Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 369 / 861

368 Preventing attacks
Enabling protection for logical network interfaces
7
Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“Static NAT Pool Properties—General tab” on page 671
■
“Address Transform Properties—General tab” on page 669
■
“Address Transform Properties—Source Address Transform tab” on page 670
■
“Address Transform Properties—Description tab” on page 670
■
“Configuring rules” on page 272
Enabling protection for logical network interfaces
Logical network interfaces are an abstraction of the security gateway’s network interfaces. Logical
network interfaces let an administrator apply the same general configuration to multiple security
gateways, even though each security gateway has a different physical hardware adapter installed.
When you run the System Setup Wizard on each security gateway, the name defined for each network
interface creates a corresponding logical network interface. If you configure each security gateway to
use the same logical network interface naming convention when you configure the network adapters in
the System Setup Wizard, you can apply rules that use the logical network interface.
This section includes the following topics:
■
Enabling port scan detection
■
Enabling SYN flood protection
■
Enabling spoof protection
Enabling port scan detection
Port scan detection is an optional feature that you can configure to detect an attempt by an attacker to
scan for open ports. Attackers often use a port scan to determine if the security gateway is listening on
a port for which there exists an exploitable service. When port scan detection is enabled, it monitors
ports 0-1023 (reserved ports). If the security gateway suspects a port scan, it logs the interface on
which the packet arrived, the source IP address, the IP header, and the total length of the IP packet.
Configuring protection against port scan detections
Port scan detection is one of the configurable network interface options. Enabling port scan detection
instructs the security gateway to monitor connection attempts on an interface. More specifically, the
destination port of each connection attempt is reviewed. If the security gateway notices that attempts
are made to multiple ports from the same source, the security gateway assumes that the system may be
the victim of a port scan attack. Changes made here take affect after the configuration is activated.
Prerequisites
None.