Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 295 / 861

294 Controlling traffic at the security gateway
Using packet filters to allow or deny traffic
Prerequisites
Complete the following tasks before beginning this procedure:
■
“Creating a packet filter” on page 290
■
“Creating packet filter groups” on page 291
To apply packet filters to individual network interfaces
1 In the SGMI, in the left pane, under Assets, click Network .
2 In the right pane, on the Network Interfaces tab, select the logical interface to which you want to
apply a packet filter.
3 Click Properties .
4 On the Packet Filters tab, do the following:
5 Click OK .
6 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“Network Interface Properties—Packet Filters tab” on page 666
Using packet filters as forwarding filters
A forwarding filter is a filter or filter group that you configure, and then apply to all incoming and
outgoing packets arriving on all network interfaces. If the packet matches the chosen filter, it is not
sent up the protocol stack for authentication; instead it passes through the security gateway,
bypassing normal security checking.
This feature is useful in cases when you want to allow a service through the security gateway that
cannot be handled by one of the proxies. You can only assign one filter on the security gateway as the
forwarding filter. It applies to all configured network interfaces. A forwarding filter provides no
security over the Internet. Forwarding filters have no timeout restrictions placed on open connections.
No logging is provided with a forwarding filter. You can also use a forwarding filter to pass DNS traffic.
Note: A forwarding filter provides no security for your internal network. Although not required, you
should stop and restart the security gateway when introducing filters into your configuration to avoid
unexpected or undesired behavior. Filters can not be used between public class and private class IP
addresses.
Prerequisites
Complete the following tasks before beginning this procedure:
■
“Creating a packet filter” on page 290
■
“Creating packet filter groups” on page 291
Input filter Select a filter to apply to incoming traffic on the interface.
Output filter Select a filter to apply to outgoing traffic on the interface.