TARGET AUDIENCE IT infrastructure and operations professional, security and risk professional

Transcription

1 TECH CHOICES Citrix Systems App Performance Is Tops In The SSL VPN Appliances Market The Forrester Wave Vendor Summary, Q by Robert Whiteley with Simon Yates and Christine E. Atwood EXECUTIVE SUMMARY Citrix Systems has been one of the fastest rising SSL VPN appliance vendors. Its solution with technology from several acquisitions has culminated in one of the highest performing solutions. Although it still lacks the additional threat protection, customization, and mobile device support of fellow leaders Aventail and Juniper Networks, it has built a solid all-purpose appliance. If you re an existing Citrix customer, this is a much-needed component for extending apps to the Web without cumbersome publishing to Presentation Server. For non-citrix environments, this SSL VPN appliance is still one of the best thanks to its ease of use and acceleration technologies. TARGET AUDIENCE IT infrastructure and operations professional, security and risk professional CITRIX IS BEST SUITED FOR MOVING ITS THIN-CLIENT APPS TO THE WEB Citrix has entered the SSL VPN market on three separate occasions. Its original product, Secure Access Manager, was not a full feature SSL VPN, but rather an SSL VPN Web portal for its thin-client Presentation Server. 1 Next, it made the wise move of acquiring Net6, whose SSL VPN appliance added the form factor and ease of use that Citrix lacked. 2 And finally, in June 2005, Citrix added NetScaler, which had an application acceleration appliance with built-in SSL VPN functionality. But to Citrix s credit, it has pulled all this together into its cohesive Access Gateway series. Although Access Gateway can be found on former Net6 and NetScaler platforms, the features and, more importantly, the underlying code are the same. The results have paid off. Citrix s channel engine has cranked up and propelled Citrix into one of the top market share positions. Forrester evaluated Citrix s current offering and strategy for its SSL VPN appliance against approximately 57 criteria (see Figure 1). Overall, the product has strong reliability and performance optimization features, but lacks integrated security and top-notch mobile device support. This means that the product is an especially good fit for buyers that: Have a need for speed. Borrowing from the NetScaler architecture, Citrix s high-end SSL VPN Access Gateway Enterprise Edition has tremendous acceleration features, including a builtin global load balancer, offload engine, caching, compression, protocol-specific optimization, Headquarters Forrester Research, Inc., 400 Technology Square, Cambridge, MA USA Tel: / Fax: /

2 Tech Choices Citrix Systems App Performance Is Tops In The SSL VPN Appliances Market 2 and hardware-assisted SSL acceleration. Although these features are not entirely unique, the underlying NetScaler architecture is built for speed. Include Citrix on your shortlist if you re pushing bandwidth-hungry apps that require low latency. Invested in Citrix s Application Delivery architecture. Citrix has been amassing several hardware components to add to its traditional Presentation Server software empire. Its SSL VPN appliance is key to this strategy, which Citrix positions as an application access control front end. What does this mean? Citrix can provide granular application-level access control to many of its products, including its heavily anticipated desktop virtualization, application streaming, and workforce continuity solutions. If you view Citrix as important to your application strategy, then the seamless integration of its SSL VPN will add additional security as well as a solid all-purpose remote-access solution. To see how Citrix stacks up against seven other competitors, see the Forrester Wave evaluation of the SSL VPN appliances market. 3

3 Tech Choices Citrix Systems App Performance Is Tops In The SSL VPN Appliances Market 3 Figure 1 Citrix Systems Access Gateway Evaluation Overview CURRENT OFFERING Product portfolio Core SSL VPN functionality Manageability and usability Scalability Reliability Performance Monitoring and reporting Security support Mobility support Citrix s SSL VPN is the Access Gateway series, which is comprised of three editions: Access Gateway Standard Edition, Advanced Edition, and Enterprise Edition (AG-SE, AG-AE, and AG-EE, respectively). Citrix also has multifunction appliances when the SSL VPN functionality is enabled on its NetScaler application acceleration switches. Citrix supports all the necessary access methods and a wide variety of OS types. Its ability to support custom applications via a clientless proxy and its policy granularity are on par with other vendors evaluated. Citrix provides ease-of-use and ease-of-administration features are on par, but it lacks customizability. Citrix is especially easy to manage when deployed within a Citrix Presentation Server environment. Citrix offers one of the more scalable solutions and supports up to 32 devices in a cluster and 5,000 or more concurrent users per appliance. Citrix s high-end enterprise appliance is based on proven NetScaler technology. The hardware uses flash components, redundant power supplies, and software fallback for SSL to accommodate partial loss. Systems can be hot-swapped to force failover option. User sessions are mirrored across HA pairs thus allowing failovers to avoid impacting connected users. Access Gateway performance is assessed by measuring throughput for SSL, HTTPS, and compression traffic. Citrix can provide its SSL VPN on the NetScaler platform (AG-EE), which has been validated at 28,000 SSL transactions/sec, 3+ Gbps encrypted throughput, 1.3+ Gbps compression throughput, and 6+ Gbps of full Layer 7 HTTP throughput. Additional performance enhancements include request switching, SSL offload, compression for both Web and non-web applications, Web caching, load balancing, surge protection, DDoS protection, TCP/IP optimization, and differential HTTP compression. Citrix offers more than 2,000 statistics that can be monitored via the Web interface, command line interface, SNMP, XML API, and a centralized management system. Reporting can log all end user activity from AAA actions (login, logout, etc.) as well as all network traffic including HTTP, TCP, UDP, ICMP, and NetBIOS connections. These logs include detailed information about source, destination, user group, duration, data transferred (sent/received), and compression ratios. Citrix provides solid authentication and authorization, but lacks the sophisticated endpoint security, integrated threat protection, and NAC functionality of other solutions. Citrix includes basic support for Windows CE and with a pre-installed client that can provide session persistence. Link optimization includes compression and TCP/IP optimizations. Source: Forrester Research, Inc.

4 Tech Choices Citrix Systems App Performance Is Tops In The SSL VPN Appliances Market 4 Figure 1 Citrix Systems Access Gateway Evaluation Overview (Cont.) STRATEGY Product strategy Corporate strategy Financial resources to support strategy Cost MARKET PRESENCE Installed base Revenue Revenue growth Services Employees Channel partners Citrix has a very strong strategy that includes positioning its SSL VPN appliance as a critical part of its broader application delivery strategy. Citrix positions the product well within its installed base and as a standalone product, both with an emphasis on application access control and policy compliance. Citrix plans to further integrate its SSL VPN with the NetScaler product. Citrix s SSL VPN is a relatively small component revenue-wise, but it s very committed to make this part of the overall portfolio and positioning its appliance as a critical component in application delivery. Citrix is leveraging its strong financial performance to aggressively fund development of the Access Gateway SSL VPN product line. It s on par to surpass $1 billion in annual revenues. Citrix offers better-than-average pricing, although its pricing model is still somewhat complex. Citrix has one of the largest installed bases of all the vendors evaluated. It has very quickly introduced its product to its existing customers as well as reaching new ones via its extensive channel. Citrix has the third largest revenue among vendors evaluated. Citrix introduced the Access Gateway SSL VPN in Q1 2005, so previous year growth is not available. However, given that all revenue came in this period it exhibits the fastest growth. Citrix offers adequate implementation and training resources to support its SSL VPN strategy. Citrix has an average number of employees dedicated to this product, especially for its size. In particular, it has a strong sales presence thanks to one of the more established channel programs. Citrix has the strongest support for its product with both an OEM partnership and the largest, most distributed channel models Source: Forrester Research, Inc. Go online to download additional in-depth data and scores for this vendor and other vendors included in this Forrester Wave evaluation.

5 Tech Choices Citrix Systems App Performance Is Tops In The SSL VPN Appliances Market 5 SUPPLEMENTAL MATERIAL Online Resource The underlying spreadsheet for Figure 1 is available online. The spreadsheet includes more detailed data and scores for this vendor. This detailed data and scores for this vendor are also available online through an Excel-based vendor comparison tool that provides detailed product evaluations and customizable rankings. The Forrester Wave Methodology We conduct primary research to develop a list of vendors that meet our criteria to be evaluated in this market. From that initial pool of vendors, we then narrow our final list. We choose these vendors based on: 1) product fit; 2) customer success; and 3) Forrester client demand. We eliminate vendors that have limited customer references and products that don t fit the scope of our evaluation. After examining past research, user need assessments, and vendor and expert interviews, we develop the initial evaluation criteria. To evaluate the vendors and their products against our set of criteria, we gather details of product qualifications through a combination of lab evaluations, questionnaires, demos, and/or discussions with client references. We send evaluations to the vendors for their review, and we adjust the evaluations to provide the most accurate view of vendor offerings and strategies. We set default weightings to reflect our analysis of the needs of large user companies and/or other scenarios as outlined in the Forrester Wave document and then score the vendors based on a clearly defined scale. These default weightings are intended only as a starting point, and readers are encouraged to adapt the weightings to fit their individual needs through the Excel-based tool. The final scores generate the graphical depiction of the market based on current offering, strategy, and market presence. Forrester intends to update vendor evaluations regularly as product capabilities and vendor strategies evolve. ENDNOTES 1 In Forrester s first evaluation of the SSL VPN space in 2004, we found that Citrix s solution was a serverbased architecture, not a standalone appliance. It required additional Microsoft servers which makes it a costly solution for many enterprises. However, for enterprises with apps already running on MetaFrame Presentation Server, Citrix became a less costly and seamless way to add secure remote access. See the March 19, 2004, Tech Choices Making SSL VPNs A Strategic Part Of Your Network. 2 In November 2004, Citrix Systems put more muscle behind its access strategy with its acquisition of Net6, an emerging SSL VPN and IP telephony vendor. With respect to the SSL VPN space, this is a smart move. It signals Citrix s commitment to push beyond server-based computing and into appliances. With the Net6

6 Tech Choices Citrix Systems App Performance Is Tops In The SSL VPN Appliances Market 6 SSL Access Gateway, Citrix gets: 1) an appliance-based remote access solution; 2) an innovative alternative to IPsec VPNs; and 3) solutions with a foothold in the SMB space. See the November 29, 2004, Quick Take Citrix Strengthens Access Strategy With Net6 Acquisition. 3 Forrester evaluated leading SSL VPN appliance vendors across 57 criteria and found that Juniper Networks maintains its SSL VPN leadership thanks to its superior reverse proxy technology and focus on secure mobility. Aventail trails close behind with its fully integrated endpoint security and similar strength in mobile device access. Citrix Systems and Microsoft also provide leading technology that focuses on access and acceleration for corporate apps. Caymas Systems rounds out the Leaders with an innovative approach of combining remote and local network access control. F5 Networks, Cisco Systems, and Nortel Networks are all Strong Performers and round out the evaluation. Further integration of F5 s technology into its application switch should nudge it into the Leaders category. Cisco and Nortel with less applicationoriented strategies remain solid alternatives for firms that simply want to offer IPsec and SSL termination in a single appliance. See the, Tech Choices The Forrester Wave : SSL VPN Appliances, Q Forrester Research (Nasdaq: FORR) is an independent technology and market research company that provides pragmatic and forward-thinking advice about technology s impact on business and consumers. For 22 years, Forrester has been a thought leader and trusted advisor, helping global clients lead in their markets through its research, consulting, events, and peer-to-peer executive programs. For more information, visit , Forrester Research, Inc. All rights reserved. Forrester, Forrester Wave, WholeView 2, Technographics, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. Forrester clients may make one attributed copy or slide of each figure contained herein. Additional reproduction is strictly prohibited. For additional reproduction rights and usage information, go to Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. To purchase reprints of this document, please resourcecenter@forrester.com