manual

Copyright © 2010, Juniper Networks, Inc. 3
APPLICATION NOTE - Branch Office Connectivity Guide
Table 1: Functionality, Features, and Capabilities of the Branch Office Types
Functionality Feature Capability Type A Type B Type C
Security
Unified Threat
Management
(UTM)
Deep Inspection • • •
Antivirus • • •
Web Filtering • • •
Firewall • • •
Connectivity WAN T1/E1 – • •
MPLS – – •
Broadband • • •
LAN Wired • • •
Wireless Optional Optional •
High availability Device
Redundancy
– • • •
Link
Redundancy
Optional Optional Optional •
Performance
optimization
WAN Acceleratiion WAN Acceleration
and Optimization
– – •
Manageability Juniper Networks
Junos
®
operating
system
Single OS
Site-wide Visibility
and Control
• • •
Branch Office Connectivity over IPsec VPN
As a best practice, Juniper Networks recommends using an IPsec VPN implementation to provide branch office
connectivity for the following major reasons:
• Satisfies standards-based compliance requirements with real-time and historical forensics and reporting
• Ensures network security at the branch office by deploying the same security solution that is at headquarters,
optimized for the branch
• Offers data confidentiality and integrity via unparallel availability, agility, security, and manageability
The recommended solution for connecting large numbers of branch offices onto the enterprise network is employed
through an IPsec-based VPN as a tunneling mechanism.
Design Recommendations
The following list summarizes the major design recommendations and their relationship to the branch types. Unless
otherwise stated, these recommendations employ the following functionalities for the three branch office types:
• Scalability: The routing design should be scalable. A medium-sized number of sites (100 to 1,000 sites) must be
deployable without significantly impacting the CPU resources or memory of the VPN devices.
• Redundancy: When redundant links are used, no single point of failure should exist. As depicted in the reference
architecture, head and regional offices have more than one connection to the public and private networks. In the
case of Type B and Type C branch offices, redundant paths must be provided to use all branch links to extend to
the external networks.
• Route Summarization: Address summarization should be performed whenever possible, as a large number of
remote sites are needed. Route summarization is important to reduce both the routing traffic and the memory
consumed in the routers.
• Network Address Translation (NAT): Remote sites can be connected behind NAT devices. Some small branches
and remote users share the Internet connectivity with other users, and in such cases, the IP addresses assigned
to them can be private.
• Load Balancing: Load balancing of customer traffic should be achieved. Remote sites with dual-homing
connections to the Internet are common. In those cases, optimum usage of both links is desirable while still
providing a backup path whenever a link goes down.