DATASHEET Client Product Overview The Client is a leading-edge, Windows-based WAN optimization software for mobile end users and small office/home office end users. The Client improves application response time by providing LANlike performance for applications regardless of where the end user is located. The Client seamlessly and transparently integrates with Juniper s branch office and data center WAN optimization products, providing distributed enterprises with a complete and cost-effective solution that accelerates both branch office up to data center connections, as well as mobile end users and small offices/home offices. The Client is capable of seamlessly coexisting with other WAN acceleration and VPN solutions in the customer s network. The Client also has the option of being integrated with Juniper Networks SA Series SSL VPN Appliances to provide accelerated, secure remote access. Product Description The Juniper Networks Client is the newest member of Juniper s WAN optimization product family. Client is a Windows (Windows 2000 and Windows XP)-based software for mobile end users that improves application response times by providing LAN-like performance for applications no matter where end users are located. Installed on the end user s desktop PC or laptop, the Client works transparently to improve application response times by applying disk-based caching, compression, and protocol acceleration techniques to WAN data traffic. End users are not required to make any changes to their Windows environment or processes, and can continue working as before, while enjoying much faster access to applications. The Client represents the next generation in enterprise application acceleration because enterprises can now enable cost-effective, dynamically provisioned, pervasive application acceleration regardless of user location. Employees who travel outside the branch or the head office can be assured of accelerated access to their applications in real time. The Client also provides an easy-to-use, affordable, high-performance WAN acceleration solution for small offices where a dedicated hardware appliance may not be economically feasible. Home offices and small branch offices need fast WAN response times for critical applications traversing long distances back to the central site. External contractors and partners who need access to the enterprise extranet are also assured fast, reliable, and secure connections to enterprise applications, enhancing collaboration. The Client works by automatically detecting and establishing a communications link with Juniper Networks C Series Application Acceleration Platforms located in the corporate data center, and optimize application traffic using disk-based caching, compression, and protocol acceleration techniques which are described below. The C Series platform monitors and manages remote Clients that are distributed across the enterprise on end users laptops and PCs. No additional hardware is needed to manage Client licensing, as this capability is provided in the C Series platform itself. 1
VERY SMALL BRANCH OFFICE HEADQUARTERS/DATA CENTER VPN WAN C Series Applications, Files Servers, etc Client MOBILE USER/TELECOMMUTER PARTNERS AND CONTRACTORS Optimized and Accelerated Traffic Figure 1: Client deployment scenarios Architecture and Key Components The Client is available as a concurrent user license on the C Series platforms, and communicates with these platforms to optimize traffic using a peer-to-peer model. IT administrators have a variety of options available to download and install the Client package to end user machines. End users can securely download the Client software from the C Series platform using a password protected access, or IT administrators can push it to end user machines using existing distribution tools such as Microsoft Systems Management Server (SMS) via a preconfigured Microsoft Installer (MSI) package. A third option that transparently deploys and starts the Client is available when the Client is deployed in combination with the Juniper Networks SA Series SSL VPN Appliances. This Client and SA Series integrated solution is detailed below. The Client is also compatible with a wide variety of VPN solutions and existing software and accessories, such as thirdgeneration (3G)/wireless cards and USB modems that reside on the end user s machine. Juniper has tested and validated interoperability with VPN solutions and wireless cards from multiple vendors. Please see the compatibility chart for a complete list of tested environments. Secure, Accelerated Remote Access Client Integration with SA Series SSL VPN Appliances The Client is unique in the industry because of its integration with Juniper Networks SA Series SSL VPN Appliances. When deployed in conjunction with the Client, the SA Series can dynamically provision secure, accelerated remote access for employees, partners, and contractors. A key challenge for IT administrators in deploying software on hundreds or thousands of end user machines is managing the distribution of the software and maintaining software version control. Juniper solves this by integrating the Client with the SA Series; when a user connects to their SA Series appliance, the Client is auto-installed on the end user s machine. For all subsequent SA Series sessions, a check is performed by the SA Series appliance to determine if the Client software and configuration version is current. If it is not, the current software and/or configuration version is transparently installed on the end user s machine. This ensures that end users always have the correct version of the Client running on their machines, and minimizes the deployment complexity associated with managing the distribution of software and configuration to end user machines on an ongoing basis. Most software clients must be manually started to accelerate traffic, which in turn requires that the end user remembers to start their software client when they are remote. Juniper solves this in its integrated solution with a Client that can be automatically started once the end user s SA Series connection is established. This ensures that end users always have their WAN optimization running when they are working remotely. Combining the Client with SA Series products provides automated download and Client management via a feature rich authentication and policy platform, providing IT administrators with a simple way to ensure that all remote end user traffic is both secure and accelerated. 2
REMOTE USER HEADQUARTERS/DATA CENTER SA Series SSL VPN Appliance WAN C Series Applications, Files Servers, etc Client Data Before Optimization Secure and Optimized Traffic Figure 2: Juniper s integrated secure and optimized remote access solution Features and Benefits The Client offers a full suite of WAN optimization technology to accelerate WAN traffic and improve application response times for mobile end users and small office/home office end users. Easy to install and requiring little or no end user intervention, the Client is a Windows-based desktop application that works transparently in the background without interfering with other applications that may be installed on the end user s machine. The Client improves application performance over the WAN by recognizing and eliminating redundant transmissions, and accelerating TCP and application-specific protocols. Compression and Caching The Network Sequence Caching (NSC) feature identifies and replaces redundant data patterns with labels before forwarding across the WAN. NSC uses a disk-based cache on the remote laptop running the Client, and employs onboard hard drives on the C Series to store large data patterns over long periods of time. This enables the Client and head-end C Series appliance to identify long patterns of repeated traffic (including entire files) and eliminate the repetitive traffic separated by megabytes of data or last seen days or weeks earlier. This allows end users to achieve reduction rates in excess of 90 percent for some applications and increase effective WAN capacity by up to a 100 fold. NSC is most effective for applications that do large data transfers such as FTP, HTTP, email, to name a few. TCP Acceleration While compression effectively increases available bandwidth, TCP acceleration improves the performance of TCP applications where the use of available bandwidth is constrained by network latency. The Client uses Packet Flow Acceleration (PFA) technology to more fully utilize link bandwidth, increasing throughput across the WAN for TCP applications and accelerating applications on long haul network connections. The end result is that applications can run many times faster, improving worker productivity and enhancing business performance. TCP acceleration optimizes a broad range of TCP-based applications including HTTP, FTP, email, and enterprise resource planning (ERP) applications such as Sharepoint, Documentum, Siebel, Oracle, SAP, and others. Application-Specific Protocol Acceleration Application-specific protocol acceleration on the Client plays a key role in managing latency. The Client uses the Application Flow Acceleration (AppFlow) technology to provide transparent acceleration for the Microsoft Common Internet File System (CIFS) protocol, which is constrained by much smaller windows than TCP. This dramatically improves the end user experience with remote file server access and file sharing. In addition, the Object Store selectively caches hot objects in the C Series cache to minimize the need to fetch repetitive data across the WAN. AppFlow for CIFS Windows improves application performance for Windows file services by accelerating the underlying protocol (CIFS). The CIFS protocol sends data in small blocks that must be received and acknowledged before the next block can be sent, requiring hundreds or even thousands of round trips to complete a single transaction. The AppFlow for CIFS technology pipelines these data blocks in quick succession, delivering in excess of a 50-fold improvement in application performance to meet the needs of remote and branch office end users accessing centralized applications or network attached storage (NAS) data over the WAN. Ease of Configuration To simplify configuration, the Client uses a secured dynamic endpoint discovery mechanism to form adjacencies with the C Series appliance on the fly, thus eliminating the requirement for any upfront setup between the two endpoints. All traffic passing between the Client and C Series is flow-based, and all application flows that match the acceleration policies are optimized. This occurs in a way that is transparent to the end user and to the application itself. There is no end user configuration required on the Client. All application acceleration policies and services such as compression, acceleration, and monitoring are configured on the C Series platform using the Web UI. The Clients obtain their configuration policies from the C Series platforms, and do not require a separate configuration. This results in extreme ease of use and transparency for end users who can focus on getting their work done efficiently. 3
Ease of Deployment By integrating with the SA Series, the Client solves the problem of software distribution to thousands of end user machines, maintaining control over versions and configuration policies. IT administrators can specify a deployment policy in the SA Series for the Client to automatically download and launch upon connecting to SA Series SSL VPN Appliances, transparent to the mobile end user. Thereafter, every time the end user starts a VPN session, an automatic check is performed to determine if the Client software needs to be upgraded to a newer version or configuration file. IT administrators do not need to spend time enforcing upgrades or managing distributions. Low Total Cost of Ownership The Client deployed at the small branch office does not require a separate WAN optimization device, reducing the cost and management burden in small offices while providing all the benefits of the C Series Application Acceleration Platforms. Clients are licensed and managed by the head-end C Series platform. By combining monitoring, management, and licensing functions in a single appliance, customers benefit from reduced operating costs by eliminating the need to have a separate licensing server. Simple and Economic Licensing Model The Client licensing model is simple and economic. The licensing model is based on the number of concurrent end users connected with their Client. Companies can thus distribute the Client to all of their employees and acquire a user license for a fraction of their work force, since not all remote employees will be connected simultaneously. Additionally, to ensure that acceleration is appropriately allocated to those who need it most, the C Series appliance monitors concurrent Client connections, putting active end users ahead of those who are idle. Troubleshooting There is an advanced view available on the end user s machine for troubleshooting, if needed. In the Client Advanced UI, the Client logging, configuration, and diagnostic information can be viewed and saved, or emailed to Technical Support for analysis and diagnosis. The diagnostic file contains information on configuration files, diagnostics, log files, and other information necessary for troubleshooting. Table 1: Client Application Acceleration Features and Benefits Feature Feature Description Benefits Auto discovery NSC compression TCP acceleration CIFS acceleration Integration with SA Series Online help VPN compatibility Client automatically discovers head-end C Series appliances in the network path and dynamically negotiates optimization services based on the configuration policies set in the C Series appliance. Client utilizes disk cache to store large data patterns over long periods of time, then identifies and removes repetitive traffic separated by megabytes of data, or data last seen days or weeks earlier. Packet Flow Acceleration (PFA) technology more fully utilizes link bandwidth by liberating data from the limitations imposed by TCP protocol. AppFlow for CIFS Windows improves application performance for Windows file services by accelerating the underlying protocol (CIFS). In addition, the Object Store selectively caches hot objects in the C Series cache to minimize the need to transport repetitive data over the WAN. Auto download and launch of Client upon starting an SA Series VPN session; Client software and configuration policies can be updated in a way that is transparent to the end user. Client provides user-friendly online help for a wide range of topics to assist first time end users. Compatible with Juniper VPN solutions as well as VPN solutions from Cisco, Nortel, and others. No up-front tunnel setup such as IP address configuration or hard coding is required, which minimizes configuration complexity. Effectively increases WAN capacity by over 100 times. Reduces latency caused by the application protocol and accelerates TCP-based applications on high latency networks, greatly improving end user response times. Improves file sharing performance by up to 50 fold. Simplified, transparent Client distribution and launch with ease of administration. User experience with Client is enhanced. Customers do not need to make any changes to their VPN infrastructure, and can preserve their existing investments. 4
Client Monitoring and Management Web UI Management Interface The C Series provides licensing, monitoring, and management for Clients. Web UI, a graphical user interface for IT administrators and managers, provides visibility into and control over deployment of Clients to end user machines. Global as well as individual Client configuration policies can be set using simple point and click functions. Web UI also provides extensive monitoring and reporting capabilities. IT managers can obtain high level and detailed views into application acceleration and compression statistics, and generate reports using a variety of filters depending upon their specific needs. They are also able to analyze application performance and acceleration on the WAN, and gain insights into how the WAN is performing over different periods of time, assessing which applications are benefiting most from optimization. A variety of reports are available from Web UI. Summary reports can be generated for WAN applications throughput, overall compression for all end users and applications, as well as compression for individual end users and applications. IT managers can view compression ratios achieved along with the number of accelerated connections established with the C Series appliances. Reports are available for granular time periods ranging from the last hour to last week, to enable managers to see fluctuations in application acceleration performance based on time of day and week. High Availability The C Series supports high availability of remote user access to ensure complete fail-safe operations, and guarantee that end users will have application acceleration always available to them when they are working remotely. Two C Series appliances can be configured such that in the event of a failure, the healthy appliance continues the optimization of incoming traffic and end users can continue to enjoy faster application access. If only a single appliance is deployed, the C Series appliance automatically fails-to-wire in the event of a failure, converting to bypass mode and allowing traffic to pass through untouched so that end users can continue their work uninterrupted. Table 2: Client Monitoring and Management Features and Benefits Feature Feature Description Benefits SNMP, system log SNMPv2c, MIB II, Series Enterprise MIB, and local system log. Use of standard protocols for monitoring. Secure remote access SSHv1, SSHv2, and HTTPS (SSL). Secure, authenticated access to the C Series device. WAN performance statistics Reporting Authentication, Authorization, and Accounting (AAA) High availability Client delivery auto download Client delivery Web download Client delivery MSI package installation Application definitions High level and detailed statistics on how much data is getting compressed and accelerated by endpoint and application. Executive and detailed reporting on compression and acceleration by individual and aggregate endpoints and applications. AAA local database support. Ensures fail-safe operation; fail-to-wire in the event of a failure. Client is automatically downloaded and launched upon starting the Network Connect VPN session. End users can download the Client from a secure link specified by the administrator. Administrators can choose to distribute the Client as an MSI package using distribution tools such as Microsoft SMS. 50 applications are provided predefined and preconfigured for optimization; 256 applications can be defined for optimization; up to 100 applications can be monitored. IT managers are able to see the benefits of WAN optimization that end users are getting. Ability to make decisions based on performance metrics and how WAN is being utilized. Leverages widely used standards for authentication. End user work is not disrupted in the event of a failure, and the network is not affected. Completely transparent install for the end user, easy to deploy for IT. Easy to distribute software to a large number of end users by simply directing them to a secure link. Leverages commonly used distribution method. IT administrators can take advantage of existing application definitions and also have the flexibility to define new applications used in their enterprise. 5
Specifications PC Software Requirements for Installation of Client Windows 2000 Professional SP4+ (32 bit) or XP Professional SP2 (32 bit versions only) Internet browsers supported: Internet Explorer 6.0, 7.0, Firefox 3.0+ Internet browsers need to support Java and ActiveX to download the Client from the C Series Administrator privileges are required to install the Client on a PC Intel Pentium M1400 or higher 512 MB RAM or higher 5 GB free disk space or higher C Series Hardware Requirements The following C Series platforms are supported for the Client: C2600 Application Acceleration Platform C3400 Application Acceleration Platform C590 Application Acceleration Platform C Series Software Requirements C Series platforms must be running Juniper Networks JWOS 6.0 operating system. Performance-Enabling Services and Support Juniper Networks is the leader in performance-enabling services and support, which are designed to accelerate, extend, and optimize your high-performance network. Our services allow you to bring revenue-generating capabilities online faster so you can realize bigger productivity gains, faster rollouts of new business models and ventures, and greater market reach, while generating higher levels of customer satisfaction. At the same time, Juniper Networks ensures operational excellence by optimizing your network to maintain required levels of performance, reliability, and availability. For more details, please visit www.juniper.net/products-services. Ordering Information The Client is available as a concurrent user license upgrade option for the C2600, C3400, and C590 platforms. The Client concurrent user licenses are shown in the table below. A C Series hardware (C2600, C3400, or C590) appliance is required to deploy the Client user license. Please contact your Juniper Networks representative or reseller for details. Client concurrent user licence options: Model Number OS-CLIENT-X-25 OS-CLIENT-X-100 OS-CLIENT-X-250* * Available only on the C3400 Description Client license for up to 25 simultaneous users Client license for up to 100 simultaneous users Client license for up to 250 simultaneous users About Juniper Networks Juniper Networks, Inc. is the leader in high-performance networking. Juniper offers a high-performance network infrastructure that creates a responsive and trusted environment for accelerating the deployment of services and applications over a single network. This fuels high-performance businesses. Additional information can be found at www.juniper.net. Corporate and Sales Headquarters Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA Phone: 888.JUNIPER (888.586.4737) or 408.745.2000 Fax: 408.745.2100 APAC Headquarters Juniper Networks (Hong Kong) 26/F, Cityplaza One 1111 King s Road Taikoo Shing, Hong Kong Phone: 852.2332.3636 Fax: 852.2574.7803 To purchase Juniper Networks solutions, please contact your Juniper Networks representative at 1-866-298-6428 or authorized reseller. EMEA Headquarters Juniper Networks Ireland Airside Business Park Swords, County Dublin, Ireland Phone: 35.31.8903.600 Fax: 35.31.8903.601 Copyright 2009 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, JUNOS, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. JUNOSe is a trademark of Juniper Networks, Inc. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 1000286-002-EN June 2009 Printed on recycled paper. 6