Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 367 / 861

366 Preventing attacks
Making your network more secure by hiding addresses
Creating virtual clients by using NAT pools and address transforms
You can use NAT pools and address transforms to create virtual clients. A virtual client is used to
describe a configuration that uses a virtual address in place of the real address of the host initiating the
connection. This is particularly useful if you have a redirected service configured on your network.
In Figure 9-4 , the External host only sees the virtual host address (192.34.56.2) when it connects to the
support database. With service redirection configured, the packet is redirected to the support database
(192.34.57.2). If the support database now initiates a connection back to the external host, the external
host expects to see the address of the virtual host on the incoming packet. However, unless you have a
virtual client configuration (in essence, a reverse NAT configuration), the External host sees the
security gateway address on any communication it receives back.
Figure 9-4
Virtual client configuration
Creating a virtual client lets you use the address of a virtual host as the source for any connection
originating from the support database.
Configuring virtual clients
Use static NAT pools and address transforms to configure virtual clients. Create a static one-to-one
NAT pool mapping and then determine the interface the connection is passing through with an address
transform.
Note: For virtual clients, you must set up the entry as a one-to-one address mapping.
Configure virtual clients
Configuring a virtual client requires two procedures:
■
Configuring a static NAT pool
■
Configuring an address transform
You also need to configure a rule that supports the virtual client. The rule requires you to select a
network entity.
192.34.57.2
Support database
192.34.57.1
wkst1
192.34.57.3
wkst3
192.34.56.2
Virtual host
192.141.1.1
External host
192.34.57.0
192.34.56.1
Security gateway
Router