Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 365 / 861

364 Preventing attacks
Making your network more secure by hiding addresses
■
“Dynamic NAT Pool Properties—General tab” on page 670
■
“Dynamic NAT Pool Properties—Description tab” on page 671
■
“Static NAT Pool Properties—General tab” on page 671
■
“Static NAT Pool Properties—Description tab” on page 672
Redirecting connections to unpublished addresses with service redirections
Service redirection involves defining a virtual IP address or security gateway address on which a
service is available and redirecting connections for that address to a non-published destination. The
security gateway automatically redirects connection attempts destined for one host and port to a
different host and port. The virtual IP address must not be associated with any host on any computer in
your network. Access attempts to that address and service must be directed to the security gateway’s
interface, otherwise the host does not see the request.
If you are configuring a service redirection for Common Internet File System (CIFS) service, you must
have an entry for both the client and the target computers. The host entry for the target computer
must be the actual IP address of the security gateway and not the virtual IP address. This information
is stored in the hosts.pub file.
When to use service redirections
Use service redirection to let outside users access information on servers behind the security gateway
without disclosing the security gateway’s addresses. If the virtual address is on the same subnet as the
security gateway’s real address, it automatically routes the packets using the address resolution
protocol (ARP). If the virtual address is not on the same subnet, add a static route on your Internet
router.
You can use service redirects as a way to do manual load balancing. For example, you could have two
RealAudio servers, and for subnet 1 redirect all the RealAudio traffic to that first server, and for subnet
2, redirect all that RealAudio traffic to the second server.
Note: If you want to use redirected services with clientless VPN for internal mail and Web servers,
there must be two published IP addresses or the validation errors will occur. If clientless VPN is
enabled with the same external IP address, the security gateway does not know where to direct the
traffic: the clientless VPN Web server or mail server, or to the internal servers to which the service
redirect points.
Configuring redirected services
For Simple Mail Transfer Protocol (SMTP) services, the target of the SMTP connection is the security
gateway. If you are in a clustered environment, the security gateway actually has two addresses: the
address of the interface and the virtual IP address (VIP), which can move between members. If you
configured a redirected service in a standalone environment, you must disable the redirected service
for SMTP, configure the clustered environment, and then point the target of the SMTP to the VIP.
Service redirections require a rule that allows the service to be passed. They are handled by proxies
and are subject to authentication rules and logging.
Note: To redirect a custom service, create a service group containing that service and use it in the rule.
Prerequisites
None.