Securing the Enterprise - new trends on networking security SCOP / Bucharest 15th April 2009 Uwe Richter Sr. SE Manager Eastern Europe The most flexible, cost-effective solution for mid to large enterprises and service providers

Juniper Networks - Leadership & Expertise SRX 5800 NS1000 NS1000 w Switch 2 SRX 5600 NS-5400 ISG 2000 NS-5200 2G FW & 1G VPN 250 VSYS A/A-Full Mesh HA 4G & 12G FW 3M & 9M PPS 500 VSYS <78 interfaces & 4000 VLANs 10G & 30G FW 6M & 18M PPS 10 GigE interfaces Jumbo Frames Hardware AES 1G FW & 1G VPN 100 VSYS 60G & 100+G FW 20G & 40+G IPS 4M & 8M Sessions 2000 Now Gartner’s Magic Quadrant Juniper Networks “Upper-right” Firewall & IPSec VPN Source: Infonetics, Jun 2008

What customers expect... Deliver a superior user experience Integrated Services Faster application and service deployment Scalable Performance Simultaneously Scale Integrated Services and Network Capabilities Carrier Grade Availability Operational Simplicity through a Single Network OS Operational Simplicity Total cost of ownership advantage FAST RELIABLE SECURE 3 3

Today’s Enterprise Requirements Enablement versus Constraint Core / Infrastructure: 10 GigE More traffic, new/next gen apps, video and other streaming media Customers demand full-fledged security posture for network performance Deliver all security services at scale VPN IPSec IPS In the past, decisions were based on three perimeters: Have a tunnel/pipe and the security devices looked at 1) IP address, 2) port and 3) protocol FW 10+ Gbps

Business Challenges Performance and Flexibility Compromise Traditional solutions based on performance/flexibility tradeoff Limited performance options Deploy more platforms Disable “expensive” features Limited flexibility options Deploy dedicated appliances Flexibility Performance

Pitfall of Today’s Security Adaptability Limited flexibility in adapting to business requirements Poor service integration resulting in poor business operations Complex rack space planning Installation, management and maintenance overhead Rack Space Planning: High CAPEX: High OPEX: High 10 Security Requirements FW, IPS & VPN (Gbps) ASA 5540 5 Network Traffic Requirements TODAY Time FUTURE

Dynamic Services Architecture ™ Dedicated Control Plane Built-on Terabit Fabric Interchangeable I/O and processing cards Any service, any card Feature integration on JUNOS Fast time to market Tightest integration between features Carrier-class Reliability Service Integration via JUNOS ™ Dedicated Management Fabric FW IDP NAT VPN DoS QoS Interface Scalability Processing Scalability

SRX Services Gateway Family of JUNOS-based Dynamic Services Gateways Consolidate Management Framework App Layer Forwarding Threat Prevention Access Control Routing Firewall IPS IPSec VPN NAT SRX Dynamic Services Gateway 8

SRX Dynamic Services Gateways Sept 2008 Market Introduction SRX5000 Series Services Gateway Revolutionary Architecture Integrated Services Scalable Performance Operational Simplicity World’s Fastest Security Solution The heritage of ScreenOS on JUNOS

Juniper (mid to high-end) Enterprise Security Portfolio SRX5800 150 Gbps Services Gateway Designed for integration and scalability Dynamic Services Architecture Terabit Fabric Technology Dynamic Processing Pool Dynamic I/O Pool JUNOS SW feature delivery SRX5600 50 Gbps 30 Gbps Products addressing this segment? 10 Gbps NS5400 ISG/IDP FW and Integrated Security Designed for enhanced perimeter and DC security

No Compromise Security: SRX3000-line: The most cost-effective network security solution Maximum Flexibility without Sacrificing Security Unmatched Price / Performance Powered by JUNOS and Juniper’s Dynamic Services Architecture (DSA) Based on Dynamic Services Architecture™ for accelerated new service deployment

SRX3400 Front Rear Hardware Modular chassis Fixed Interfaces 7 slots (4 front, 3 rear) MGT module – dual, hot swap 3U chassis height Fixed Interfaces 12 built-in (8-10/100/1000 + 4-SFP) 2 Ethernet Management Ports Modular Interfaces 16-10/100/1000 16-SFP 2-XFP Performance & Capacities FW – 10/20 Gbps VPN – 6 Gbps IDP – 6 Gbps Concurrent sessions – 1M New and sustained CPS – 175k Concurrent IPSec VPN tunnels – 10k Front Rear

SRX3600 Front Rear Hardware Modular chassis Fixed Interfaces 12 slots (6 front, 6 rear) MGT module – dual, hot swap 5U chassis height Fixed Interfaces 12 built-in (8-10/100/1000 + 4-SFP) 2 Ethernet Management Ports Modular Interfaces 16-10/100/1000 16-SFP 2-XFP Performance & Capacities FW – 10/20/30 Gbps VPN – 10 Gbps IDP – 10 Gbps Concurrent sessions – 2M New and sustained CPS – 175k Concurrent IPSec VPN tunnels – 20k Front Rear

Sample SRX3000 Base Configurations Minimal Configuration SRX 3400 Chassis 1 SPC 1 NPC SRX3600 Minimal Configuration SRX 3600 Chassis 1 SPC 1 NPC

System configuration flexibility Flexible configuration of IOCs, NPCs and SPCs: SRX3400: 7 slots for Common Form-factor Modules (CFMs): 4 in the front for IOCs and SPCs 3 in the rear for NPCs and SPCs 4 SPCs max (1 min) 2 NPCs max (1 min) 4 IOCs max SRX3600: 12 slots for Common Form-factor Modules (CFMs): 6 in the front for IOCs and SPCs 6 in the rear for NPCs and SPCs 7 SPCs max (1 min) 3 NPCs max (1 min) 6 IOCs max SRX 3400-DC is limited by power supply capacity. No HA limitations.

SRX 3K Packet Flow – Fully Integrated Flow Lookup Classification DoS/DDoS Policing Network Processing Cards Routing / Device MGT RE Services FW/VPN/IDP NAT/Routing Integrated in SRX 5000 IOC Oversubscrptn. Control 1.5 Fabric Fabric  Ingress Packet  Egress Packet Services Processing Cards Input/Output Cards QoS/Shaping

Integrated Services Dynamic Services Architecture Differentiator Juniper SRX Traditional Appliances Dedicated Control Plane   Buildable Processing Pool   Buildable I/O Pool   Scalable Service Engine   Single policy/configuration   Single device to manage  

Adapting to Changing Security Requirements High integration supporting wide range of services Scales as your business grows Minimal/No policy changes required Rack Space Planning: NONE CAPEX: LOW OPEX: LOW 10 Security Requirements FW, IPS & VPN (Gbps) 5 Network Traffic Requirements TODAY Time FUTURE

10 Gbps FW, IPS & IPSec VPN Solution Price per Gbps FW/IPS/IPSec VPN Industry’s Most cost-effective security solution Power Savings 10 Gbps FW, IPS & IPSec VPN Solution Price per Gbps FW/IPS/IPSec VPN 83% SAVINGS 84% SAVINGS 84% SPACE SAVINGS Price per FW Gbps 31 Appliances Cisco ASA 5580 44% SAVINGS Juniper SRX 3600 Juniper SRX 3600 Cisco ASA 5540

Juniper (mid to high-end) Enterprise Security Portfolio SRX5800 150 Gbps Services Gateway Designed for integration and scalability Dynamic Services Architecture Terabit Fabric Technology Dynamic Processing Pool Dynamic I/O Pool JUNOS SW feature delivery SRX5600 50 Gbps SRX3600 30 Gbps SRX3400 10 Gbps NS5400 FW and Integrated Security Designed for enhanced perimeter and DC security ISG/IDP

Juniper Networks Security Manager A comprehensive approach to security management Device-lifecycle management Manages through every phase of device lifecycle: design, deploy, configure, monitor, maintain, upgrade, adjust Manage all aspects of configuration Manage configuration tasks at device, networking and security levels Delegation of administrative access Provides needed power and tools to the right groups (access and control) Control to provide/restrict information to different people within the organization, allowing them to make appropriate decisions Monitor / Maintain Upgrade / Adjust Configure Design / Deploy Juniper NSM is for those environments that have large deployments of Juniper FW/VPN and IDP devices. Right now it manages only the Firewall/VPN and IDP platforms, but going forward that will be extended to other Juniper security platforms as well. The Device Lifecycle

NSM Management Features Description Scheduled Security Updates Automatically update devices with new attack objects Domains Service providers and distributed enterprises may use this mechanism to logically separate devices, policies, reports, objects, etc… Role-based Administration Granular approach in which all 100+ activities in the system may be assigned as a separate permissions Object Locking Multiple administrators can safely and concurrently modify different objects in the system at the same time Audit Logs Sort-able and filterable record of who made which changes to which objects in the system Device Templates Manage shared configuration such as sensor settings in one place Job Manager View pending and completed directives (such as device update) and their status High Availability Active/passive high availability of the management server Scheduled Database Backups Copies of the NSM database may be saved on a daily basis NSM is Juniper’s central management tool for FW/VPN and IDP appliances. Domains and Role-based Admin feature deserves to be pointed out in this slide. While often requested by service providers, this feature is also very valuable to enterprise. It is not uncommon for enterprise to logically divide the roles of administrators based on the type of security gear so that s specific administrator manages firewall policies while others manage IDP policies, etc… It is also common for enterprises to logically separate admin responsibilities based on their business requirements (e.g., a particular admin manages all security gear at a specific branch office while another manages the headquarter).

3-Tier Management Network-Security Manager (NSM) NS-5000 Series ISG / ISG with IDP NSM SSG Series NSM utilizes a 3-tier management architecture which optimizes performance as well as security. From the perspective of the administrator, managing multiple security appliances is greatly simplified. Centralized NSM Server Common User Interface IDP Appliances

JUNOS Future Direction Integrated security and networking on JUNOS Continued leadership in security JUNOS Integrated security and networking on JUNOS Best-in-Class Security Continued leadership in networking Best-in-Class Routing

Ministry of Foreign Affairs The High-Value Branch When remote sites are essential to the organization’s strategic mission, you can WIN! Ministry of Foreign Affairs

What Are High-Value Remote Locations? Gateways to Better Businesses Role Mission Changes The Humble Storefront Revenue Gateway Create new sources of revenue and operational efficiencies Support partners, guests, and devices Reputation and compliance The Mission Critical Clinic Service Gateway Attract and retain valuable clients Centralization of applications and databases; SaaS Privacy and compliance The High-Powered Center of Excellence Innovation Gateway Retain and activate a high quality workforce Advanced collaboration Unrestricted Internet access for employees

THANK YOU