Juniper 5 Daagse. Junos SPACE. Jitender K Garg Systems Engineer Juniper Networks Feb 2015

Transcription

1 Juniper 5 Daagse Junos SPACE Jitender K Garg Systems Engineer Juniper Networks Feb 2015

2 SOLVING THE PROBLEM A Scalable Approach to Network Security Management of SRX Enable EFFICIENT SECURITY POLICY MANAGEMENT for multiple security devices HIGHLY SCALABLE DEVICE MANAGEMENT to keep up with business growth COMPREHENSIVE SECURITY POLICY MANAGEMENT for granular protection JUNOS SPACE SECURITY DIRECTOR*

3 EFFICIENT SECURITY POLICY MANAGEMENT Policy Management Scale implement and validate security policy across thousands of devices Policy Configuration Scale apply single policy to multiple SRX Series gateways and/or apply a complex policy with thousands of rules to one or more gateways and scale # rules supported

4 Junos Space Security Director is tightly integrated with Junos Space Network Management platform HIGHLY SCALABLE DEVICE MANAGEMENT Can support management of thousands of Junos devices Instantly scale by simply adding or deleting nodes on the fabric Can extend # of concurrent administrators supported

5 COMPREHENSIVE SECURITY POLICY MANAGEMENT Rapidly manage FW, VPN, NAT, IPS, and AppFW from centralized console Eases policy configuration Comprehensive and intuitive Google-like search engine

6 Juniper s network management platform Efficiently Manage the New Network Junos Space SDK & APIs Programmable interface to customize apps/ Easy MoM & 3rd party integration Security Director Network Director Service Activation SPACE Platform

7 How is Junos SPACE packaged? Delivered to customers as a Fabric Embodied in a number of common appliances (physical and virtual) Junos Space applications enabled by simple licenses Quad-core processor 32 GB memory 3 1TB hot-swappable drives (RAID 5) 2U rack-mountable chassis Identical ISO, including OS Current release is VMware-based Other Hypervisors planned in future releases Identical deployment options Runs CentOS operating system Physical Virtual

8 Security Director

9 Junos Space Security Director AUTOMATES Firewall management IPsec VPN management Network Address Translation (NAT) management Intrusion prevention (IPS) signature management Application-level policy management UTM unified threat management Security Services Delivers scalable and responsive security management Improves the reach, ease, and accuracy of security policy administration Enables quick and intuitive web-based management of security policy lifecycle Publish WorkFlow: Manage policy work by role for better accuracy

10 Simplified Firewall Management 1 2 Deployed in Order 3 Granular and flexible control of policies Better organization for compliance Reuse of policies across devices Device can be a member of multiple Groups

11 Change Control Process Create Policy Create VPN Create NAT Create IPS Signatures Publish View impacted devices View CLI Verification Optimization Schedule updates Bulk update Granularity Device status Design Update Better policy oversight via cross checks at every stage of the workflow Fewer errors by separating policy work by role (designer, reviewer, operator) Approve policies by viewing actual CLI before provisioning

12 POWERFUL SEARCH ENGINE FOR EASING POLICY ADMINISTRATION EFFORTS Chicago Chicago Chicago Powerful search capability allows for finding devices, address and objects of interest quickly

13 Security director object handling Advanced object handling that helps with keeping your object library efficient

14 Simplified Firewall management with policy hierarchy

15 Simplify management of VIRTUAL PRIVATE NETWORk (VPN) IPSEC Tunnels Fully Meshed Hub-and-Spoke Site-to-Site Rapid deployment of fully meshed and hub-and-spoke VPNs Flexibility to deploy thousands of spokes with multiple hubs Better scale across thousands of site-to-site VPNs

16 easy and scalable vpn creation and management CHOOSE TOPOLOGY CHOOSE DEVICES ADDITIONAL SETTINGS

17 MANAGE Network Address translation (NAT) POLICIES Source Destination Static Granular control of NAT policies Easier management of complex NAT rules Less administration through reuse of NAT policies across devices

18 Intuitive NAT management Easy to see what is being translated

19 Informative and dynamic IPS management Informative dynamic policy based IPS management Easy to Edit and manage settings

20 Simple IPS signature management for granular control and faster remediation Color coded and categorized signatures allow for ease of management Ability to create custom signatures

21 Includes GRANULAR application identification security management APP Denied Apps X APP Approved Apps Control use of social media and cloud-based apps for better business productivity Manage apps by category, name, and risk level Block granular activity (e.g., Farmville) while enabling approved activity (such as corporate Facebook page access) Integrate AppFW, firewall, and IPS policies for easier administration Ability to create a custom signature

22 Simplified Application level security Critical Major Minor Warning Info Simply choose which applications to block or allow Signatures are categorized and color coded for ease of management and understanding Ability to create custom signatures

23 Utm policy configuration support Policy Based Antivirus Antispam Content filtering Web filtering

24 UTM Wizard

25 logging informative event viewer

26 Logging intuitive dashboard Dashboard provides an easy way to see items such as: Top Source IP s Top Destinations As well as the ability to create a custom monitor

27 Logging and Reporting Integrated Logging & Reporting Juniper Secure Analytics (JSA) SPACE Platform Log Director Supports SRX only Jump from policy to log & log to policy Moderate performance Supports events today and flows in January Supports multi-vendor Analytics engine detects violations and anomalies High performance Supports events and flows Is a SIEM (Security Information and Event Manager)

28 Role based access control Devices Policies Domain Objects Ability to place devices, policies and objects within domains then assign read or read/write permissions to a user

29 THANKS