Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual, Page: 162 / 861

162 Defining your security environment
Defining traffic endpoints with network entities
■
“Creating a packet filter” on page 290
■
“Configuring tunnels” on page 385
Defining a network or subnet with a subnet entity
A subnet entity is a group of hosts defined by a network address and netmask. You typically use subnet
entities to define whole networks, or subnetworks within a particular IP address range. The group of
hosts can sit either on the protected network, or on the public network.
You can create subnet entities to define a range of IP addresses that serve as the source or destination
of traffic in a rule, removing the requirement to create a separate access rule for each host. You can use
subnet entities to specify the source and destination of traffic controlled by packet filters and address
transforms, as well as the real or NAT subnet in a NAT pool. You can also use a subnet entity as the
local or remote endpoint in VPN tunnels.
By default, the security gateway ships with a subnet entity called Universe. The Universe subnet entity
has an IP address of 0.0.0.0 and a subnet mask of /0. The Universe subnet entity is similar to a wildcard
that defines the set of all valid IP addresses. You can use this entity in rules that apply to any IP
address, but you should only use it in these rules when any host can have access; do not use this entity
in a rule when you want to restrict access to only a defined set of hosts.
Prerequisites
None.
To define a network or subnet with a subnet entity
1 In the SGMI, in the left pane, under Assets, click Network .
2 In the right pane, on the Network Entities tab, click New > Subnet Network Entity .
3 In the Subnet Network Entity Properties dialog box, on the General tab, do the following:
4 Optionally, on the Spoof Protection tab, apply spoof protection to the subnet network entity by
specifying which interfaces are associated with it.
In the Available list, select one or more interfaces. To associate them with the subnet network
entity, click the right-arrow >> button, which moves them to the Selected list.
To remove an association, in the Selected list, select an interface and click the left-arrow << button
to move it to the Available list.
5 Optionally, on the Description tab, type a more detailed description than you typed in the Caption
text box.
6 Click OK .
7 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
8 Use the subnet network entity for any of the following:
■
To specify the source or destination of traffic in rules and packet filters.
■
To specify the local or remote endpoint in an IPsec static or gateway-to-gateway VPN tunnel.
Entity name Type a name for the subnet entity.
Network address Type the IP address of the subnet.
Netmask Type the subnet mask.
Caption Type a brief description of the subnet entity.