Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 363 / 861

362 Preventing attacks
Making your network more secure by hiding addresses
When to use NAT pools
Use NAT pools when connections to protected resources must originate from a specific network. NAT
is used for true address hiding and alleviates the IPv4 address shortage. NAT helps partition and
control network traffic. For VPN tunnel connections, you must pass traffic to the proxies to use NAT
pools. If you are using NAT for address hiding, select ESP as your Data Integrity protocol in your VPN
policy.
When you have a Web server on a protected network that only accepts connections from other hosts on
the same network, and you want to grant access to the Web server to several partner companies, you
can create several NAT pools, one for each company. Whenever someone connects, he or she is always
assigned the same IP address. This way, you can look locally to see which addresses are in use and
understand which companies are connected.
Note: Never assign addresses to a NAT pool if they are already used by a host or subnet.
Configuring NAT pools
There are two types of NAT pools: dynamic and static. Use static NAT pools to map a client IP address
to a specific NAT pool address. The address map is then assigned in advance of the connection and
remains the same. You must use subnet entities with static one-to-one NAT addresses, but those
subnets may consist of only one entity. You must have the same number of entities in your real subnet
as you do in your NAT subnet.
Use dynamic NAT pools to map a client IP address to an IP address dynamically chosen from a pool of
addresses. An IP address becomes available for reassignment when the connection ends and the
assigned address is no longer being used. It is suggested that you use a range of addresses reserved in
RFC 1918. These non-routable Internet address ranges are inclusive and include:
■
10.0.0.0 through 10.255.255.255
■
172.16.0.0 through 172.31.255.255
■
192.168.0.0 through 192.168.255.255
If you need to allocate an entire network of addresses for a NAT pool, exclude all 0s and 1s in the
subnet broadcast address. For example, use 192.168.1.1 through 192.168.1.254 instead of 192.168.1.0
through 192.168.1.255.
Do not use your existing network of subnet IP addresses to create an address pool. You can create an
address pool using a subset of real network addresses. This subset should consist of an unassigned
range of addresses on the internal network that is directly attached to the security gateway.
If you are using NAT pool addressing with Symantec Client VPN tunnels, you must check the Pass
Traffic to Proxies check box on the General tab of the VPN policy you are using. You must also
configure address transforms.
Prerequisites
Complete the following tasks before beginning this procedure:
■
“Understanding VPN policies” on page 378
■
“Configuring address transforms” on page 360