Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 120 / 861

120 Establishing your network
Deployment scenarios
Advanced enclave deployment
It may be necessary to manage an enclave security gateway that is protected by a second security
gateway. This scenario presents a unique challenge; each security gateway listens for management
requests and must understand whether the request was truly directed to itself, or to another security
gateway that it protects.
Figure 5-5 shows an example of an enclave network.
Figure 5-5
Managed security gateway through another security gateway
The management host on which the SGMI is run (10.1.1.1) can manage both security gateways if the
first security gateway (172.16.0.2) is configured properly.
The problem that this scenario presents is a function of how the security gateway handles requests.
Regardless of the destination, all requests that go through the security gateway initially have their
destination address changed to that of the security gateway to force them up the stack for processing.
If the request is ultimately for another computer (host client or server), and the connection request
meets all requirements, a new connection is created to the destination address.
Now, because the packet’s destination IP address has been temporarily changed to the security
gateway’s IP address (the destination port is still 2456) and the security gateway has a process listening
on port 2456, the security gateway intercepts the packet as a request to manage locally. Management
requests are caught by the management server prior to when the security gateway creates the new
connection. Therefore, without modification, any management request sent to or through the security
gateway is always caught by the first security gateway encountered.
External perimeter security gateway
Router
SGMI
SGMI
Hub
Hub
192.168.2.5 192.168.2.6 192.168.2.7
192.168.2.8
192.168.0.10
192.168.2.1
192.168.0.15
192.168.0.5 192.168.0.6 192.168.0.7 192.168.0.8
192.168.0.1
172.16.0.2
172.16.0.1
10.1.1.1
Enclave security gateway