 Gbps

Max IPS Throughput 6 Gbps 10 Gbps 15 Gbps 30 Gbps

Max PPS 4 Mpps 7 Mpps 10 Mpps 18 Mpps

Max Sessions 2.25 million 2.25 million 9 million 10 million

New & Sustained CPS 175,000 175,000 350,000 350,000

Interfaces 8 10/100/1000 + 4 SFP

16 x SFP module

2 x 10GbE module

8 10/100/1000 + 4 SFP

16 x SFP module

2 x 10GbE module

40 x SFP

4 x 10GbE XFP

16 x TX/SFP FlexIOC

4 x 10GbE XFP FlexIOC

40 x SFP

4 x 10GbE XFP

16 x TX/SFP FlexIOC

4 x 10GbE XFP FlexIOC

Max I/O Ports 76 x GbE or

8 x 10GbE

108 x GbE or

12 x 10GbE

200 x GbE or

40 x 10GbE

440 x GbE or

88 x 10GbE

SRX SERIES FOR THE DATA CENTER COMPARISON CHART


MODULE 5SECURITÉ DES ENVIRONNEMENTS VIRTUALISÉS

VGW : VIRTUAL GATEWAY ( ALTOR)

MODULES

– 1 –

– 2 –

– 3 –

– 4 –

– – 5 5 ––

– 6 –

– 8 –

– 7 –


THE VIRTUALIZED NETWORK

Physical Server is no longer the interesting entity

Virtual Network has become a new network layer

Isolating within physical network doesn’t address vNetwork

Inter-VM communication is a “blind spot” for physical tools

VMwareVirtual Switch

SERVERS

SERVER VIRTUAL MACHINES

Physical Network

Physical Network


SECURITY IMPLICATION OF VIRTUALIZATION

Physical Network Virtual Network

Firewall/IDS Sees/ProtectsAll Traffic Between Servers

Physical Security is “Blind” to Traffic Between Virtual Machines

VM1 VM2 VM3

Virtual Switch

HYPERVISOR

ES

X H

ost


VIRTUALIZATION & CLOUD SECURITY CHALLENGES

Threat Mitigation – Malware, Internal threats

Visibility – Inter-VM Traffic, Inappropriate Protocols

Control – VM Sprawl, Policy Enforcement, vMotion, Isolation

Compliance – Eliminate Virtualization Compliance Gaps

Database SAP WWW

VMware

Desktop Desktop

VMware

Physical Network

Virtual Switch Virtual Switch

PhysicalFirewall /IDS

WWW

Physical Server Physical Server


THE GOAL IS SECURE CLOUD COMPUTING

Corporate Backbone

Internet

Firewall

Internal Cloud

ESX 3

ESX 2

ESX 1

ESX 6

ESX 5

ESX 4

Virtualization islands can be consolidated by integrating security into the hypervisor!

Security Layer

Security Layer

Security Layer Security Layer

Security Layer

Security Layer


SECURITY INTEGRATED INTO THE HYPERVISOR

Database SAP WWW Desktop Desktop

Physical Network

PhysicalSecurity Devices

WWW

ESX ESX

Why it’s important! Security for Cloud Implementations

- Integrated Intrusion Detection, Firewalling and Network Visibility- VMs can be intermingled on shared infrastructure!

Kernel Integration is Fast and Secure!- Hypervisor Kernel Firewall (Fast Path) with individual VM security policies

vGW 3.0 vGW 3.0


Juniper SRX JuniperSwitching

Policies

vGW Virtual GatewayvGW Virtual Gateway

VMware vSphere Hypervisor

…

1. SRX Zone Visibility extends to include VM awareness

2. Firewall Event Syslogs and Netflow for Inter-VM Traffic to STRM

3. VM Traffic Inspection and Enforcement with selective mirroring to SRX for IPS

vGW Solution Integration

VM 1 VM 2 VM 3 VM 20

vGW VIRTUAL GATEWAYEXTENDING ENFORCEMENT TO ANY FLOW IN THE DATA CENTER

Security Design

Copyright © 2011 Juniper Networks, Inc. www.juniper.net


INTRODUCING THE VGW

Visibility – to all inter-VM traffic and VM configuration

Compliance – with dynamic policies against whitelists, blacklists & VM Introspection data

Control – of all traffic, of malware proliferation, of policy deviations of VMs on the “move”


VISIBILITY – VIRTUAL ENVIRONMENT


VISIBILITY – APPLICATIONS & USE


VGW & THE HYPERVISOR-BASED ARCHITECTURE

Enterprise-grade VMware “VMsafe Certified” Protects each VM and the hypervisor Fault-tolerant architecture (i.e. HA)

Virtualization Aware “Secure VMotion” scales to

1,000+ ESX “Auto Secure” detects/protects

new VMs

Granular, Tiered Defense Stateful firewall and integrated IDS Flexible Policy Enforcement – Zone,

VM group, VM, Application, Port, Protocol, Security state

THE vGW ENGINE

Virtual Center VM

VM1 VM2 VM3

Partner Server(IDS, SIM,

Syslog, Netflow)

Packet Data

VMWARE DVFILTER

VMWARE VSWITCH OR CISCO 1000V

HYPERVISOR

ES

X K

ern

al

ES

X H

ost

Security Design

for VGW


MODULE 5VPN SSLSA SERIES

MODULES

– 1 –

– 2 –

– 3 –

– 4 –

– – 5 5 ––

– 6 –

– 8 –

– 7 –


JUNIPER NETWORKS SSL VPN MARKET LEADERSHIP

Source: 3Q10 Infonetics Research Network Security Appliances and Software Report

Juniper maintains #1 market share position worldwide

Leader since SSL VPN product category inception


ANALYST PRAISE & RECOGNITION

2008 Gartner Magic Quadrant for SSL VPN

Source: Gartner (December 2010)

2010 Magic Quadrant Key Takeaways:

“Juniper has maintained the product vision, execution and overall momentum so effectively that it has held a Magic Quadrant leadership position continuously …”

“…entrenched in the Fortune 500 with a track record for large deployments.”

“Juniper is the No. 1 competitive threat cited by peer vendors…”

“Junos Pulse…is expected to pose a strong competitive advantage for Juniper SSL VPN sales.”

http://www.gartner.com/technology/media-products/reprints/juniper/vol6/article7/article7.html

http://www.gartner.com/technology/media-products/reprints/juniper/vol6/article7/article7.html


Pre-Authentication

Gathers informationfrom user, network, endpoint

Authentication &Authorization

Authenticate user Map user to role

Role Assignment

Assign session properties for user role

Resource Policy

Applications availableto user

ACCESS PRIVILEGE MANAGEMENT1 USER / 1 URL / 3 DEVICES & LOCATIONS

•Host Check: Pass•AV RTP On•Definitions up to date

•Machine Cert: Present•Device Type: Win XPManaged

Laptop

Unmanaged (Home PC/Kiosk)

Mobile Device

•Host Check: Fail•No AV Installed•No Personal FW

•Machine Cert: None•Device Type: Mac OS

•Host Check: N/A

•Machine Cert: None•Device Type: Win Mobile 6.0

•Auth: Digital Certificate

•Role Mapping: Managed

•Auth: AD Username/ Password

•Role Mapping: Unmanaged

•Auth: Digital Certificate

•Role Mapping: Mobile

•Access Method: Network Connect•File Access: Enabled•Timeout: 2 hours•Host Check: Recurring

•Access Method: Core•SVW Enabled•File Access: Disabled•Timeout: 30 mins•Host Check: Recurring

•Access Method: WSAM, Core•File Access: Enabled•Timeout: 30 mins

•Outlook (full version)•CRM Client/Server•Intranet•Corp File Servers•Sharepoint

•Outlook Web Access (no file up/download)•CRM Web (read-only)•Intranet

•Outlook Mobile•CRM Web•Intranet•Corp File Servers


customers.company.com

employees.company.com

partners.company.com

ONE DEVICE FOR MULTIPLE GROUPSCUSTOMIZE POLICIES AND USER EXPERIENCE FOR DIVERSE USERS

“Partner” Role

“Employee” Role

“Customer” Role

SA Series

Authentication Username/Password

Host Check Enabled – Any AV, PFW

Access Core Clientless

Applications MRP, Quote Tool

Authentication Username/Password


Access Core Clientless

Applications Support Portal, Docs

Authentication OTP or Certificate


Access Core + Network Connect

Applications L3 Access to Apps


RECENT UNPLANNED EVENTS - IMPACTING THE GLOBAL BUSINESS

Asia Quake Disaster (Dec 04)

Recent examples:Volcanic Ash Event (April ‘10)Snowstorms in US (Feb ‘10)

Pakistani Earthquake (Oct 05)

Bird Flu Outbreaks?

MTA Strike in NYC (Dec 05)

Bird Flu Outbreaks?

Pandemic

H1N1 VirusAvian/Bird FluSARS

Natural EarthquakesHurricanesOtherTerror attacksWinter storms

Disastrous Events

Social Distancing

Geographical isolationQuarantines

Maintain productivity Sustain partnerships Continue to deliver

exceptional service to customers and partners with online collaboration

Meet government mandates for Disaster Recovery and compliance

Business Continuity Challenges


JUNIPER NETWORKS ICE FOR BUSINESS CONTINUITY

Juniper Networks ICE delivers Proven market-leading SSL

VPN Easy deployments Instant activation Investment protection Affordable risk protection

Peak Demand

Num

be

r of

Rem

ote

Use

rs

Time

Average usage

Unplanned event

What will you do when your non-remote users need access?

Meeting the peak in demand for remote access in the event of a disaster


Bre

adth

of

Fu

nctio

nalit

yJUNIPER SSL VPN PRODUCT FAMILY FUNCTIONALITY AND SCALABILITY TO MEET CUSTOMER NEEDS

Enterprise Size

SA700

SA2500

SA4500SA6500

Designed for: SMEs Secure remote accessIncludes: Network Connect

Options/upgrades:• 10-25 conc. users• Core Clientless Access• Network & Security

Manager (NSM)

Designed for: Medium enterpriseSecure remote, intranet and extranet accessIncludes: Core Clientless Access

Designed for: Medium to large enterpriseSecure remote, intranet and extranet accessIncludes: Core Clientless Access

Options/upgrades:• 25-100 conc. users• Secure Meeting• Cluster Pairs• EES• NSM

Options/upgrades:• 50-1000 conc. users• Secure Meeting• Instant Virtual System• SSL Acceleration• Cluster Pairs• EES• NSM

Designed for: Large enterprises & SPsSecure remote, intranet and extranet accessIncludes: Core Clientless AccessSSL accelerationHot swap drives, fans

Options/upgrades:• Up to 30K conc. users• Secure Meeting• Instant Virtual System• 4-port SFP card• 2nd power supply or

DC power supply• Multi-Unit Clusters• EES• NSM

All models are Common Criteria EAL3+ certified:http://www.dsd.gov.au/infosec/evaluation_services/epl/network_security/juniper_networks_SAF.html

http://www.dsd.gov.au/infosec/evaluation_services/epl/network_security/juniper_networks_SAF.html


SECURE ACCESS FROM MOBILE DEVICES

Junos Pulse for mobile devices enables smartphone and mobile device access to email, Web, and corporate applications

EmailEmail

WebAppsWebApps

CorporateApps

CorporateApps

App

licat

ion

s

More Applications on More Devices Over Time


JUNOS PULSE PLATFORMS SUPPORTED

Platforms Junos Pulse 1.0

Windows 7, Windows XP, Windows Vista X

iPhone iOS 4.1 X

iPad iOS 4.2 X

Windows Mobile X


LA GAMME SWITCHESEX SERIES

MODULES

– 1 –

– 2 –

– 3 –

– 4 –

– 5 –

– – 6 6 ––

– 8 –

– 7 –


BUILD HIGH-PERFORMANCE NETWORKS WITH EX SERIES ETHERNET SWITCHES

EX4500 EX8216EX8208

EX2200 EX3200

Operational Simplicity

Carrier-class Reliability

Integrated Security

EX4200


JUNIPER SERIE LAN SWITCHES EX

4 SERIES DE SWITCHES : EX2200 – EX3200 – EX4200 – EX8200

Norme PoE : Technologie permettant de véhiculer sur un cable réseau standard

une tension de 48V afin d’alimenter les téléphones IP , cameras de

vidéo-surveillance ou bornes wi-fi

Technologie du Virtual Chassis sur la serie EX4200

JUNOS : fiabilité de l’OS juniper de type Carrier Class depuis 11 ans

Non Bloquant

Niveau 2 & 3

Aggressivité de Juniper pour gagner comme challengerOpportunité de se différencier avec une offre crédible face aux institutionnels


EX2200 LINE OF ETHERNET SWITCHES

Designed for branch and low-density wiring closets

Fixed configuration 24 or 48 ports PoE model options 4 SFP uplinks

Junos operating system L2 and RIP in

base license

Fixed power supply and fans

List price starts at $1,995

# Ports Port Type PoEPorts

Fixed Uplinks

Max Power Consumption(PoE Power)

24 10/100/1000B-T 0 4 SFP 100 (0) W

24 10/100/1000B-T 24 4 SFP 550 (405) W

48 10/100/1000B-T 0 4 SFP 100 (0) W

48 10/100/1000B-T 48 4SFP 550 (405) W


EX3200 LINE OF ETHERNET SWITCHES

Fixed, standalone configuration

Flexible uplink modules 4-port GbE (SFP) 2-port 10GbE (XFP) Dual-mode 4-port GbE/2-port 10GbE (SFP+)

Modular power and cooling Field-replaceable AC, DC PSU External RPS option

Field replaceable fan tray Full Class 3 PoE (15.4 W)

Runs Junos operating system with full OSPF and IP multicast in base license


Max Power Consumption

(incl. PoE)

24 10/100/1000B-T 8 112 (320) W

24 10/100/1000B-T 24 138 (600) W

48 10/100/1000B-T 8 167 (320) W

48 10/100/1000B-T 48 207 (930) W

Roadmap


EX4200 LINE OF ETHERNET SWITCHESWITH VIRTUAL CHASSIS TECHNOLOGY

Virtual Chassis technology 128 Gbps virtual backplane Manage up to 10 as a single device Extend over 10GbE or GbE uplinks Master and backup route engines

Flexible uplink modules 4-port GbE (SFP) 2-port 10GbE (XFP) Dual-mode 4-port GbE/

2-port 10GbE (SFP+)

Fully redundant power and cooling Dual, hot-swappable AC, DC PSU External RPS option

Fan FRU, multiple blowers Full Class 3 PoE (15.4 W)

LCD display Runs Junos operating system with full OSPF and IP multicast in base license


Max Power Consumption

(incl. PoE)

24 10/100/1000B-T 8 129 (320) W24 10/100/1000B-T 24 160 (600) W24 100B-FX/1000B-X N/A 108 (N/A) W48 10/100/1000B-T 8 181 (320) W48 10/100/1000B-T 48 224 (930) W

Roadmap


8 PoE ports in the-24T and -48T models

POWER OVER ETHERNET (POE) IN EX3200 & EX4200

Full Class 3 PoE (15.4W per port) Requires only one power supply IP telephony deployments need all PoE ports Lower costs with the “T” SKUs for low-density PoE

Wireless access points Surveillance cameras

24 or 48 PoE ports inthe -24P and -48P models


EX SERIES FIXED-CONFIGURATION COMPARISON

Features EX2200 EX3200 EX4200

List Price (24T) $1,995 $3,000 $6,000

RIP in base image

Enhanced L3 features (OSPF, PIM) (License)

Advanced features(BGP, IS-IS, MPLS, IPv6 routing) X (License) (License)

Modular power supply and fans X

Modular uplinks X

DC power supply X

Fiber aggregation model X X

Redundant power and fans X X

Virtual Chassis technology X X

Acoustic noise 40dB - 45dB 47dB - 55dB 47dB - 54dB

Depth (inches) 10 16.4 16.4

Max. PoE power per port (total system PoE) 30W (405W) 15.4W (740W) 15.4W (740W)

Roadmap


EX8200 LINE OF MODULAR ETHERNET SWITCHES High-performance chassis platforms

EX8208 – Eight line cards, 960 Mpps EX8216 – Sixteen line cards 1.92 Bpps 100 GbE ready Fully redundant routing engines

with N+1 redundant switch fabrics Up to 256 wire-speed, non-blocking

10GbE ports in a rack 320 Gbps capacity per line card

Virtual Chassis technology Two-member Virtual Chassis External Routing Engine (XRE) required

Fully redundant power and cooling Redundant, load-sharing PSUs

(AC, DC) Hot-swap fan tray with

redundant fans

Proven Juniper technology Switch fabrics, control plane Packet Forwarding Engine (PFE) Junos operating system


48-port 10/100/1000B-T 384 or 768 RJ-45

48-port 100B-FX/1000B-X 384 or 768 SFP

8-port 10GbE 64 or 128 SFP+

40-port GbE/10GbE 320 or 640 SFP/SFP+

Roadmap


MODULE 7WLC SERIES WIRELESS (EX-TRAPEZE)

MODULES

– 1 –

– 2 –

– 3 –

– 4 –

– 5 –

– 6 –

– 8 –

– – 7 7 ––


NOS PLUS BELLES RÉFÉRENCES


RÉFÉRENCES SANTÉ (SECTEUR PUBLIC)


RÉFÉRENCES SANTÉ (INSTITUTIONNELS)


RÉFÉRENCES COLLECTIVITÉS TERRITORIALES


CONCEPTS DE SMART MOBILE SYSTEM

Solution totalement intégrée

Disponibilité la plus élevée du marché

Management et planning centralisés unique

Un seul but: maintenir l’utilisateur connecté à son VLAN, où qu’il soit, et quoi qu’il fasse

Annexe: transformer sa géographie en donnée dynamique

AAA

WLM-RingMaster

WLC

WLC

WLA

WLA

WLM-Location Appliance


1: INTÉGRER LES BESOINS APPLICATIFS

Internet Internet

Architecture centralisée Architecture distribuée

Sécurité Management Evolutivité

Fiabilité Performance Adaptabilité


Internet

2: MULTIPLIER LES MATRICES DE COMMUTATION

Le mode centralisé n’est pas adapté aux hauts débits du 802.11n

Le mode distribué est la bonne réponse pour les hauts débits du 802.11n

10x de trafic dépasse la capacité du contrôleur,

de l’interface

11n augmente la charge par 10x

Internet


Virtual Controller Cluster

3: VIRTUALISER LES CONTRÔLEURS

WLC 1Haute Disponibilité

• MàJ d’un contrôleur• WLAs redistribués: 0.1

s• Pas d’interruption voix

Et aussi:• Répartition auto d’APs• Ajout d’APs• Meilleure utilisation des

licences

11

22

2

WLC 2

WLC 3

3

3

3

2


Trapeze Networks, A BELDEN Brand | Proprietary and Confidential | 05/16/11 Slide 89

COMPOSANTES OFFRE


FAMILLE DES CONTRÔLEURS

WLC200

32-64 WLAs (Centralized a/b/g/n)

32-192 WLAs (Distributed a/b/g/n)

WLC2

4 WLAs4

WLC2800

64-512 .11n WLAs

12 16 32 64 128 192 256 512

WLC800

16 - 128 .11n WLAs

WLA Count

WLC8

12 WLAs


FAMILLE DES POINTS D’ACCÈS

Indoor Outdoor

Fun

ctio

nalit

é

WLA432 802.11n

3x3, 300Mb/sHaut débit

WLA632802.11n

3x3, 300Mb/sHaut débit

WLA371Simple Radio

(a ou b/g)

WLA522WLA522E

802.11nNouvelle génération

WLA422802.11a et b/g

Local Switching&

Mesh


RINGMASTER : CONFIGURATION GRAPHIQUE


RINGMASTER : MONITORING


RINGMASTER PLANNING

en critères chiffrés...


RINGMASTER PLANNING

Emplacement & nombre de bornes, réglages canaux & puissance, modèle 3D RF, ordre de mission pour l’installation, fichiers de configurations pour le déploiement

• ... en réalités !


POURQUOI JUNIPER ?

Architecture Mode local / Mode distant (hébergé) Très Haute Disponibilité (cluster)

La solution d’administration Planification théorique inégalée Version 7, jusqu’à 100.000 points d’accès

Localisation Solution complète, du tag aux applications Seul acteur du marché doté d’une solution intégrée


MODULE 8SUMMARY AND NEXT STEPS

MODULES

– 1 –

– 2 –

– 3 –

– 4 –

– 5 –

– 6 –

– – 8 8 ––

– 7 –


FORMATIONS JUNIPER

Westcon Academy propose une gamme complète de cours et de certification sécurité conçue pour assurer la montée en compétences de vos équipes sur les solutions Juniper.

Formations dispensées : JunOS Routing Essential

Operating Juniper Networks Switches in the Entrerprise

Introduction to junOS system

Configuring Unified Access Control

JunOS for Security Plateforms

Configuring Juniper Security Access

Configuring Juniper FireWALL /IPSec VPN Products(…)

Sites de formations :• Courbevoie• Nantes• Toulouse

• Marseille• Lyon• Strasbourg

juniper networks - présentation | juniper networks...

Documents