Juniper Mist Access Assurance Datasheet
Download DatasheetProduct overview
Juniper Mist Access Assurance is a cloud-based service that ensures Zero-Trust, identity-based network access, and full-stack policy and segmentation assignments with end-to-end user experience visibility. The service delivers a suite of access control functionality with a flexible, yet simple, authorization policy framework for onboarding guest, IoT, BYOD, and corporate devices. Client connection is controlled based on user and device identities, regulating access for devices connecting to the network. Access Assurance also provides access control services for devices leveraging 802.1X authentication and MAC Address Bypass for non-802.1X allowlisted, wired IoT devices.
Product Description
Juniper® Mist™ Access Assurance is a microservices-based, cloud network access control (NAC) service that enables enterprises to easily enforce a Zero-Trust security model. Access Assurance solves many complexity challenges associated with traditional NAC offerings by:
- Removing on-premises server hardware
- Providing inherently highly available and resilient services
- Enabling automatic at-run-time feature updates, security, and vulnerability fixes
Access Assurance extends beyond the capabilities of Juniper Mist IoT Assurance, which simplifies onboarding for headless IoT and BYOD devices. With Access Assurance, IT teams can onboard wired and wireless devices with 802.1X authentication or MAC Authentication Bypass (MAB) methods, even for non-802.1X devices.
Access Assurance uses hundreds of different vectors to match the identity of the user and device, such as X.509 certificate attributes, user group memberships, device compliance and posture metrics, and location context. These vectors help determine identity-based network admission criteria, such as the network segment or microsegment a device should connect to and the network policy that should be dynamically applied to a user.
Figure 1: The Juniper Mist Access Assurance cloud service greatly simplifies network access control
Figure 2: The flexible policy creation interface helps admins assign policies based on business requirements
Most importantly, Access Assurance provides end-to-end connectivity troubleshooting in a unified view from the client, network infrastructure, and access control perspective, dramatically simplifying Day 2 support. IT admins gain a cohesive view of the end user experience and can determine whether poor experiences are due to client configuration, network infrastructure, authentication, or a service.
Figure 3: Client SLE tracks network access control events
Architecture and Key Components
Access Assurance is delivered through Juniper Mist cloud and powered by Mist AI. The microservices architecture ties together high availability, redundancy, and autoscaling for optimal network access across wired, Wi-Fi, and wide area networks. Using geo-awareness, Access Assurance automatically redirects authentication requests from different regions to the nearest Access Assurance instance to provide minimal latency and the best end user experience.
Access Assurance provides an authentication service by integrating external directory services, like Google Workspace, Microsoft Azure AD, Okta Identity, and others. It also integrates external Public Key Infrastructure (PKI) and Mobile Device Management (MDM) providers, such as Jamf, Microsoft Intune, and others, to provide granular user and device identification to enforce identity-based, Zero Trust network access control.
Features and Benefits
Prioritizing client experiences
Access Assurance provides a unified view of the client connectivity experience and can easily identify a problem and perform root cause analysis. All client events, including connection and authentication successes and failures, are captured by Juniper Mist cloud. With this data, Juniper Mist cloud helps simplify day-to-day operations by easily identifying if an end user connectivity issue is caused by a client configuration mistake, network infrastructure and service problems, or authentication policy configuration issues. The Juniper Mist service level expectations (SLEs) for wired and wireless clients are enhanced to include network access events, such as authentication events, certificate validations, and more.
Figure 4: Client SLE failures provide descriptions for known issues
Single pane of glass for management and operations
Access Assurance is tightly integrated with Juniper Mist cloud, providing full-stack management and day-to-day operations for Wi-Fi Assurance, Wired Assurance, SD-WAN Assurance, and Access Assurance in one dashboard for end-to-end visibility. The Marvis™ AI engine leverages data from multiple sources for anomaly detection to provide actionable metrics. Through the dashboard, users can:
- Create and apply access policies that ensure only authorized devices and users are allowed network access
- Assign users and devices to the correct network segment
- Prevent users and devices from accessing restricted resources
- Add and modify certificates and certificate authorities
- Configure identity providers
- Monitor client activity across the organization
Figure 5: A friendly user interface highlights Access controls
Granular user and device identity
Access Assurance is capable of granular identity fingerprinting based on X.509 certificate attributes. It also uses identity provider (IdP) information like group membership, user account state, MDM compliance state, client lists, and user location for fingerprinting. The resulting user and device fingerprint provides an identity vector for accurate policy assignment within the Zero Trust principles.
Figure 6: Identity fingerprinting is possible through multiple methods
Network policy enforcement and microsegmentation
Based on user and device identity, Access Assurance can instruct the network to assign a user to a specific network segment (VLAN or a group-based policy tag), as well as enforce network policy by assigning a user role. Such roles can be leveraged in the Juniper Mist WxLAN policy framework or switch policies.
Figure 7: Enforced policies for VLANs, group-based policies, and user roles are easily visible
Figure 8: Recognizing policies with group-based tags is quick and fast
Built-in high availability and geo-affinity
With Access Assurance, organizations gain reliable and low-latency network access control of their networks in single and multisite deployments. Juniper has deployed cloud instances of its network access control cloud service in multiple regional locations. In multisite deployments, authentication traffic coming from the network infrastructure is automatically directed to the nearest Access Assurance instance. Latency is minimized and users enjoy an exceptional wireless experience. This automated process is fully transparent to users and requires no involvement from the IT team. Organizations are assured reliable, redundant network access for client devices, regardless of the state of the nearest regional instance.
Automatic feature and security updates
The Juniper Mist microservices-based cloud architecture keeps Access Assurance optimized with the most advanced technologies. New features, security patches, and updates are automatically added to Access Assurance on a bi-weekly basis without interruptions or service downtime. This capability dramatically simplifies and improves service operations for network IT administrators, eliminating lengthy software upgrades and service downtime. Juniper can easily deploy new features and functions to its cloud-based services, bringing advancements to market more rapidly and continuously improving your client-to-cloud experience.
Access Assurance extends Juniper Mist IoT Assurance
Access Assurance is paired with Juniper Mist IoT Assurance to build out controls for onboarding and management of corporate devices with 802.1X authentication and MAC-less onboarding of non-802.1X IoT and BYOD devices. IoT Assurance capabilities simplify IT operations and secure connections for headless IoT and BYOD devices via a Multiple Pre-Shared Key (MPSK) mechanism. It incorporates a full suite of access control functionality leveraging MPSK or Private Pre-Shared Key (PPSK) as a new type of identity and policy vector.
IoT Assurance also provides PSK Portal creation, enabling BYOD onboarding workflows by automating PSK generation based on user identity, leveraging Security Assertion Markup Language (SAML) for an SSO experience. It enables seamless client device onboarding via mobile QR code or by typing a personalized passphrase without installing any client software.
Access Assurance subscriptions include IOT Assurance functionality for simple access control for all clients and devices on your network, no matter how they connect.
Marvis Virtual Network Assistant
Marvis Virtual Network Assistant uses Mist AI to help IT teams interact and engage with their networks. The Marvis AI engine binds together Access Assurance with other Juniper Mist cloud-based services, such as Wired Assurance, Wi-Fi Assurance, and WAN Assurance, helping the operations team move closer to achieving The Self-Driving Network™ with simplified troubleshooting and performance analysis.
Using features powered by Mist AI, help desk staff and network administrators can simply ask a question in natural language and get actionable insights using the Marvis Conversational Interface that
API-Driven architecture
Access Assurance service is 100% based on public Representational State Transfer (REST) APIs that allow easy integration with external security information and event management (SIEM) or IT service management systems or other platforms for both configuration and policy assignment. These APIs provide the capability to invoke actions based on user or external events, as well as for using the cloud-native Webhook framework. Overall, the Juniper Mist platform is 100% programmable, using open APIs, for full automation and seamless integration with complementary Juniper access, wired, wireless, WAN, security, user engagement, and asset visibility solutions.
Specifications
| Feature | Description |
| X.509 certificate management | External PKI support Automatic CRL/OSCP certificate revocation check |
| External identity provider integration | The following protocols are supported to integrate into any identity provider to do user lookup and get device state information:
|
| 802.1X Authentication Methods | The following EAP methods are supported for secured 802.1X access:
|
| Non-802.1X authentication methods | MAC Authentication Bypass (MAB) Multi Pre-Shared Key (MPSK) |
| Network policy and microsegmentation | Assign VLANs, role and group-based policy tags dynamically based on the user identity |
| Third-party network infrastructure support | Supported via Mist Edge Auth Proxy application, third-party vendor devices can communicate over standard RADIUS to the Mist Edge Auth Proxy |
| Juniper Mist IoT Assurance (Included with all Access Assurance subscriptions) | IoT and BYOD client-device onboarding
|
Ordering Information
The Access Assurance service is provided as a subscription, based on the average concurrently active client devices seen over a 7-day period.
Standard subscriptions include all network access control capabilities from within the Juniper Mist Cloud.
Advanced subscriptions add client posture checking (UEM/EMM/MDM) and firewall Integrations to the standard Access Assurance capabilities.
| SKU | Description |
| S-CLIENT-S-1 | Standard Access & IOT Assurance subscription for 1 client for 1 year |
| S-CLIENT-S-3 | Standard Access & IOT Assurance subscription for 1 client for 3 years |
| S-CLIENT-S-5 | Standard Access & IOT Assurance subscription for 1 client for 5 years |
| S-CLIENT-A-1 | Advanced Access & IOT Assurance subscription for 1 client for 1 year |
| S-CLIENT-A-3 | Advanced Access & IOT Assurance subscription for 1 client for 3 years |
| S-CLIENT-A-5 | Advanced Access & IOT Assurance subscription for 1 client for 5 years |
About Juniper Networks
Juniper Networks believes that connectivity is not the same as experiencing a great connection. Juniper's AI-Native Networking Platform is built from the ground up across the AIOps layer and our systems to fully harness the power of AI. From real-time fault isolation to proactive anomaly detection and self-driving corrective actions, it provides campus, branch, data center, and WAN operations with next-level predictability, reliability, and security. Additional information can be found at Juniper Networks (www.juniper.net) or connect with Juniper on X (Twitter), LinkedIn, and Facebook.
1000769 - 003 - EN MAY 2024