Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 126 / 861

126 Establishing your network
Defining security gateway routing
You can add specific routing information manually to the security gateway’s routing table. Each
routing entry identifies a specific network or subnet destination. Each entry in the table contains:
Static routes are used for network or subnet designations only. IP hosts automatically generate a direct
route to the network or subnet based on the interface’s assigned IP address.
One of the limitations of a static routing environment is that you must manually configure routing
information. In smaller networks, manual configuration is not a major administrative task and is an
acceptable alternative to configuring a more complex routing environment. However, as networks
increase in size, manual configuration is time-consuming and error-prone.
See “Configuring static routes” on page 128.
Understanding dynamic routing
To address some of the inherent limitations of static route configuration, administrators can use the
security gateway’s dynamic routing capability. Dynamic routing significantly reduces the likelihood of
an errant entry in a routing table by letting the routing daemon add the entry electronically. It also
removes some of the responsibility of monitoring the network.
Dynamic routing is achieved by configuring all of your network routers to speak the same protocol. On
corporate networks, it is common to find an Interior Gateway Protocol (IGP) deployed as a practical
means of dynamic route discovery.
This section discusses two possible dynamic routing protocol choices: Routing Information Protocol
Version 2 (RIP-2) and Open Shortest Path First (OSPF) Version 2.
See “Configuring dynamic routing” on page 129.
Routing Information Protocol Version 2 (RIP-2)
As defined in RFC 2453, RIP-2 is a UDP-based dynamic routing protocol based on the Bellman-Ford
(distance vector) algorithm and is an enhancement to the RIP protocol discussed in RFC 1058. The term
distance vector means that messages sent by RIP-2 contain a vector of distances (hop counts). The cost
assigned to a route between two networks is calculated by counting the number of hops between the
two networks. If there are multiple routes to the same destination, RIP-2 chooses the route with the
smallest hop count, and ignores the other paths.
RIP-2 communicates using UDP port 520 and is designed to work with moderate size networks using
the same or similar technology. RIP-2 has very little bandwidth overhead when compared to OSPF.
RIP-2 supports multicasting in addition to broadcasting, which can reduce the load on hosts that are
not listening for RIP-2 messages. However, the protocol is limited to networks whose longest path is 15
hops and uses fixed metrics to compare alternative routes. Because the metrics are fixed, this protocol
is not appropriate for situations where routes need to be chosen based on real-time parameters such as
load or reliability.
Note: By default, the security gateway does not allow traffic to UDP port 520. You must configure it to
do so by adding or modifying the advanced option portcontrol.enable_udp_ports.
See “Configuring RIP support” on page 129.
Destination IP address Network, subnet, or host.
Netmask This is generally an 8-bit, 16-bit, or 24-bit value depending on the destination. For
example, 255.0.0.0 is used as an 8-bit mask for a class A network, and 255.255.255.255 is
used as a 32-bit mask for a host.
Gateway address The next hop IP address.