product family data sheet ® av e n t a i l ™ ™ ™ EX-2500 , EX-1600 , & EX-750 Aventail Smart SSL VPNs deliver the easiest remote access control solution available today. Aventail offers users seamless access to more applications from more devices and locations. And administrators get security and control through one easy-to-manage gateway. As the leading IPSec replacement VPN, Aventail’s award- winning family of SSL VPN appliances can boost your productivity and security while easing your overall cost of ownership. Why choose Aventail? Detect the security of any end point The easiest remote access controller on the market Robust interrogation for secure control of the end point ® ™ ™ Aventail delivered the first SSL VPN, and delivers on the promise Only Aventail End Point Control (EPC ) lets you enforce ® of complete remote access control today. With maturing mobile granular access control rules for Windows , Windows Mobile, ® ® technologies like WiFi and VoIP, booming global markets, and Macintosh , and Linux end point environments. EPC combines heightened focus on remote access for disaster preparedness, pre-authentication interrogation to protect from keystroke loggers today’s enterprises have an increasingly distributed and and other malware, as well as confirming end-point criteria like mobile workforce. Remote access control has become a antivirus updates. ® ™ business imperative. For more flexible security control, Aventail Policy Zones let you apply zones of detected end point criteria to automated policy enforcement. For example, a user’s access may be quarantined—and EX-2500 the user automatically redirected EX-1600 EX-750 to remediation instructions—until You are an enterprise with You are a growing mid- You are a small to mid-size hundreds or thousands of remote size company, an enterprise company, an enterprise a particular security patch is access users. You need high department, or you have a department, or you have a installed. Should an end point availability to ensure anytime remote facility. You support remote facility. You support device be lost or stolen, Device access to critical applications. 25 to 250 concurrent remote up to 50 concurrent remote Watermarks allow rapid and access users who need access users. The EX-2500 offers: anytime access. simple access revocation, based The EX-750 offers: • Clustering and high availability upon detection of client certificates The EX-1600 offers: (HA) support: • The advantages of Aventail’s on the end point. Untrusted end • Clustering for high availability proven, secure, and easy-to- • Up to 8 nodes of externally points can be protected from (HA) and load sharing. manage SSL VPN platform at sourced load balancing. a lower cost. • Up to 8 nodes of externally keystroke sniffers by enforcing • 2 nodes for internal HA with sourced load balancing. • A cost-effective unit intended integrated load balancing. authentication using Aventail’s for standalone use. • 2 nodes nodes for internal HA • Support for up to 2,000 Virtual Keyboard. with integrated load balancing. • An ideal solution if your user concurrent users per load base will not grow beyond balanced node or HA pair. Advanced EPC for • Support for up to 250 50 concurrent users. concurrent users per load ultimate protection balanced node or HA pair. ® Optional Aventail Advanced ™ EPC combines the granular end point control detection of Expensive NAC initiatives seek to control access, but are less Advanced Interrogator with the superior data protection of effective in extending beyond the traditional network perimeter. Secure Desktop. IPSec VPNs can be cumbersome to use and manage. Only Aventail Smart SSL VPNs deliver a complete remote access control Advanced Interrogator simplifies end point protection by allowing solution today, without escalating infrastructure costs or complexity. administrators to set up device profiles from a comprehensive predefined list of antivirus, personal firewall, and anti-spyware Detect, protect, and connect solutions for Windows platforms, including version and currency Applying a comprehensive approach to remote access control, of signature file update. On unmanaged end point devices like Aventail SSL VPNs first detect the security of an end point prior to kiosks, Cache Control extends beyond basic cache cleaning to authentication; protect resources with granular policy based on purge browser cache, session history, cookies, and passwords. that user and end point; and then connect the user effortlessly to For even deeper protection, Secure Desktop offers advanced data only authorized resources. Aventail Product Family Data Sheet Page 1 protection technology that creates a virtual encrypted environment from any Web browser. Visual tools provide real-time information that prevents sensitive information from being left behind. on system state, and give you direct, intuitive options for managing all system objects. On Aventail SSL VPNs, users are never granted open network- wide access to your resources. Connections are closed by default, Connect users to resources—simply and seamlessly providing “deny all” firewall-style protection. Broadest application access from the most end points Protect your enterprise resources with ease From the very first connection, Aventail SSL VPNs deliver intelligent access to all network resources, including Web- Streamlined policy management based, client/server, server-based, host-based, and back- With its context-sensitive help and Setup Wizard, an Aventail SSL connect applications such as VoIP. Aventail SSL VPNs work VPN is easy to set up and deploy, letting you rapidly establish seamlessly across all platforms—Windows, Windows Mobile, a single secure gateway for both internal and external access Linux, or Macintosh—from desktops, laptops, kiosks, PDAs, and to resources. smartphones, as well as automated application-to-application ® Remote access control management is simplified with Aventail remote access. This unparalleled ease of use significantly increases ™ Unified Policy . This extensible object-based policy model productivity, while reducing support costs associated with more consolidates control of all Web resources, file shares, and cumbersome solutions. client-server resources in a single location. This lets you quickly ® ™ From the user’s perspective, Aventail Smart Access does all set policy with a single rule across all objects, so that policy the work. Smart Access dynamically determines and deploys the management can take only minutes instead of the hours it appropriate access method and security level based on the type takes with other VPNs. Groups can be populated dynamically and state of the device, user identity, and resources needed. based on RADIUS, LDAP, or Active Directory authentication Adaptive addressing and routing dynamically adapts to networks, repositories, including Nested Groups. Aventail SSL VPNs offer eliminating addressing and routing conflicts common with other robust authentication support for Single Sign-On (SSO) and forms- solutions. Smart Access streamlines installation and activation based Web applications. And users can easily update their own of any required agents on Windows devices according to passwords at any time without IT assistance. Microsoft standards. Intuitive management and reporting Clientless Web-based access or full “in-office” experience ® ™ The Aventail Management Console provides a rich, centralized Aventail SSL VPNs offer both clientless browser-based access set of monitoring capabilities for auditing, compliance, and full access from Windows, Windows Mobile, Macintosh, ® management, and resource planning. Optional Aventail and Linux environments to client/server and legacy applications. Advanced Reporting™ allows robust auditing of who accessed ® ™ Aventail WorkPlace provides users with a personalized and what enterprise resources, at what time, from which remote policy-driven Web portal that provides easy access to Web- location, using standard or custom reports that can be accessed Aventail Remote Access Control Aventail’s Remote Access Controller provides secure access for all users, devices and applications Aventail Product Family Data Sheet Page 2 based and client/server applications from virtually any device or Most complete access solution for mobile devices ® ™ location, including desktops, laptops, PDAs, smartphones, even Aventail Mobile provides Web and client-based access to critical from wireless hot spots and kiosks. The portal can be optimized network resources from any wireless network environment with for the type of access device; for example, for smartphones, complete security and control, including Windows Mobile (CE) only the mobile versions of applications would be available. 4.21 and 5.0 PDAs and smart phones, Symbian smart phones, Users can define their own shortcuts to frequently-used resources, DoCoMo iMode devices, and WAP-enabled devices. personalizing their experience. Aventail WorkPlace works well Aventail Mobile provides centralized management of all devices for those accessing the network from devices not managed by with granular access control and the ability to prohibit access from your organization. the device if lost or stolen. And with Session Persistence, mobile ® ™ Aventail Connect access delivers an “in-office” experience users can have the flexibility to retain a current session as they for Windows, Windows Mobile, Macintosh, and Linux users, switch between networks—on the go between office, commute, enabling full access to a broad base of client/server and Web- home, and hotel—without needing to re-authenticate. based applications, and all other network resources. Connect High availability and flexibility you can rely on Access is enabled through a lightweight, Web-deployable agent, For added reliability, Aventail SSL VPNs offer high availability or optionally, through a standard MSI installation that makes client (HA) with integrated load balancing and active/active stateful provisioning simple and flexible. Aventail Connect is ideal for failover on the EX-2500 and EX-1600, eliminating the added cost users needing full application access from devices that are owned of a third-party load balancer. And with an optional Aventail Spike and managed by your organization, and that require strong License Pack, you can temporarily and cost-effectively increase desktop security, including split-tunneling control and personal your remote user count to the maximum capacity of those Aventail firewall detection. ® appliances for disaster recovery or planned business cycle peaks, Users benefit from the unparalleled application reach of Aventail ™ whether it’s a few dozen or a few thousand additional users. Smart Tunneling a patent-pending Layer 3 technology that supports UDP, TCP, and IP protocols, as well as support for back- The clear business choice: Aventail SSL VPNs connect applications like VoIP. In NAT mode, no set up of IP Aventail’s market-leading EX-Family of SSL VPN appliances offers address pools is required. your business the best solution for secure remote access control. With Aventail, you can enhance your enterprise network security, A solution customized to your users’ needs ® ™ increase your mobile workforce productivity for greater return Optional Aventail Native Access Modules offer additional native on investment (ROI), and reduce IT overhead for a lower total access to Windows Terminal Services, as well as native support cost of ownership (TCO). Aventail’s best-of-breed technology for load-balanced Citrix farm environments as an alternative to ® gives you flexible access options for disaster recovery, and expensive Citrix nFuse implementations. Aventail Host Access ™ supports easy audits to help you comply with Sarbanes-Oxley, Modules directly integrate industry-leading AttachmateWRQ HIPAA, Basel 2, and other regulatory requirements, even during terminal emulation with your Aventail SSL VPN to access a unexpected business disruptions. And Aventail SSL VPNs make wide range of host-based applications on IBM, UNIX, and an ideal replacement strategy for IPSec VPNs. From any business OpenVMS environments. perspective, Aventail is the easy choice for secure access. About Aventail Aventail is the best-of-breed remote access company. Aventail delivered the first SSL VPN solution in 1997 and today is a market leader, delivering a remote access control solution that is the easiest to use and easiest to control. Aventail SSL VPN appliances provide users with transparent, clientless access to more applications from more devices via any network environment. For network managers, Aventail delivers a single secure access gateway for all users, internal and external, to all network resources with complete security. With more than 2.5 million end users around the globe, Aventail is the SSL VPN of choice among mid-sized to large-sized organizations worldwide, including AT&T, Chicago Housing Authority, DePaul University, DuPont, the Environmental Protection Agency (EPA), IBM Global Services, James Richardson International, Mississippi Department of Corrections, Organization for Economic Cooperation and Development (OECD), Overlake Hospital, Radiology Ltd., and Sanyo. For more information, go to www.aventail.com. MArkEt lEAdErship Who rEliEs on AvEntAil? Awards and Reviews Customers Best Standalone Solution Leader status in industry evaluation Certifications Service Providers Certified for the Aventail EX-1500 Aventail Product Family Data Sheet Page 3 Corporate Headquarters: 808 Howell St. Seattle, WA 98101• Tel 206.215.1111 • 1.877.AVENTAIL (U.S.) • Fax 206.215.1120 Aventail EMEA: Tel +44 (0) 870 240 4499 • emea@aventail.com Aventail Asia-Pacific: Tel +65 6832 5947 • asiapac@aventail.com www.aventail.com • Dynamic proxy detection • Passive and active Feature specifications ACCEss And Logging and authentication mode FTP AppliCAtion sUpport • Support for central • Windows domain SSO • Dynamic routing ® ™ • Windows networking SYSLOG server sECUritY Aventail WorkPlace (Connect only) support (Windows/NT • Adaptive addressing Access (browser- Network & device • W3C common log format domain logon integration), • NTLM for Microsoft based access) protection • OnDemand tunnel mode • SOCKS5 log format drive mapping, password Web servers (browser-based access via (OnDemand and • Split tunneling control • Clientless access to Web- change notification and WorkPlace) Connect only) Password management based resources change, login scripts) • Hides internal DNS • Connect Tunnel mode namespace and IP • Notification of password • Web-based: HTTP/HTTPS, • Connect Tunnel Service MAnAGEMEnt & expiration and password DHTML/HTML, JavaScript, addressing scheme Edition (remote application- • Session Persistence across AdMinistrAtion change from the Aventail VBScript to-application access) IP address changes • URLs can be aliased • Aventail Management WorkPlace portal ® ™ • Web file access: SMB/ Aventail Connect Mobile •NAT mode (does not Console (AMC): centralized • Hardened against attack CIFS, DFS Access control options require IP address pools) (Windows Mobile client) Web-based management • Can prevent direct connections • Personal Bookmarks for all access options • User and group (handles ® • Aventail Connect Mobile is Aventail End Point to internal network users in multiple groups) ™ ™ a certified application for • Secure Shell (SSH) support Control (EPC ) Aventail WorkPlace • TCP/UDP port restrictions ™ Windows Mobile -based • Source IP and network Mobile access • Directory browsing and • Aventail End Point Pocket PCs Authentication methods Interrogator (classifies connection testing • Destination network • WorkPlace access • Lightweight, Web-deployed • Server-side digital end point into Policy Zones) configuration for any • Serial console access • Service/Port, such as FTP, certificates, independent agent provides access to mobile device HTTP (OnDemand and • Wildcard selection with • DHCP address provisioning of end-user authentication both Web and client/ Connect only) Boolean operators • Supports WAP, smartphone, integration server applications method iMode, and PDA browsers • Define resources by • Cache Control • Customizable templates for • Username/password AUditinG, MonitorinG ® ™ destination URL, host (data protection) Aventail OnDemand WorkPlace portal • Client-side digital certificates name or IP address, IP & loGGinG (Client/server & network • Detection of files and • MSI installer option for range, subnet, and domain • RSA SecurID and other running processes access within WorkPlace): Auditing Connect access integrates one-time password tokens • Day, date, time, and range ® with standardized software • WholeSecurity Confidence • Passive and active • Aventail Advanced ™ • Dual/stacked authentication distribution processes • Browser encryption Online Enterprise Edition mode FTP Reporting key length (malware and Trojan • Role-based administration Directories • Any TCP- or UDP-based • User/group scanning) • Policy Zones (controls application (single-port, • Microsoft Active Directory • Source IP address and port hiGh AvAilABilitY • Zone Labs Integrity access and data protection multi-port, dynamic (native mode) • Destination IP address Aventail EX-2500 based on end point Clientless Security (malware port, including standard • LDAP (Active Directory, Sun and port security profile) and Trojan scanning) Internet e-mail protocols, • Support for high-availability iPlanet, etc.) native e-mail protocols, • Bytes processed (up to 8-node clusters from • Quarantine and • Device Watermarking terminal emulation • RADIUS (Windows NT, external sources) with built-in Deny Zones ® ™ • Date/time Aventail Advanced EPC protocols, and terminal ACE, etc.) load-balancing and stateful • File system access controls services) • URLs accessed • Advanced Interrogator authentication failover • Dynamic groups based off (Windows domain, ® ™ (simplified granular end • Authentication method Aventail Connect access an LDAP/AD query • Support for load-balanced Windows Server UNC, point detection, including (Windows client) arrays using standard Full-path UNC) • RADIUS auditing and • Certificate revocation detailed configuration external load balancers accounting integration lists (CRL) • Any TCP- or UDP-based information on over 100 Encryption application (single port, anti-virus, anti-spyware, and Monitoring Single sign-on adapters Aventail EX-1600 • Configurable session length multi-port, dynamic port, personal firewall solutions, • User connection monitoring • Forms-based single sign-on including standard Internet • Support for high-availability • Ciphers: DES, 3DES, including McAfee, for Web authentication RC4, AES e-mail protocols, native • Event alarms 2-node clusters with built-in Symantec, Sophos products like Netegrity e-mail protocols, terminal load-balancing and stateful and Trend) • Hashes: MD5, SHA • View logs and performance SiteMinder and RSA emulation protocols, and authentication failover information via the Aventail ® ™ • Secure Desktop (advanced ClearTrust Aventail Smart Tunneling terminal services) Management Console • Support for load-balanced data protection) (Layer 3 connection) • HTTP basic authentication • Native access to Windows arrays using standard • SNMP integration including (IETF RFC 2617) • Split tunneling and redirect Terminal Services as well as external load balancers Aventail-specific SNMP MIB forwarding Citrix farms all access hardware technical specifications AVENTAIL EX-2500 APPLIANCE AVENTAIL EX-1600 APPLIANCE AVENTAIL EX-750 APPLIANCE Form factor: 1U rack-mount Form factor: 1U rack-mount Form factor: 1U rack-mount Dimensions: 17” W x 1.7” H x 19.6” D (43cm W x Dimensions: 1.7” H x 16.8” W x 13.2” D (4.4cm H x Dimensions: 17” W x 1.71” H x 15” D (43.18cm W x 4.4cm H x 50 cm D) 42.6cm W x 33.4cm D) 4.34cm H x 38.1cm D) Processor: Intel Xeon 2.4 GHz CPU 533 MHz FSB Processor: Intel Pentium, 2.4 GHz CPU, 533 MHz FSB, Processor: Intel P4 2.4 GHz CPU, 533 MHz FSB, 512 MB 2 GB DDR RAM 1 GB DDR RAM DDR RAM NETWORK NETWORK NETWORK Six 10/100/1000Base-T Ethernet Two 10/100 and one 1000Base-T Ethernet, 2 USB Two 10/100Base-T Ethernet POWER Ports, 1 serial bus connection (DB9) POWER Input voltage: 120 (6A) / 240 (3A) VAC auto-switching POWER Input voltage: 100 (5A)/240 (3A) VAC PFC auto-switching Output power: 300W Input voltage: 120 (6A) / 240 (3A) VAC auto-switching Output power: 200W Power supply: MTBF 100,000 hours at 35° C (95° F) Output power: 185W Power supply: MTBF 100,000 hours at 40° C Power supply: MTBF 100,000 hours at 35° C (95° F) ENVIRONMENTAL ENVIRONMENTAL Operating temperature: 0°C to 40°C (32°F to 104°F) ENVIRONMENTAL Operating temperature: 0° - 50° C Non-operating shock: 50g, 11msec Operating temperature: 0°C to 40°C (32°F to 104°F) Non-operating shock: 50g, 11msec Non-operating shock: 50g, 11msec REGULATORY APPROVALS REGULATORY APPROVALS Emissions: FCC Part 15 Class A, CE, C-Tick, VCCI, REGULATORY APPROVALS Emissions: FCC Class A, EN, VCCI CCC, BSMI Emissions: FCC Part 15 Class A, CE, C-Tick, VCCI, Safety: CAN/CSA, UL, CB Scheme Safety: UL, cUL, CE, TUV, STQC, S, PSB, CCC, BSMI, CCC, BSMI CB Scheme Safety: UL, cUL, CE, TUV, STQC, PSB, CCC, BSMI, CB Scheme ©2007 Aventail Corporation. All rights reserved. Aventail, Aventail ST2, Aventail EX-750, Aventail EX-1600, Aventail EX-2500, Aventail Smart Access, Aventail Smart Tunneling, Aventail End Point Control, Aventail EPC, Aventail Unified Policy, Aventail Cache Control, Aventail Secure Desktop, Aventail Host Access Modules, Aventail Native Access Modules, Aventail WorkPlace, Aventail Connect, Aventail Connect Tunnel, Aventail WorkPlace Mobile, Aventail Connect Mobile, Aventail Mobile, Aventail Connect Tunnel Service Edition, Aventail Advanced EPC, Aventail Advanced Reporting, and their respective logos are trademarks, registered trademarks, or service marks of Aventail Corporation. Other product and company names mentioned are the trademarks of their respective owners. DS-4059-02/07/15 Aventail Product Family Data Sheet Page 4