Samsung Ubigate iBG2016, Configuration Manual

Page: 286 / 744

CHAPTER 3. Firewall NAT
236
© SAMSUNG Electronics Co., Ltd.
Application Level Gateways
For packets to pass through firewall a corresponding allow policy will be
required. If there is no policy, then the packet will be dropped by firewall.
But some applications(for ex: FTP, games) open connections dynamically
based on respective application parameter. It is a security threat to add firewall
rules to pre-open such port numbers. Intelligence can be added to parse
packets for such application and open appropriate dynamic connections.
This is referred as Application Level Gateway(ALG), wherein the firewall,
acting at routing level can parse application’s data. With this, firewall can
allow packets for many applications(that require some special processing) and
at the same time not compromising on firewall.
All the ALGs are enabled by default and there are CLI commands to enable or
disable ALGs administratively.
Network Address Translation
NAT functionality in firewall conceals network addresses avoiding this
disclosure as public information. This functionality also provides solutions for
IP address depletion issue, by allowing multiple hosts to share limited public
IP addresses. Firewall has reverse NAT capabilities, which enables users to
host various Internet services in the private IP address space, such as web
servers, e-mail servers, Real Audio servers, and others.
Firewall has an inbuilt functionality for providing Network Address
Translation. Firewall supports configuration of NAT records, by which NAT IP
addresses can be configured before attaching them to policies. NAT database
maintains a list of such NAT IP addresses and it can be eventually attached to
access policies.
There are the 3 types of NAT that can be configured with the NAT database:
many-to-one(PAT), one-to-one(static) and many-to-many(dynamic).
The NAT records created in the NAT databases would eventually be attached
to the access policy database, based on the access policy type(whether it is out
bound or in bound). The NAT record would eventually be used in one of the
following category.
y
Many-to-one regular NAT(NAT record attached to out bound policy)
y
One-to-one regular NAT(NAT record attached to out bound policy)