Introduction; Scope; Design Considerations; Figure 1: Reference Network - Juniper V10000 Implementation Manual

Introduction

A powerful new paradigm of Internet-enabled relationships is transforming businesses across the globe. Companies
that embrace "Web 2.0" technologies empower effective and lasting connections with employees, customers,
and partners. These are powerful tools that can create and sustain competitive advantage—but the underlying
technologies can also expose the business to complex and dynamic new risks. Juniper Networks
Gateways, combined with Websense's V10000 Web Security Gateways, help companies enjoy the benefits of Web 2.0
solutions while mitigating the associated security challenges with power, speed, and flexibility.

Scope

This document is targeted at system engineers, network administrators, and other technical audiences interested in
designing and implementing Juniper Networks SRX Series Services Gateways with Websense TRITON V10000 Web
Security Gateway appliances.

Design Considerations

Figure 1 illustrates a common network design solution using the SRX Series and V10000 appliances. The SRX Series is
responsible for redirecting specific traffic from the User LAN --for example, HTTP/HTTPS --to the V10000 appliances.
The network administrator configures the TRITON V10000 appliances to provide multi-vector inbound and outbound
real-time content inspection to protect against malware and sensitive data loss. The policy-based user interface
increases user productivity by basing privileges on user or group identity in your corporate user directory. The V10000
proxies user traffic to the Internet. When the user traffic is unauthorized based on protocol or dynamic website policy,
the user's browser is redirected to the "Block Page" served by the V10000.
The enterprise network includes the SRX Series and the Websense TRITON V10000 appliances in the "management"
segment of the network, and the enterprise users are identified in the "User LAN" segment of the network. This
deployment architecture leverages the flexibility of the SRX Series to securely separate the user traffic from the
network administration of the SRX Series and the Websense security appliances.
INTERNET
SRX
Series
L2 Switch
user browser. The user browser is redirected to a "Block Page" that is served by the V10000 at the C port. These two
scenarios are illustrated in the following ladder diagrams.
Copyright © 2010, Juniper Networks, Inc.
L2 Switch
USER LAN

Figure 1: Reference network

IMPLEMENTATION GUIDE - Juniper Networks SRX Series Services Gateways/Websense V10000
For the one V10000 appliance solution, three physical
ports are utilized: "C", "P1," and "N." The "C" port of the
appliance is the management port through which the
administrator manages the appliance. The "C" port is also
the destination for the "Block Page" redirection. The "P1"
port is the proxy port of the V10000 that provides the
Websense
real-time malware and dynamic website classification. The
V10000
SRX Series connects the V10000 to both the user LAN and
the Internet. The "N" port is used to provide application
and Web protocol-specific blocking and bandwidth
V10000
throttling. Over 120 Web protocols are recognized by
protocol "fingerprint" (this permits the identification
of applications such as Skype, BitTorrent, and Yahoo
Chat.) Malware "phone-home" communications are
also recognized and denied access to the Internet. To
implement this capability, a layer 2 switch is needed to
mirror user traffic. When the P1 port allows user traffic,
the V10000 establishes a new traffic flow (proxy) via
the same P1 port. When traffic is not permitted, the
V10000 issues a redirect message via the P1 port to the
SRX Series Services
®
3