Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 281 / 861

280 Controlling traffic at the security gateway
Understanding and using rules
The following are examples of advanced services that can be used in rules:
4
Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“Rule Properties—Advanced Services tab” on page 594
■
“Enabling support for traceroute” on page 241
Rule examples
The following procedures describe how to create rules that are often required in an enterprise security
environment:
■
Using the Universe network entity in rules
■
Granting internal users access to public services
■
Providing public access to a server on a service network
Using the Universe network entity in rules
The security gateway contains a network entity called Universe that is created by default. The
Universe entity is used like a wildcard and specifies the set of all possible addresses. Its associated IP
address is 0.0.0.0.
The Universe entity is automatically transparent for each of the interfaces flagged as internal during
the security gateway setup. All transparent entities can be accessed directly by systems connecting to
that interface.
The Universe entity is a permanent part of the security gateway configuration. You cannot delete,
change, or rename it.
ping.preserve.ttl Pass traceroute through the security gateway.
The rule must use the ping protocol.
http.remove-
header.server Removes the server information from HTTP response packets that are sent back
through the security gateway.
This lets you conceal information about your Web server behind your security gateway.
The rule must use the HTTP protocol.
http.noproxy Prevents the security gateway from being used as a proxy.
Use this advanced parameter if you are using service redirect on the security gateway
(for example, HTTP connecting to your Web server) and you do not want to allow users
connecting through the security gateway to use it as a proxy. This denies all HTTP
proxied connections.
The rule must use the Web service group.
smtp.strip_received Suppresses received lines in antispam scanning.
The presence of this entry in a rule causes all received lines to be suppressed. This is
somewhat risky because it masks the true source of a message. If someone is using
your site as a spam relay, then you lose all trace information. For this reason, this entry
is discouraged unless absolutely necessary.