Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • Networking

    Juniper SSL VPN Grants Granular Rights

    By
    eWEEK EDITORS
    -
    August 21, 2006
    Share
    Facebook
    Twitter
    Linkedin

      Juniper Networks Secure Access 4000 SSL VPN appliance provides robust remote access for users and neat management tools for IT administrators.

      Click here to read the full review of Secure Access 4000 SSL VPN.

      2

      Juniper Networks Secure Access 4000 SSL VPN appliance provides robust remote access for users and neat management tools for IT administrators.

      The SA4000 Secure Sockets Layer VPN is part of a family of security products that Juniper acquired when it bought NetScreen Technologies in 2004. The high-end SA4000 appliance also comes in a FIPS (Federal Information Processing Standard) 140-compliant model that meets the standards for cryptographic systems that handle sensitive but not classified data. New for the SA4000 software is Secure Access ICE, or In Case of Emergency, licensing.

      /zimages/3/144162.jpg

      The SA4000 configured for 1,000 users costs $59,995, a price that is nearly identical to that of competing SSL VPN appliances. An $18,000 ICE license allows a temporary increase in the number of remote access users who can come in over the SA4000, for a period of up to eight weeks.

      In eWEEK Labs tests, the SA4000 matched competitors such as F5s FirePass 4100 and Aventails EX-2500 in ease and breadth of configuration. Meanwhile, the SA4000s level of remote access granularity was the best weve seen this year. (For eWeek Labs reviews of the FirePass and Aventail SSL VPNs, go to “FirePass 4100” and “Aventail EX-2500,” respectively, at eweek.com.)

      The Juniper SA4000 fits easily in spaces where more traditional IP Security solutions would be a tough sell: Unlike its more complex IPSec cousins, the SA4000 offers the kind of ease of use that is necessary for client systems that are not under the direct control of IT, such as systems used at business partners or suppliers.

      The SA4000 also will work well for IT managers who want to be able to provide granular access to road warriors using centralized policies. (For the Labs analysis of SSL VPNs increasing role in the enterprise, go to “SSL VPNs offer more control to IT managers” at eweek.com.)

      /zimages/3/28571.gifClick here to read a review of FirePass 4100.

      We began our testing of the Juniper SSL VPN by installing the 1U (1.75-inch), rack-mountable SA4000 in our wiring cabinet in “one-arm” mode. We assigned an IP address from our internal network to the SA4000 and used our firewall to port-forward SSL connections to the device.

      The SA4000 offers a wide variety of user authentication and authorization choices. We integrated the VPN with our Microsoft Windows AD (Active Directory) running on a Windows Server 2003 Standard server. (While the AD server was running on a physical server, most of the other servers in our testbed were running on virtual machines courtesy of VMware.)

      We had no problems connecting outside clients with our internal systems. The outside clients were all laptops running Windows XP and a variety of browsers (including Microsofts Internet Explorer 6.0 and the Mozilla Foundations Firefox 1.5.0.6).

      But this isnt to say that there werent some hiccups along the way.

      For one thing, while SSL VPN appliance vendors make much of their products “clientless” nature, it turns out that sophisticated, secure access to applications, network file shares and other network resources requires that some client software be downloaded to the Web browser. The SA4000 is no exception.

      The other bump in the road appeared during the proc-ess of creating policies for enabling user access to network resources.

      During eWeek Labs tests of the SA4000, we created user groups that matched the organizations we already had set up in AD. For example, we set up editorial, sales, operations and facilities groups.

      We made Web-enabled applications, such as our Microsoft Exchange Server system, available by creating resource profiles. The resource profiles specify the exact resource—such as a network file share or Web application—as well as the allowed users of that resource. We found that creating the resource profiles was the easy part of the process; it was the user management that was a little tough.

      /zimages/3/28571.gifClick here to read a review of Aventail EX-2500.

      As with other SSL VPN systems that weve recently tested, IT managers should devote a significant amount of time to setting up user access profiles, called “user roles” in the SA4000. This is especially true if the new ICE licensing is going to be used to accommodate large numbers of users in emergency conditions, when time will likely be in short supply to review user access rights.

      The nice thing about SSL VPNs in general and the SA4000 in particular is that resources are excluded unless specifically added by the administrator. In addition, the time devoted to creating these policies will pay off in reduced support costs.

      In addition to defining end-user roles, we were able to set up restricted administrators of the SA4000 system. However, the SA4000 is more limited in this area than competitors, allowing administrators only to be either fully entitled or read-only.

      This paints administrators with far too broad a brush, and administrative access will thus need to be limited to a few trusted, well-trained operators. We would prefer to see more options so that the burden of granting and revoking user access can be spread more evenly.

      Next page: Evaluation Shortlist: Related Products.

      Page 3

      Evaluation Shortlist

      Array Networks Appliances

      Offer broad application support (sslvpn.net)

      Check Point Software Technologies Connectra

      Available as software-only or as a hardware appliance (www.checkpoint.com/products/connectra/index.html)

      Cisco Systems SSL VPN services

      The SSL VPN services modules for the Catalyst 6500 and 7600 complement the better-known and more widely implemented IPSec VPN services on Cisco gear (www.cisco.com)

      OpenVPN Solutions OpenVPN

      A community-supported software project that runs on a variety of operating system platforms (openvpn.net)

      Positive Networks PositivePro

      A hosted VPN and endpoint security service (www.positivenetworks.com)

      Whale Communications Intelligent Application Gateway

      Focuses on endpoint security and precise application access control (www.whalecommunications.com)

      Technical Director Cameron Sturdevant can can be reached at [email protected].

      Check out eWEEK.coms for the latest news, views and analysis on servers, switches and networking protocols for the enterprise and small businesses.

      eWEEK EDITORS
      eWeek editors publish top thought leaders and leading experts in emerging technology across a wide variety of Enterprise B2B sectors. Our focus is providing actionable information for today’s technology decision makers.

      MOST POPULAR ARTICLES

      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Cloud

      Yotascale CEO Asim Razzaq on Controlling Multicloud...

      James Maguire - May 5, 2022 0
      Asim Razzaq, CEO of Yotascale, provides guidance on understanding—and containing—the complex cost structure of multicloud computing. Among the topics we covered:  As you survey the...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      Android

      Samsung Galaxy XCover Pro: Durability for Tough...

      Chris Preimesberger - December 5, 2020 0
      Have you ever dropped your phone, winced and felt the pain as it hit the sidewalk? Either the screen splintered like a windshield being...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×