Juniper SSG provides fast branch-office security

Juniper is announcing a new product family based on its acquisition of NetScreen, a fast security platform with high-speed WAN ports designed for branch offices that have direct Internet connections.

While firewalling, intrusion prevention and VPN come standard on these secure services gateway (SSG) devices, they also support a range of other security applications, putting SSG in competition with Cisco’s popular integrated services routers (ISR). However, SSG and ISR are different in key ways.

Juniper’s SSG offers a faster firewall with more features as well as support for a range of other security applications. Initially the Juniper devices support Web filtering provided by SurfControl and Websense, and later this year will also support anti-virus software from Kaspersky Labs, and Brightmail anti-spam software from Symantec.

“This is where Juniper is going to take the baseball bat to Cisco,” says Joel Conover, principal analyst with Current Analysis. “This is really taking the security message to heart.”

The ISR, on the other hand, has built-in intrusion detection as an option, and does support an optional URL filtering via a separate server. It lacks anti-virus and anti-spam protection.

ISRs draw on Cisco’s routing strength with full WAN routing features while Juniper’s SSG lacks full BGP capabilities and doesn’t support MPLS. Rather than basing the device on Juniper’s router operating system JUNOS, it is based on NetScreen’s ScreenOS.

The ISR also supports VoIP capabilities via a separate card; SSG does not. Cisco also has an optional wireless access point card that Juniper lacks.

“The SSG approach is security-centric,” says Mark Fabbi, vice president with Gartner. “This is targeted at Ethernet-connected branch offices connected at higher speeds than we traditionally have seen there.”

Gartner projects that by 2009, half of branch offices will have direct Internet connections as opposed to routing Internet traffic from branch offices over the WAN and onto the Internet from a headquarters site. That is up from 10% today, and represents a dramatic shift, Fabbi says. Branches with their own Internet link also need their own Internet security, he says.

The SSGs support up to 1Gbps firewall protection and 500Mbps IPSec VPN as well as 500Mbps intrusion prevention. “The edge that Juniper has is that this is a next-generation platform built from the ground up with strong and comprehensive security,” says Fabbi. “Cisco (ISR) doesn’t scale up to the same performance levels.” In order to reach comparable top security speeds would require two Cisco devices, a combination of a Cisco router and its ASA security platform, he says.

The SSG comes with four gigabit Ethernet LAN ports built into the chassis with six slots that support both WAN and LAN cards. Now the device supports serial, T-1 and T-3 WAN ports and the company has plans to support Ethernet WAN connections. It supports the WAN cards that fit Juniper’s J-Series branch office routers, so customers can reuse those if they decide to swap chassis.

Virtualization capabilities enable separating branch networks into segments with their IP address schemes as well as separate firewall rules. This will come in handy as branches make more use of Wi-Fi networking and want to isolate and secure access points on their own segments, Fabbi says, particularly when the access points are used by visitors.

For all its features, the SSG is attractive to customers simply looking for a faster firewall, says Perry Jarvis, the network operations manager for the City of Burbank in California. He’d like to put a firewall in front of key network assets, but can’t afford more of Juniper’s fast NetScreen 208 firewalls, which cost him about $9,000. But an SSG can protect gigabit links for less he says. “This is very comparable to what I’m buying but it has more ports than the 208, you can put Gigabit interfaces in them, which is something I could not do with the 208s,” he says.

He may at some point want to add URL filtering to the SSG and get rid of his separate SurfControl server. “I can simplify my network model and do two or three security checks with one device,” Jarvis says.

Base price for an SSG 520 is $6,000; base price for the SSG 550 is $10,000.

Return to Juniper Clear Choice Test