Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 19 / 861

19 Introducing the security gateway
Key components of the security gateway
The security gateway responds to detected intrusions using signatures to detect and prevent numerous
attacks. Symantec LiveUpdate technology ensures that new signatures are downloaded to address new
threats well before they become security issues.
Content filtering
The security gateway offers a variety of tools for managing Web access for both incoming and
outgoing traffic. You can customize HTTP and NNTP access to and from designated entities within
your network using the content management tools that are available through the appliance.
You can filter content based on the following criteria:
High availability/load balancing
Symantec security gateways include configurable clustering technology that ensures high availability
(HA) for your security gateways and increases performance through load balancing (LB).
To increase availability, you can cluster Symantec’s security gateways into groups of from two to eight
security gateways. When two or more security gateways are clustered, the failure of one security
gateway causes another security gateway to automatically pick up the workload of the failed cluster
member.
Security gateways in a cluster can also share the traffic load to maintain high throughput. With load
balancing configured, the cluster spreads out connections more evenly over several security gateways
instead of always sending requests to one computer. This makes more efficient use of your network
resources.
LiveUpdate support
The Symantec Gateway Security 5000 Series v3.0 software incorporates patented LiveUpdate
technology to keep your security gateway components up-to-date.
HTTP inclusion/
exclusion lists Configure rules for the HTTP proxy based on inclusion and exclusion lists. This includes
URL address, URL pattern matching, MIME type, and file extensions. Configuring the
security gateway to provide filtering based on these parameters conserves resources and
increases overall efficiency.
Subject matter of
Web content To provide content enforcement based on subject matter, you can create content profiles
that specify certain types of content for which access should be denied. You can create any
number of content profiles with different levels of content filtering and apply the
appropriate content profile when you configure a rule that contains HTTP. By specifying a
content profile in a rule, you restrict access to selected Web content for those users to which
the rule applies.
To provide comprehensive filtering of Web content based on subject matter, the security
gateway uses a combination of the following:
■
Predefined content categories
These are lists of URLs that contain related subject matter. Thirty-one pre-populated
content categories, which include subject matter ranging from pornography, crime,
and violence to news and humor, are currently provided with the security gateway.
Each content category has an associated DDR dictionary.
■
Dynamic Document Review (DDR) dictionaries
Predefined DDR dictionaries contain key words and phrases, in multiple languages.
DDR dictionaries provide real-time analysis of Web content. DDR dictionaries are used
in conjunction with Content Categories to provide comprehensive subject matter
filtering.
Newsgroup profiles
and subject matter of
newsgroups Newsgroup profiles let you can control access to newsgroups through the security gateway.
You do this by defining each newsgroup that you want to permit or deny access to, adding it
to a newsgroup profile, and then including that profile in a rule.