User manual JUNIPER NETWORKS SPACE SECURITY DESIGN

[. . . ] Consequences can impact overall deployment schedules, increase complexity, and even delay profitability. Junos Space Security Design helps integrate a secure network design workflow into your branch deployment solution. The result is faster time to market, reduced security risk, centralized, consistent configuration of the network, and overall lower cost of maintenance. Product Description Juniper Networks® Junos® Space Security Design is a state-of-the-art, scalable enterprise solution designed to automate the visualization, configuration, and deployment of the security architecture of a multi-domain network. Large-scale network security implementations often increase operational complexity and cause configuration errors leading to heightened security risk. [. . . ] Figure 3: Security whiteboard and network topology Security Whiteboard Security whiteboard consists of three sub-functions--security topology, security policy, and IPsec VPN configurations. using topology view of the whiteboard the user can create and manage network objects of a targeted network domain. Each object allows the user to view its specific properties and thus make further adjustments. When specific topology information is not available, the architect can simply import the new topology from a commaseparated values (CSV) file that can be created using other design tools. The objects within the security whiteboard workspace include applications, security domains, and addresses that can be created and managed using the object builder feature of Security Design. Security policies that control the traffic between security domains are applied to the topology using GuI tools provided in the workspace. For example, the user can simply establish a policy association between two security domains by dragging a line Figure 2: Security Design is an application on Junos Space platform from the toolset. Then, the details of the policy and the traffic rules are created graphically in a dialog box related to this policy association. In the next step, the architect decides whether to provision the security policy immediately or schedule it for a later date to finally complete policy implementation between the required security domains. Architecture and Key Components Security Design represents several innovations including topology based policy definition to model security devices once and have the configuration ready to push to thousands of devices, policy abstraction to create a logical security topology, and patent 2 shipped with Security Design. If a new application is needed, the user can conveniently provide the details using object builder, and it will simply add the application to the Junos Space database. Figure 4: Creating a policy using security whiteboard IPsec VPN is the last of the Security Whiteboard functions enabling configuration of thousands of VPNs in hub spoke, full mesh, or site-site, and the monitoring and troubleshooting of these tunnels: A sophisticated VPN configuration wizard simplifies an otherwise complex VPN setup, reducing it to a few simple steps. Define VPN properties as name, VPN type, profile, and the tunnel IP subnet. Figure 5: Adding devices using object builder Rapid Deployment Junos Space provides a rapid deployment workflow that is common to all Junos Space applications. Similar to the other workspaces in Security Design, rapid deployment follows a familiar convention to present an overview of the devices that are maintained in Junos Space, available to deploy, and can be added to the topology as required. Introduction of new devices to the network infrastructure, including the required security policy configuration, is as simple as creating a configuration file, known as configlet, and applying it to the network device in the branch location. Central management and simple provisioning capabilities of rapid deployment enable network operators to deploy and provision new devices with minimal manual intervention. Object Builder object builder is a multi-tenant workspace that contains standard network objects and enables the addition of new devices. Similar to the security whiteboard workspace, network resources as applications, security domains, and addresses are displayed graphically. A set of predefined, common applications such as FTP, telnet, SSH, SMTP, netbios-session, and many others are Features and Benefits Table 1: Junos Space Security Design features and benefits FeAtuRe BeneFit Web-based Interface · Junos Space applications are web-based and provide a simple to use but sophisticated browser interface with familiar design tools. · users can focus on their task, better apply their knowledge, interact within a familiar environment, and challenge their creativity as they design. The consistent interface among applications, whether it is a Juniper or a third-party application, lets users accomplish tasks with greater productivity. Application within the Junos Space family Granular device configuration · As a member of the Junos Space family, Security Design provides the user with a common Web interface thataccesses an expanded Junos Space feature set. · rapid deployment is an example of a feature shared among all Junos Space applications. [. . . ] · using this wizard accessed from within the Security Design workspace, the required configuration file can be created and distributed to the branch location conveniently. · Application of configuration does not require an onsite security architect and, when applied, the device is simply commissioned to the network with a preset configuration. · Accelerates the deployment of a network device with controlled configuration settings. · Greatly reduces or eliminates the risk of security configuration errors. Specifications Client Browser Support Supported browsers include Firefox 3. 0, Internet Explorer 7. 0, and above. Ordering information When ordering Junos Space Security Design two items are required: the Junos Space plaform--physical or a virtual appliance for VMWare environment--and a Junos Space Security Design application license. [. . . ]