Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 294 / 861

293 Controlling traffic at the security gateway
Using packet filters to allow or deny traffic
Applying packet filters to a VPN tunnel
When imposing a packet filter on a VPN tunnel, the entities that you create as endpoints do not have to
be the same for both the packet filter and the tunnel. For example, your tunnel endpoints can be the
Client VPN user and the secure subnet. The packet filter entities could be the Client VPN user and the
destination server (which is part of the secure subnet). You apply the packet filter to the VPN policy
that is used in the tunnel.
Note: When you apply a filter to a VPN tunnel, the security gateway must be restarted for this change
to take effect.
Prerequisites
Complete the following tasks before beginning this procedure:
■
“Creating a packet filter” on page 290
■
“Creating packet filter groups” on page 291
To apply a packet filter to a VPN tunnel
1
In the SGMI, in the left pane, under Policy, click VPN .
2 On the VPN Policies tab, select the VPN policy to which you want to apply a packet filter, and then
click
Properties .
3 In the Properties dialog box, on the General tab, in the Filter applied drop-down list, select the
packet filter you want to apply.
4 Click OK .
5 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“IPsec static key policy Properties—General tab” on page 614
■
“IPsec IKE policy Properties—General tab” on page 609
Applying packet filters to individual network interfaces
The security gateway allows packet filtering on any of its logical network interfaces. Each interface can
have an input filter, an output filter, or both.
Input filters affect packets coming into the interface. The input filter is the first check performed on an
incoming packet. If the packets do not satisfy the filter, they are dropped before the proxies or local
applications see them.
An output filter affects packets going out of the interface. The output filter is the last check performed
on an outgoing packet. If the packets do not satisfy the filter, they are dropped. When the security
gateway drops a packet due to an output filter, no log message is recorded, and the input filter logs the
packet dropped.