Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 276 / 861

275 Controlling traffic at the security gateway
Understanding and using rules
■
“Adding authentication to rules” on page 276
■
“Using content security checks with rules” on page 278
■
“Using advanced service parameters for nonstandard services” on page 279
Enforcing time-based access restrictions
You can restrict when trusted users can gain access to your corporate resources. For example, you may
have an administrator available only during normal working hours, and want to limit connections to
that time period.
Prerequisites
Complete the following task before beginning the procedure:
■
“Creating basic rules” on page 273
To enforce time-based access restrictions
1
In the SGMI, in the left pane, under Policy, click Firewall .
2 In the right pane, on the Rules tab, highlight the rule to which you want to apply a time restriction,
and then click
Properties .
3 In the Rule Properties dialog box, on the General tab, in the Time range drop-down list, select the
time range period or time range group that applies to the rule.
Optionally, use the New or Properties button to create a new time range period or time range group,
or to edit a selected entry.
4 Click OK .
5 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“Rule Properties—General tab” on page 589
Applying alert thresholds to rules
For some rules, you may want to generate alert level log messages when specific levels of traffic occur.
You can do this by applying alert thresholds to the rule. Alert thresholds work according to the number
of connections or connection attempts made over a given period of time.
You can then configure notification methods to be used when alert level messages occur. Notifications
alert administrators by email, pager, or SNMP message when events requiring attention occur. Alerts
can also cause an application to be run or blacklist traffic for a specified amount of time.
If you expect a rule to experience a high level of activity, for example rules using HTTP or SMTP, you
may not want to enable alert thresholds.
Prerequisites
Complete the following task before beginning the procedure:
■
“Creating basic rules” on page 273