DATASHEET APPSECURE FOR SRX SERIES SERVICES GATEWAYS AppSecure Description Product Overview As network infrastructure and the threats targeting that infrastructure continue to evolve, AppSecure is a suite of next- so too must the network security solutions adopted to protect organizations. At the same generation security capabilities time, the latest generation of web-based applications and the proliferation of mobile for Juniper Networks SRX Series devices provide an increasingly challenging task for network administrators to effectively Services Gateways that utilize manage traffic flows and access to data while delivering the right mix of security and advanced application identification network services. In the past, network administrators would simply buy a new appliance and classification to deliver greater to overcome a security or network issue. However, that approach leads to greater network visibility, enforcement, control, and complexity, excessive management overhead, and poor overall performance. protection over the network. Today’s network security solutions must not only have the right architecture to deliver the appropriate mix of performance and scale in this evolving network environment, but must Working in conjunction with the also deliver the right security services to give administrators visibility and control over other security services of the SRX the types of applications now traversing their networks. Juniper Networks® AppSecure Series, AppSecure provides a deep is a suite of application-aware security services for the Juniper Networks SRX Series understanding of application Services Gateways that classify traffic flows, bringing greater visibility, enforcement, behaviors and weaknesses to prevent control, and protection to network security. AppSecure uses a sophisticated classification application borne threats that are engine to accurately identify applications regardless of port or protocol, including nested difficult to detect and stop. applications that reside within trusted network services. As an integrated service on the world’s fastest services gateways, The result is a powerful tool that helps bring context and clarity to the setting and AppSecure provides the scalability to enforcement of security policies, provides protection against common evasion techniques, meet the requirements of the most and helps stop modern malware attacks, all while delivering the industry’s highest demanding environments. performance and scale. AppSecure gives security administrators the context to regain control of their network traffic, set and enforce policies based on accurate information, and deliver the performance and scale required to address business needs. The services that are enabled by AppSecure include: AppTrack for detailed visibility of application traffic; AppFW for granular policy enforcement of application traffic; AppQoS to prioritize and meter application traffic; and AppDoS for greater control over the latest breed of botnet attacks targeting applications. AppSecure also works with the SRX Series’ integrated intrusion prevention system (IPS) solution to deliver deeper protection against zero-day attacks. 1 TM AppSecure AppTrack AppFW AppQoS AppDoS IPS Visibility for Enforcement Control and Protection Threat application to block/allow prioritization against mitigation usage and applications botnet attacks bandwidth SMTP HTTP UDP HTTPS SMTP HTTP UDP HTTPS Application awareness and classification engine User context AppTrack from Junos logs to Pulse or STRM Series active for reporting directory Figure 1: The application awareness and classification engine improves efficiency by inspecting network traffic and publishing the results for use by all of the AppSecure services. AppSecure Features and Benefits Feature Feature Description Benefit Application awareness and Context, protocol information, and signatures used to Enables all AppSecure capabilities by exposing classification identify applications on any TCP or UDP port. application information to advanced, next-generation security services for increased visibility, control and protection. Nested application support Accurate identification of applications running on top Provides enhanced protection against modern of, or embedded into approved/trusted services and evasion techniques that utilize trusted services. protocols. User-role based policies Fine-grained policies, including application security, Superior protection and easier policy management as based on user role and identity for all endpoints user and user groups reduce the number of policies including mobile devices. and rules needed to account for other elements such as location, device, and IP address. SSL inspection Inspection of HTTP traffic encrypted in SSL on any Combined with AppSecure, provides visibility TCP/UDP port. and protection against threats embedded in SSL encrypted traffic. Purpose built platform Built from the ground up on dedicated hardware. Delivers unrivaled performance and flexibility to protect service provider, enterprise and data center environments. ® Junos OS service integration on Rich set of native network and security services Provides consolidation and optimization of SRX Series including: firewall, AppSecure, IPS, IPsec VPN, NAT, application-aware security services for maximum QoS, routing, and switching. scale. 2 prioritize business critical traffic over the network. AppQoS Application Visibility with AppTrack provides the ability to meter and mark traffic based on the AppTrack collects byte, packet, session, and time statistics application policies set by the administrator. These policies enable while accurately identifying hundreds of applications, giving lower priority Web traffic to continue when network bandwidth network administrators detailed analysis of application data. allows, but ensures that mission critical traffic is delivered when AppTrack quickly and easily provides visibility into the types of usage levels surge. applications traversing through the SRX Series gateway and allows classification based on risk level, users, groups, zones, Application Protection with AppDoS source, and destination addresses, as well as volumes. This AppDoS identifies attacking botnet traffic and legitimate client information can be used to assess adherence to usage policies, traffic based on application-layer metrics and remediates these help address bandwidth management, or simply report on the botnet attacks. Employing a multi-stage approach that includes most active users and applications. Juniper’s centralized logging server connection monitoring, deep protocol analysis, and bot- and reporting system, STRM Series Security Threat Response client classification, AppDoS delivers the ability to detect subtle Managers, provides a flexible and extensible way to analyze data changes in traffic patterns and client behaviors that could indicate from a centralized location and take action. Using a variety of pre- an application-level denial-of-service (DoS) attack. Once suspicious defined report formats, STRM Series can generate reports based activity is detected, AppDoS can then issue an alert, block offending on AppTrack application log data. IP addresses, or completely drop irregular sessions and packets. AppDoS is typically deployed with the SRX Series’ integrated IPS Application Enforcement with AppFW service to increase protection against malicious attacks. AppFW enables administrators to create fine grained application control policies to allow or deny traffic based on dynamic Application Protection with IPS application name or group names rather than static IP/port IPS tightly integrates Juniper’s latest and most advanced security information. It is designed to simplify security policies by using features with the network infrastructure for threat mitigation application white lists and black lists, as well as to define what and protection from a wide range of attacks and vulnerabilities. actions to perform on matched traffic while taking default action IPS subscribes to the results of application identification/ against all other traffic. contextualization. These results help determine the appropriate 1 protocol decoding and attack objects to use for the permitted Application Control with AppQoS incoming traffic that will be processed by the IPS software With the increased use of web-based customer relationship services module. management (CRM), enterprise resource planning (ERP), and other business tools, network administrators need a way to Specifications - Branch SRX Series Services Gateways SRX100/ SRX210 SRX220 SRX240 SRX550 SRX650 SRX110 Services Services Services Services Services Services Gateway Gateway Gateway Gateway Gateway Gateway Maximum AppSecure 90 Mbps 250 Mbps 300 Mbps 750 Mbps 1.5 Gbps 1.9 Gbps 2 throughput Application identification >900 >900 >900 >900 >900 >900 applications applications applications applications applications applications Maximum IPS throughput 75 Mbps 65 Mbps 80 Mbps 230 Mbps 800 Mbps 1 Gbps Maximum connections per 1,500 1,500 1,800 7,400 27,000 35,000 second Maximum sessions 12,000 24,000 32,000 48,000 375,000 512,000 Specifications - Data Center SRX Series Services Gateways SRX1400 SRX3400 SRX3600 SRX5600 SRX5800 Services Services Services Services Services Gateway Gateway Gateway Gateway Gateway 2 Maximum AppSecure throughput 4 Gbps 16 Gbps 25 Gbps 50 Gbps 100 Gbps Application identification >900 applications >900 applications >900 applications >900 applications >900 applications AppDoS protocols >60 protocols + >60 protocols + >60 protocols + >60 protocols + >60 protocols + 600 contexts 600 contexts 600 contexts 600 contexts 600 contexts Maximum IPS throughput 2 Gbps 6 Gbps 10 Gbps 15 Gbps 30 Gbps 3 Maximum connections per second 40,000 180,000 180,000/300,000 380,000 380,000 4 Maximum sessions 0.5 million 2.25 million/ 2.25 million/ 9 million 12.5/20 million 3 3 3 million 6 million SSL inspection Yes Yes Yes Yes Yes 1 AppQoS is currently supported on SRX Series Services Gateways for the data center. AppQoS support on SRX Series Services Gateways for the branch forthcoming in the near future. 2 Throughput numbers based on HTTP traffic with 44 kilobyte transaction size. 3 Additional Extreme License required for 3 million and 6 million sessions. 4 To achieve more than 12.5M CP sessions on SRX5800, use software knob available from 10.4 or 11.4 and later. 3 Juniper Networks Services and Support Model Number Description Juniper Networks is the leader in performance-enabling services SRX650-APPSEC-A-3 3-year subscription for AppSecure and IPS updates for SRX650 that are designed to accelerate, extend, and optimize your high-performance network. Our services allow you to maximize SRX1400-APPSEC-A-3 3-year subscription for AppSecure and IPS updates for SRX1400 operational efficiency while reducing costs and minimizing risk, achieving a faster time to value for your network. Juniper SRX3400-APPSEC-A-3 3-year subscription for AppSecure and IPS updates for SRX3400 Networks ensures operational excellence by optimizing the network to maintain required levels of performance, reliability, and SRX3600-APPSEC-A-3 3-year subscription for AppSecure and IPS availability. For more details, please visit www.juniper.net/us/en/ updates for SRX3600 products-services. SRX5600-APPSEC-A-3 3-year subscription for AppSecure and IPS updates for SRX5600 Ordering Information SRX5800-APPSEC-A-3 3-year subscription for AppSecure and IPS updates for SRX5800 Model Number Description SRX1XX-APPSEC-A-5 5-year subscription for AppSecure and IPS AppSecure Subscription updates for SRX100 and SRX110 SRX1XX-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX210-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX100 and SRX110 updates for SRX210 SRX210-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX220-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX210 updates for SRX220 SRX220-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX240-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX220 updates for SRX240 SRX240-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX550-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX240 updates for SRX550 SRX550-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX650-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX550 updates for SRX650 SRX650-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX1400-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX650 updates for SRX1400 SRX1400-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX3400-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX1400 updates for SRX3400 SRX3400-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX3600-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX3400 updates for SRX3600 SRX3600-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX5600-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX3600 updates for SRX5600 SRX5600-APPSEC-A-1 1-year subscription for AppSecure and IPS SRX5800-APPSEC-A-5 5-year subscription for AppSecure and IPS updates for SRX5600 updates for SRX5800 SRX5800-APPSEC-A-1 1-year subscription for AppSecure and IPS updates for SRX5800 About Juniper Networks SRX1XX-APPSEC-A-3 3-year subscription for AppSecure and IPS Juniper Networks is in the business of network innovation. From updates for SRX100 and SRX110 devices to data centers, from consumers to cloud providers, SRX210-APPSEC-A-3 3-year subscription for AppSecure and IPS Juniper Networks delivers the software, silicon and systems that updates for SRX210 transform the experience and economics of networking. The SRX220-APPSEC-A-3 3-year subscription for AppSecure and IPS company serves customers and partners worldwide. Additional updates for SRX220 information can be found at www.juniper.net. SRX240-APPSEC-A-3 3-year subscription for AppSecure and IPS updates for SRX240 SRX550-APPSEC-A-3 3-year subscription for AppSecure and IPS updates for SRX550 Corporate and Sales Headquarters APAC Headquarters EMEA Headquarters To purchase Juniper Networks solutions, Juniper Networks, Inc. Juniper Networks (Hong Kong) Juniper Networks Ireland please contact your Juniper Networks 1194 North Mathilda Avenue 26/F, Cityplaza One Airside Business Park representative at 1-866-298-6428 or Sunnyvale, CA 94089 USA 1111 King’s Road Swords, County Dublin, Ireland authorized reseller. Phone: 888.JUNIPER (888.586.4737) Taikoo Shing, Hong Kong Phone: 35.31.8903.600 or 408.745.2000 Phone: 852.2332.3636 EMEA Sales: 00800.4586.4737 Fax: 408.745.2100 Fax: 852.2574.7803 Fax: 35.31.8903.601 www.juniper.net Copyright 2012 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, Junos, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 1000327-006-EN May 2012 Printed on recycled paper 4