NNTF12_51 SIMPLY CONNECTED IN ACTION : AN OVERVIEW OF DIFFERENT USE-CASES. Tim McCarthy

Transcription

1 NNTF12_51 SIMPLY CONNECTED IN ACTION : AN OVERVIEW OF DIFFERENT USE-CASES Tim McCarthy

2 MAJOR MARKET TRENDS DATA MOBILITY AND SCALE AT AN ALL TIME HIGH AND GROWING Sophisticati on (Maturity) Device Proliferation New Devices Explosion of devices Diversity of Applications & Richness Of Data Internet Information Services ERP New Applications *Forester Security Risk Proliferation Virus Worms Trojans Type of Attack DoS Malware Botnets APT 2 Copyright 2012 Juniper Networks, Inc.

3 THE WORLD IS ON THE MOVE THE NETWORK CAN T STAND STILL legacy model of the business network From Wired connections Corporate owned devices Corporate operated applications Perimeter security Stable application environments Multiple isolated networks To Wireless as primary means of connectivity Mix of personal and corporate devices Cloud based, IT or user chosen apps Security attacks from everywhere Ever evolving software based applications Context aware unified network Today s Flexible, proactive business network 3 Copyright 2012 Juniper Networks, Inc.

4 THE SOLUTION IS TO BE SIMPLY CONNECTED BYOD, Explosion of Apps Coordinated Security Simply Connected Performance at Scale Mobile Rich Media OTT Apps Highly Resilient Always On An integrated portfolio of resilient wired, wireless and security products that simply enable mobility at scale. 4 Copyright 2012 Juniper Networks, Inc.

5 NEED FOR COORDINATED SECURITY Mobility and BYOD Enable mobility/byod and application proliferation while protecting the corporate assets User-centric security that is context aware (device,location) Enforce security at every point and level Transparent, automated and secure user access Granular application visibility to meet compliance regulations Gain Visibility Into Web 2.0 Threats And Control Application Usage 5 Copyright 2012 Juniper Networks, Inc.

6 DELIVERING COORDINATED SECURITY BRINGING CONTROL BACK TO IT 1 Qualify the device Branch 2 3 Provision and authenticate the user Enforce user and application policies across the network Campus AP MX EX MX SRX 4 Control the device and avoid data leakage MAG SRX WLC Servers EX AP Comprehensive Enhanced Simply Connected portfolio, Comprehensive enterprise solution Consistent Orchestrated access solution. Consistent user experience that is simple and secure Coordinated Unified policy. Coordinated security for BYOD and enterprise access. 6 Copyright 2012 Juniper Networks, Inc.

7 MOBILITY IS MUCH MORE THAN BYOD Guest Devices Employee Owned Devices (BYOD) Corporate Owned Devices Today's business environment requires coordinated access 7 Copyright 2012 Juniper Networks, Inc.

8 MOBILE USER TYPES AND REQUIREMENTS Open access, Guest Users Self provisioning Open, No encryption, Captive Portal Simple Experience Device aware policy Differentiated access Guest Devices Corporate Issued Devices Self provisioning Secure Certificate based authentication User, App, Device aware policy On-device Security Device Management Application Management Content Monitoring Corporate Owned Devices Employee Owned Devices 8 Copyright 2012 Juniper Networks, Inc. BYOD (Employee owned) Self provisioning Secure Certificate based authentication User, App, Device aware policies Device management On-device security Device, data loss/ theft prevention Secure network, cloud access

9 USER EXAMPLES FOR MOBILITY Doctor s own ipad Hotel Employees on ipad Teachers own ipad Students own ipad Employee owned Laptops, Smartphones and tablets at an enterprise Visitors at Museum Visitors at an Enterprise Hospital issued ipad School issued mobiles Visitors at Hospital Visitors at Hotel Hospital issued Laptops School issued Laptops 9 Copyright 2012 Juniper Networks, Inc.

10 GUEST USER ON CORP NETWORK GUEST SELF PROVISIONING & APPLICATION RESTRICTION Hospital Network Google Can t access!!! Hospital Guest Login This Hospital is keeping bandwidth GUEST ID for (408) what matters most WLA532 WLC2800 With Smartpass SRX 550 MAG Series (UAC) 10 Copyright 2012 Juniper Networks, Inc.

11 GUEST USER ON CORP NETWORK GUEST SELF PROVISIONING 1 Unknown device connects to open captive portal SSID 4 SmartPass sends temporary credential to end user via Clickatell SMS service Clickatell SMS Gateway service 2 User session is captured and redirected to SmartPass WLC 3 User selects SmartPass selfregistration and creates a temporary user credential SmartPass Wireless User Tablet/smartphone 6 User is connected to the network using mobile phone number and temporary password AP EX Series 5 User uses temporary credentials to authenticate against SmartPass EX Series 11 Copyright 2012 Juniper Networks, Inc.

12 EMPLOYEE OWNED DEVICE ON CORP NETWORK EMPLOYEE SELF PROVISIONING & APPLICATION RESTRICTION Hospital Network Electronic Medical Records! Can t access!!! Hospital Login EMR This Hospital Now connecting to a secure hospital network is DOCTOR keeping ID Dr. Brown 423 bandwidth for what matters most WLA532 WLC2800 With Smartpass Provisioning Server SRX 550 MAG Series (UAC) 12 Copyright 2012 Juniper Networks, Inc.

13 EMPLOYEE OWNED DEVICE ON CORP NETWORK EMPLOYEE SELF PROVISIONING 1 Unknown device connects to open captive portal SSID Wireless User Tablet/smartphone AP Provisioning wizard gets EAP-TLS configuration profile (and cert) from provisioning portal; agent dissolves 6 EX Series User selects secure wireless network and device authenticates to RADIUS without requiring user to enter credentials 7 2 User session is captured and redirected to SmartPass Provisioing portal pushes native supplicant config wizard to client device 5 4 Provisioning portal gets user credentials from wizard; validates against AD; and requests user cert for end user WLC 3 SmartPass web portal presents captive portal and redirects client to provisioning portal Provisioning Server EX Series SmartPass UAC AD/Certificate Authority Corporate Data Center 13 Copyright 2012 Juniper Networks, Inc.

14 EMPLOYEE OWNED DEVICE ON CORP NETWORK EMPLOYEE DEVICE APPLICATION RESTRICT 1 DHCP Device authenticated on wireless network Wireless User Tablet/smartphone AP 4 2 Server/Smartpass communicates User and IP information to UAC via IF-MAP EX Series 5 SRX AppSecure SRX enforces user Polices block nonwork related user basic access to policies allowing applications like all servers except Hulu and Netflix finance SRX AppTrack feature combined with MAG data collects per user application information providing detailed reports in STRM 3 UAC pushes role based ACL and FW policies to EX and SRX WLC UAC SRX DHCP and IF-MAP Active Directory /LDAP Data Finance Video Apps Corporate Data Center Internet 14 Copyright 2012 Juniper Networks, Inc.

15 EMPLOYEES ON CORPORATE LIABLE DEVICE HOST CHECKING & APPLICATION RESTRICT Hospital Network Electronic Medical Records WLA532 WLC2800 EMR Dr. Rose 369 Scan Connect is Clean With SmartPass SRX240 MAG Series / Junos Pulse Access Control Service (UAC) / Junos Pulse Secure Access Service (SSL VPN) Junos Pulse Mobile Security Suite 15 Copyright 2012 Juniper Networks, Inc.

16 ONBOARDING EMPLOYEES ON CORP. OWNED ASSETS 1 Device completes registration with MSS and downloads wireless ios profile via MDM profile (user is still connected to open SSID) 3 Device installs profile and acquires user cert from Corp Certificate Authority via SCEP enrollment process WLC W2K8 Certificate Server Wireless User Tablet/smartphone 4 User connects to secure SSID and authenticates to RADIUS using certificate 5 AP EX Series User is now connected to secure SSID with no user input of credentials required 2 Wireless profile contains: 1) WiFi EAP-TLS settings (certificate based auth) 2) SCEP profile for device to enroll for new certitifacate 3) CA cert to use for server validation EX Series Mobile Security Suite UAC Corporate Data Center 16 Copyright 2012 Juniper Networks, Inc.

17 APPLICATION FILTERING CORP. LIABLE DEVICE APPLICATION RESTRICTION 1 Device authenticates on wireless network 2 SmartPass communicates User and IP information to UAC via IF-MAP WLC Data Active Directory /LDAP SRX Finance Wireless User Tablet/smartphone SRX AppSecure Polices blocks Linkedin 5 AP 4 EX Series SRX enforces user policies allowing user basic access 3 UAC pushes role based ACL and FW policies to EX, WL and SRX SmartPass Video Apps UAC Corporate Data Center Internet 17 Copyright 2012 Juniper Networks, Inc.

18 NEED FOR PERFORMANCE AT SCALE Performance at Scale Explosive demand for mobile devices and rich media usage Future-proof your new investment Maximize your network resource utilization Assure quality of experience regardless of application or access type Scale Without Complexity Or Compromise 18 Copyright 2012 Juniper Networks, Inc.

19 DELIVERING PERFORMANCE AT SCALE SIMPLE & COST-EFFECTIVE SCALING 1 Wire speed data plane Branch 2 3 Seamless scalability across wired and wireless Architecturally consistent QoS Campus AP MX EX MX SRX MAG SRX WLC Servers EX AP Wired-like Performance Everywhere Designed for Bandwidthhungry Rich Media Applications No Performance Tradeoffs as Campus Scales 19 Copyright 2012 Juniper Networks, Inc.

20 INCREASED EXPECTATIONS FOR NETWORKS Unique Daily Wireless Sessions Large American University ~50,000 Students, Multiple Devices Per Student x SPRING SUMMER FALL SPRING SUMMER FALL 20 Copyright 2012 Juniper Networks, Inc.

21 MOBILITY REDEFINES BUSINESS PRACTICES AN OPPORTUNITY, NOT A PROBLEM Business Applications Personal Applications Pulse 42% Increased Productivi 39% Reduced Paperwor 37% Increased Revenue Source : Forrester, ty Frost &Sullivan, Business k week, Gigaom pro, ABI research 21 Copyright 2012 Juniper Networks, Inc.

22 NEED FOR CONSISTENT CONNECTIVITY Highly Resilient Assure uninterrupted availability of critical business applications Non-stop mobility Cloud services dependent on continuous accessibility Greater productivity through an always-on rich media collaboration Highly Reliable Network For Robust Connectivity 22 Copyright 2012 Juniper Networks, Inc.

23 DELIVERING CONSISTENT CONNECTIVITY FOR NON-STOP PRODUCTIVITY Uninterrupted service for mission-critical applications Seamless upgrade and scalability Simplified operations 80% fewer devices to manage Branch Campus AP MX EX MX SRX MAG SRX WLC Servers EX AP Improved Operational Efficiency Carrier-class Network for Enterprise No Single Point of Failure 23 Copyright 2012 Juniper Networks, Inc.

24 ACTIVE-ACTIVE CONTROLLERS Primary controller authenticates/ authorizes client 2 Primary Seed 3 Primary propagates session details to backup controller for use during failure Client Session State Secondary Seed 1 A new client associates to the system Member Member Client Session State Member 24 Copyright 2012 Juniper Networks, Inc.

25 SELF-REPAIRING CONTROL ARCHITECTURE 1 Should the Primary be taken out of service, the Secondary immediately takes over Primary Seed Member Secondary Seed Member Member 25 Copyright 2012 Juniper Networks, Inc.

26 NONSTOP OPERATION HITLESS FAILOVER Primary Seed 2 A new Secondary is designated and is given the AP configuration and client session state Secondary Seed Member Member 26 Copyright 2012 Juniper Networks, Inc.

27 SIMPLY CONNECTED ENABLES TRUSTED MOBILITY AT SCALE Coordinated Security Safe and simple mobility while protecting assets Switching Security Wireless Routing Non-stop Mobility experience Performance at Scale Scalability without complicating the network Highly Resilient Automated, uninterrupted service All the great things are simple. - Albert Einstein 27 Copyright 2012 Juniper Networks, Inc.

28

29 SMARTPASS CONNECT Automated, Self-Service On-Boarding Automatically provision client devices Secure 802.1x or PSK access to the network Authentication: Credentials (PEAP, TTLS) or Certificates (TLS) Automates certificate enrollment process Self service client certificates deployment from Microsoft CA Devices: ios, Android, Windows, Mac Client-side Reporting http based reporting on client state Driver information, OS and platform information 29 Copyright 2012 Juniper Networks, Inc.

30 SMARTPASS CONNECT COMPONENTS Cloud-hosted IT provisioning utility Administrative Console Specify configurations necessary to access the network(s) Creates deployment package for BYOD devices Hosted service (SaaS) so it is always up-to-date Wizard Available to BYOD devices via browser: Automated, self-service configuration Self service certificate deployment through Microsoft CA When unable to connect to secure network Hosted on Web server, in cloud, or media 30 Copyright 2012 Juniper Networks, Inc.

31 SMARTPASS CONNECT ON-BOARDING 1. New user connects to Open SSID 2. Captive portal provides link for secure network 3. SmartPass Connect configures device 4. SmartPass Connect moves device to secure SSID 31 Copyright 2012 Juniper Networks, Inc.

32 USER EXPERIENCE 1 2 Web Server AAA Server Network Management Admin Console SmartPass Connect allows agent-less network provisioning: Open SSID 4 Secure SSID 1 IT Admin configures network parameters 2 IT Admin deploys the configuration files to local Web server or SmartPass server 3 User connects to local Web server and downloads configuration 4 5 SmartPass Connect s (dissolvable) client runs through configuration on device 6 User device connects to secure network 32 Copyright 2012 Juniper Networks, Inc. SmartPass Connect wizard securely logs device details to the network mgmt application and dissolves 3 5 6

33 SIMPLY CONNECTED LARGE KIT Demonstrates: CBBU Portfolio Products & Features: 1. EX4200's (Enforcement point, Virtual Chassis) 2. SRX240 (HA cluster, Layer 3 Enforcement point, AppSecure w/ RoleBased Firewall, EFW+Sophos AV, 3G/4G backup, Dynamic VPN 3. WL880R's (Enforcement point, WL Cluster) 4. MAG2600 (Access Control- as centralized policy manager) 33 Copyright 2012 Juniper Networks, Inc.

34 SIMPLY CONNECTED SMALL KIT Demonstrates: CBBU Portfolio in a portable package Products & Features: 1. EX2200-C s (Enforcement point) 2. SRX210E (Layer 3 Enforcement point, AppSecure w/ RoleBased Firewall, EFW+Sophos AV, 3G/4G backup, Dynamic VPN 3. WLC2's (Enforcement point, WL Cluster) 4. MAG2600 (Access Control- as centralized policy manager) 34 Copyright 2012 Juniper Networks, Inc.

35 35 Copyright 2012 Juniper Networks, Inc.

36 36 Copyright 2012 Juniper Networks, Inc.

37 37 Copyright 2012 Juniper Networks, Inc.

38