JUNIPER防火墙培训PPT3---JNSS-S ISG 0014 Sec3V2.pptVIP

Integrated Security Gateway Series Technical Overview Module Objectives Curriculum Products and Services Section Objectives Network and Security Trends Increasing number of network attacks target application layer Driving the requirement for greater intelligence in network/security devices Existing controls are not application aware, therefore driving consolidation of multiple security services on single device Firewall seen as natural choice – mature, stable technology with integration success (VPN, DI, etc.) Loose “integration” impacting performance Vendors cutting corners for short “Time to Market” Firewall performance degradation not a compromise Network and Security Trends (Cont’d.) Increased used of small packet applications (VoIP, multi-media, streaming video) Applications are more sensitive to latency Application vulnerabilities and attacks are on the rise Increasing demand for remote network connectivity Enterprise Level Security Requirements Firewalls control which traffic is permitted in and out of network Second layer of defense to detect and prevent any malicious traffic that get past firewall Integration of FW, AV, URL filtering, IPS, IDP and GPRS facilitates network segmentation and minimize network re-architecture IPS (Deep Inspection) ICAP (Antivirus) Redirection ICAP (Internet Content Adaptation Protocol) redirects email content to stand alone third party AV server Currently available on ISG 1000 ISG 2000 ICAP supports HTTP and SMTP protocols Allows AV to be supported on higher end platforms Allow customers to use existing AV solution if ICAP enabled Requires Third Party Load balancers to distribute AV traffic among multiple ICAP Antivirus servers ICAP Redirection Maximum Values: AV sessions: ISG 1000 1600 IS2000 4096 ICAP connections per server: ISG 1000 512 ISG 2000 512 Web Filtering Control Web usage to improve employee productivity, network resource utilization and avoid litigation Stop users from visiting known spyware, and phish