DATA SHEET

Ivanti Connect Secure (ICS):
Secure Access VPN for the Everywhere Workplace
Product Description
Overview
The modern workforce is a remote workforce,and the modern workplace extends beyond
the office to the cloud. With the increasing
number and complexity of applications thatusers need, the many different types of devices
users can connect from, and the constant threatof malicious actors, securing the EverywhereEnterprises and service providers have the difficult
challenge of providing location- and deviceindependent network connectivity that is secure andcapable of controlling resource access for authorized

most widely adopted SSL VPN by organizations ofevery size, across every major industry.

connectivity.

users to networks, both data center and cloud. Wrappedusers are connecting from outside the office as thein a user-friendly package, the Ivanti Secure Accesswork-from-home revolution continues to grow.

Client dynamically enables the appropriate network andIvanti Connect Secure includes the Ivanti Secure

anywhere. Powerful and easy to use, ICS is thefull tunnel and FQDN or IP/network-based split tunnel

The Ivanti Secure Access Client securely connects

Ivanti Connect Secure (ICS) provides a seamless,from any web-enabled device – anytime,modes.The Ivanti Secure Access Client also supports

control, and increasing numbers of employees andIvanti Secure Access Client

mobile users to connect to corporate resources

on-demand VPN connectivity, always-on and lockdown

users. Breaches and threats continue to spiral out of

Workplace can be a daunting task.

cost-effective SSL VPN solution for remote and

The Ivanti Secure Access Client supports per-app VPN,

Access Client, a dynamic, multiservice network client
for mobile and personal computing devices. IvantiSecure Access Clients are easy to deploy, enablingusers to quickly “click and connect” from any
device, anywhere.

security services on users’ endpoints. With Ivanti, theconnection just works, helping deliver the productivity
promised by mobile devices.
The Ivanti Secure Access Client on desktop delivers
dynamic access control, seamlessly switching between
remote (SSL VPN) and local (NAC) access control
services on user devices. It also enables comprehensive
endpoint security posture assessment for mobileand desktop computing devices, and quarantine andremediation if necessary.

ivanti.com

Ivanti Security Appliance
The Ivanti Security Appliance (ISA) is the newgeneration of Ivanti appliance offerings. ISA series
appliances are purpose-built for speed and security
and can scale to match any organization’s needs,
from SMB to enterprise. ISA series appliances
can be deployed to the data center or cloud asvirtual appliances and are also available as fixedconfiguration rack-mounted hardware.

Architecture and Key Components
Ivanti Connect Secure is available on Ivanti Security
Appliance (ISA) as hardware or as a virtual appliance
as noted below.

Ivanti Security Appliance (ISA) Series■ ISA 6000 Appliance: Fixed configuration, 1U

rack-mounted appliance supports up to 2,500
concurrent users.
■ ISA 8000 Appliance: Fixed configuration, 1U

rack-mounted appliance supports up to 25,000
concurrent users in stand-alone mode and up to
45,000 concurrent users in cluster mode.
■ Virtual Appliances (ISA-V Series): VMware ESXi,

KVM, Microsoft Hyper-V, Nutanix, Microsoft Azure,
Amazon Web Services and Google Cloud Platform.
■ Virtual Appliances (ISA-V Series) include:- ISA4000-V: supports up to 250 users- ISA6000-V: supports up to 2,500 users.
- ISA8000-V: supports up to 25,000 users.

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

2

Features and Benefits
FeatureDescription■ Dual-transport (SSL + Encapsulating Security Payload) full Layer 3 VPN connectivity with granular access control.
■ “Always-on VPN with Lockdown Mode” and “VPN Only Access” modes for Compliance (VPN connection automatically connects/disconnects based on user’sLayer 3 VPN

location).

■ Machine-based VPN with ability to step up to user-based authentication after user log-in.
■ “On Demand VPN” and “Per App VPN” for seamless and secure end-user experience.
■ Client/server proxy application that tunnels traffic from specific applications to specific destinations.
Layer 4 VPN■ The Windows version of the Secure Application Manager (PSAM) enables secure traffic to individual client/server applications and application servers.
■ The Java version of the Secure Application Manager (JSAM) provides support for static TCP port client/server applications.

Conditional Access■ Validates and verifies devices and users via a set of automated policies to protect networks and data. Each access attempt is evaluated dynamically and controlled
in real time based on the policies in effect.

■ Secures clientless access from any HTML5-capable browser to published and/or user-added applications and links.
■ Dynamically generated based on user role.
Advanced User Portal■ RDP/Telnet/VNC/SSH access with Advanced HTML5.

(Layer 7/Clientless VPN)

■ Web rewriter and web proxy built in.
■ Multi-portal support (e.g., SSO portal for employees, 2FA portal for contractors).
■ Support for Windows Terminal Services, VDI (Citrix, VMware) and File Browsing.

Optimized end-user experience

Stateful endpoint integrity and assessment■ Smooth roaming from remote access to local LAN access (Ivanti Policy Secure).
■ Single Sign On (SSO) for rapid, secure access from remote or on-site locations (via integration with Ivanti Connect Secure and Ivanti Policy Secure).
■ Assesses and remediates end-user devices prior to authentication with easy policy definitions.
■ Windows, MacOS, Apple iOS and Android.

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

3

Features and Benefits (continued)■ Users can easily launch SSL VPN via their web browser or directly from their devices.
Flexible launch options (standalone client,■ Auto Connect feature allows devices to automatically connect to VPN, either when the machine starts or user logs on.

browser-based launch)■ VPN on demand feature leverages OS capabilities for auto triggering VPN seamlessly in the background when an approved application needs corporate access.

Supports Cloud Secure Solution

Pre-configuration options(Windows and Mac only)■ Blend cloud and data-center access into a seamless user experience for next-generation workers.
■ Add compliance rules for hybrid DC access.
■ Administrators can preconfigure a deployment with a list of gateways for end users to choose.
■ Adaptive Authentication using dynamic, multi-factor authentication using several user attributes.
■ Administrators can deploy Ivanti for remote user authentication using a wide array of authentication mechanisms, including biometric authentication support with

Authentication options

Windows Hello for Business, hardware token, smart card, soft token, Google Authenticator, one-time passwords and certificate authentication.

■ Administrators can send AAA traffic via a desired interface (internal / external / management) for delegating user authentication to an Identity Provider.
■ OAuth/OpenID Connect support allows integration with any standard OpenID Provider like Google, OKTA, Azure AD, etc., while connecting to Connect Secure(acting as Relying Party).

VDI support■ Ivanti supports the latest versions of VMware Horizon and Citrix XenApp / XenDesktop.

Granular SSL Cipher Configuration■ Enables the administrator to select specific ciphers over those pre-configured for highly secure compliance.

REST API■ A comprehensive REST-based API for programmatic access to the appliances.

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

4Rich Access Privilege Management Capabilities
FeatureDynamic role mapping with custom
expressions

Description

Benefit■ Combines network, device and session attributes to determine which types■ Enables the administrator to provision by purpose for each unique session.

of access are allowed.

■ A dynamic combination of attributes on a per-session basis can be used tomake the role-mapping decision.

■ Through MDM integration, fetches device attributes and applies policy
decisions appropriately before granting access.

Support for RSA Authentication Manager

Standards-based built-in Time-based
One-Time Password (TOTP)

Multiple sessions per user

■ RSA Authentication Manager risk-based authentication.

■ Provides another authentication layer option.

■ Leverages smartphones to roll out a cost-effective and self-service two-

■ Enables multi-factor authentication using smartphones.

factor authentication mechanism, where one-time passcodes are generated
by a mobile app.

■ Enables remote users to have multiple authenticated sessions open at the■ Allows remote users to launch multiple remote-access sessions.

same time, such as when accessing VPN from a laptop and a smartphone
simultaneously.

User record synchronization

Mobile-friendly SSL VPN login pages

Integration with strong authenticationand identity and access management(IAM) platforms■ Supports synchronization of user records such as user bookmarks acrossdifferent Ivanti Appliances.

to another and therefore need to connect to different Ivanti Appliances
running Ivanti Connect Secure.

■ Provides predefined HTML pages that are customized for mobile devices,
including Apple iPhone, iPad and Google Android.

■ Provides mobile device users with a simplified and enhanced user
experience and web pages customized for their device types.

■ Ability to support SecurID, Security Assertion Markup Language (SAML)
including standards-based SAML v2.0 support and public key infrastructure(PKI)/digital certificates.

■ Ensures a consistent experience for users who often travel from one region■ Leverages existing corporate authentication methods to simplify
administration.

■ OAuth/OpenID Connect Support.

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

5

Ease of Administration
FeatureNeurons for Secure Access

Description■ Optional centralized management, analytics and reporting platform for
Ivanti Connect Secure deployments.

■ Full configuration management, one-click upgrades, centralized
logging, custom reporting and troubleshooting.

■ “Lift and shift” configurations through configuration templates andBenefit■ Centralized configuration and gateway lifestyle management saves time andmoney.

■ Enhanced behavioral analytics identify and automatically act on risky user
behavior before it becomes a problem.

■ Simplifies management of multi-node or global deployments.

multi-node configuration management.

Mobile Device Management (MDM)
integration■ Enables consolidated reporting and dashboards for simplified
management.

■ Extends MDM investments to gain comprehensive endpoint visibility andsupport additional mobile use cases.

■ Leverages MDM attributes for more intelligent and centralized policy
creation.

■ Facilitates transparent “no touch” MDM-based deployment of Ivanti
Clients to iOS and Android devices.
Bridge Certification Authority (BCA)
support■ Bridge CA is a PKI extension that cross-certifies anchors (Root CAs).
■ Supports federated PKI deployments with client certificate
authentication.

■ Enables customers who use advanced PKI deployments to deploy IvantiAppliances to perform strict standards-compliant certificate validation before
allowing data and applications to be shared among organizations and users.

■ Enables customers to configure policy extensions in the admin UI, tobe enforced during certificate validation.

Multiple hostname support■ Ability to host different virtual extranet websites from a single
appliance.

■ Eliminates the cost of incremental servers.
■ Provides a transparent user experience with differentiated entry URLs.
■ Eases management overhead.

Customizable user interface■ Creation of completely customized sign-on pages.

■ Provides an individualized look for specified roles, streamlining the user
experience.

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

6

Flexible Single Sign-On (SSO) Capabilities
FeatureSAML single sign-on for cloud and web
applications access

Description

Benefit■ SAML 2.0-based SSO to a variety of web applications, including many of today’s
most popular Software as a Service (SaaS) applications.

■ Single sign-on to a user’s web and cloud-based applications, simplifying
the user connectivity experience.

■ Includes SSO functionality, even when connecting via an Ivanti Connect Secure
Layer 3 VPN tunnel.

■ Ivanti Connect Secure supports deployments as both a SAML Identity Provider(IdP) and as a SAML Service Provider (SP).

Kerberos Constrained Delegation■ Support for Kerberos Constrained Delegation (KCD) protocol.

■ Eliminates the need for companies to manage static passwords,■ Enforces KCD for Exchange Active Sync traffic, requiring client certificates,

reducing administration time and costs.

trusted CA certificates and proper delegation policies for authentication.
Kerberos SSO and NT LAN Manager(NTLMv2) support
Password management integration■ Ivanti Connect Secure will automatically authenticate remote users via Kerberosor NTLMv2 using user credentials.

■ Simplifies the user experience by eliminating their need to enter
credentials multiple times to access different applications.

■ Standards-based interface for extensive integration with password policies in
directory stores (LDAP, AD and others).

■ Leverages existing servers to authenticate users.
■ Users can manage passwords directly through the Ivanti Connect
Secure interface.

Web-based SSO basic authentication and
NTLM
Web-based SSO forms-based, header
variable-based, SAML-based
OAuth/OpenID Connect■ Enables users to access other applications or resources protected by anotheraccess management system without re-entering login credentials.

■ Alleviates the need for users to enter and maintain multiple sets ofcredentials for web-based and Microsoft applications.

■ Ability to pass username, credentials and other customer-defined attributes to the■ Enhances user productivity and provides a customized experience.

authentication forms of other products and as header variables.

■ OAuth/OpenID Connect support allows integration with any standard OpenID■ Integrate into existing OAuth deployments for easy user ID federation.

Providers like Google, Okta, Azure AD, etc., while connecting to Connect Secure(acting as Relying Party).

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

7

Provision by Purpose
FeatureIvanti Secure Access Client

Description■ Unified, integrated, remote access client that can also provide LAN access control
and dynamic VPN features to remote users.

Benefit■ Ivanti Secure Access Client replaces the need to deploy and maintain multiple,
separate clients for different functionalities such as VPN and LAN access control. End
users simply “click and connect” the connection they need.

Clientless core web access■ Secure access to different types of web-based applications, including today’s
most common applications such as Outlook Web Access, SharePoint and manyothers.

■ Provides the most easily accessible form of application and resource access from avariety of end-user devices with extremely granular security control options.

■ Completely clientless approach using only a web browser.

■ Remote Desktop Protocol (RDP) access in Ivanti Connect Secure can be delivered
over HTML5, via third-party RDP, through a WebSockets translator such as
Ericom.
IKEv2 support formobile devices■ Enables remote users to connect from any mobile device that supports Internet
Key Exchange (IKEv2) VPN connectivity.

■ Full L3 VPN support for new devices that support IKEv2 but for which a client is not
yet available.

■ Administrator can enable strict certificate or username/password authentication
for access via IKEv2.
Virtual Desktop infrastructure(VDI) support■ Allows interoperability with VMware View Manager and Citrix Xen Desktop to
enable administrators to deploy virtual desktops with Ivanti Connect Secure.

■ Provides remote users seamless access to their virtual desktops hosted on VMware
servers.

■ Provides dynamic delivery of the VMware View client and Citrix Workspace client,including dynamic client fallback options, to allow users to connect to their virtual
desktops.
Zero Touch Provisioning■ Deploy ICS using OpenStack, VMWare, Hyper V and cloud (GCP, Azure, AWS).

■ Enhances admin productivity and provides a customized experience.

■ Obtain initial configuration from local DHCP server without manual data entry.
■ Configure and manage via REST API.
ActiveSync Proxy■ Provides secure access connectivity (strong encryption + certificate
authentication) from mobile devices (such as iOS or Android) to the Exchange■ Enables customers to allow many users (including employees, contractors andpartners) to access corporate resources through mobile phones via ActiveSync.

Server via proxy, with no client software installation. Enables up to 5,000
simultaneous sessions.
Secure Application Manager(SAM)■ A lightweight application download enabling access to client/server applications.

■ Enables access to client/server applications using just a web browser. Also provides
native access to terminal server applications without the need for a preinstalled client.

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

8

About Ivanti
Ivanti breaks down barriers between IT and security
so that Everywhere Work can thrive. Ivanti has
created the first purpose-built technology platform
for CIOs and CISOs – giving IT and security teams
comprehensive software solutions that scale with
their organizations’ needs to enable, secure andelevate employees’ experiences. The Ivanti platform is
powered by Ivanti Neurons - a cloud-scale, intelligent
hyperautomation layer that enables proactive healing,user-friendly security across the organization, andprovides an employee experience that delights users.
Over 40,000 customers, including 85 of the Fortune
100, have chosen Ivanti to meet challenges head-on
with its end-to-end solutions. At Ivanti, we strive tocreate an environment where all perspectives areheard, respected and valued and are committed to amore sustainable future for our customers, partners,
employees and the planet. For more information,
visit ivanti.com and follow @GoIvanti.

Copyright © 2024, Ivanti. All rights reserved. IVI-2516 09/24 GG/DH

For more information, or to contact Ivanti,
please visit ivanti.com