Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 360 / 861

359 Preventing attacks
Making your network more secure by hiding addresses
Making your network more secure by hiding addresses
The use of address transforms, network address translation (NAT) pools, redirected services, and
creating virtual clients can make your network more secure.
Use an address transform when you want to replace client source addresses. A NAT pool is a set of
addresses that are designated as replacement addresses for client IP addresses. You use NAT pool
addressing to present a routable address to the security gateway. This is commonly done to translate
packets on non-routable networks to routable packets for travel across public networks, or to hide
external source packets and make them appear to be internal source packets. Service redirection
involves defining a virtual IP address or security gateway address on which a service is available and
redirecting connections for that address to a non-published destination. The security gateway
automatically redirects connection attempts destined for one host and port to a different host and
port. In addition, you can use NAT pools and address transforms to create virtual clients. A virtual
client is used to describe a configuration that uses a virtual address in place of the real address of the
host initiating the connection. This is particularly useful if you have a redirected service configured on
your network.
For packets that originate from an inside host and are destined to an outside host, the security
gateway, by default, changes the source IP address and leaves the destination IP address unchanged.
The topics in this section are:
■
Controlling IP addresses with address transforms
■
Mapping addresses with NAT pools
■
Redirecting connections to unpublished addresses with service redirections
■
Creating virtual clients by using NAT pools and address transforms
Controlling IP addresses with address transforms
Address transforms give you the ability to control the IP address that appears as the source or
destination of a connection. You can expose the original client or server address, substitute the
security gateway’s own IP address, or substitute an address from a NAT pool.
When to use address transforms
There are four general network routing issues that require the creation of address transforms to
correctly route packets through the security gateway to their final destination. Address transforms
replace client source addresses.
■
When the security gateway is the default route for servers behind the security gateway that want to
see the original address of connecting clients.
■
When the security gateway is not the default route, and a connection coming into the security
gateway can only see the security gateway address. It does not know where to send the connection
from there and an address transform is needed to route packets to their final destination.
■
When the security gateway is not the default route, and you are using static one-to-one mapping of
addresses to conceal addresses on your network or to handle the problem of address overlapping.
■
When the security gateway is not the default route, and you are using dynamic NAT pools to
distribute a pool of addresses to a number of clients that is larger than the allotted NAT addresses.