Inhaltszusammenfassung zur Seite Nr. 1
Buyer’s Guide
For Integrated Firewall and
Virtual Private Network Solutions
Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089 USA
408 745 2000 or 888 JUNIPER
www.juniper.net
Part Number: 710008-001 June 2004
Inhaltszusammenfassung zur Seite Nr. 2
Table of Contents Introduction................................................................................................................................... 3 Executive Summary...................................................................................................................... 4 Quick Checklist............................................................................................................................. 6 Detailed Buyer’s Checklist.......
Inhaltszusammenfassung zur Seite Nr. 3
FW/IPSec VPN Buyer’s Guide Introduction Technology is radically changing the way companies conduct business, opening up new possibilities that enable efficiencies and growth on a global scale. But for everything that technology facilitates, it also opens up new risks, forcing companies to think about how to protect the assets they are working so hard to build. Security and IT administrators are faced daily with the challenge of successfully implementing technology that supports t
Inhaltszusammenfassung zur Seite Nr. 4
FW/IPSec VPN Buyer’s Guide Executive Summary Firewall/IPSec VPNs serve as the foundation upon which a strong security stance can be built, so the purchase decision should be framed in terms that support a long-term investment that can be leveraged as the organization’s needs change and grow. The chosen firewall/VPN solution should not only provide robust security functionality, but also the networking and availability features that will support the company’s ongoing connectivit
Inhaltszusammenfassung zur Seite Nr. 5
FW/IPSec VPN Buyer’s Guide 3. Deliver a high level of fault tolerance to ensure the solution is always available. Being able to survive a failure and maintain both connectivity and the security stance of the organization is the sign of good solution. The solution needs to provide redundancy at all levels to give an organization the flexibility to choose the level of availability they want for each of their network segments, based on their cost and connectivity requirements.
Inhaltszusammenfassung zur Seite Nr. 6
FW/IPSec VPN Buyer’s Guide Quick Checklist This section builds upon the framework for evaluating firewall and VPN products that was described in the previous section, providing a quick checklist of some of the top questions to pose in each criteria category. For more in- depth questions that enable a side-by-side comparison of different solutions, go to the Detailed Buyer’s Checklist that follows this section. 1. Provide Strong Security • Does the solution integrate best-
Inhaltszusammenfassung zur Seite Nr. 7
FW/IPSec VPN Buyer’s Guide 3. Deliver a high level of fault tolerance to ensure the solution is always available • Does the solution support high availability (HA) configurations, including active/active, full mesh, to reduce the chance of a single point of failure? • Does the HA solution maintain both session and VPN state information to ensure that both the connection and VPN security association are maintained in the event of a failure? • Can the solution take advantag
Inhaltszusammenfassung zur Seite Nr. 8
FW/IPSec VPN Buyer’s Guide Detailed Buyer’s Checklist This section provides a feature/functionality checklist for each of the criteria categories to help evaluators determine the true capabilities of vendor solutions they are considering. Evaluation Date: Evaluated By: Juniper Networks Alternate Firewall / IPSec VPN / Solution: Feature Deep Inspection Notes Solutions* 1. Strong Security Performs Stateful Inspection Yes Protects a
Inhaltszusammenfassung zur Seite Nr. 9
FW/IPSec VPN Buyer’s Guide capabilities Yes, Security Zones • Ability to apply policies to restrict traffic between internal network segments Ability to split network into completely separate domains and create security Yes, Virtual Systems policies for each one • Completely separate Yes policies Yes • Completely separate administrative controls Certifications: • Common Criteria Yes Yes • ICSA certification VPN Specific Uses IPSec for secure Al
Inhaltszusammenfassung zur Seite Nr. 10
FW/IPSec VPN Buyer’s Guide Safenet Open source code No The number of years the FW/VPN – June 1998 solutions have been Deep Inspection/Intrusion available on the market Prevention – Feb 2002 The applications that have been recognized as best-of- FW/VPN/Deep Inspection breed (Gartner Magic Quadrant) Simplifies deployment, All functionality managed FW/VPN/Deep Inspection reduces chance for human with the same console managed with same error that could result in int
Inhaltszusammenfassung zur Seite Nr. 11
FW/IPSec VPN Buyer’s Guide • Juniper Networks NetScreen-5XT, 5GT seriesfor remote/home offices Can scale from a small • Juniper Networks remote user to a large NetScreen-25 & -50 central site to eliminate weak for branch office or links small central site • Juniper Networks NetScreen-200 series for medium central site, regional offices • Juniper Networks NetScreen-500 and Juniper Networks NetScreen-ISG 2000 for large central sites • Juniper Networks NetSc
Inhaltszusammenfassung zur Seite Nr. 12
FW/IPSec VPN Buyer’s Guide 2. Predictable Performance Ability to process traffic of varying packet sizes to meet Yes, the performance See Tolly Reports for requirements of the network third party verification Accelerates intensive Yes, including custom processing with hardware security ASICs Ability to support applications with a low tolerance for Yes, hardware is latency/jitter, such as VoIP, optimized for streamlined multimedia, etc. processing Fast session ramp
Inhaltszusammenfassung zur Seite Nr. 13
FW/IPSec VPN Buyer’s Guide 3. Fault Tolerant – High Availability, Resiliency Device, itself, provides redundancy: o Solid-state Yes o Redundant Yes components (fans/power supplies) o Port Density Yes Supports dynamic routing Enables the survival of protocols: failures at the transport level o OSPF Yes –needed for other o BGP Yes components of resiliency o RIP Yes High Availability (HA) Configurations to reduce single point of failure: o Stateful (shar
Inhaltszusammenfassung zur Seite Nr. 14
FW/IPSec VPN Buyer’s Guide Supports different VPN deployment modes: Rule-based/Policy-based Yes Route-based Yes Dynamic Route-based (Best Yes Path) Support multiple VPN For rule-based or policy- gateways to enable VPN to Yes based VPNs persist in the event of a failure Supports multiple tunnels, Note: rule-based or policy- running the same services, Yes based VPNs cannot do this, between VPN gateways only route-based and dynamic route-based VPNs Supports fail-over
Inhaltszusammenfassung zur Seite Nr. 15
FW/IPSec VPN Buyer’s Guide 4. Ease of Use Multiple ways to interact with the system: o CLI Yes o Web UI Yes o Central Management Yes Platform Remote management options: o SSH Yes o Telnet Yes o Web (HTTP/HTTPs) Yes o Centralized Yes Management GUI o Syslog Yes o SNMP Yes o Ping for remote Yes monitoring Ability to manage the device, network and security Yes, Juniper functionality from a single Networks NetScreen- console Security Manager Ability to
Inhaltszusammenfassung zur Seite Nr. 16
FW/IPSec VPN Buyer’s Guide in logs o Identification of failures Yes in logs o Web-based trouble Yes shooting Offers roll-back option to last- known “good” configuration, if Yes changes do not “work” Ability to integrate with other Note: NTP integration allows management and enterprise internal clocks to be platforms/systems: synchronized to ensure log o SNMP traps Yes files have accurate time o MIP Yes stamps o MIB Yes o CLI via SSH for Yes configuration o
Inhaltszusammenfassung zur Seite Nr. 17
FW/IPSec VPN Buyer’s Guide 5. Simple Deployment and Installation Delivered as an appliance for simple deployment Yes Delivered as software that has to Can introduce interoperability be loaded onto hardware No issues Multiple deployment options: o Transparent mode Yes o Route mode Yes o BGP Yes o OSPF Yes o NAT Yes, can be done on per policy basis Offers multiple ways to interact with the system: o Command Line Interface Yes (CLI) o Web interface Yes
Inhaltszusammenfassung zur Seite Nr. 18
FW/IPSec VPN Buyer’s Guide Features for Remote Users and Offices Remote User solution including VPN, firewall, virus and Yes application-level protection Provides strong remote site Eliminates “weak” links with security: affordable solutions o Integrated functionality Yes to apply access control to remote traffic o Ability to protect against Yes viruses and application- level attacks o Split tunneling support Yes o Separation of corporate Yes and personal tr
