Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 160 / 861

160 Defining your security environment
Defining traffic endpoints with network entities
When you define rules and filters, you specify the following:
Defining traffic endpoints with network entities
A network entity is a host or group of hosts that reside locally on the protected network, or on the
public network external to the security gateway. Network entities include host, subnet, domain name,
security gateway, group, and VPN security entities. You can define network entities before you create
the rules that use them or while you are creating the rules.
Network entities are building blocks, each providing a single endpoint or network definition. Network
entities also provide flexibility to your configuration by letting you change host attributes (the IP
address of the mail server, for example) without having to change associated rules. Rules that use the
network entity are updated automatically when you make a change.
You use network entities to identify specific network resources when you create the rules and packet
filters that control traffic through the security gateway. In addition, you specify network entities when
you use to an address transform to control the IP address that appears as the source or destination of a
connection, and when you create a NAT pool addressing scheme for a connection.
This section describes the tasks associated with defining traffic endpoints with network entities:
■
Configuring a single computer with a host network entity
■
Defining a network or subnet with a subnet entity
■
Defining a registered domain with a domain name network entity
■
Creating security gateway network entities for use in tunnels
■
Creating a network entity group for rules that apply to multiple entities
■
Defining an entity and security gateway pair with a VPN security entity
Configuring a single computer with a host network entity
A host network entity defines a single host located either on the network protected by the security
gateway or on the public network outside of the security gateway. You can specify a host by using its IP
address in dotted quad format (for instance, 192.168.1.3 or 205.14.76.4) or by its DNS resolvable name.
As part of the security planning process, you should identify hosts that have specialized uses in your
network, such as:
■
Mail server
■
A World Wide Web server
Network entities The sources and destinations of traffic such as internal and external hosts, subnets, and
mail servers.
Network interfaces The security gateway interfaces through which the traffic passes. When you specify
interfaces, you specify the logical names that are associated with the physical interfaces
of the security gateway.
Service groups Logical containers used to group protocols so that you can use them together in a rule. By
modifying the protocols within a service group that is used by a rule, you can configure
specific behaviors for that rule. Rules are also affected by the ways you configure the
proxies that provide protocol-specific security checks.
Authentication schemes Optionally, a rule can include an internal or external authentication scheme for
additional security when users access the security gateway. When a rule includes
authentication, you specify the users and user groups who must authenticate, and users
and groups that are excluded from the rule.