Pulse Secure SA Series SSL VPN Virtual Appliances
Service providers can offer costeffective managed mobile and remote access services.

Architecture and Key Components:

SA Series Virtual Appliances fulfill the service provider’s requirement for managed VPN services for SMB and enterprise customers alike. Service providers want hardware that can scale to support virtually an unlimited number of customers, fully virtualized systems that can run completely independent of other customers, flexible licensing that doesn’t limit their options, and management interfaces that allow them to tie straight into their operations and business support systems. Pulse Secure has delivered on each of these requirements with the SA Series SSL VPN Virtual Appliances.

With SA Series Virtual Appliances, any service provider can assemble the right solution with the following:

• Blade servers running VMware are deployed to support SA Series Virtual Appliances.
• A single bulk license (such as 25,000 concurrent users on a three-year subscription) is applied to a Pulse Secure license server.
• SA Series Virtual Appliances configured to meet a particular customer’s requirements, licensed as needed from the license server, and moved to any VMware server in the world to best support each customer.
• Service provider’s own management systems can automate additional configuration changes, license moves, reporting, etc. as needs change.

Subscription Licensing and License Server

The SA Series Virtual Appliances feature subscription licenses. A service provider simply installs all licenses on a Pulse Secure SA2500 SSL VPN Appliance license server, and administrators assign licenses at various levels to the virtual appliances. This provides tremendous flexibility for service providers to easily adjust how much license support they will need at any given time. This capability also eliminates the need to have In Case of Emergency (ICE) licensing, since the virtual appliances can support burst licensing as well.

Virtual Appliances Schematic

Figure 1 shows a typical deployment model where the SA Series Virtual Appliances are hosted by a service provider within a suitable part of its infrastructure, such as a hosting center with direct connectivity to the Internet and connectivity to the customer IP environment. The figure also shows potential service enhancements in the form of dedicated customer blades, where enterprise customers can have their own assigned virtual appliance blades offering not only secure mobile and remote access, but hosted virtual systems for back-office applications and other network services. Note that the orange halo around one SA Series appliance means that it is a virtual appliance.

Pulse is an integrated, multiservice network solution that enables anytime, anywhere connectivity, access control, security, acceleration, and collaboration with a simplified user experience that requires minimal user interaction. It makes secure network and cloud access easy through virtually any device—mobile or nonmobile, Wi-Fi or 3G/4G, Long Term Evolution (LTE)-enabled, managed or unmanaged—over a broad array of computer and mobile operating systems. The following table provides key features and benefits of Pulse.

Figure 1: Virtual appliance schematic Pulse

Tech Info:

SA Series SSL VPN Virtual Appliances are the best way to secure access to data centers hosting virtual desktops and other applications, providing the following key features and benefits:

High Scalability

• Gives service providers the ability to quickly scale to meet the needs of many new SMB and enterprise customers

Service Offerings that Increase Average Revenue per User (ARPU)

• Allows service providers to offer new applications to end customers today (such as Enhanced Endpoint Security, Pulse Application Acceleration Service, or Pulse Mobile Security Suite), with more offerings in the future to further increase revenue stream

Changing Needs Easily Addressed

• Provides flexibility to perform additional configuration changes, license moves, reporting, etc. at any time, as required

Pulse Support for Mobile Devices

• Enables service providers to sell mobile devices such as Apple iPhones and iPads, Google Android devices (running Android 4.0 or higher, or any Samsung GALAXY mobile devices), as well as additional services into SMBs and enterprises, while supporting corporate Bring Your Own Device (BYOD) initiatives
• Increases enterprise productivity by empowering employees to safely, securely access corporate applications on personal and/or corporate handsets

Long-Term Investment Protection

• Provides users with a single platform to access virtual desktops, Web applications, terminal services, client/server applications, and to obtain access from various mobile devices
• Enables companies to change their mix of remote access needs over time through a single, already deployed solution

Improved Productivity and Ubiquitous Access

• Provides broad cross-platform device support including Microsoft Windows, Apple Mac OS, Linux, and mobile devices running Apple iOS, Google Android, Microsoft Windows Mobile, Nokia Symbian, and RIM BlackBerry
• Offers access for diverse audiences (employee, contractor, partner) using a variety of Web-enabled devices (corporate laptop, home PC, smartphone, tablet device, kiosk) from virtually any location (home, airport, hotel, office, etc.)

Easy to Deploy and Manage

• Allows for plug-and-play connectivity, with desktop users easily launching Pulse via the Web from the SA Series landing page, and mobile or remote users launching Pulse from their desktop or from the Pulse interface downloaded and installed on their mobile device
• Requires only a Web browser and Internet connection to simplify the user’s network and cloud access experience
• With cloud/Web single sign-on (SSO), allows service providers to easily and securely federate enterprise user identity with third-party Web applications, including cloudbased SaaS applications, delivering seamless, authenticated cloud/Web application access and a quality user experience

Greater Security

• Enables granular access control to users based on the user type, endpoint device, and network connectivity location
• Supports endpoint health checking to significantly reduce the influx of devices infected with viruses, trojans, and bots—even from unmanaged devices such as home and contractor PCs, employeeowned mobile devices, etc.

Superior Reliability

• Proven SSL VPN vendor deployed in tens of thousands of enterprises and service provider networks worldwide
• Market leader since SSL VPN category was created in 2002, and recipient of numerous industry awards

Features and Benefits:

Feature	Benefits
Layer 3 SSL VPN	Layer 3 VPN connectivity with granular, role-based access control is provided. Offers SSL or Encapsulating Security Payload (ESP) transport mode.
Location awareness	Seamless roaming from remote access (to SA Series Virtual Appliance) to local LAN access (via Pulse Secure Unified Access Control or MAG Series Pulse Gateways running Pulse Access Control Service) is allowed for laptops. Pulse can be preconfigured by administrators to automatically prompt end users for credentials to authenticate to the SA Series when they are remote.
Endpoint security	Full Host Checker capability checks endpoint security for Windows, Mac OS, and Linux devices, as well as Apple iOS and Google Android mobile devices. Host Checker for iOS and Android platforms enables administrators to restrict or prohibit VPN access from noncompliant devices based on centrally defined corporate policies, including OS version restrictions, jail-broken or rooted status, or presence and/or enablement of Pulse Mobile Security Suite. Enhanced Endpoint Security option delivers on-the-fly malware protection, preconnection scanning policies, and real-time protection supported by SA Series SSL VPN Virtual Appliances (or MAG Series running Pulse Secure Access Service) and UAC (or MAG Series running Pulse Access Control Service).
Split tunneling options (enable or disable without route monitoring)	Key split tunneling options found in Network Connect are also supported in Pulse. Secure, granular, user role-based access control is enforced.
Flexible launch options (standalone client, browser-based launch)	Users can easily launch Pulse via the Web from the SA Series landing page. Remote users can simply launch Pulse from their desktop or mobile device.
Preconfiguration options (preconfigured installer to contain list of SA Series appliances)	Administrators can preconfigure a nonmobile Pulse deployment with a list of corporate SA Series SSL VPN Virtual Appliances from which users can choose.
Connectivity options (max/idle session timeouts, automatic reconnect, logging)	Administrators can set up flexible connectivity options for remote users.

Specifications:

Since the SA Series SSL VPN Virtual Appliances are meant for service providers, the specifications needed to run them vary depending on the service provider’s network environment. Please consult with your Pulse Secure representative to determine the specifications required to run SA Series Virtual Appliances based on your specific network infrastructure.

SA Series Virtual Appliance Specifications
Form Factor	VMware ESX or KVM virtual machine (Requires hardware-based license server)
Functionality	VPN or NAC
Concurrent Connections	10,000 SSL or 32,000 NAC
Throughput	600 Mbps
RAM	4 GB
Hard Drive	20 GB
Encryption Data Acceleration (AES-NI)	None

Documentation:

Download the Pulse Secure SA Series SSL VPN Virtual Appliances Datasheet (.PDF)