Service Provider Security

Juniper AI-Native Security safeguards users, data, and infrastructure by extending security to every point of connection, from client to cloud, across the entire network. It helps organizations build threat-aware networks to keep attackers at bay and keep the network clear for business-critical traffic.

Juniper Service Provider Security supports seven use cases:

1. Mobile security gateway (SEG)
2. SGi/N6 firewall
3. Carrier-grade NAT (CGNAT)
4. Roaming firewall
5. Distributed denial-of-service (DDoS) detection and mitigation
6. Data center firewall
7. Intra-data center/East-West traffic protection

A security gateway (SEG) is a high-performance IPsec tunneling gateway that connects the service provider’s Evolved Packet Core (EPC) to base stations (eNodeBs and gNodeBs) on the S1/NG interface and handles connections between base stations on the X2/Xn interface.

Security gateway IPsec functionality can protect traffic as it traverses mobile backhaul by establishing an encrypted, protected connection between the service provider’s base station and EPC network. The security gateway simplifies the provisioning burden for S1-MME and S1-U (NG-C and NG-U for 5G) traffic by being a central point of IPsec concentration. (See 5G Security Strategy Considerations to learn why a security gateway is important in 5G network deployments.)

An SGi/N6 firewall is a firewall connected to the Evolved Packet Core (EPC)/5G Core (5GC) on a Gi LAN/N6 interface. It protects the packet core and user equipment (UE) endpoints against a variety of outside-in attacks, such as snooping and theft of information.

Carrier-Grade Network Address Translation (CGNAT) performs address translation for many purposes, including:

• Hiding topology so attackers cannot directly attack resources within the service provider’s network
• Preventing IPv4 address exhaustion by mapping a large number of private IP addresses within a service provider’s network to a small number of public IP addresses
• Connecting IPv6 endpoints within a service provider’s network to legacy IPv4 addresses on the public internet

CGNAT provides address obfuscation and prevents bad actors from communicating with internal resources, such as customer devices and provider host servers, by hiding the source IP addresses of these devices from the outside world.

A roaming firewall is a roaming gateway connecting the Evolved Packet Core (EPC) of the home network to the EPC of the visited network to handle roaming handover.

With a roaming firewall, networks are protected through a combination of security capabilities, including:

• Encryption of GTP-C and GTP-U traffic with IPsec
• Rate limiting of GTP-C traffic
• Prevention of GTP-C-specific attacks
• Signaling normalization and modification of GTP-C traffic, including 3GPP release interoperability

A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic.

Juniper’s DDoS detection and mitigation is an industry-leading volumetric DDoS firewall that provides real-time DDoS filtering capability at the industry’s fastest rate to prevent DDoS attacks within 5–10 seconds. (See Juniper and Corero Joint DDoS Protection Solution to learn more.)

Juniper Zero Trust Data Center Security protects hybrid data centers by operationalizing security and extending Zero Trust across networks to prevent threats with proven efficacy. It checks all incoming and outgoing traffic, so customers can validate and grant data center access to the right users and devices.

Juniper’s Zero Trust Data Center Security solution helps with the following:

• Centralized visibility and analytics for all applications and data, including encrypted data and infrastructure 
• Consistent policies across firewalls (all form factors, from managing via a single UI to reducing operational complexity to allowing scalability)
• Shared automation and intelligence at every point of connection across the entire infrastructure, making automated threat response a click away
• Macro- and micro-segmentation to control who and what can access the network resources and reduce the attack surface while preventing lateral threat propagation
• Advanced threat services that use the power of AI/ML to detect sophisticated threats and block them

(See the Juniper Zero Trust Data Center product portfolio to learn more.)

Juniper Intra-DC/East-West Traffic Protection is security enforcement that prevents attackers from moving laterally inside on-premises or cloud data centers by creating microsegments that limit the impact of a successful attack.

For security technical content and resources for service providers, visit the TechLibrary Connected Security page.