DATA SHEET

Ivanti Connect Secure: Secure Access VPN for theEverywhere Workplace
Product Description
Overview

Enterprises and service providers have thesupports full tunnel and FQDN or IP/network-based split
tunnel connectivity.

difficult challenge of providing location and device

The Ivanti Secure Access Client securely connect users

independent network connectivity that is secure andto networks, both data center and cloud. Wrapped incapable of controlling resource access for authorizeda user-friendly package, Ivanti Secure Access Client

users. Breaches and threats continue to spiral out ofdynamically enables the appropriate network andcontrol and increasing numbers of employees andsecurity services on users’ endpoints. With Ivanti, theusers are connecting from outside the office as theconnection just works, helping to deliver the productivity

work from home revolution continues to grow.

promised by mobile devices.

Everywhere Workplace can be a daunting task.

Ivanti Secure Access Client

Ivanti Secure Access Client delivers dynamic access

Ivanti Connect Secure provides a seamless, cost-

Ivanti Connect Secure includes the Ivanti Securecontrol, seamlessly switching between remote (SSL

The modern workforce is a remote workforce,and the modern workplace has spread beyond
the office and the traditional data center to thecloud. With the increased number and complexityof applications users need, the many different
types of devices users can connect from, and theconstant threat of malicious actors, securing theeffective, SSL VPN solution for remote and mobile
users from any web-enabled device to corporate
resources — anytime, anywhere. Powerful andeasy to use, Ivanti Connect Secure is the mostwidely deployed SSL VPN for organizations of any
size, across every major industry.

Access Client. The Ivanti Secure Access Client is a
dynamic, multiservice network client for mobile andpersonal computing devices. Ivanti Secure Access
Clients are easy to deploy, enabling users to quickly“click and connect” from any device, anywhere.
The Ivanti Secure Access Client supports per-app
VPN, on-demand VPN connectivity, always-on andlockdown modes. Ivanti Secure Access Client also

ivanti.com

VPN), and local (NAC) access control services on user
devices. Ivanti Client also enables comprehensive
endpoint security posture assessment for mobileand desktop computing devices, and quarantine andremediate, if necessary.

Ivanti Security Appliance
Ivanti Security Appliance (ISA) is the new generationof Ivanti appliance offerings. ISA series appliances
are purpose-built for speed and security and canscale to match any organizations needs, from SMB
to enterprise. ISA series appliances are available as
fixed-configuration rack-mounted hardware or canbe deployed to the data center or cloud as virtual
appliances. With massive performance increases
through hardware, software and kernel optimizations,
ISA series appliances boast impressive throughput
speed boosts in lab testing over equivalent PSA series
appliances.

Architecture and Key Components
Ivanti Connect Secure is available on Ivanti Security
Appliance (ISA) and Ivanti PSA series appliances, as
hardware or as a virtual appliance as noted below.

Ivanti Security Appliance (ISA) Series■ ISA 6000 Appliance: Fixed configuration, 1U rack

mounted appliance, supporting up to 2,500 SSL
VPN concurrent users

Ivanti PSA Series■ PSA3000 Appliance: Fixed configuration, 1U

rack-mount appliance, supporting up to 200 SSL
VPN concurrent users■ PSA5000 Appliance: Fixed configuration 1U

rack-mount appliance, supporting up to 2,500 SSL
VPN concurrent users■ PSA7000 Appliance: Fixed configuration 2U

appliance, supporting up to 25,000 SSL VPN■ ISA 8000 Appliance: Fixed configuration, 1U rack

mounted appliance, supporting up to 25,000 SSL
VPN concurrent users

concurrent users■ Virtual Appliances (PSA-V Series): VMware ESXi,

KVM, Microsoft Hyper-V, Microsoft Azure, Amazon■ Virtual Appliances (ISA-V Series): VMware ESXi,

KVM, Microsoft Hyper-V, Nutanix, Microsoft Azure,
Amazon Web Services, and Google Cloud Platform

Web Services, OpenStack Fabric and Alibaba
Cloud■ Virtual Appliances (PSA-V Series) include:■ Virtual Appliances (ISA-V Series) include:- PSA3000-V: Supporting up to 200 users- ISA4000-V: Supporting up to 250 users- PSA5000-V: Supporting up to 2500 users- ISA6000-V: Supporting up to 2500 users- PSA7000-V: Supporting up to 10,000 users- ISA8000-V: Supporting up to 25,000 users

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

2

Features and Benefits
FeatureDescription■ Dual-transport (SSL + Encapsulating Security Payload) full Layer 3 VPN connectivity with granular access control.

Layer 3 SSL VPN■ “Always-on VPN with Lockdown Mode” & “VPN Only Access” modes for Compliance (VPN connection automatically connects/disconnects based on user’s
location).

■ Machine based VPN with ability to step up to user-based authentication after user log-in

Application VPN

Layer 7 Web single sign-on (SSO) via SAML

Conditional Access■ Client/server proxy application that tunnels traffic from specific applications to specific destinations■ “On Demand VPN” and “Per App VPN” for a seamless and secure end user experience■ Allows end users to authenticate to the network through a Layer 3 tunnel, while simultaneously enjoying SSO to Web applications accessed through their browser
via SAML SSO support■ Validate and verify devices and users via a set of automated policies to protect networks and data. Each access attempt is evaluated dynamically and controlled inreal-time based on the policies in effect. Enables granular control and Zero Trust enforcement for application access■ Secure clientless access from any HTML5 capable browser to published and/or user added applications and links■ Dynamically generated based on user role
Advanced User Portal■ RDP/Telnet/VNC/SSH access with Advanced HTML5■ Web rewriter and web proxy built in■ Multi-portal support (e.g., SSO portal for employees, 2FA portal for contractors)

Optimized end-user experience

Stateful endpoint integrity and assessment■ Smooth roaming from remote access to local LAN access (Ivanti Policy Secure)■ Single Sign On (SSO) for rapid, secure access from remote or on-site locations (via integration with Ivanti Cloud Secure and Ivanti Policy Secure)■ Assess and remediate end user devices prior to authentication with easy policy definitions■ Windows (Desktop & Mobile), MacOS, Apple iOS, and Android

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

3

Features and Benefits (continued)
Flexible launch options (standalone client,browser-based launch)

Supports Cloud Secure Solution

Pre-configuration options (Windows and Mac
only)■ Users can easily launch SSL VPN via their Web browser, or directly from their desktop■ Auto Connect feature allows devices to automatically connect to VPN, either at the time when the machine starts or user logs on■ VPN on demand feature leverages OS capabilities for auto triggering VPN, seamlessly in the background, when an approved application needs corporate access■ Blend cloud and data center access into a seamless user experience for next generation workers■ Ability to add compliance rules for hybrid DC access■ Administrators can preconfigure a deployment with a list of gateways for end users to choose from
■ Adaptive Authentication using dynamic, multi-factor authentication using several user attributes.
■ Administrators can deploy Ivanti for remote user authentication using a wide array of authentication mechanisms, including biometric authentication support
with Windows Hello for Business, hardware token, smart card, soft token, smart card, soft token, Google Authenticator, one-time passwords and certificate

Authentication Options

authentication.

■ Administrators can choose to send AAA traffic via a desired interface (internal / external / management), for delegating user authentication to an Identity Provider.
■ OAuth/OpenID Connect support allows integration with any standard OpenID Providers like Google, OKTA, Azure AD, etc. while connecting to Connect Secure(acting as Relying Party)
VMware Horizon and Citrix XenApp/
XenDesktop VPN■ Ivanti supports the latest versions of VMware and Citrix.

Granular SSL Cipher Configuration■ Enables the administrator to select specific ciphers over those pre-configured for highly secure compliance.

REST API■ A comprehensive REST-based API for programmatic access to the appliances.

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

4Rich Access Privilege Management Capabilities
FeatureDynamic role mapping with custom
expressions

Description

Benefit■ Combines network, device, and session attributes to determine which types■ Enables the administrator to provision by purpose for each unique session.

of access are allowed.

■ A dynamic combination of attributes on a per- session basis can be used tomake the role mapping decision.

■ Through MDM integration, fetch device attributes and apply policy decisions
appropriately before granting access■ Seamlessly provision SSL VPN user sessions into NAC sessions upon login.
■ Since session data is shared between the Ivanti Appliances for SSL VPN and
SSL VPN federation with NAC (Ivanti

NAC, users need to authenticate only one time to get access in these types

Policy Secure)of environments.

■ Provides users, whether remote or local, seamless access with a single login
to corporate resources that are protected by access control policies.

■ Simplifies the end user experience.

■ Policy and access decisions can also be controlled by device attributes
discovered by NAC Profiler
Support for RSA Authentication Manager

Standards based built-in Time- based
One-Time Password (TOTP)

Multiple sessions per user

■ RSA Authentications Manager 8.1 enables Risk Based Authentication.

■ Offer another authentication layer option via email account.
■ Leverage ubiquitous smart phones to roll out a cost-effective and self-■ Enables multi-factor authentication using smartphones

serve two-factor authentication mechanism, where one-time passcodes are
generated by a mobile app. Implemented based on RFC6238■ Enables remote users to have multiple authenticated sessions open at■ Allows remote users to launch multiple remote access sessions.

the same time, such as when accessing VPN from a laptop and from asmartphone simultaneously.

User record synchronization■ Supports synchronization of user records such as user bookmarks acrossdifferent Ivanti Appliances.

including Apple iPhone and iPad, Google Android, and Nokia Symbian
devices.

Integration with strong authentication andidentity and access management (IAM)
platforms■ Ability to support SecurID, Security Assertion Markup Language■ (SAML) including standards based SAML v2.0 support, and public key
infrastructure (PKI)/digital certificates.

to another and therefore need to connect to different Ivanti Appliances
running Ivanti Connect Secure.

■ Provides predefined HTML pages that are customized for mobile devices,
Mobile-friendly SSL VPN login pages■ Ensures a consistent experience for users who often travel from one region■ Provides mobile device users with a simplified and enhanced user
experience and webpages customized for their device types.

■ Leverages existing corporate authentication methods to simplify
administration.

■ OAuth/OpenID Connect Support

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

5

Ease of Administration
FeatureMobile Device Management (MDM)
integration

Description■ Enables consolidated reporting and dashboards for simplified
management.

Benefit■ Extend MDM investments to gain comprehensive endpoint visibility and support
additional mobile use cases.

■ Leverages MDM attributes for more intelligent and centralized policy
creation.

■ Facilitates transparent “no touch” MDM-based deployment of Ivanti
Clients to iOS and Android devices.
Secure Browser

Bridge Certification Authority (BCA)
support■ A mobile browser for securely accessing corporate web applications,■ IT does not have to worry about deploying and managing VPN on mobile devices.

without the need of installing / managing / launching a VPN client.

End user does not have to worry about launching VPN. Seamless end user
experience where a user launches browser and accesses his resources, as hewould normally expect to.

■ Supports federated PKI deployments with client certificate
authentication. Bridge CA is a PKI extension (as specified in RFC 5280)
to cross-certify client certificates that are issued by different trust
anchors (Root CAs).

■ Enables customers who use advanced PKI deployments to deploy the IvantiAppliances to perform strict standards-compliant certificate validation—before
allowing data and applications to be shared between organizations and users.

■ Also, enables customers to configure policy extensions in the admin UI,
to be enforced during certificate validation.
Multiple hostname support■ Ability to host different virtual extranet websites from a single
appliance.

■ Saves the cost of incremental servers.
■ Provides a transparent user experience with differentiated entry URLs
■ Eases management overhead.

Intuitive Dashboard Design■ View and control enterprise access to the data center and cloud fromone console.

Customizable user interface■ Creation of completely customized sign-on pages.

■ Quick access to dynamic information and reports.
■ Customizable layouts via drag and drop functionality.
■ Provides an individualized look for specified roles, streamlining the user
experience.

Application Launcher (AL)■

Enhanced support for non-JAVA based browsers.

■ Support for latest generation browsers (Apple, Microsoft, Google, Firefox, etc)that do not support Java and Active X.

Neurons for Secure Access■ Optional centralized management, analytics and reporting platform for
Ivanti Connect Secure Deployments■ Full Configuration management, one-click upgrades, centralized
logging, custom reporting and troubleshooting■ “Lift and shift” configurations through configuration templates and■ Centralized configuration and gateway lifestyle management saves time andmoney■ Enhanced behavioral analytics identify and automatically act on risky user
behavior before it becomes a problem■ Simplify management of multi-node or global deployments

multi-node configuration management
Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

6

Flexible Single Sign-On (SSO) Capabilities
FeatureSAML single sign- on for cloud and Web
applications access

Description

Benefit■ SAML 2.0-based SSO to a variety of Web applications, including many of today’s
most popular Software as a Service (SaaS) applications such as Salesforce.com■ Single sign-on to a user’s Web and cloud-based applications, simplifying
the user’s connectivity experience.

and Google Apps.

■ Includes SSO functionality, even when connecting via a Ivanti Connect Secure
Layer 3 VPN tunnel, which is unique in the industry.

■ Ivanti Connect Secure supports deployments as both an SAML Identity Provider(IdP) and as a SAML Service Provider (SP).
Kerberos Constrained Delegation■ Support for Kerberos Constrained Delegation protocol.

■ Eliminates the need for companies to manage static passwords resulting■ When a user logs into Ivanti Connect Secure with a credential that cannot be

in reduced administration time and costs.

proxied through to the backend server, the gateway will retrieve a Kerberos ticket
on behalf of the user from the Active Directory infrastructure.

■ The ticket will be cached on Ivanti Connect Secure throughout the session.
■ When the user accesses Kerberos-protected applications, the Appliance will
use the cached Kerberos credentials to log the user into the application without
prompting for a password.
Kerberos SSO and NT LAN Manager(NTLMv2) support
Password management integration■ Ivanti Connect Secure will automatically authenticate remote users via Kerberosor NTLMv2 using user credentials.

■ Simplifies the user experience by eliminating users entering credentials
multiple times to access different applications.

■ Standards-based interface for extensive integration with password policies in
directory stores (LDAP, AD, and others).

■ Leverages existing servers to authenticate users.
■ Users can manage their passwords directly through the Ivanti Connect
Secure interface.

Web-based SSO basic authentication and
NTLM
Web-based SSO forms-based, header
variable- based, SAML- based
OAuth/OpenID Connect■ Allows users to access other applications or resources that are protected byanother access management system without reentering login credentials.

■ Ability to pass user name, credentials, and other customer defined attributes to■ Alleviates the need for users to enter and maintain multiple sets ofcredentials for web-based and Microsoft applications.

■ Enhances user productivity and provides a customized experience.

the authentication forms of other products and as header variables.

■ OAuth/OpenID Connect support allows integration with any standard OpenID■ Integrate into existing OAuth deployments for easy user ID federation

Providers like Google, OKTA, Azure AD, etc. while connecting to Connect Secure(acting as Relying Party)

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

7

Provision by Purpose
FeatureIvanti Secure Access Client

Description■ Single, integrated, remote access client that can also provide LAN access control,and dynamic VPN features to remote users.

Benefit■ Ivanti Secure Access Client replaces the need to deploy and maintain multiple,
separate clients for different functionalities such as VPN and LAN access control. The
end user simply “clicks and connects” the connection they need.

Clientless core Web access■ Secure access to many different types of web- based applications, including
many of today’s most common Web applications such as Outlook Web Access,
SharePoint, and many others.

■ Provides the most easily accessible form of application and resource access from avariety of end user devices with extremely granular security control options.

■ Completely clientless approach using only a web browser.

■ Remote Desktop Protocol (RDP) access in Ivanti Connect Secure can be delivered
over HTML5, via third-party RDP, through a WebSockets translator such as
Ericom.
IPsec/IKEv2 support formobile devices■ Allows remote users to connect from any mobile device that supports Internet Key
Exchange (IKEv2) VPN connectivity.

■ Full L3 VPN support for new devices that support IKEv2 but for which a client is not
yet available.

■ Administrator can enable strict certificate or username/password authentication
for access via IPsec/IKEv2.
Virtual Desktop Infrastructure(VDI) support■ Allows interoperability with VMware View Manager to enable administrators to
deploy virtual desktops with Ivanti Connect Secure.

■ Provides remote users seamless access to their virtual desktops hosted on VMware
servers■ Provides dynamic delivery of the VMware View client, including dynamic client
fallback options, to allow users to connect to their virtual desktops.
Zero Touch Provisioning■ Deploy PCS using OpenStack centralized orchestration.
■ Obtain initial configuration from local DHCP server without manual data entry.
■ Configure and manage via REST API.

ActiveSync Proxy■ Provides secure access connectivity (strong encryption + certificate■ Enables customers to allow a large number of users (including employees,
contractors, and partners) to access corporate resources through mobile phones via
ActiveSync.

■ Enhances user productivity and provides a customized experience.

authentication) from mobile devices (such as iOS or Android devices) to the
Exchange Server via proxy, with no client software installation. Enables up to
5,000 simultaneous sessions.
Secure Application Manager(SAM)■ A lightweight application download enabling access to client/server applications.

■ Enables access to client/server applications using just a Web browser. Also provides
native access to terminal server applications without the need for a preinstalled client.

Ivanti Connect Secure: Secure Access VPN for the Everywhere Workplace | DATA SHEET

8

About Ivanti
Ivanti makes the Everywhere Workplace possible. In
the Everywhere Workplace, employees use myriad
devices to access IT networks, applications and data
to stay productive as they work from anywhere. The
Ivanti automation platform connects the company’s
industry-leading unified endpoint management, zerotrust security and enterprise service management
solutions, providing a single pane of glass forenterprises to self-heal and self-secure devices, andself-service end users. More than 40,000 customers,
including 96 of the Fortune 100, have chosen Ivanti todiscover, manage, secure and service their IT assets
from cloud to edge, and deliver excellent end user
experiences for employees, wherever and however
they work. For more information, visit ivanti.com

Copyright © 2022, Ivanti. All rights reserved. IVI-2516 09/22 MM/DH

ivanti.com
1 800 982 2130
sales@ivanti.com