Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 361 / 861

360 Preventing attacks
Making your network more secure by hiding addresses
Configuring address transforms
When you configure an address transform, you select one of three options:
■
Use Original Source Address
■
Use Gateway Address
■
Use NAT Pool
The Use original source address option is for connections to allow an entity behind the security
gateway to view the source address of the connecting client on the outside of the security gateway.
Otherwise, the source address of the real client is hidden. This prevents the security gateway from
overwriting the real client’s source address for the connection. If you are using a protocol that includes
the IP address as application data (GSP), you cannot modify the IP address using NAT. You must select
Use original source address to correctly route the connection.
When an address transform record exists with the Use original source address option for connections
that are passed to the application proxies; for example, a secure network connector (SNC) or VPN, then
rules that use the address transform must specify an incoming interface that is different from the
outgoing interface. If the incoming and outgoing interface are the same, the connection is dropped and
the following message is logged:
NAT rule was chosen, but client transparency is not possible as both the source and
destination interfaces are the same.
The Use gateway address option allows the real packet source address to be overwritten by the security
gateway address for the connection. Note that this should be the addressing scheme for most
connections, except VPN tunnels. With VPN tunnels the actual source addresses are applied to
incoming and outgoing packets.
The Use NAT pool option lets you apply a configured NAT pool addressing scheme to the connection,
or, if you have not already configured one you can create one here. If you choose this option, you must
also select a pre-configured NAT pool from the drop-down list. To use NAT pools, you must select a
server entity or outgoing interface for which the NAT address is valid and routable back to the security
gateway. For example, using <ANY> and Universe could become a problem, since the NAT address is
not valid across all interfaces.
Note: If you are using NAT for address hiding with VPN tunnels, you must select ESP (encapsulation
security payload) as the Data integrity protocol in your VPN policy. If you change the default behavior
for the VPN traffic, you have to pass the traffic through the proxy you are using in the rule for the
tunnel.
NAT pools are not supported with the AH (authentication header) protocol.
Prerequisites
None.
To configure an address transform
1
In the SGMI, in the left pane, under Assets, click Network .
2 In the right pane, on the Address Transforms tab, click New .
3
In the Address Transform Properties dialog box, on the General tab, do the following:
Enable To enable this address transform, check Enable .
Transform name Type a name for the address transform.
Caption Type a brief description of the address transform.