Data Center LAN Migration Guide - Juniper Networks

Data Center LAN Migration Guide
Consolidating and Virtualizing Security Services in the Data Center: Installation Tasks
In addition to cyber theft and increasing malware levels, organizations must guard against new vulnerabilities
introduced by data center technologies themselves. To date, security in the data center has been applied primarily
at the perimeter and server levels. However, this approach isn’t comprehensive enough to protect information and
resources in new system architectures. In traditional data center models, applications, compute resources, and
networks have been tightly coupled, with all communications gated by security devices at key choke points. However,
technologies such as server virtualization and Web services eliminate this coupling and create a mesh of interactions
between systems that create subtle and significant new security risks within the interior of the data center. For a
complete discussion of security challenges in building cloud-ready, next-generation data centers, refer to the white
paper, “Security Considerations for Cloud-Ready Data Center”: www.juniper.net/us/en/local/pdf/implementationguides/8010046-en.pdf.
A key requirement for this insertion point is for security services platforms to provide the performance, scalability, and
traffic visibility needed to meet the increased demands of a consolidated data center. Enterprises deploying platforms
which do not offer the performance and scalability of Juniper Networks SRX Series Services Gateways and their associated
management applications are faced with a complex appliance sprawl and management challenge, where numerous
appliances and tools are needed to meet requirements. This is a more costly, less efficient, and less scalable approach.
Preinstallation Tasks for Security Consolidation and Virtualization
SRX5800
EX82XX
Legacy Security Appliances
Figure 16: SRX Series platform for security consolidation
• Ensure that the appropriate power, cooling, airflow, physical rack space, and cabling required to support the new
equipment have been ordered and installed.
• Ensure that the security tier is sized to meet the organization’s requirements for capacity headroom for future growth.
• Define and provision routing/switching Infrastructure first (see prior section). This sets the L3/L2 foundation
domains upon which the security “zones” the SRX Series enforces will be built. The SRX Series supports a pool
of virtualized security services that can be applied to any application flow traversing the data center network.
Setting up the network with this foundation of subnets and VLANs feeding the dynamic security enforcement point
segments the data center resources properly and identifies what is being protected and what level of protection
is needed. With SOA, for example, there are numerous data flows between servers within the data center and
perimeter but security is often insufficient for securing these flows. Policies based on role/function, applications,
business goals, or regulatory requirements can be achieved using a mix of VLAN, routing, and security zone policies
enabling the SRX Series to enforce the appropriate security posture for each flow in the network.
• The performance and scalability requirements should be scoped. SRX Series devices can be paired together in a
cluster to scale to 120 Gbps of firewall throughput, as well as providing HA.
Virtual machine security requirements should also be defined. Juniper’s vGW Virtual Gateway is hypervisor neutral,
eliminating VM security blind spots. For more information on Juniper’s virtual firewall solution, refer to Chapter 2 (vGW
Virtual Gateway).
44 Copyright © 2012, Juniper Networks, Inc.