Overview of Supported Virtual Appliances

JSA Threat Analytics “All-in-one” or Console 3199

This virtual appliance is a Juniper Secure Analytics system that profiles network behavior and identifies network security threats. The JSA Threat Analytics “All-in-one” or Console 3199 virtual appliance includes an on-board Event Collector, a combined Event Processor and Flow Processor, and internal storage for events.

The JSA Threat Analytics “All-in-one” or Console 3199 virtual appliance supports the following items:

• Up to 1,000 network objects

• 1,200,000 flows per interval, depending on your license

• 30,000 Events Per Second (EPS), depending on your license

• External flow data sources for NetFlow, sFlow, J-Flow, Packeteer, and Flowlog files

• Flow Processor and Layer 7 network activity monitoring

To expand the capacity of the JSA Threat Analytics “All-in-one” or Console 3199 beyond the license-based upgrade options, you can add one or more of the JSA Virtual Event Processor Virtual 1699 or Flow processor Virtual 1799 virtual appliances.

JSA Flow Processor Virtual 1799

This virtual appliance is a dedicated Flow Processor that you can use to scale your JSA deployment to manage higher flows per interval rates. The JSA Flow Processor Virtual 1799 includes an onboard Flow Processor and internal storage for flows.

JSA Flow Processor Virtual 1799 appliance supports the following items:

• 3,600,000 flows per interval, depending on traffic types

• 2 TB or larger dedicated flow storage

• 1,000 network objects

• Flow Processor and Layer 7 network activity monitoring

The JSA Flow Processor Virtual 1799 is a distributed Flow Processor virtual appliance and requires a connection to JSA console. Flow Processor appliance and requires a connection to any series appliance.

JSA Event Processor Virtual 1699

This virtual appliance is a dedicated Event Processor that allows to scale your Juniper Secure Analytics (JSA) deployment to manage higher EPS rates. The JSA Event Processor Virtual 1699 includes an onboard Event Collector, Event Processor, and internal storage for events.

JSA Event Processor Virtual 1699 appliance supports the following items:

• Up to 80,000 events per second

• 2 TB or larger dedicated event storage

The JSA Event Processor Virtual 1699 is a distributed Event Processor virtual appliance and requires a connection to JSA console. Event Processor appliance and requires a connection to any series appliance.

JSA Event Collector Virtual 1599

This virtual appliance is a dedicated Event Collector that you can use to scale your JSA deployment to manage higher EPS rates. The JSA Event Collector Virtual 1599 includes an onboard Event Collector.

JSA Event Collector Virtual 1599 appliance supports the following items:

• Up to 30,000 events per second

• 2 TB or larger dedicated event storage

The JSA Event Collector Virtual 1599 is a distributed Event Collector virtual appliance and requires a connection to JSA console. Event Collector appliance and requires a connection to any series appliance.

JSA Flow Processor Virtual 1299

This virtual appliance provides the same visibility and function in your virtual network infrastructure that a JSA Flow Processor offers in your physical environment. The JSA Flow Processor virtual appliance analyzes network behavior and provides Layer 7 visibility within your virtual infrastructure. Network visibility is derived from a direct connection to the virtual switch.

The JSA Flow Processor Virtual 1299 virtual appliance supports a maximum of the following items:

• 10,000 flows per minute

• Three virtual switches, with one more switch that is designated as the management interface.

JSA Vulnerability Manager Processor 600

This appliance is used to process vulnerabilities within the applications, systems, and devices on your network or within your DMZ. The vulnerability processor provides a scanning component by default. If required, you can deploy more scanners, either on dedicated JSA Vulnerability Manager managed host scanner appliances or JSA managed hosts. For example, you can deploy a vulnerability scanner on an Event Collector or JSA Flow Processor.

JSA Vulnerability Manager Scanner 610

This appliance is used to scan for vulnerabilities within the applications, systems, and devices on your network or within your DMZ.

JSA Risk Manager 700

This appliance is used for monitoring device configurations, simulating changes to your network environment, and prioritizing risks and vulnerabilities in your network.

JSA App Host 4000

This appliance is a managed host that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your JSA Console. Apps such as User Behavior Analytics with Machine Learning Analytics require more resources than are currently available on the Console.

JSA Log Manager Virtual 8099

Functions as a Log Manager AIO/Console.