Juniper SSG provides fast branch-office security

Juniper is announcing a new product family based on its acquisition of NetScreen, a fast security platform with high-speed WAN ports designed for branch offices that have direct Internet connections.

While firewalling, intrusion prevention and VPN come standard on these secure services gateway (SSG) devices, they also support a range of other security applications, putting SSG in competition with Cisco's popular integrated services routers (ISR). However, SSG and ISR are different in key ways.

Juniper's SSG offers a faster firewall with more features as well as support for a range of other security applications. Initially the Juniper devices support Web filtering provided by SurfControl and Websense, and later this year will also support anti-virus software from Kaspersky Labs, and Brightmail anti-spam software from Symantec.

"This is where Juniper is going to take the baseball bat to Cisco," says Joel Conover, principal analyst with Current Analysis. "This is really taking the security message to heart."

The ISR, on the other hand, has built-in intrusion detection as an option, and does support an optional URL filtering via a separate server. It lacks anti-virus and anti-spam protection.

ISRs draw on Cisco's routing strength with full WAN routing features while Juniper's SSG lacks full BGP capabilities and doesn't support MPLS. Rather than basing the device on Juniper's router operating system JUNOS, it is based on NetScreen's ScreenOS.

The ISR also supports VoIP capabilities via a separate card; SSG does not. Cisco also has an optional wireless access point card that Juniper lacks.

"The SSG approach is security-centric," says Mark Fabbi, vice president with Gartner. "This is targeted at Ethernet-connected branch offices connected at higher speeds than we traditionally have seen there."

Gartner projects that by 2009, half of branch offices will have direct Internet connections as opposed to routing Internet traffic from branch offices over the WAN and onto the Internet from a headquarters site. That is up from 10% today, and represents a dramatic shift, Fabbi says. Branches with their own Internet link also need their own Internet security, he says.

The SSGs support up to 1Gbps firewall protection and 500Mbps IPSec VPN as well as 500Mbps intrusion prevention. "The edge that Juniper has is that this is a next-generation platform built from the ground up with strong and comprehensive security," says Fabbi. "Cisco (ISR) doesn't scale up to the same performance levels." In order to reach comparable top security speeds would require two Cisco devices, a combination of a Cisco router and its ASA security platform, he says.

The SSG comes with four gigabit Ethernet LAN ports built into the chassis with six slots that support both WAN and LAN cards. Now the device supports serial, T-1 and T-3 WAN ports and the company has plans to support Ethernet WAN connections. It supports the WAN cards that fit Juniper's J-Series branch office routers, so customers can reuse those if they decide to swap chassis.