Now that you have Junos Pulse up and running on iOS 4.1, it’s time to grap the latest version of the iPhone configuration utility and configure some cool things…like VPN on Demand or certificate authentication.

App Store, App Note

Maximizing Licensed Capacity:

Before we go too far, let’s ask ourselves: What is a Juniper SSL VPN license?  Although we say that the VPN licenses enable concurrent users, the naming itself is perhaps a bit unfortunate.  What do I mean?  Well, in an ideal world we possibly never would have started out calling them concurrent users “licenses” as that implies to many that they are strictly a license for users, although the truth is that they are really licenses for capacity on an appliance.  (see the Juniper standard EULA for a more thorough description and terms)   

Let’s come back to this in a minute.  For now, let’s look at a rather simple comparison: unlimited Internet access.

If you are at all like me, you are paying for “unlimited Internet access” in several ways each month, often times through the same provider.  You may have a DSL modem for home, a broadband card for your mobile laptop, 3G service for your tablet, and of course a smartphone.  So there you are, with “unlimited” access across 4 devices, all going to the same network carrier!  Can I go to the carrier and ask that they just bill me for one unlimited access account?  Well sure, I can ask.  Of course, they will laugh.  That’s how they make their money (not the laughing at me part, just the multiple data plans).  After all, they don’t charge Kevin Peterson for unlimited access, they charge for each device.  And if I ever could negotiate a single package that gave me unlimited connectivity on any of my devices, you can bet it would complex to set up and perhaps still just as costly.

Now back to the Juniper SSL VPN licensing…

Just as the phone provider charges for data packages on each device, Juniper licensing charges for capacity of each appliance, albeit by calling the capacity “concurrent user licenses”.  So, for larger multi-box customers, it would be great to allow them to just buy X boxes along with a single big pool of licenses to spread across all of them, but that would not make for a profitable business for Juniper Networks. 

Large Install Example (for customers running > 10K concurrent users):

Let’s say you want to buy 25K licenses in just one bulk license along with 4 SA6500 appliances.  So you buy the license and then assign it to just one of the boxes.  And what do you now have?  You have a single box that can run up to 10K users but with a 25K concurrent user license on it.  In other words, you just cut yourself off at the knees, because that one box is not going to run 25K concurrent users.  What you now need to make it all work out are the 25K -CL (cluster) licenses, as that ensure that each box has the licenses needed to run and support the required user capacity.  I actually get this request quite often, where I am asked to take the price per user for a single 25K concurrent user license ($16/user – LIST) and just forget all of the remaining licenses that are actually required to get to that level (3 x SA6500-CL-25000 = $15.60/user – LIST).  Sorry, but we just don’t want to give up half of the revenue any more than your phone company wants to not charge for you data on your smartphone just because you have unlimited data at home and at work.  So even for these very large installations, every box must have the required capacity licensed as needed.

Anyway, I hope all of this makes sense.  SSL VPN licenses simply enable capacity per box just as data plans from telcos are enabled per device and are not tied to specific users such that they can move from one device to another.  And all appliances must have some licensed capacity in order to be used.

But  you can still save money here!  Just use the following three easy guidelines:

• Use the online scalability calculator to best estimate the capacity for each box you intend to deploy and plan to stay within the qualitative and quantitative limits of your particular design/environment. 
• Using the guidance from Part II of this series (not stacking licenses), maximize the bulk licensed capacity on each appliance. I know this sounds self-serving, but it is honestly mentioned here as a way to save you money.  The more capacity you buy and can comfortably handle on each appliance, the lower the effective price per user.  And oftentimes stepping up to a higher license count works out better than trying to buy lower and then coming back later to add more concurrent user and/or ICE licenses).   Going back to the data plan analogy, I can possibly buy plans from my provider with lower usage caps, but if I ever exceed the contracted amount you can bet I will have a huge bill at the end of the month, so it’s just cheaper in the long run to budget and plan for my peak usage rather than the minimum.  Sure I might run a bit of a surplus each month, but that is always much less expensive than having a deficit.
• Finally, if you are building a cluster, don’t forget the lessons learned in Part I.

Just as it is a waste to buy more capacity on a box than it can possibly handle in a certain environment, it can be equally wasteful to have far more capacity enabled than will ever be used.  Some buffer is good and even healthy.  But excessive waste is a problem and it is highly recommended that the right questions are asked early and often so that such generally foreseeable events can be avoided.  Your efficiency goal should be to regularly achieve roughly 75% of your own maximum rated and licensed capacity on each appliance.  And if you get into some really wacky situation (yes, it does happen from time to time), just hunt down your Juniper partner and/or sales team as needed.  There’s a workable solution out there for everyone.

In almost all cases, stacking licenses will cost more than just buying a more capacity to begin with.  For example, if you are looking to size an SA6500 for 1500 users, you might be inclined to get a 1000 user license plus a 500 user license, with a combined LIST price of $114,990.  But if you just purchased a single 2500 user license, the LIST price is only $99,995, and you would likely have enough capacity in reserve that you would probably not even need to consider the additional In Case of Emergency (ICE) license.

I know this may seem all-too-obvious, but you would likely be surprised just how many times I see this.

So, what would you like me to include this time around?

Part I:  Cluster Licenses Not Required

Available with IVE 7.0 (and UAC 4.0 for those of you also running that product) is a great new feature: cluster licenses are no longer required. 

Old School: Up to now anyone that wanted to build a cluster had to buy a regular license and the complementary cluster license.  So if you had a 2 unit cluster, one box might have a license of SA4500-ADD-1000U while the other would have SA4500-CL-1000U.  Together they equaled, well, 1000 users.  And the list price for this tidy little collection of licenses is $114,900.

New School: Cluster licenses are gone!  Well, okay, they are really not gone-gone, but once you see this option you probably won’t want them.  Here’s how you save money while also increasing your flexibility.  Just buy an equal number of ADD licenses on each box, and when they come together they will actually add up to the total.  So to build a 1000 user cluster as before, just put an SA4500-ADD-500U on one box and another SA4500-ADD-500U on the other box.  Your new list price (again, just licenses here): $89,990.  Oh, and you can split the cluster in the future if you so choose.

Further insight into the newer model:

• If the cluster splits (a single box should just up and die for some reason), the surviving box (from the example above) will still run at 1000 concurrent users…for 5 days.  We call that the grace period.  After 5 days, the surviving box will only run 500 concurrent users, because that is the license count that is really on the box.  Actually it will be 550 concurrent users, because you get a 10% buffer anyway, albeit with warning messages that the users can see for those unlucky enough to be in that range (between 500 and 550).  So if a box dies, just make sure you call JTAC early so they can get you an RMA ASAP (under your active maintenance contract, of course).  And if you just can’t get things restored in 5-whole-days for some reason, JTAC can always extend your licenses temporarily, bringing you right back to 1000 for a longer period of time.
• You can’t get away with just putting a 1000 user license on one box (moving up to an SA6500 for a moment since the SA4500 peaks out at 1000 concurrent users) and a 10 user license on the other box.  They will actually cluster this way and they will end up allowing 1010 concurrent users, but there is a catch.  You see, each license–once clustered–is only allowed to borrow what it brings to the table.  What this means is that if the box with 10 users should die, then the box with 1000 users will still have 1000 users.  And why shouldn’t it, right?  But if the box with 1000 users should die, then the box with 10 users can only borrow what it brought to the table, which is 10.  So immediately following the failure of the box with 1000 user licenses, the box with 10 licenses really only has 20.  And this takes place immediately, albeit for the 5 day grace period.  After the 5 day grace period, it’s back to 10 concurrent users, unless of course the other cluster node comes back online.  The bottom line here is to just keep the license counts equal and all will be well in the universe. 
• Run 7.0R2 or higher.  There was actually a bug in the licensing code for this new model in R1 and since I know you want to avoid running into it, my best advise is to go with R2.  It’s available now.
• Cluster licenses are not being discontinued.  We need them to service existing customer needs and to continue to service the needs of new customers that simply want to pay more and have less flexibility.
• Converting licenses: Sorry, but this is not even up for discussion. We will not convert -CL (cluster) licenses to regular ADD licenses.  The reason for this is simple: CL licenses by themselves are cheaper than ADD licenses, so if we were to automatically convert them to ADD licenses, then all anyone would ever have to do is buy CL licenses and just not worry about ADD licenses at all.  And that’s just a bit more discounting than we can handle right now.
• Crazy Scenarios: Existing customers with a mixed bag of ADD and CL licenses across boxes can certainly bring them together and the boxes will actually calculate a solution.  Just as ADD licenses converge in this new scenario, CL licenses will also get the same love.  So if you just happen to have several boxes lying around and want to bring them together into a new cluster, you may actually be in luck and either avoid having to buy any new licenses at all or perhaps at least only a fraction of what you thought you might have otherwise needed.  Just keep in mind that each box actually calculates its own capacity and the best way to test your new lumped together pile of licenses will be to just disconnect each now-clustered box one at a time and see what is then calculated on that node and all remaining nodes. 

PCoIP uses both TCP and UDP, requires the View client, and offers the best possible user experience over a UDP-based tunnel.  That is where Network Connect (NC) when the ESP/UDP transport really shines.   All you need to do is configure a single Network Connect profile, make sure that UDP port 4500 is open to the external interface of the SSLVPN and then test to make sure that clients are connecting with ESP instead of SSL  transport.  It’s that easy.  But if you get stuck, just hit me up and I will do all I can to clarify any configuration, performance or scalability questions.

I would also like to have a call with first Juniper SSL VPN customer to come forward that uses the new Local Mode feature of View 4.5 to see how you plan to use it in production settings.

“We’re aware of a bug in iOS 4 that is causing a delay with the Pulse app and we are working with Apple to resolve it.”

Just wanted to keep everyone in loop here.  That’s the approved messaging and all that can be shared right now, but please keep checking back and as things change and clearance is given to detail things further I will be sure to blast it out.

Juniper and SMobile together…what a combination!   This, my friends, should be fun.  Those interested in reading more should definitely check out The Network Ahead blog entry.

Please keep in mind that this in beta and feedback is certainly welcome. 

The goal here is to let everyone know not only what it takes to run these boxes up to their maximum, but also show where there might be limitations for given design.  And by allowing everyone to access the same calculations that would otherwise involve reading a lengthy document and then engaging a Juniper sales SE for clarification, simplicity wins…as do you.   Next we will look at adding some mobile platform support.