DATASHEET JUNOS SPACE SECURITY DIRECTOR Product Overview Exponential growth in network traffic, changes in end user behavior, and an onslaught of new applications and content are expanding the avenues available to malicious attackers. Managing security policy in these complex environments can become overly time-consuming and prone to error if management solutions are slow, unintuitive, or restricted in their level of granularity and control. Juniper Networks Junos Space Security Director provides security policy compliance through an intuitive, centralized web-based interface that offers enforcement across emerging and traditional risk vectors. Product Description Juniper Networks Junos Space Security Director delivers a scalable and responsive security management application that improves the reach, ease, and accuracy of policy administration. It helps administrators more quickly and intuitively manage all phases of security policy lifecycle through one centralized web-based interface. The latest Junos Space Security Director features include powerful application identification control with Junos Application Secure, as well as Junos Network Secure, Junos IPS Secure, Network Address Translation (NAT), and Junos VPN Site Secure security policy management. Junos Space Security Director runs on the Junos Space Network Management Platform, enabling administrators to extend their policy control capabilities both broadly and deeply. This includes managing security policy horizontally across multiple Juniper Networks SRX Series Services Gateways, and vertically to manage LSYS instances or dense and varied security rule bases on individual SRX Series devices. This reach improves security policy consistency and compliance, even as networks scale. Security Maintain Remediate Junos Space Security Director Monitor Create Deploy JUNOS SPACE SECURITY DIRECTOR FOCUS: Junos Network Secure Policies Junos VPN Site Secure Policies NAT Policies Junos IPS Secure Policies AppFW Policies RESTful Web Service API Network Infrastructure JUNOS SPACE NETWORK MANAGEMENT PLATFORM: Templates Inventory Configs Traffic Events Scheduler Database Tasks UI Widgets JUNOS SPACE NETWORK MANAGEMENT PLATFORM Device Management Inventory Management Image Management User Management Audit Logs Device Management Interface (DMI) Figure 1: Junos Space Security Director, a management application running on the Junos Space Network Management Platform. 1
administrators can use Junos Space Security Director to speed and simplify security administration and reduce management costs and errors with efficient security policy and workflow tools. Junos Space Security Director helps ease administration through a responsive Web interface and granular control over global, group, and device level firewall policies. Administrators can intuitively manage the entire policy lifecycle in one easy-to-use interface, from policy creation to remediation. Rapid search tools quickly locate policy terms or issues even inside rules for faster maintenance. Junos Space Security Director reduces management costs and errors with efficient security policy, workflow tools, and a powerful app and platform architecture. Specialized features such as Publish Workflow help delegate policy work by role and check policy/command-line interface before provisioning, to reduce the risk and costs of accidental errors. To improve policy accuracy and compliance, administrators can reuse Junos Space Security Director policies across integrated firewalls, intrusion prevention, and NAT. Junos Space Security Director lays the groundwork for further management innovation across the network (i.e., domains) as part of the Junos Space Network Management Platform. For example, new apps can be added in a familiar interface, minimizing staff training time on new technologies and driving innovation as part of developer ecosystem contributions. As an application running on the open Junos Space Network Management Platform, Junos Space Security Director is a security management building block providing extensive security scale, policy control, and reach across the network. Junos Space Junos Space Security Director is part of Junos Space, which is Juniper s comprehensive Network Management Solution that simplifies and automates management of Juniper s switching, routing, and security devices. The Junos Space Network Management Platform provides deep element management for extensive FCAPS capability, same day support for new devices and Junos releases, a task-specific user interface, and northbound APIs to easily integrate into existing NMS or OSS/BSS deployments. Extending the breadth of the Junos Space Network Management Platform are multiple Junos Space Management Applications that optimize network management for various domains. These applications, with their easy-to-use interface, enable you to provision new services across thousands of devices and optimize work flow tasks for specific domains, such as core, edge, data center, campus, security, mobile, and more. Figure 2: Use Junos Space Security Director to block engineering s access to Farmville and allow marketing access to the entire web. Table 1: Junos Space Security Director Features and Benefits Web-based GUI Policy Locking Policy Versioning Published workflow Policy lifecycle management Junos Application Secure - application identification and classification policy management Graphical user interface that is responsive and portrays policy management capabilities in an intuitive view Prevents two users from editing the same policy at the same time Allows users to snapshot, compare and roll back configuration version Ability to save and publish different services to be updated at a later time to appropriate firewalls Ability to manage all phases of security policy lifecycles, including create, deploy, monitor, remediate, and maintain Ability to control and protect against misuse of applications resulting in security risks or productivity impact on the enterprise, with applications like Facebook games or instant messaging Allows administrators to drag and drop, easily switch between views, and quickly refresh data for an updated view Reduces configuration errors Simplifies configuration changes and allows recovery from configuration errors Allows administrators to review their firewall, VPN, and NAT policies before updating the device Saves administrators troubleshooting time, avoids errors, and saves costs associated with errors Enables central policy control over Junos Network Secure, AppFW, Junos IPS Secure, VPN, and NAT in one Junos Space Security Director management console Eases administration by unifying common policy tasks within a single interface Reduces errors by enabling reuse of policy across multiple devices Delivers greater visibility, enforcement, control, and protection over the network 2
Table 1: Junos Space Security Director Features and Benefits (continued) User-based firewall policies Integrated Junos IPS Secure and AppFW rule Junos IPS Secure/AppFW signature management Junos IPS Secure manual mode NSM import support for SRX Series gateways Device import support Simple VPN VPN dynamic routing management Extranet VPN LSYS support All devices policy Group policies Multi-group membership Junos Space Security Director and Juniper Networks Unified Access Control capability to configure all traffic, including AppFW approved or restricted traffic, based on user identity Ability to configure Junos IPS Secure and AppFW rules within a single firewall policy/ rule Flexible, granular, and automatic signature management for Junos IPS Secure and AppFW Ability to custom-select intrusion prevention signatures Ability to import Juniper Networks Network and Security Manager firewall policy, NAT policy, and objects for SRX Series gateway deployments for use in Junos Space Security Director 12.1 Ability to extract SRX Series gateway device information for use in Junos Space Security Director 12.1 (information imported can include firewall policy, NAT policy, and objects such as address and service) Predefined VPN profiles that provide the ability to easily configure site-to-site, huband-spoke, and fully meshed VPNs Ability to leverage router and switch protocols such as OSPF and RIP to support virtual private network configuration Ability to configure a secure connection between your Juniper device and a partner or supplier network Ability to partition resources and run multiple instances of policies on an individual SRX Series gateway with Logical Systems (LSYS) support Ability to group common policies and deploy them across all SRX Series gateways Ability to apply a comprehensive policy for a set group of devices or device Ability for one device to belong to more than one policy group, and a group to be assigned a priority relative to other groups Provides granular control over application policy Enables identity-based application security management Allows customers to configure Junos IPS Secure and AppFW rules within the context of the rule Saves time for remediation, as users don t have to navigate back and forth to make simple policy changes Allows customers to automatically download the latest signatures and view them instantly (with quick and dynamic filtering, users can preview and look at all signatures, then appropriately apply them) Provides better research, which can reduce false positives when applied to policy Allows granular control over intrusion prevention security Automates migration of some essential policy data from existing NSM SRX Series deployments Allows for reuse of existing NSM policies to save setup time and carry forward policy improvements Leverages investments in NSM in a more responsive and scalablejunos Space Security Director security management architecture Automates migration of some essential device data from existing SRX Series deployments Lessens administrative burden Allows customers to leverage or customize existing VPN profiles, and in a few clicks configure thousands of VPN tunnels Saves time and reduces the risk of mis-configuration Eases implementation of secure communication between SRX Series devices with Junos Space Security Director and other network devices Supports agile and productive business by allowing quick and secure connections to partner or supplier networks Scales security policy by enabling management of different security policies per LSYS instance on a single SRX Series security gateway Maximizes IT investments by reusing existing infrastructure for further functionality Allows customers to maintain compliance by creating global policies that impact all SRX Series devices Allows customers to group common device policies and apply them to thousands of devices Speeds policy implementation across multiple groups or devices Provides flexibility in policy configuration to address customers unique needs Easy to create complex hierarchies of policies 3
Features and Benefits Table 2: Junos Space Network Management Platform Features and Benefits Junos Space Network Management Platform Web 2.0 GUI Device Management Interface (DMI) Hot-pluggable/multi-tenant applications Application fabric Network Operations Network discovery and inventory management Topology Software image management An open, scalable, and secure network management platform Task-oriented GUI to enable users to complete tasks in congruent navigation steps and screen flows without context switches Persona-oriented system views and workflows Workflow automations for common tasks Progressive disclosure for contextual view of the network XML schema and metadata files describing how to manage each release of the device s software Hosted applications that can be hot-plugged into Junos Space platform via global dashboard Applications that leverage global platform capabilities but maintain their unique identities Distributed fabric of IP-connected physical or virtual appliances of preassembled, near identical full application stacks, including the complete Junos Space software to enable each appliance to provide full management functionality End users who are able to access management applications through a single, public virtual IP Fabric that is deployed in active/active cluster configuration Network and device discovery Near real-time network inventory Dedicated socket connection to each device Inventory management for automated collection of inventory data from Juniper devices Inventory views of physical and logical inventory of supported devices, allowing users to generate reports and track locations, availability, and deployment of hardware and software Automated synchronization between hardware inventory, interface information, and configuration of the device Multi-target specification (IP address, IP address range, IP subnet, host name) Automated discovery of network topology (devices and interconnections) Tools for visualizing the discovered topology Tabular view for device-specific details Topology view for broad network visibility Semantic zooming for fine-grained device view Centralized device software installation for all managed devices Enables device images to be uploaded from local file system and deployed onto a device or onto multiple devices of the same device family in a single workflow Image verification for accuracy Junos Space is a comprehensive Network Management Solution that simplifies and automates management of Juniper s switching, routing, and security devices. Junos Space consists of a Network Management Platform for deep element management, a programmable SDK for customization, and domain-optimized management applications for reducing costs and provisioning new services quickly Working cohesively, Junos Space offers a unified network management and orchestration solution to help you more efficiently manage the New Network With Junos Space, you can simplify and automate the network, improve network agility, and deliver new services quickly, all from a single console Identity-based navigational flows and a consistent user experience that increase user productivity, eliminate error-prone manual operations, and speed up operation cycle times Lower OpEx due to reduced requirement for highly skilled personnel; reduced training and support costs due to consistent interface and workflow automation Zero-day device support Future proofing of network investments Rapid deployment of applications and devices In-service application and device updates to increase uptime and business continuity Instant scale by simply adding or deleting nodes on the fabric Increased application availability and resilience due to no single point of failure Resource optimization due to each node being fully utilized and load-balanced with others in the fabric Supports Fault, Configuration, Accounting, Performance, Security (FCAPS) network management framework, and provides total management of network elements Includes autodiscovery for improved asset management and network planning Enables secure notifications and action for each configuration change Provides detailed view of all hardware inventory (power supplies, chassis cards, fans, part numbers, etc.) for all managed devices to enable intelligent cataloging for effective system upgrades and modifications Flexible network visualization options for simplifying network operations Provides the ability to do remote software upgrades and in-service software upgrades Enables automated upgrade planning, scheduling, and downloading Reduces errors with the use of a recommended image 4
Features and Benefits (continued) Table 2: Junos Space Network Management Platform Features and Benefits (continued) Network Operations Configuration templates Device configuration templates that provide the ability to design and push any configuration to a device or group of devices Schema-driven GUI for template creation to enable granular control Entry forms to create template definitions Audit log that captures all template deployment operations Allows administrators to design, validate, and push configurations to device or device group Enables deployment of common configuration across multiple devices Allows operators to manipulate all knobs on a given device Configuration editor Configuration file management Junos XML management protocol management Full rapid application development framework Configuration editor that provides the ability to view, edit, and delete all aspects of a device s configuration Ability to view a given device s configuration and edit, add, or delete portions of that configuration Schema-driven Up-to-date view of device s configuration Ability to view, edit, version control, compare, backup and restore network configuration files Configuration and management of Juniper Networks Junos operating system automation scripts, including import/export, view/edit, version control, deploy/ delete, and verify script execution Includes a common infrastructure, a tool kit with core services and user interface widgets, and integration APIs Allows operators to quickly view and modify any portion of a device s configuration Simplified configuration management to optimize network performance and health Instant visibility into network configuration and performance correlation Entry forms to create template definition and bulk modify configurations Administrators able to compare different configuration versions either for the same or different devices Centralized management of all Junos OS automation scripts Comprehensive development environment to rapidly create and monetize applications Easy integration into operations support systems (OSS) and data center ecosystems Ability to create mash-ups for market-specific solutions Specifications Client Browser Support Supported browsers include Firefox 3.0, Internet Explorer 7.0 and above. VMware Version Junos Space works with VMware vsphere 4.0 and above. Juniper Platforms Junos Space Security Director runs on Juniper Networks devices running Junos OS 10.3 and later releases. Junos Space Virtual Appliance Junos Space Virtual Appliance includes the complete Junos Space software package as well as the operating system. It requires users to create a virtual machine in order to deploy the appliance. The recommended specifications for the virtual machine are identical to the specifications of the physical appliance. Model Number SPC1500-A-BSE Description Base Appliance Junos Space Junos Space Security Director supports AppFW on Junos Space 12.1 and later releases. Juniper Networks Services and Support Juniper Networks is the leader in performance-enabling services that are designed to accelerate, extend, and optimize your high-performance network. Our services allow you to maximize operational efficiency while reducing costs and minimizing risk, achieving a faster time to value for your network. Juniper Networks ensures operational excellence by optimizing the network to maintain required levels of performance, reliability, and availability. For more details, please visit www.juniper.net/us/en/ products-services. 5
About Juniper Networks Juniper Networks is in the business of network innovation. From devices to data centers, from consumers to cloud providers, Juniper Networks delivers the software, silicon and systems that transform the experience and economics of networking. The company serves customers and partners worldwide. Additional information can be found at www.juniper.net. Corporate and Sales Headquarters Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA Phone: 888.JUNIPER (888.586.4737) or 408.745.2000 Fax: 408.745.2100 www.juniper.net APAC and EMEA Headquarters Juniper Networks International B.V. Boeing Avenue 240 1119 PZ Schiphol-Rijk Amsterdam, The Netherlands Phone: 31.0.207.125.700 Fax: 31.0.207.125.701 To purchase Juniper Networks solutions, please contact your Juniper Networks representative at 1-866-298-6428 or authorized reseller. Copyright 2013 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, Junos, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 1000332-008-EN Feb 2013 Printed on recycled paper 6