3
Chapter
54
Addressing
Interfaces
An
Interface
is
an
important
logical
building
block
in
the
SEG.
All
network
traffic
that
transits
through,
originates
from
or
is
terminated
in
a
security
gateway,
does
so
through
one
or
more
interfaces.
Source and destination interfaces
An
interface
can
be
thought
of
as
a
doorway
through
which
network
traffic
passes
to
or
from
the
SEG.
An
SEG
interface
has
one
of
two
functions:
•
Source
interface:
When
traffic
arrives
through
an
interface,
that
interface
is
referred
to
in
the
SEG
as
the
source
interface
(also
sometimes
known
as
the
receiving
or
incoming
interface).
•
Destination
interface:
When
traffic
leaves
after
being
checked
against
the
SEG’s
security
policies,
the
interface
used
to
send
the
traffic
is
referred
to
in
the
SEG
as
the
destination
interface
(also
sometimes
known
as
the
sending
interface).
All
traffic
passing
through
the
SEG
has
both
a
source
and
destination
interface.
As
explained
in
more
depth
later,
the
special
logical
interface
core
is
used
when
the
SEG
itself
is
the
source
or
destination
for
traffic.
Interface types
The
SEG
supports
a
number
of
interface
types,
which
can
be
divided
into
the
following
groups:
•
Ethernet
interfaces:
Each
Ethernet
interface
represents
a
physical
Ethernet
port
on
an
SEG
‐
based
product.
All
network
traffic
that
originates
from
or
enters
a
security
gateway
will
pass
through
one
of
the
physical
interfaces.
The
SEG
currently
supports
Ethernet
as
the
only
physical
interface
type.
•
Tunnel
interfaces:
Tunnel
interfaces
are
used
when
network
traffic
is
being
tunneled
between
the
system
and
another
tunnel
endpoint
in
the
network
before
it
gets
routed
to
its
final
destination.
An
example
of
a
tunnel
interface
is
an
IPsec
tunnel
object,
which
is
described
further
in
IPsec
components
on
page
117
.
To
accomplish
tunneling,
additional
headers
are
added
to
the
traffic
that
is
to
be
tunneled.
Furthermore,
various
transformations
can
be
applied
to
the
network
traffic
depending
on
the
type
of
tunnel
interface.
For
example,
when
routing
traffic
over
an
IPsec
interface,
the
payload
is
usually
encrypted
to
achieve
confidentiality.
