Juniper VGW VIRTUAL GATEWAY Datasheet

DATASHEET

VGW VIRTUAl GATEWAy

Product Overview

The vGW Virtual Gateway combines best-in-class virtual firewall to meet the unique security challenges of virtual data centers and clouds. IT teams can now secure their virtual environment by enforcing a rule-based firewall for each VM. Because the vGW has been purpose-built with virtualization features in mind, it synchronizes automatically with VMware vCenter, secures VMotion, and uses VMsafe to provide breakthrough levels of security and performance.

The vGW delivers superior protection, throughput, scalability, automated deployment and operations, and value for virtualized environments. Enterprises can now achieve the full ROI of virtualization by maximizing the number of secure VMs on each physical host and virtualizing mission-critical systems.

And for the first time, they can maintain equal security and regulatory compliance across physical and virtual networks.

Product Description

Juniper Networks ® vGW Virtual Gateway rounds out a virtualization security solution that includes a high-performance hypervisor-based stateful firewall complete virtual network visibility, monitoring, and reporting. The vGW brings forward powerful new features that automate security and compliance enforcement within virtual networks and clouds. By leveraging virtual machine introspection (VMI) data and intelligence, and coupling it with

Juniper’s wide-ranging knowledge of the security and virtual network environment, vGW creates an extensive database of control points by which security policies and compliance rules can be defined.

The vGW makes this rich data available in intuitive UIs that let administrators build the entire range of policies from corporate rules on global protocol handling (e.g., block Kazaa) to discrete regulatory compliance policies for how virtual machines should be configured (e.g., must have antivirus installed). Compliance assessment and security enforcement happen automatically and in lockstep with changes in the virtual environment. New VMs, for example, will be scanned and quarantined if out of compliance with policies. The same applies to VMs whose “state” changes such that the security posture is weakened. The vGW VMware VMsafe-certified security operates from deep within the virtualization fabric as part of the hypervisor. Consequently, the software delivers unprecedented levels of security, far beyond what is possible with traditional physical network security products.

Security and compliance concerns are top of mind in virtualization and cloud deployments. Juniper’s experience and innovative research in virtualization security has resulted in a powerful software suite capable of monitoring and protecting virtualized environments without negatively impacting performance. A hypervisor-based, VMsafecertified, virtualization security approach, in combination with “X-ray” level knowledge of each virtual machine through VMI, gives the vGW a unique vantage point in the virtualized fabric. Here, virtualization security can be applied efficiently and with context about the virtual environment and its state at any given moment.

1

vGW delivers total virtual data center protection and cloud security through visibility, compliance, and control:

• Visibility —full view to all applications flowing between VMs and how they are used. Complete VM and VM group inventory, including virtual network settings. Deep knowledge of VM state, including installed applications, operating systems, and patch level, through VMI.

• Compliance —enforcement of corporate and regulatory policies for the presence of required or banned applications via VMI.

Some practical applications of compliance enforcement such as assurance of segregation of duties to ensure that VMs are assigned to the right trust zones inside the virtual environment.

Pre-built compliance assessment based on common industry best practices and leading regulatory standards.

• Control —a VMsafe-certified, stateful firewall provides access control over all traffic via policies that define which ports, protocols, destination VMs, etc. should be blocked. Further inspection of allowed traffic can be conducted by protocol or application in order to identify intrusion attempts, malformed packets, or the presence of malware.

Architecture and Key Components

Figure 1: A dashboard view of virtual network security and compliance states

Virtual

Center

Database

VM

Physical Server #1

Intranet Application

SAP

VM

Live

Migration

WWW

VM

WWW

VM

WWW

VM

WWW

VM

WWW

VM

Physical Server #2

Desktop

VM

Desktop

VM

1 2 1

Virtual

Firewall

Virtual

Firewall

Virtual

Switch

Virtual

Switch

Virtual

Switch

NIC NIC NIC

Physical Network

1

2

Virtual Firewall secure inter-VM communication, stopping infections.

Secure VMotion by “attaching” an enforceable policy to the migrating VM.

Figure 2: The vGW secures highly dynamic VMs through change and motion

NIC

Virtual

Switch

2

Features and Benefits

Virtualization has brought both economic benefits and new security concerns to enterprises. IT managers often hesitate to virtualize systems with sensitive data or take full advantage of VM live migration due to security worries. Among their concerns are:

• Undetected and uncontained malware outbreaks or insider attacks in the virtual environment

• lack of visibility into, or control of, traffic between VMs that never touches the physical network

• Inability to enforce policies that isolate VMs, prevent VM sprawl, or secure features like VMotion

• Virtualization compliance gaps and audit data holes

• Increasing network complexity and administrative burden caused by applying legacy VlAN or firewall technology to the virtual environment

Figure 3: VM Introspection technology gives the vGW an

X-ray view of VMs

Without the means to mitigate risks in a cost-effective manner, many enterprises are not currently realizing the full potential that virtualization technology offers.

Architected for Multiple Platforms

Juniper Networks multi-platform architecture is designed to secure all leading virtualization platforms (e.g., Microsoft Hyper-V, Xen) and support their newest technologies, such as VMsafe from VMware.

Enterprises retain the freedom to choose whatever virtualization technologies meet their needs, today and into the future.

Automated Deployment and Integration

The vGW virtual appliance automatically installs itself and discovers all guest VMs through integration with vCenter. Unlike using VlANs to isolate VMs, Juniper’s solution is easy to maintain and readily scales as virtualization use grows and new virtual machines are added to the environment.

Automated VM Security

The vGW automates the application and enforcement of security rules. This is accomplished in two ways. First, it allows for the creation of highly detailed security policies that “dynamically” combine desired conditions from a rich database of virtual infrastructure (VI) and VM information. The dynamic policy groups can then be associated with one or more VMs. When additional

VMs are created, they can be automatically associated with known groups and policies by matching predefined criteria. Administration overhead is reduced by allowing a “build once, apply continuously” model to security policy definition and enforcement.

Cloud Security API

Juniper provides an XMl-RPC programming interface that lets service providers and large enterprises customize and automate firewall provisioning. Users of the API can efficiently secure virtualization services for internal or external customers, while ensuring strict isolation of customer VMs.

Compliance

The vGW lets administrators, security managers, and compliance auditors define and report on the specific conditions (corporate and regulatory) that constitute compliant operation in their environments. The vGW user interface allows for the building of custom “whitelists” (desired configurations) and “blacklists”

(unwanted conditions). vGW continuously monitors all VMs, including newly created ones, to report on the overall compliance posture of the virtual environment. Virtual data center and cloud administrators can see their aggregate compliance posture at a glance and drill down on each VM to identify the exact condition that has triggered a noncompliance alert (e.g., VM in wrong VlAN, or trust zone has been quarantined).

High Availability

Using redundant system components, the vGW provides mission- critical reliability. An easily deployed shadow management server immediately takes over if the primary system fails, ensuring uninterrupted policy enforcement and management control.

High-Performance, Hypervisor-Resident Firewall

By processing inspections in the VMware hypervisor kernel, vGW provides 10 times the throughput of older, bridge-mode firewalls running in virtual environments. This optimized VMsafe innovation can increase VMs per host while eliminating network reconfigurations. Firewall protection is continuous as VMs move from host to host using VMotion. Unlike traditional firewalls, the vGW keeps the “live” in live migration by maintaining open connections and security throughout the event.

Intuitive Central Management

The Web-based central management console displays real-time views of each virtual machine’s operating and security status at a glance. And a simple, familiar interface for defining rules and managing policies supports role-based administration, enabling separation of duties.

Logging, Reporting, and Alerts

System logging output gives security event management systems insight into virtual network activity. Administrators can print reports of historical VM traffic data and configure SNMP traps to alert them to selected events.

3

Smart Default Policy for New Virtual Machines

When a new VM is created, the vGW assigns it an administratordefined default policy. Allowing only admin and Domain Name

System (DNS) protocols, for example, mitigates the risks of misconfigured or “rogue” VMs with vulnerable or infected workloads.

VMware Hypervisor Protection

By monitoring and storing all network connections to the hypervisor using VMsafe APIs, the vGW creates a new defensive layer that protects hypervisors against unauthorized connection attempts from VMs. vGW provides a hypervisor-based stateful firewall that inspects all packets to and from VMs, blocking all unapproved connections and subjecting allowed packets to deeper inspection (e.g., port 80 for Web applications). Administrators can enforce stateful firewall policies for individual VMs, logical groups of VMs, or all VMs.

VM Introspection

Virtual Machine Introspection (VMI) is a groundbreaking approach, analogous to an “X-ray” of VMs and the virtual environment from the hypervisor. VMI enables information gathering about VMs, the security of the virtual network, and virtual environment settings— without the use of agents. The ability of malware to disable or hide from security agents is a classic unresolved security problem that has plagued the security industry for decades. VMI offers an innovative new approach to leveraging the hypervisor for an uncompromised “X-ray” inspection of VMs, where malware literally has nowhere to hide. vGW incorporates VMI as part of its security policy definition and enforcement mechanism.

By amassing information about the kinds of applications and services running on VMs, vGW sustains deep knowledge about the internal security state of each virtual device. This information is then made available through vGW’s point-and-click dynamic policy editor, so that rules can be easily built to enforce a desired

VM security posture. For example, a security rule could require the presence of antivirus software to be present inside a VM, or alternatively discover unapproved applications, forcing automated quarantine and alerts for noncompliant machines. vGW’s unique vantage point in the hypervisor delivers unprecedented visibility and control over the virtual environment to achieve compliance with corporate standards.

Figure 4: Granular virtual firewall policies enforce all access to and from VMs

System Requirements

vGW Firewall

• Operating System Virtual Appliance

• Memory: 512 MB

• Disk space: 1 GB

• Virtual Infrastructure VMware

• vSphere 4

• VMware ESX or ESXi 4.0, with vCenter 4

Security Design for vGW

• Operating System Virtual Appliance

• Memory: 1 GB

• Disk space: 10 GB

• Virtual Infrastructure Infrastructure 3

• VMware ESX

• Server 3.x.x

• VirtualCenter 2.x.x

Juniper Networks Services and Support

Juniper Networks is the leader in performance-enabling services and support, which are designed to accelerate, extend, and optimize your high-performance network. Our services allow you to bring revenue-generating capabilities online faster so you can realize bigger productivity gains and faster rollouts of new business models and ventures. At the same time, Juniper

Networks ensures operational excellence by optimizing your network to maintain required levels of performance, reliability, and availability. For more details, please visit www.juniper.net/us/en/ products-services.

4

Ordering Information

For more information about Juniper Networks vGW Virtual

Gateway, please contact www.juniper.net

.

MODeL NuMBeR

AlTOR-CENTER-1

AlTOR-SVM-ADD-2

AlTOR-SVM-ADD-10

AlTOR-SVM-ADD-20

AlTOR-SVM-ADD-50

AlTOR-SVM-ADD-100

AlTOR-SVM-UNl

AlTOR-HA-ADD-2

AlTOR-HA-ADD-10

AlTOR-HA-ADD-20

AlTOR-HA-ADD-50

AlTOR-HA-ADD-100

DeSCRIPtION

Central management center

Security VM license for 2 CPU sockets

Security VM license for 10 CPU sockets

Security VM license for 20 CPU sockets

Security VM license for 50 CPU sockets

Security VM license for 100 CPU sockets

Security VM license for unlimited CPU sockets

High availability license for 2 CPU sockets

High availability license for 10 CPU sockets

High availability license for 20 CPU sockets

High availability license for 50 CPU sockets

High availability license for 100 CPU sockets

About Juniper Networks

Juniper Networks is in the business of network innovation. From devices to data centers, from consumers to cloud providers,

Juniper Networks delivers the software, silicon and systems that transform the experience and economics of networking. The company serves customers and partners worldwide. Additional information can be found at www.juniper.net

.

5

Corporate and Sales Headquarters

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089 USA

Phone: 888.JUNIPER (888.586.4737) or 408.745.2000

Fax: 408.745.2100 www.juniper.net

APAC Headquarters

Juniper Networks (Hong Kong)

26/F, Cityplaza One

1111 King’s Road

Taikoo Shing, Hong Kong

Phone: 852.2332.3636

Fax: 852.2574.7803

eMeA Headquarters

Juniper Networks Ireland

Airside Business Park

Swords, County Dublin, Ireland

Phone: 35.31.8903.600

EMEA Sales: 00800.4586.4737

Fax: 35.31.8903.601

Copyright 2011 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, Junos,

NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper

Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

1000363-001-EN Feb 2011 Printed on recycled paper

6

To purchase Juniper Networks solutions, please contact your Juniper Networks representative at 1-866-298-6428 or authorized reseller.