Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net 1 Unified Access Control Solution Javier López –

2 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net  SSL VPNs Review  Unified Access Control Solution  Unified Access Control Scenarios  Live Demo AGENDA

3 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net SSL VPNs vs. IPSec Business Partners Mobile Workers Branch Offices Home workers Data Center Internet Department Servers DMZ Finance HR Sales Customers Extranet access SSL VPN Site-to-Site IPSEC VPN Intranet access SSL VPN Employee remote access SSL VPN

4 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Typical Custom Extranet Deployment Web server DMZ MRP/ERP API Internal Corporate LAN Web server API Web server Policy Server SW Agent Web server SW Agent Extensive Deployment Requirements:  Duplication & Migration of Servers into DMZ  Harden OS/Server Farms & Ongoing Patch Maintenance  Maintenance of public facing infrastructure  AAA Limitation to only those integrated resources  Custom API development for non-Web content UNIFIED ACCESS ENFORCEMENT:  Dynamic Authentication Policies  Expressive Role Definition & Mapping Rules  Dynamic Resource-based Authorization  Granular Auditing & Logging  Web Single Sign-On (SSO)  Password Management Integration  Multiple Hostnames & Customizable UI  Endpoint Policy Enforcement

5 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net The Secure Access Platform in the Network MRP/ERP Intranet / Web Server Unix/NFS = Encrypted External Session = Standard Internal Session Corporate LAN Partner A Directory Store Partner B Extranet Partners Server Farms Sales & Service Telecommuters Mobile Employees

6 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Three Access Methods for Granular Secure Access Core Access Core Client less access Web content / links Web based applications XML, Flash, JAVA Files (Webified) Telnet / SSH Terminal Emulation Secure Application Manager (JSAM and WSAM) TCP based Client / Server application access JSAM JAVA applet Cross platform WSAM Active-X control Transparently redirects application requests Per application (client process) Per host (Hostname / IP:port range) MD5 Checksum for application validation Windows 2K/XP/98 Pocket PC (Win CE ) Network Connect (NC) Network Layer tunnel Virtual adapter Static, DHCP and RADIUS based IP address assignment TCP and UDP based Client / Server application access Server Initiated applications such as VoIP, X- Windows, NetMeeting

7 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net From the field From the LAN From a Kiosk Pre Authentication Gathers information from user, network, endpoint Dynamic Authentication Authenticate user Map user to role Roles Assignment Assign session properties for user role Resource Policy Grant access to resource as specified by policy SAM = No File = No Web Download=Yes Web Upload=No Timeout = ½ hour Host Check = Recurring Digital Cert = NO Source IP = outside Host Check = failure Authentication = Strong Mapped to Field role Resources = CRM Web-read only Outlook Web Access Digital Cert = YES Source IP = outside Host Check = success Authentication = Strong Mapped to Sales role SAM = Yes File = Yes Web Download=Yes Web Upload = Yes Timeout = 2 hours Host Check = Recurring Resources = CRM Client/Server Exchange Digital Cert = YES; Source IP = LAN; Host Check = success Authentication = PW Mapped to Office role Network Connect = Yes Timeout = 12 hours Host Check = No Resources = Full network access Step 3a: Control Access – 1 URL Same person access from 3 different locations

8 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Breadth of Functionality Juniper SSL VPN Product Family: Functionality and Scalability to Meet Customer Needs Enterprise Size Secure Access 700 Secure Access 2000 Secure Access 4000 Secure Access 6000 Designed for: SMEs Secure remote access Includes: Network Connect Options/upgrades: conc. users Core Clientless Access Designed for: Medium enterprise Secure remote, intranet and extranet access Includes: Core Clientless Access Designed for: Medium to large enterprise Secure remote, intranet and extranet access Includes: Core Clientless Access Options/upgrades: conc. users SAMNC Secure Meeting Advanced w/ CM Cluster Pairs Options/upgrades: conc. users SAMNC Secure Meeting Advanced w/ CM Instant Virtual System SSL Acceleration Cluster Pairs Designed for: Large-global enterprise Secure remote, intranet and extranet access Includes: Core Clientless Access SSL acceleration Options/upgrades: conc. users SAMNC Secure Meeting Advanced w/ CM Instant Virtual System GBIC Multi-Unit Clusters

9 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Web Mail Farm Intranet Web Farm Corporate Intranet 1,000’s Teachers’ Home PCs 10,000’s Students’ Home PCs Mobile User Cost Scalability  Users access from home PCs  No install, configuration or support  Only variable cost is authentication Increased Security  Unified Security Layer Across Servers  Known Hardened Security Posture  Common Auth’n & Auth’z Policies WWW Case #1: Remote Access for Students/Teachers

10 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net ERP Application Server Corporate Intranet School A Cost Scalability  Rapidly Add/Drop Partners  No Timely Security Negotiations  No Cap Ex per Additional Partner Increased Security  Group Based Auth’z Policies  Strong Auth’n & PKI  Resource-Based Logging Unix/NFS Files School B School C Case #2: Campus Services Access

11 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net  SSL VPNs Review  Unified Access Control Solution  Unified Access Control Scenarios  Live Demo AGENDA

12 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Trend and Business Problem WAN LAN Remote Office LAN User Mobile User Day Extenders Business Partners LAN User Data Center Mission critical apps, File Servers, ERP, CRM etc Widely diverse users Unmanaged or ill managed endpoints Business critical network assets “Deadly” network and application-layer threats 11% QoQ increase in new vulnerabilities – Q2,’05 SANS Zotob took 96 hours from patch to full outbreak New threats exploit common TCP ports, requiring both host intelligence and network-based enforcement

13 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net How the Enterprise Infranet works  What Does it Do? The Enterprise Infranet couples user identity, network identity, and endpoint status with network and endpoint policies.  How Does it do it? Using a centralized policy management to push policy based on user, endpoint, network, etc to enforcement points throughout the network. Policy management is done by leveraging Dynamic Access Privilege Management (proven by #1 SSL VPN - IVE) Enforce the policies on different points throughout the network (proven by #1 FW/VPN – ScreenOS) 13 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net

14 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Unified Access Control Solution How does it work? Infranet Agent (IA) Comprehensive enterprise integration AAA Servers Identity Stores Phase 1 Enforcers Infranet Controller (IC) Unified policy enforcement based on identity, endpoint assessment, and network IA protects authenticated endpoints from malicious/non-compliant endpoints Host Checker (J.E.D.I) Host Enforcer (with firewall policy or optional dynamic MS IPSec enforcement) MS Windows Single SignOn Agentless enforcement for Mac and Linux Enforcers – ScreenOS 5.3 capable NetScreen 5GT – NetScreen 5000 From 90 Mbps to 30 Gbps Access control decision point Automatically provisions Infranet Agent (if required) Dynamically provisions enforcement policy Integrated remediation support

15 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Juniper Networks Infranet Controllers IC 4000 Supports up to 3000 concurrent endpoints per appliance High Availability/Scalability Cluster pairs IC 6000 Supports up to 25,000 concurrent endpoints per appliance High Availability/Scalability Multi-unit clusters Unique hardware features Hot swappable, field upgradeable power supply Field upgradeable hard disk Hot swappable fans

16 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Infranet Agent Dynamically provisioned endpoint assessment and policy enforcement agent No pre-installed client software Lightweight (<1Mb) Host Checker (J.E.D.I) for endpoint assessment Native Functionality APIs for leveraging third party endpoint solutions Pre login and post login endpoint assessment for compliance enforcement during entire duration of user session Host Enforcer Dynamic role based firewall policy Optional dynamic MS IPSec enforcement MS Windows Single SignOn Agentless enforcement for Mac and Linux Endpoint Assessment but no IPsec

17 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Phase One Infranet Enforcers Phase 1 incorporates Juniper FW/VPN platforms Screen OS 5.3 Software upgrade required 75Mbps to 30Gbps for wire speed policy enforcement in LAN Network security policy enforcement DOS Protection Deep Packet Inspection Anti Virus Capabilities Content Management Logging and Auditing SEM, NSM Integration HSC NetScreen 5 Series NetScreen 204 & 208NetScreen 25 & 50 NetScreen 5200 & 5400 ISG Series NetScreen 500

18 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Data Center Mission critical apps, File Servers, ERP, CRM etc AAA Servers Identity Stores 1.Endpoint: Assess, Authenticate,Remediate, Contain & Self-Protect Enterprise Infranet Service Control Layer Deployment Scenarios Enterprise Infranet Controller (IC) 3. Authorize, Enforce & Log 2. Trusted XPort (IE) Enterprise Infranet Agent (IA) J.E.D.I. APIs Native or 3 rd Party Host Compliance Trusted Xport Self-Defense Mobile Worker Bus. Partner Infranet Enforcer (IE) (IE) 3. Authorize, Enforce & Log

19 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net  SSL VPNs Review  Unified Access Control Solution  Unified Access Control Scenarios  Live Demo AGENDA

20 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Server Front End Deployment Scenario Data Center Mission critical apps, File Servers, ERP, CRM etc AAA Servers Identity Stores Network Services (DNS, DHCP) Enterprise Infranet Controller (IC6000) Infranet Enforcer (IE) Users

21 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net WAN Gateway Deployment Scenario Data Center Mission critical apps, File Servers, ERP, CRM etc AAA Servers Identity Stores Network Services (DNS, DHCP) Enterprise Infranet Controller (IC4000) Infranet Enforcer (IE) Users

22 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Distributed Enterprise Data Center Mission critical apps, File Servers, ERP, CRM etc AAA Servers Identity Stores Network Services (DNS, DHCP) Enterprise Infranet Controller (IC6000) Infranet Enforcer (IE) Users Branch OfficeCorporate Office Infranet Enforcer (IE) Site to Site VPN AAA Servers Identity Stores Network Services (DNS, DHCP)

23 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Campus – Wired Deployment Scenario Data Center Mission critical apps, File Servers, ERP, CRM etc AAA Servers Identity Stores Enterprise Infranet Controller (IC6000) GigE Users Infranet Enforcer

24 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Data Center Mission critical apps, File Servers, ERP, CRM etc AAA Servers Identity Stores Campus – Wireless Deployment Scenario Enterprise Infranet Controller (IC4000) Infranet Enforcer (IE) Generic AP GigE

25 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net  SSL VPNs Review  Unified Access Control Solution  Unified Access Control Scenarios  Live Demo AGENDA

26 Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Demo Network architecture Infranet Agent (IA) Local Auth Server Enforcer NS-25 Infranet Controller (IC-4000) / Untrust Zone Enforcer 5GT

Copyright © 2005 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net 27 Thank You