WIXLIB

DATASHEETSSG320M ANDSSG350M SECURESERVICESGATEWAYSProduct OverviewThe Juniper Networks SSG300 lineconsists of purpose-built securityappliances that deliver the ideal blendof performance, security, routing,and LAN/WAN connectivity for large,regional branch offices and medium-Product DescriptionThe Juniper Networks SSG300 line of secure services gateways comprises highperformance security platforms that help businesses stop internal and external attacks,prevent unauthorized access, and achieve regulatory compliance. The Juniper NetworksSSG350M Secure Services Gateway provides 500 Mbps of stateful firewall performanceand 225 Mbps of IPsec VPN performance, while the Juniper Networks SSG320M SecureServices Gateway provides 400 Mbps of stateful firewall performance and 175 Mbps ofIPsec VPN performance.size, standalone businesses. TrafficThese products focus on three key disciplines:flowing in and out of a regional officeSecurity: Protection against worms, viruses, trojans, spam, and emerging malwareor business is protected from worms,is delivered by proven Unified Threat Management (UTM) security features that arespyware, trojans, and malware bybacked by best-in-class partners. To address internal security requirements and facilitatea complete set of Unified Threatregulatory compliance, the SSG300 line supports an advanced set of network protectionManagement security features,features such as security zones, virtual routers, and VLANs that allow administrators toincluding stateful firewall, IPsec VPN,divide the network into distinct, secure domains, each with their own unique securityintrusion prevention system (IPS),policy. Policies protecting each security zone can include access control rules andantivirus (includes antispyware,inspection by any of the supported UTM security features.antiadware, antiphishing), antispam,and Web filtering. The SSG300 linecomprises the SSG350M and theRegional OfficeHeadquartersSSG320M Secure Services Gateways.Zone AM7iSSG350MZone CINTERNETNetScreen-5400Zone BThe SSG350M deployed at a branch office for secure Internet connectivity and site-to-siteVPN to corporate headquarters. Internal branch office resources are protected with uniquesecurity policies applied to each security zone.1

Connectivity and Routing: The SSG300 line provides four onboardmanagement engine by interacting with the SSG300 line to augment10/100/1000 interfaces complemented by I/O expansion slots thator replace the firewall-based access control. It grants/denies accesscan house a mix of LAN or WAN interfaces, making the SSG300based on more granular criteria, including endpoint state and userline an extremely flexible platform. The broad array of I/O optionsidentity in order to accommodate the dramatic shifts in attackcoupled with WAN protocol and encapsulation support makes thelandscape and user characteristics.SSG300 line of gateways easily deployable as traditional branchoffice routers or as consolidated security and routing devices, whichcan help reduce CapEx and OpEx.In addition, Juniper Networks Professional Services will collaboratewith your team to identify goals, define the deployment process,create or validate the network design, and manage the deploymentAccess Control Enforcement: The SSG300 line of gateways can actto its successful conclusion. Whether it involves simple lab testingas enforcement points in a Juniper Networks Unified Access Controlor a major network implementation, Juniper Networks Professionaldeployment with the simple addition of the Juniper Networks ICServices is there to help you ensure success.Series UAC Appliances. The IC Series functions as a central policyFeatures and BenefitsFEATUREFEATURE DESCRIPTIONBENEFITHigh performancePurpose-built platform is assembled from custom-builthardware, powerful processing and a security-specificoperating system.Delivers performance headroom required to protectagainst internal and external attacks now and intothe future.Best-in-class UTM security featuresUTM security features (antivirus, antispam, Webfiltering, IPS) stop all manner of viruses and malwarebefore they damage the network.Ensures that the network is protected against allmanner of attacks.Integrated antivirusAnnually licensed antivirus engine, provided by Juniper,is based on Kaspersky Lab engine.Stops viruses, spyware, adware and other malware.Integrated antispamAnnually licensed antispam offering, provided byJuniper, is based on Sophos technology.Blocks unwanted email from known spammers andphishers.Integrated Web filteringAnnually licensed Web filtering solution, provided byJuniper, is based on Websense SurfControl technology.Controls/blocks access to malicious Web sites.Integrated intrusion preventionsystem (IPS) (Deep Inspection)Annually licensed IPS engine is available with JuniperNetworks Deep Inspection Firewall Signature Packs.Prevents application-level attacks from flooding thenetwork.Fixed InterfacesFour fixed 10/100/1000 interfaces, two USB ports, oneconsole port and one auxiliary port are standard on allSSG300 line models.Provides high-speed LAN connectivity, futureconnectivity and flexible management.Network segmentationBridge groups, security zones, virtual LANs and virtualrouters allow administrators to deploy security policiesto isolate guests, wireless networks and regional serversor databases.*Powerful capabilities facilitate deploying security forvarious internal, external and DMZ sub-groups on thenetwork, to prevent unauthorized access.Interface modularitySix interface expansion slots support optional T1, E1,Serial, ADSL/ADSL2/ADSL2 , G.SHDSL, 10/100/1000,and SFP connectivity.Delivers combination of LAN and WAN connectivityon top of unmatched security to reduce costs andextend investment protection.Robust routing engineProven routing engine supports OSPF, BGP and RIP v1/2along with Frame Relay, Multilink Frame Relay, PPP,Multilink PPP and HDLC.Enables the deployment of consolidated securityand routing device, thereby lowering operational andcapital expenditures.Juniper Networks Unified AccessControl enforcement pointInteracts with the centralized policy managementengine (IC Series) to enforce session-specific accesscontrol policies using criteria such as user identity,device security state and network location.Improves security posture in a cost-effectivemanner by leveraging existing customer networkinfrastructure components and best-in-classtechnology.Management flexibilityUse any one of three mechanisms, CLI, WebUI or JuniperNetworks Network and Security Manager (NSM), tosecurely deploy, monitor and manage security policies.Enables management access from any location,eliminating on-site visits thereby improving responsetime and reducing operational costs.Auto-Connect VPNAutomatically sets up and takes down VPN tunnelsbetween spoke sites in a hub-and-spoke topology.Provides a scalable VPN solution for mesharchitectures with support for latency-sensitiveapplications such as VoIP and video conferencing.World-class professional servicesFrom simple lab testing to major networkimplementations, Juniper Networks ProfessionalServices will collaborate with your team to identifygoals, define the deployment process, create or validatethe network design and manage the deployment.Transforms the network infrastructure to ensure thatit is secure, flexible, scalable and reliable.* Bridge groups supported only on uPIMs in ScreenOS 6.0 and greater releases2

Product OptionsOPTIONOPTION DESCRIPTIONAPPLICABLE PRODUCTSNetwork Equipment BuildingSystems (NEBS) complianceNEBS-compliant versions of the SSG350M areavailable.SSG350MDRAMAll models in the SSG300 line are available with1 GB of DRAM. The SSG320M and SSG350M are alsoavailable in 256 MB-DRAM versions.SSG350MUTM/Content Security (highmemory option required)With the addition of licensing keys, the SSG300line can be configured with any combination of thefollowing best-in-class UTM and content securityfunctionality: antivirus (includes antispyware,antiphishing), IPS (Deep Inspection firewall), Webfiltering and/or antispam.SSG350M high-memory model onlyI/O optionsThree (SSG320M) or five (SSG350M) expansion slotssupport optional T1, E1, Serial, ADSL2 , G.SHDSL,10/100/1000, and SFP.SSG350MSSG320MSSG320M high-memory model 50MMaximum Performance and Capacity(1)ScreenOS version testedScreenOS 6.2ScreenOS 6.2Firewall performance (Large packets)450 Mbps550 MbpsFirewall performance (IMIX)(2)400 Mbps500 MbpsFirewall Packets Per Second (64 byte)175,000 PPS225,000 PPSAES256 SHA-1 VPN performance175 Mbps225 Mbps3DES SHA-1 VPN performance175 Mbps225 MbpsMaximum concurrent sessions64,000128,000New sessions/second10,00012,500Maximum security xed I/O4x10/100/10004x10/100/1000Physical Interface Module (PIM) Slots35WAN interface options (PIMS)Serial, T1, E1, ADSL/ADSL2/ADSL2 , G.SHDSLSerial, T1, E1, ADSL/ADSL2/ADSL2 , G.SHDSLLAN interface options (uPIMS)8x10/100/1000, 16x10/100/1000, and 6xSFP8x10/100/1000, 16x10/100/1000, and 6xSFPMaximum users supportedConvertible to Juniper Networks Junos operating system8.0 or higher Network Connectivity3

Specifications (continued)SSG320MSSG350MFirewallNetwork attack detectionYesYesDoS and DDoS protectionYesYesTCP reassembly for fragmented packet protectionYesYesBrute force attack mitigationYesYesSYN cookie protectionYesYesZone-based IP spoofingYesYesMalformed packet protectionYesYesIPS (Deep Inspection firewall)YesYesProtocol anomaly detectionYesYesStateful protocol signaturesYesYesIPS/DI attack pattern obfuscationYesYesYesYesSignature database200,000 200,000 Protocols scannedPOP3, HTTP, SMTP, IMAP, FTP, IMPOP3, HTTP, SMTP, IMAP, FTP, esYesInstant message AVYesYesAntispamYesYesIntegrated URL filteringYesYesExternal URL filtering(4)YesYesH.323 ALGYesYesSIP ALGYesYesMGCP ALGYesYesSCCP ALGYesYesNAT for VoIP protocolsYesYesConcurrent VPN tunnels500500Tunnel interfaces100300DES (56-bit), 3DES (168-bit) and AES (256-bit)YesYesMD-5 and SHA-1 authenticationYesYesManual key, IKE, IKEv2 with EAP, PKI (X.509)YesYesPerfect forward secrecy (DH Groups)1,2,51,2,5Prevent replay attackYesYesRemote access VPNYesYesL2TP within IPsecYesYesIPsec NAT traversalYesYesAuto-Connect VPNYesYesRedundant VPN gatewaysYesYesBuilt-in (internal) database - user limit500500Third-party user authenticationRADIUS, RSA SecureID, LDAPRADIUS, RSA SecureID, LDAPRADIUS AccountingYes – start/stopYes – start/stopXAUTH VPN authenticationYesYesWeb-based authenticationYesYes802.1X authenticationYesYesUnified Access Control enforcement pointYesYesUnified Threat Management(3)AntivirusVoIP SecurityIPsec VPNUser Authentication and Access Control4