1. Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net 1 IPSec or SSL VPN? Decision Criteria

2. 2 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net The Traditional Enterprise Leased Lines The Extended Enterprise Business Partners Day Extenders Mobile Workers Customers Branch Offices Fixed Telecommuters Data Center

3. 3 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Business Connectivity Requirements  Must support business productivity for all audiences, while cost- effectively securing communications Secure Affordable Raise Productivity High Performance & Availability

4. 4 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net The Enterprise Connectivity Solution Use the Internet to replace leased lines Business Partners Day Extenders Customers Branch Offices Fixed Telecommuters Data Center Business Partners Mobile Workers Fixed Telecommuters Mobile Workers Internet

5. 5 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net NetScreen IPSec and SSL VPNs Department Servers DMZ Finance HR Sales Business Partners Day Extenders Mobile Workers Customers Branch Offices Fixed Telecommuters Data Center Internet

6. 6 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net The Secure Access Landscape Fixed/Site-to-SiteRemote Access Connectivity Requirements:  Bridge fixed, “trusted” networks  Managed devices  Transparent access to remote LAN  Full access to network resources  Network-layer mgmt & administration Connectivity Requirements:  Access from “untrusted” networks  Access from unmanaged devices Options:  Internet VPNs (IP Sec)  Network VPNs (MPLS) Options:  SSL VPNs Remote/Branch Office Fixed telecommuters Business Partners Customers HQ Mobile employees/consultants

7. 7 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Juniper Network Netscreen Secure Access SSL VPNs and IPSec VPN Products Type of Application Type of PCRemote Network Security Type of Connection Type of VPN Remote Office/ Branch Office CorporateManaged, TrustedFixedIPSec Mobile EmployeeCorporate or Non-Corporate Unmanaged, Untrusted MobileSSL VPN Partner/CustomerNon-CorporateUnmanaged, Untrusted MobileSSL VPN

8. 8 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net NetScreen VPNs Meet Business Needs Requirements: Resiliency at device, network and VPN level Dynamic Route-Based VPNs leverage "self-healing” capabilities Centralized management Integrated purpose-built solution Integrated high performance, robust firewall (w/ Zones) Secure Affordable Ease of use High Performance & Availability NetScreen IPSec VPNNetScreen Secure Access SSL VPN Hardened appliance, AAA policy integration, and access privilege management Route-based VPNs offer low TCO for site-to-site or fixed configurations No client or server changes Low TCO for remote/mobile employees, partners and customers Simple Web interface Centralized management for administrators Stateful failover an a variety of clustering options

9. 9 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Industry Analysts Agree The IPSec VPN Market is Growing IPSec VPN market: $10B in 2003, $12B by 2004 Inclusive of hardware, software and services Site-to-Site VPNs (Infonetics 2003) 60% of enterprises implementing network-layer VPNs

10. 10 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Industry Analysts Agree… The SSL VPN Market is Growing TAM M$’s (Infonetics 2/04) Remote Access “We project that by 2004, 60% of corporate users will use SSL for remote access at least some of the time.” “By 2005/06 SSL- based solutions will be the dominant method for remote access, with 80% of users utilizing SSL...” TAM M$’s (Infonetics 2/04)

11. 11 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Decide Your VPN Needs By User Type and Network IT environment:IPSec VPNSSL VPN Type of connectionFixed connectionTransient connection Type of deviceManaged corporate deviceVarying devices Type of accessSite-to-siteRemote employee, business partner, customer Access Controls Robust firewall functionality Enables access management policy enforcement

12. 12 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Decide Your VPN Needs By User Type and Network User constituency:IPSec VPNSSL VPN Remote office employeesX IT staffXX Mobile employeesX Day extendersX ConsultantsX CustomersX Business partnersX

13. 13 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net Decide Your VPN Needs By User Type and Network Applications and content:IPSec VPNSSL VPN Voice Over IPX Entire subnets with no application access control required X Networks, including intranets and extranets, that require access control X Web applicationsXX Client/server applicationsXX Intranet contentXX EmailXX File ServersXX Server socket dependent applications XX

15. 15 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net IPSec and SSL IPSec Design Goal – low level secure network connectivity Network layer connection IPSec encryption Any TCP ports flow over tunnel Usually done with a hardware gateway on the LAN and a hardware or software client Gateway IPSec Gateway Tunnel/transport applications SSL Design Goal – Secure application-to-application connectivity Server Specific Protocol Client Port 443 Application layer connection SSL or TLS encryption Specific port is open (easier to secure) Usually done in application software (included with all standard Web browsers and e-mail applications)

16. 16 Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net IPSec and SSL Physical Data Link Network Transport Sessions Presentation Application Transport Internet Protocol Network HTTP, FTP, POP TCP, UDP IP SSL/TLS IPSec OSI TCP/IP