Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 204 / 861

204 Defining your security environment
Controlling full application inspection of traffic
About direct access connections
The security gateway lets you reveal inside addresses to an outside server, giving the appearance of
direct access. For outbound connections, direct access reveals information about your private network
to people on the Internet. Do not set up direct access for any service until you consider the security
implications.
Note: Although direct access carries a security risk, it makes using H.323 applications easier. If you use
an address transform, it is not necessary to maintain an alias file on the security gateway or enter the
IP address of the security gateway as the H.323 gateway in NetMeeting.
Configuring access for Internet-based communications
Configuring access for H.323 traffic lets users communicate through the security gateway on group-
based collaborative efforts through such applications as Microsoft NetMeeting. Prior to configuring
access, you should determine what level of access is to be granted, and who should have that access.
Additionally, you must decide whether or not the security gateway will hide the group collaboration
server’s identity to prevent it from being attacked directly.
Prerequisites
None.
Configure access for Internet-based communications
To configure access for Internet-based communications, you must do the following:
■
Ensure that the H.323 proxy is enabled
■
Create an H.323 service group
■
Create an allow rule for H.323
■
Create an alias file
To ensure the H.323 proxy is enabled
1 In the SGMI, in the left pane, under Assets, click Proxies .
2 In the right pane, in the Proxies table, click H.323 , and then click Properties .
3
In the Proxy Properties dialog box, on the General tab, to enable the H.323 proxy, click Enable .
4 In the Caption text box, type a brief description of the CIFS proxy.
5
Optionally, on the Description tab, type a more detailed description than you typed in the Caption
text box.
6 Click OK .
To create an H.323 service group
1
In the SGMI, in the left pane, under Assets, click Protocols .
2 In the right pane, on the Service Groups tab, click New .
3
In the Service Group Properties dialog box, on the General tab, in the Service Group name text box,
type a name for this service group.
4 On the Protocols tab, to display a list of available protocols to add to this service group, click Add .
5 In the Select Protocols dialog box, click h323 .
6 Click OK .
7
Optionally, on the Description tab, type a more detailed description than you typed in the Caption
text box.