Juniper SSG140 Product Overview

SSG140 SECURE
SERVICES GATEWAY

DATASHEET

Product Overview

The SSG140 Secure Services
Gateway is a purpose-built security
appliance that delivers a perfect
blend of performance, security,
routing and LAN/WAN connectivity
for medium sized branch offices and
business deployments. Traffic flowing
in and out of the branch office or
business is protected from worms,
spyware, trojans, and malware by
a complete set of Unified Threat
Management security features that
include stateful firewall, IPsec VPN,
intrusion prevention system (IPS),
antivirus (includes antispyware,
antiadware, antiphishing), antispam
and Web filtering.

Product Description

The Juniper Networks® SSG140 Secure Services Gateway is a high-performance security

platform for branch offices and small/medium sized standalone businesses that want to

stop internal and external attacks, prevent unauthorized access, and achieve regulatory

compliance. The SSG140 is a modular platform that delivers more than 350 Mbps of

stateful firewall traffic and 100 Mbps of IPsec VPN traffic.

Security: Protection against worms, viruses, trojans, spam, and emerging malware is

delivered by proven unified threat management (UTM) security features that are backed

by best-in-class partners. To address internal security requirements and facilitate

regulatory compliance, the SSG140 supports an advanced set of network protection

features such as security zones, virtual routers and VLANs that allow administrators to

divide the network into distinct, secure domains, each with its own unique security policy.

Policies protecting each security zone can include access control rules and inspection by

any of the supported UTM security features.

Connectivity and Routing: The SSG140 supports ten on-board interfaces (eight 10/100 plus two

10/100/1000) complemented by four I/O expansion slots that can house additional LAN and

WAN interfaces (T1, E1, G.SHDSL, ISDN BRI S/T, Serial, and 10/100/100), making the SSG140 the

most extensible security platform in its class. This broad array of I/O options coupled with WAN

protocol and encapsulation support in its routing engine make the SSG140 a platform that can

easily be deployed as a traditional branch oce router or as a consolidated security and routing

device to reduce CapEx and OpEx.

Access Control Enforcement: The SSG140 can act as an enforcement point in a Juniper

Networks Unified Access Control (UAC) deployment with the simple addition of the

IC Series Unified Access Control Appliance. The IC Series functions as a central policy

management engine, interacting with the SSG140 to augment or replace the firewall-

based access control with a solution that grants/denies access based on more granular

criteria that include endpoint state and user identity, in order to accommodate the

dramatic shifts in attack landscape and user characteristics.

World Class Support: From simple lab testing to major network implementations,

Juniper Networks Professional Services will collaborate with your team to identify goals,

define the deployment process, create or validate the network design, and manage the

deployment to its successful conclusion.

1

ZONE A

ZONE B

SSG140

WWW

Internet

M7i

HeadquartersBranch Oce

ISG2000

The SSG140 deployed at a branch oce for secure Internet connectivity and site-to-site VPN to corporate headquarters.

Internal branch oce resources are protected with unique security policies for each security zone.

Features and Benefits

Feature Feature Description Benefit

High performance Purpose-built platform is assembled from custom-built

Best-in-class UTM security
features

Integrated antivirus Annually licensed antivirus engine, provided by Juniper, is

Integrated antispam Annually licensed antispam oering, provided by Juniper,

Integrated Web filtering Annually licensed Web filtering solution, provided by

Integrated IPS (Deep
Inspection)

Fixed Interfaces Eight fixed 10/100 interfaces and two 10/100/1000

Network segmentation Bridge groups, security zones, virtual LANs and virtual

Robust routing engine Proven routing engine supports OSPF, BGP and RIP v1/2

High interface density Eight 10/ 100 plus two 10/100/1000 interfaces plus a

Interface modularity Four SSG140 interface expansion slots support optional

Management flexibility Use any one of three mechanisms, CLI, WebUI or

Juniper Networks Unified
Access Control enforcement
point

World-class professional
services

Auto-Connect VPN Automatically sets up and takes down VPN tunnels

hardware, powerful processing and a security-specific
operating system.

UTM security features (antivirus, antispam, Web filtering,
IPS) stop all manner of viruses and malware before they
damage the network.

based on Kaspersky Lab engine.

is based on Sophos technology.

Juniper, is based on Websense SurfControl technology.

Annually licensed IPS engine is available with Juniper
Networks Deep Inspection Firewall Signature Packs.

interfaces, one USB port, one console port, and one
auxiliary port.

routers allow administrators to deploy security policies to
isolate guests, wireless networks and regional servers or
databases.*

along with Frame Relay, Multilink Frame Relay, PPP,
Multilink PPP and HDLC.

console and an Aux interface for management.

T1, E1, ISDN BRI S/T, G.SHDSL and serial physical
interface modules (PIMs), and 10/100/1000 and SFP
universal PIMs (uPIMs).**

Juniper Networks Network and Security Manager (NSM),
to securely deploy, monitor and manage security policies.

Interacts with the centralized policy management engine
(IC Series) to enforce session-specific access control
policies using criteria such as user identity, device security
state, and network location.

From simple lab testing to major network
implementations, Juniper Networks Professional Services
will collaborate with your team to identify goals, define
the deployment process, create or validate the network
design, and manage the deployment.

between spoke sites in a hub-and-spoke topology.

Delivers performance headroom required to protect
against internal and external attacks now and into the
future.

Ensures that the network is protected against all manner
of attacks.

Stops viruses, spyware, adware and other malware.

Blocks unwanted email from known spammers
and phishers.

Controls/blocks access to malicious Web sites.

Prevents application-level attacks from flooding
the network.

Provides high-speed LAN connectivity, future
connectivity, and flexible management.

Powerful capabilities facilitate deploying security for
various internal, external and DMZ sub-groups on the
network, to prevent unauthorized access.

Enables the deployment of consolidated security and
routing device, thereby lowering operational and capital
expenditures.

Provides unmatched interface density when compared to
competitive oerings.

Delivers LAN and WAN connectivity options on top
of unmatched security to reduce costs and extend
investment protection.

Enables management access from any location,
eliminating on-site visits thereby improving response
time and reducing operational costs.

Improves security posture in a cost-eective manner
by leveraging existing customer network infrastructure
components and best-in-class technology.

Transforms the network infrastructure to ensure that it is
secure, flexible, scalable and reliable.

Provides a scalable VPN solution for mesh architectures
with support for latency-sensitive applications such as
VoIP and video conferencing.

* Bridge groups supported only on uPIMs in Juniper Networks ScreenOS® Software 6.0 and higher releases.

**uPIMs are only supported in ScreenOS 6.0 or higher releases.

2

Product Options

Option Option Description Applicable Products

DRAM The SSG140 is available with either 256 MB or

Unified Threat Management/
Content Security (high memory
option required)

I/O options Four SSG140 interface expansion slots support

Specifications

Maximum Performance and Capacity

ScreenOS version tested ScreenOS 6.2

Firewall throughput (large packets) 350+ Mbps

Firewall throughput (IMIX)

Firewall packets per second (64 byte) 90,000 PPS

Advanced Encryption Standard (AES)
256+SHA-1 VPN throughput

3DES encryption +SHA-1 VPN throughput 100 Mbps

Maximum concurrent sessions 48,000

New sessions/second 8,000

Maximum security policies 1,000

Maximum users supported Unrestricted

Network Connectivity

Fixed I/O 8x10/100, 2x10/100/1000

Physical Interface Module (PIM) slots 4

Modular WAN/LAN interface options
(PIMs/uPIMs)

Firewall

Network attack detection Yes

DoS and DDoS protection Yes

TCP reassembly for fragmented packet
protection

Brute force attack mitigation Yes

SYN cookie protection Yes

Zone-based IP spoofing Yes

Malformed packet protection Yes

Unified Threat Management

IPS (Deep Inspection firewall) Ye s

Protocol anomaly detection Yes

Stateful protocol signatures Yes

IPS/DI attack pattern obfuscation Ye s

Antivirus Yes

(2)

512 MB of DRAM.

The SSG140 can be configured with any combination
of the following best-in-class UTM and content
security functionality: antivirus (includes antispyware,
antiphishing), IPS (Deep Inspection), Web filtering,
and/or antispam.

optional T1, E1, ISDN BRI S/T, G.SHDSL and serial
physical interface modules (PIMs), and 10/100/1000
and SFP universal PIMs (uPIMs).

SSG140

(1)

300 Mbps

100 Mbps

2xT1, 2xE1, 2xSerial,
1xISDN BRI S/T SFP,
10/100/1000

Yes

(3)

Signature database 200,000+

Protocols scanned POP3, HTTP, SMTP, IMAP,

Antispyware Yes

Antiadware Yes

Anti-keylogger Yes

Instant message AV Ye s

Antispam Yes

Integrated URL filtering Yes

External URL filtering

VoIP Security

H.323. Application-level gateway (ALG) Yes

SIP ALG Ye s

MGCP ALG Yes

SCCP ALG Ye s

Network Address Translation (NAT) for VoIP
protocols

IPsec VPN

Concurrent VPN tunnels 500

Tunnel interfaces 50

DES encryption (56-bit), 3DES encryption
(168-bit) and AES (256-bit)

MD-5 and SHA-1 authentication Yes

Manual key, Internet Key Exchange (IKE),
IKEv2 with EAP public key infrastructure
(PKI) (X.509)

Perfect forward secrecy (DH Groups) 1,2,5

Prevent replay attack Yes

Remote access VPN Yes

Layer 2 Tunneling Protocol (L2TP) within
IPsec

IPsec Network Address Translation (NAT)
traversal

Auto-Connect VPN Yes

Redundant VPN gateways Yes

User Authentication and Access Control

Built-in (internal) database user limit 250

Third-party user authentication RADIUS, RSA SecureID,

RADIUS Accounting Yes – start/stop

XAUTH VPN authentication Ye s

Web-based authentication Yes

802.1X authentication Ye s

Unified Access Control (UAC) enforcement
point

SSG140

SSG140 high memory model only

SSG140

(4)

FTP, IM

Yes

Yes

Yes

Yes

Yes

Yes

LDAP

Yes

3

Specifications (continued)

PKI Support

PKI certificate requests (PKCS 7 and
PKCS 10)

Automated certificate enrollment (SCEP) Ye s

Online Certificate Status Protocol (OCSP) Yes

Certificate Authorities supported Verisign, Entrust,

Self signed certificates Yes

Yes

Microso, RSA Keon,
iPlanet (Netscape)
Baltimore, DOD PKI

Virtualization

Maximum number of security zones 30

Maximum number of virtual routers 6

Bridge groups* Yes

Maximum number of VLANs 100

Routing

BGP instances 6

BGP peers 24

BGP routes 2,048

OSPF instances 3

OSPF routes 2,048

RIPv1/v2 instances 64

RIP v2 routes 2,048

Static routes 2,048

Source-based routing Yes

Policy-based routing Yes

Equal-cost multipath (ECMP) Yes

Multicast Yes

Reverse Forwarding Path (RFP) Yes

Internet Group Management Protocol

(IGMP) (v1, v2)

IGMP Proxy Ye s

Protocol Independent Multicast (PIM)

single mode

PIM source-specific multicast Yes

Multicast inside IPsec tunnel Yes

Yes

Yes

Encapsulations

Point-to-Point Protocol (PPP) Yes

Multilink Point-to-Point Protocol (MLPPP) Yes

MLPPP max physical interfaces 4

Frame relay Ye s

Multilink Frame Relay (MLFR) (FRF 15, FRF 16) Yes

MLFR max physical interfaces 4

HDLC Yes

IPv6

Dual stack IPv4/IPv6 firewall and VPN Yes

IPv4 to/from IPv6 translations and
encapsulations

Syn-Cookie and Syn-Proxy DoS Attack
Detection

SIP, RTSP, Sun-RPC, and MS-RPC ALG’s Yes

RIPng Yes

BGP Yes

Transparent mode Ye s

NSRP Yes

DHCPv6 Relay Yes

Yes

Yes

Mode of Operation

Layer 2 (transparent) mode

Layer 3 (route and/or NAT) mode Yes

(5)

Yes

Address Translation

Network Address Translation (NAT) Yes

Port Address Translation (PAT) Yes

Policy-based NAT/PAT (L2 and L3 mode) Yes

Mapped IP (MIP) (L3 mode) 1,500

Virtual IP (VIP) (L3 mode) 16

MIP/VIP Grouping (L3 mode) Ye s

IP Address Assignment

Static Yes

Dynamic Host Configuration Protocol
(DHCP),Point-to-Point Protocol over
Ethernet (PPPoE) client

Internal DHCP server Yes

DHCP relay Yes

Yes

Trac Management Quality of Service (QoS)

Guaranteed bandwidth Yes - per policy

Maximum bandwidth Yes - per policy

Ingress trac policing Yes

Priority-bandwidth utilization Yes

Dierentiated Services marking Yes - per policy

High Availability (HA)

Active/active - L3 mode Yes

Active/passive - Transparent & L3 mode Yes

Configuration synchronization Ye s

Session synchronization for firewall and
VPN

Session failover for routing change Ye s

VRRP Ye s

Device failure detection Ye s

Link failure detection Ye s

Authentication for new HA members Yes

Encryption of HA trac Ye s

Yes

*Bridge groups supported only on uPIMs in ScreenOS 6.0 and higher releases.

4

Specifications (continued)

System Management

WebUI (HTTP and HTTPS) Ye s

Command line interface (console) Ye s

Command line interface (telnet) Ye s

Command line interface (SSH) Yes – v1.5 and v2.0

Network and Security Manager (NSM) Yes

All management via VPN tunnel on any
interface

Rapid deployment No

compatible

Yes

Administration

Local administrator database size 20

External administrator database support RADIUS, RSA SecureID,

Restricted administrative networks 6

Root Admin, Admin, and Read Only user
levels

Soware upgrades TFTP, WebUI, NSM, SCP,

Configuration roll-back Ye s

LDAP

Yes

USB

Logging/Monitoring

System log (multiple servers) Yes – up to 4 servers

Email (2 addresses) Ye s

NetIQ WebTrends Yes

SNMP (v3) Yes

SNMP full custom MIB Yes

Traceroute Yes

VPN tunnel monitor Ye s

External Flash

Additional log storage USB 1.1

Event logs and alarms Yes

System configuration script Yes

ScreenOS Soware Ye s

Dimensions and Power

Dimensions (W x H x D) 17.5 x 1.8 x 15 in

Weight 10.2 lb (4.63 kg)

Rack mountable Yes, 1RU

Power supply (AC) 100-240 VAC,

Maximum thermal output 580 BTU/hour (170 W)

Noise Level 48.8 dB

(44.5 x 4.5 x 38.1 cm)

AC Input line frequency
50 Hz or 60 Hz
AC system current
rating 2 A

Certifications

Safety certifications UL, CUL, CSA, CB

Electromagnetic compatibility (EMC)
certifications

Network Equipment Building System
(NEBS)

Mean time between failures (MTBF)
(Bellcore model)

FCC class B, CE class B

No

16 years

Security Certifications

Common Criteria: EAL4 Yes (ScreenOS 6.2)

FIPS 140-2: Level 2 Ye s

ICSA Firewall and VPN Yes

Operating Environment

Operating temperature 32° to 104° F

Non-operating temperature -4° to 158° F

Humidity 10% to 90%

(1) Performance, capacity and features listed are based upon systems running ScreenOS 6.2

and are the measured maximums under ideal testing conditions unless otherwise noted.
Actual results may vary based on ScreenOS release and deployment. For a complete list of
supported ScreenOS versions for SSG Series gateways, please visit the Juniper Customer
Support Center (www.juniper.net/customers/support/) and click on ScreenOS Software
Downloads.

(2) IMIX stands for Internet mix and is more demanding than a single packet size as it represents

a traffic mix that is more typical of a customer’s network. The IMIX traffic used is made up
of 58.33% 64 byte packets + 33.33% 570 byte packets + 8.33% 1518 byte packets of UDP
traffic.

(3) UTM Security features (IPS/Deep Inspection, antivirus, antispam and Web filtering) are

delivered by annual subscriptions purchased separately from Juniper Networks. Annual
subscriptions provide signature updates and associated support. The high memory option is
required for UTM Security features.

(4) Redirect Web filtering sends traffic from the firewall to a secondary server. The redirect

feature is free, however it does require the purchase of a separate Web filtering license from
either Websense or SurfControl.

(5) NAT, PAT, policy-based NAT, virtual IP, mapped IP, virtual systems, virtual routers, VLANs,

OSPF, BGP, RIPv2, active/active HA and IP address assignment are not available in layer 2
transparent mode.

(0° to 40° C)

(-20° to 70° C)

noncondensing

IPS (Deep Inspection Firewall) Signature Packs

Signature packs provide the ability to tailor the attack protection to the specific deployment and/or attack type. The following signature
packs are available for the SSG140:

Signature Pack Target Deployment Defense Type Type of Attack Object

Base Branch oces, small/medium

businesses

Client Remote/branch oces Perimeter defense, compliance for hosts

Server Small/medium businesses Perimeter defense, compliance for

Worm mitigation Remote/branch oces of large

enterprises

Client/server and worm protection Range of signatures and protocol

(for example desktops)

server infrastructure

Most comprehensive defense against
worm attacks

anomalies

Attacks in the server-to-client direction

Attacks in the client-to-server direction

Worms, trojans, backdoor attacks

5

Juniper Networks Services and Support

Juniper Networks is the leader in performance-enabling services
that are designed to accelerate, extend, and optimize your
high-performance network. Our services allow you to maximize
operational efficiency while reducing costs and minimizing
risk, achieving a faster time to value for your network. Juniper
Networks ensures operational excellence by optimizing the
network to maintain required levels of performance, reliability, and
availability. For more details, please visit www.juniper.net/us/en/
products-services.

Ordering Information

Model Number Description

SSG140

SSG-140-SB SSG140 with 256 MB memory, 0 PIM cards,

AC power

SSG-140-SH SSG140 with 512 MB memory, 0 PIM cards,

AC power

I/O Options

JX-1BRI-ST-S 1-port ISDN BRI S/T PIM

JX-2E1-RJ48-S 2-port E1 PIM with integrated CSU/DSU

JX-2T1-RJ48-S 2-port T1 PIM with integrated CSU/DSU

JX-2Serial-S 2-port Serial PIM

JX-2SHDSL-S 2-port 2-wire or 1-port 4-wire G.SDHSL PIM

JXU-6GE-SFP-S 6-port SFP Gigabit Ethernet Universal PIM*

(SFP sold separately)

JXU-1SFP-S 1-port SFP 100 Mbps or Gigabit Ethernet

Universal PIM* (SFP sold separately)

JXU-8GE-TX-S 8-port Gigabit Ethernet 10/100/1000 Copper

Universal PIM*

JXU-16GE-TX-S 16-port Gigabit Ethernet 10/100/1000 Copper

Universal PIM*

* uPIMs are only supported in ScreenOS 6.0 or higher releases.

Model Number Description

Unified Threat Management/Content Security
(High Memory Option Required)

NS-K-AVS-SSG140 Antivirus (antispyware, antiphishing)

NS-DI-SSG140 IPS (Deep Inspection)

NS-SPAM2-SSG140 Antispam

NS-WF-SSG140 Web filtering

NS-RBO-CS-SSG140 Remote Oce Bundle (AV, IPS, WF)

NS-SMB2-CS­SSG140

Main Oce Bundle (AV, IPS, WF, AS)

Memory Upgrades, Spares and Communications
Cables

SSG-100-MEM-512 512 MB DIMM Memory upgrade

CBL-JX-PWR-AU Power Cable, Australia

CBL-JX-PWR-CH Power Cable, China

CBL-JX-PWR-EU Power Cable, Europe

CBL-JX-PWR-IT Power Cable, Italy

CBL-JX-PWR-JP Power Cable, Japan

CBL-JX-PWR-UK Power Cable, UK

CBL-JX-PWR-US Power Cable, US

JX-Blank-FP-S Blank I/O plate

JX-CBL-EIA530-DTE EIA530 cable (DTE)

JX-CBL-RS232-DTE RS232 cable (DTE)

JX-CBL-RS449-DTE RS449 cable (DTE)

JX-CBL-V35-DTE 35 cable (DTE)

JX-CBL-X21-DTE X.21 cable (DTE)

Note: The appropriate power cord is included based upon the sales order “Ship To” destination.

About Juniper Networks

Juniper Networks is in the business of network innovation. From
devices to data centers, from consumers to cloud providers,
Juniper Networks delivers the software, silicon and systems that
transform the experience and economics of networking. The
company serves customers and partners worldwide. Additional
information can be found at www.juniper.net.

Corporate and Sales Headquarters

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunny vale, CA 94089 USA

Phone: 888.JUNIPER (888.586.4737)

or 408.745.2000

Fax: [phone]

www.juniper.net

Copyri ght 2013 Juniper Net works, Inc. All r ights reser ved. Junipe r Networks , the Juniper Net works logo, Jun os and QFabric are
regist ered trademar ks of Juniper Ne tworks, Inc . in the United States an d other countri es. All other trad emarks, ser vice marks ,
regist ered marks, o r registered se rvice mark s are the proper ty of their res pective own ers. Juniper N etworks as sumes no
respo nsibility fo r any inaccuracie s in this documen t. Juniper Net works reser ves the right to c hange, modif y, tran sfer, or otherw ise
revise t his publicatio n without noti ce.

1000181- 011-EN S ept 2013

6

Printed o n recycled pap er

APAC and EMEA Head quarters

Juniper Networks International B.V.

Boeing Avenue 240

1119 PZ Schiphol-Rijk

Amsterdam, The Netherlands

Phone: [phone]

Fax: [phone]

To purchase Juniper Networks solutions,
please contact your Juniper Networks
representative at 1-866-298-6428 or
authorized reseller.