SSL VPN & Virtual Private Networks

Citrix Access Gateway Enterprise Edition firmware Version 8.0

Charles Aunger / www.eknowlogy.com — Wed, 04 Apr 2007 20:12:00 GMT

Citrix have released version 8 of their firmware for the Access Gateway Enterprise Edition (that's the version that runs on the same hardware as the NetScaler appliance family).

This version is the first (of the Enterprise edition software) to provide the full ICA proxy capabilities we've seen in Citrix Secure Gateway and more recently in Citrix Access Gateway appliances. Essentially it means that users can login and access Presentation Server-based applications without have to establish any VPN connections. The ICA protocol is simply tunneled within an HTTPS connection and reverse proxied by the Access Gateway.

The key difference between the Advanced and Enterprise version of the Access Gateway relates to the number of concurrent users you can support. The standard CAG hardware (2000 series) can host up to 2,000 concurrent connections. The Enterprise platform increases that number to around 10,000.

You can download the latest firmware from here. (requires a MyCitrix.com login)

click for source also see this link for more information

Charles Aunger
charles aunger eknowlogy / eviglio / frameworkx / charles.aunger homepage

Tolly Group Review - Citrix CAG Advanced vs Juniper NetScreen SA-1000

Charles Aunger / www.eknowlogy.com — Wed, 28 Mar 2007 14:21:00 GMT

As I published back October last year (2006)

http://geekswithblogs.net/eknowlogy/archive/2006/10/11/93799.aspx

Thanks to Doug (www.dabcc.com) and Citrix User Group - New Zealand reminding us.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The Tolly group has published a very interesting article about the findings of their performance comparison between the Citrix and Juniper offerings.

The Juniper SA-1000 is targeted at small to medium size businesses. Both products offer similar services (SSL VPN) with the CAG offering somewhat more granular controls, especially when combined with Presentation Server, but this review suggests that at a base performance level the Citrix product comes out on top over the Juniper offering.

You can download the Tolly paper here at no cost

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Over the past year / 18 months I have been involved with quite a bit of SSL VPN testing and as usual the vendors have analysis's and information valid for both sides of the arguments.

Since the test was published there seems to be information around this that Juniper and Citrix might wanted to have told Tolly / are Tolly might have wanted to ask about , but did not. Not Quoting Internal source's from both Citrix and Juniper but..

1) At the time of the test the Juniper SA 1000 was an end of line product and was replaced with the Juniper SA 2000.

2) Citrix have been upgrading and adding feature's like wild fire since the test and versions of builds at the time were quarterly or monthly.

3) Citrix solution with Advanced access controlled requires an internal Windows server to provide the Advanced Access options were the Juniper SSL VPN has built in Advanced access control features. (No need for an internal server)

4) The Citrix Access Gateway was Pre-Release version of the Citrix Access Gateway 4.2.

5) Juniper SSL VPN is purchased as feature modules vs. Citrix bundled features.

6) Testing tools that can really analysis bandwidth, performance etc other than ethereal might had want to be used.

Today both products have changed in version and moved on quite a bit.

Juniper is now the SA2000 R 5.4 http://www.juniper.net/products_and_services/ssl_vpn_secure_access/secure_access_2000/index.html
Citrix Access Gateway http://www.citrix.com/English/ps2/products/product.asp?contentID=15005

Both companies have very interesting products and solutions, and it would be nice to test the products and solutions independently, and not limited to what each company does best.

I would hope that Citrix should be great at Citrix Presentation Server and Juniper should be good at access control because this is each's product backgrounds, in a balanced bakeoff / platform test I would always suggest that the solutions and devices are tested to as close as real life as possible.

Test the wide use of features that companies claim to have and can deploy, then rate the products on business as well as features. Options examples cost per user, supportability, functionality versus requirements, style of environment that the device is going into (is it an all Citrix or Juniper environment), roadmaps. corporate strategy.

The SSL VPN space is very fast moving at the moment and a lot of players buying for number one spot.

In my experience do your home work and pick the 2 or 3 best for your solution and POC and test like mad.. "Personally Citrix and Juniper would be one of the 2 at the top of my list, with my experience over the past 18 months"..

Check out a few reports such as

The Forrester Wave™: SSL VPN Appliances, Q4 2006

http://www.juniper.net/company/presscenter/awards/forrester_sslvpn_wave_report_Q406.pdf

also available at http://www.citrix.com/English/ps2/products/documents.asp?contentid=15005

Charles Aunger
charles aunger eknowlogy / eviglio / frameworkx

F5's Newest FirePass Controller SSL VPN - Delivers Industry's First Support for Windows Vista Operating System

Charles Aunger / www.eknowlogy.com — Wed, 21 Feb 2007 18:02:00 GMT

F5 announced an enhanced version of its award-winning FirePass® Controller SSL VPN software. The new release provides the SSL VPN market's first support of Microsoft's Windows Vista™ operating system. It also features seamless integration with F5's BIG-IP® Global Traffic Management (GTM) product to ensure superior performance, scalability and 'always on' access for FirePass users worldwide. In addition, F5 debuted its FirePass 4300 hardware platform for large scale deployments, delivering the best price-performance available for enterprises with up to tens-of-thousands of users.

"Our support for Microsoft's Windows Vista gives our customers the assurance that their F5 investment will serve them far into the future," said Ameet Dhillon, Director of Product Management at F5. "Couple that with the powerful new FirePass platform and integration with F5's unique Global Traffic Manager and enterprises have an easy-to-manage, single-vendor solution that readily accommodates tens of thousands of remote users."

Highlights of the new FirePass product include:

Vista client support:
Integration with BIG-IP Global Traffic Manager (GTM):
FirePass 4300 high performance hardware platform: Catering to the needs of large enterprise SSL VPN deployments, the 4300 platform offers the best price-performance, scalability, and high availability for large enterprise SSL VPN deployments. supports up to 2,000 concurrent users. (hmm interesting seems low compared to other manufactures)

click for source

Charles Aunger

charles aunger eknowlogy / eviglio / frameworkx

Citrix Access Gateway Wins Prestigious 2007 SC Magazine Reader Trust Award

Charles Aunger / www.eknowlogy.com — Tue, 20 Feb 2007 22:08:00 GMT

Citrix Systems today announced it won a 2007 Reader Trust Award in the 10th annual SC Magazine Award program for outstanding achievement in information technology (IT) security. Citrix Access Gateway™ was named the Best IPSec/SSL VPN at a gala event held in San Francisco in conjunction with the recent RSA Conference, the world’s leading information-security event.

Citrix Access Gateway was among nearly 400 entries submitted in 20 technology categories. Winners in the SC Magazine Awards Reader Trust program are based on voting by more than 9,000 of the publication’s readers.

click here

Citrix Launches Citrix Access Gateway™ 10000 Series SSL VPN

Charles Aunger / www.eknowlogy.com — Mon, 05 Feb 2007 23:24:00 GMT

The new Citrix Access Gateway™ 10000 Series SSL VPN appliance for demanding enterprise scalability and application security. The latest Access Gateway appliance now supports up to 10,000 concurrent users per device, more than double the capacity of other market leading products.

Citrix Access Gateway 10000 series appliance will be available through authorized Citrix Channel partners in Q1’07. Suggested retail pricing for the new Citrix Access Gateway 10000 Series is $50,000 per appliance or $90,000 for a high availability pair, with user licenses available separately, starting at $170 per concurrent user, dropping to $50 each for more than 2500 concurrent users.

click for source

Juniper Networks Named Overall SSL VPN Market Leader by Independent Research Firm.

www.eknowlogy.com / Charles Aunger — Mon, 15 Jan 2007 22:40:00 GMT

Juniper Networks, Inc. (Nasdaq: JNPR) announced January 8, 2007 that Forrester Research has named Juniper Networks as the leading vendor and "best all-around solution" in the SSL virtual private network (VPN) market. Juniper Networks was among eight select companies that Forrester invited to participate in its December 2006 Forrester Wave report titled, "The Forrester Wave^TM: SSL VPN Appliances, Q4 2006; Juniper Networks Leads The Pack," written by Forrester Research analyst Robert Whiteley.

In this evaluation, Forrester evaluated leading SSL VPN appliance vendors across 57 criteria and found that Juniper Networks maintains its SSL VPN leadership thanks to its superior reverse proxy technology and focus on secure mobility. Juniper has the most mature and full featured core SSL VPN platform.

"Juniper is the clear leader in the SSL VPN market and continues to maintain its success by focusing on superior client access, endpoint security, and reliability. The result is the most well-rounded solution that excels at all the core requirements," writes Robert Whitely, senior analyst at Forrester Research.

"Juniper Networks is dedicated to continuing to deliver our Secure Access appliances with the most innovative, comprehensive and easy to use functionality for our diverse set of customers. Our consistent market leadership since the inception of the category is a testimony to that dedication," said Hitesh Sheth, vice president of security products at Juniper Networks.

click for source and click for whitepaper

charles aunger eknowlogy / eviglio - 15th Jan 2007

Juniper SSL VPN - Visio Icons Stencils

Charles Aunger / www.eknowlogy.com — Mon, 15 Jan 2007 15:55:00 GMT

Link to Juniper SSL VPN - Visio Icons Stencils

check out my homepage for more information http://charlesaunger.eknowlogy.com

charles aunger (http://geekswithblogs.net/eknowlogy/articles/103624.aspx) - 15th Jan 2007

Microsoft in Visionaries Quadrant in 3Q06 SSL VPN Magic Quadrant

www.eknowlogy.com / Charles Aunger — Mon, 08 Jan 2007 22:28:00 GMT

Microsoft Corp. is positioned in the “Visionaries” quadrant of the SSL VPN Magic Quadrant¹, published recently by Gartner Inc. The report evaluates the Intelligent Application Gateway (IAG), Microsoft’s secure sockets layer virtual private network (SSL VPN) product obtained in the acquisition of Whale Communications in July 2006, and Microsoft’s Internet Security and Acceleration Server (ISA Server). Microsoft’s ISA Server is integrated with the IAG to provide a single, consolidated appliance for network perimeter defense, remote access, endpoint security and application-layer protection (http://www.microsoft.com/whale).

“We believe our position in the Visionaries quadrant validates Microsoft’s strategy of providing customers with a comprehensive secure access platform that is easy to use and manage,” said Avi Nathan, general manager, research and development, Forefront Edge Products, Microsoft. “We are building on the innovative technologies and application-level granular access controls developed by Whale Communications, and we will continue to innovate and further integrate with Microsoft technologies to provide customers with comprehensive solutions.

click for source

click for Whales site and products

Aventail SSL VPNs are First to Support Microsoft IE7

Charles Aunger / www.eknowlogy.com — Wed, 22 Nov 2006 00:32:00 GMT

Aventail ST2 SSL VPN officially supports Microsoft IE7. While other major SSL VPN vendors, such as Juniper and F5, have been forced in recent days to advise their customers not to upgrade to IE7 because of incompatibility with their VPN products, Aventail is encouraging its customers to upgrade and take advantage of all the new security and ease of use features in IE7.

Seamless support of IE7 is an imperative for maintaining a productive mobile workforce, since over 3 million people downloaded the new browser in the first four days following its October 18, 2006 release. Many more users' browsers will be automatically updated now that IE7 has gone into Windows XP Automatic Update mode as of November 1st. Any SSL VPN solutions that do not support Microsoft IE7 will fail to be able to connect those users to their corporate resources.

“As the technology leader in SSL VPNs, our customer base expects us to enable secure remote access from any device— and that clearly includes PCs running IE7,” stated Chris Hopen, CTO, Aventail. “We made it our business to understand the changes that Microsoft was making, and to invest ahead of the curve to support them.”

click for more information at source

check out my homepage for more information http://charlesaunger.eknowlogy.com

AEP Networks Announces Latest Generation Netilla Security Platform (NSP) SSL VPN Product

www.eknowlogy.com / Charles Aunger — Wed, 11 Oct 2006 23:56:00 GMT

AEP Netilla Security Platform (NSP) Secure Sockets Layer (SSL) Virtual Private Network (VPN). The NSP Release 5.4 includes several performance improvements, new certifications, improvements to the administrator web interface, and new features such as load balancing for failover and scalability. It also includes seamless integration with Ericom PowerTerm® WebConnect from Ericom Software to provide improved access to applications residing on Windows Terminal Servers and legacy host systems such as IBM Mainframe (zSeries), IBM Midrange (iSeries), UNIX, Linux, OpenVMS, Tandem and more.

click to read the press release