Next-Generation Firewall Services Datasheet

The days of tying applications to traditional port-based communications are long gone. Today, new applications are designed to change ports and protocols dynamically. Some are designed to tunnel through services such as HTTP web traffic. This means applications can be used anywhere, at any time the user needs. Empowering users to access applications anywhere poses a challenge in defending against a constantly changing threat landscape that directly targets applications and passes through traditional network-layer protections to protect the enterprise.

Juniper NGFW Services offer a powerful security platform well equipped to meet this challenge. At the core lies AppSecure, which offers robust visibility and control over applications on the network.

AppSecure quickly recognizes applications and surfaces the application name, description of the service, and inherent level of risk, regardless of port, protocol, or encryption method.

Offering deep application visibility and control, AppSecure provides the context that links application use to a user, regardless of location and device. Furthermore, AppSecure understands application behaviors and identifies vulnerabilities, enabling administrators to block risky applications before they can do any damage. AppSecure helps reduce an application's threat footprint by allowing the definition of granular security policies, such as the level of deep packet inspection required and to which users or groups are allowed access.

AppSecure enforces quality of service (QoS) at the application layer, forwarding traffic based on applications and providing multi-path routing capabilities for critical application traffic.

Juniper's intrusion prevention system (IPS) is tightly integrated with Juniper SRX to mitigate network and application exploits and protect against a wide range of attacks. Juniper's intrusion detection system (IDP) constantly monitors for new exploits against recently discovered vulnerabilities, keeping network protection up to date against the latest cyberattacks and stopping them at the exploit stage before they gain a foothold inside the network. IDP signatures can be enabled in detection-only mode or inline to block malicious traffic directly.

Custom signatures can be created using existing signature sets. You can create policies using a pre-defined policy template or based on custom signatures to keep network traffic protected. It allows you to define policy rules to match a section of traffic based on a zone, network, and application and then take active or passive preventive actions on that traffic. You can also take packet capture before and after the attack for further analysis.

SecIntel provides verified threat intelligence to all points of connection across the network to block malicious traffic, enabling a threat-aware network. To help reduce risk, SecIntel can be deployed on the SRX to block malicious traffic originating from malicious IP addresses and domains without needing deep packet inspection. SecIntel's threat feeds are automated and constantly updated. Additionally, these feeds are scrubbed and verified by Juniper Threat Labs to maintain high detection efficacy and reduce false positives. SecIntel can help reduce the load on the network.

Malicious files, including ransomware and adware, are becoming more prevalent from multiple attack vectors. These threats compromise network endpoints and make them vulnerable to data theft, including credentials and personally identifiable information (PII). Detecting and blocking malware and unwanted files at line rate before they reach an endpoint is critical to safeguarding users, data, and infrastructure against attacks. Juniper’s AI-Predictive Threat Prevention predicts and prevents known and zero-day malware at line rate by using AI to effectively identify threats in packet snippets and reduces false positives by filtering out non-threatening activities. It helps human experts focus on more critical security tasks and discover the real, dangerous threats at line rate for the entire attack lifecycle—keeping the network safe from initial and all subsequent attacks. Juniper understands that when there is an attack, every second counts.

Juniper combines cloud-based file reputation intelligence and malware signatures that remain active for the entire attack lifecycle with the SRX Series NGFW to deliver lightweight and fast security. Gain a highly effective perimeter defense against known threats without slowing down your users or business. NGFW delivers lightweight and fast security. The result is a highly effective perimeter defense against many known threats, which doesn't slow down your users or business.

Users spend over half their time browsing the Internet and using web-based tools. Web traffic must be both legitimate and safe. At the same time, specific web applications, such as online banking or healthcare, must remain private. EWF allows administrators to block unwanted URL categories, such as gambling and malware sites and enables selective decryption to keep business traffic safe from threats. In contrast, users' personal traffic can remain private. To reduce attacks, EWF contains more than 200 URL categories that can be used within security policies on the SRX.

SSL has become the universal method for authenticating websites and encrypting traffic between Web clients and Web servers.

Since SSL content is encrypted, users can download malware directly onto client endpoints. Typically, organizations have no visibility into SSL connections, leaving them blind to any threats transmitted over HTTPS to their corporate enterprise clients.

Juniper offers a powerful application-level SSL proxy that sits between client and server, intercepting encrypted traffic, terminating the session, and re-initiating the connection towards the end destination. It can be used as an SSL “forward” proxy that sits between users on the corporate LAN and their access to the Internet, protecting the end client. It also intercepts HTTPS traffic by acting as a gateway at the enterprise perimeter and terminates the encrypted traffic. At that point, unencrypted traffic is immediately inspected to determine compliance with security policy, as set by the security team. Traffic is then handled by proactive malware engines that will instantly block malware, thwarting any security breach.

The SSL Proxy can be configured with exemptions that prevent traffic between certain URLs from being decrypted for user privacy protection. The exemptions can be set based on user groups, URL categories, or custom categories. The SSL proxy provides security between clients and the web server the firewall protects. This can be termed as SSL “reverse” proxy, which sits between external connections and web servers that are managed within the organization.

Juniper Advanced Threat Prevention (ATP) is Juniper's threat intelligence hub and uses machine learning algorithms to provide complete advanced malware detection and prevention. ATP supports threat detection without breaking decryption and surfacing compromised devices. When integrated with SRX Series Firewalls, Juniper ATP leverages a global threat database to deliver threat intelligence, dynamic malware analysis, Encrypted Traffic Insights, and adaptive threat profiling. Juniper ATP is offered as a cloud-based service or as an on-premises appliance.

Juniper’s AI-Predictive Threat Prevention provides anti-malware capabilities at wire speed, ensuring that you don’t have to compromise your throughput performance for better security, all while eliminating patient zero. Signatures generated by AI-Predictive Threat Prevention remain active for the entire attack lifecycle, instead of a mere 24 hours after discovering the malware like other technologies, and the active signatures provide effective protection against subsequent attacks.

Juniper ATP protects against trojans, worms, ransomware, botnets, IoT threats, and DNS threats like Domain Generation Algorithm (DGA) generated domains and DNS tunneling.

Security Director Cloud is Juniper’s simple and seamless management experience delivered in a single UI to connect customers’ current deployments with their future architectural rollouts. Management is at the center of the Juniper Connected Security strategy and helps organizations secure every point of connection on their network to safeguard users, data, and infrastructure.

Organizations can secure their architecture with consistent security policies across any environment—on-premises, cloud-based, cloud-delivered, and hybrid—and expand zero trust to all parts of the network from the edge all the way into the data center and to the applications and microservices. With Security Director Cloud, organizations have unbroken visibility, policy configuration, administration, and collective threat intelligence all in one place.

Juniper meets our customers where they are on their journey, helps them leverage their existing investments, and empowers them to transition to their preferred architecture at a pace that is best for business by automating their transition with Security Director Cloud.

Juniper Secure Edge secures workforces anywhere with the fast, reliable, and secure access they need. Delivers full-stack Security Service Edge (SSE) capabilities, including Firewall as a Service (FWaaS), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB) with Data Loss Prevention (DLP), Zero Trust Network Access (ZTNA), and advanced threat protection to protect access to web, SaaS, and on-premises applications and provide users with security that follows them wherever they go. Juniper meets customers where they are and takes them where they want to go by leveraging what they have and extending their zero-trust initiatives to a cloud-delivered architecture without breaking the bank or their ops team.

Juniper Secure Edge, managed by Security Director Cloud, uses a single policy framework that enables security policies to be created once to follow users, devices, and data wherever they go. Customers don’t have to start from scratch when adopting cloud-delivered security. With our three-click wizard, customers can easily leverage existing campus edge policies and translate them into an SSE policy. Because it uses a single policy framework regardless of the deployment model, Secure Edge applies existing security policies from traditional deployments to its cloud-delivered model in just a few clicks, reducing misconfigurations and risk.

Whether securing remote users, campus and branch locations, private cloud, public cloud, or hybrid cloud data centers, Juniper provides unified management and unbroken visibility across all architectures. This makes it easy for ops teams to easily and effectively bridge their current investments with future architectural goals, including SASE. Organizations can manage security anywhere and everywhere, on-premises, in the cloud, and from the cloud, with security policies that follow users, devices, and data wherever they go, all from a single UI.

Users have fast, reliable, and secure access to the data and resources they need, ensuring great user experiences. IT security teams gain seamless visibility across the entire network while leveraging their existing investments, helping them transition to a cloud-delivered architecture at their own pace.

Juniper Secure Edge provides consistent security policies that follow the user, device and data without having to copy over or recreate rule sets. It's easy to deploy cloud-delivered application control, intrusion prevention, content and Web filtering, and effective threat prevention without breaking visibility or security enforcement.

Juniper has been consistently validated by multiple third-party tests as the most effective security technology on the market for the past four years, with 100% security efficacy across all use cases.

Juniper Networks is the leader in performance-enabling services that are designed to accelerate, extend, and optimize your high-performance network. Our services allow you to maximize operational efficiency while reducing costs and minimizing risk, achieving a faster time to value for your network. Juniper Networks ensures operational excellence by optimizing the network to maintain required levels of performance, reliability, and availability.

For more details, please visit https://www.juniper.net/us/en/products.html.

To order Juniper Networks SRX Series Firewalls and to access software licensing information, please visit the How to Buy page on www.juniper.net.

At Juniper Networks, we are dedicated to dramatically simplifying network operations and driving superior experiences for end users. Our solutions deliver industry-leading insight, automation, security and AI to drive real business results. We believe that powering connections will bring us closer together while empowering us all to solve the world’s greatest challenges of well-being, sustainability and equality.

1000623 - 009 - EN OCTOBER 2023