Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 188 / 861

188 Defining your security environment
Understanding proxies
When you change settings directly on a proxy, the settings apply globally in any rule or filter where the
protocols associated with the proxy are used. You can also configure proxy settings for specific uses by
including the protocol associated with the proxy in a service group and then configuring proxy
properties that apply only to that service group.
A combination of these configuration methods enables you to control the traffic that passes through
the security gateway, as described in the following sections:
■
Configuring a GSP for protocols without proxies
■
Configuring the Oracle Net9 Connection Manager proxy
■
Controlling full application inspection of traffic
■
About service groups
Configuring a GSP for protocols without proxies
You can use the Generic Service Proxy (GSP) to configure the security gateway to pass traffic for
services that are not already predefined on the security gateway.
Once defined, generic services can be used in authorization rules along with the standard services. Like
standard services (such as Telnet, FTP, and HTTP), custom generic services listen for external hosts
that are attempting to access them on the security gateway ports. Generally, you should not have to
change any GSP default settings.
By default, the GSP proxy handles all service requests transparently, as if the requester were directly
connected to the remote destination machine. All connections are subject to gateway authorization
rules.
In addition, when you have bottlenecks in the security gateway, you can increase throughput by
enabling the use of the GSP proxy instead of a predefined proxy. For example, if you have a bottleneck
for HTTP traffic, you can relieve it by configuring the HTTP protocol to use GSP. If you enable a GSP
for a protocol that has a proxy, you must disable the proxy. If the proxy is enabled, traffic goes to it
rather than through the GSP.
You should use the GSP protocol to increase traffic flow only when there is no predefined proxy to
handle the traffic, or when security is not the main concern.
Note: Custom or generic services include any service not supported by one of the Symantec application
proxies.
Prerequisites
None.
To configure the GSP proxy for protocols without proxies
1 In the SGMI, in the left pane, under Assets, click Proxies .
2
In the right pane, on the Proxies tab, double-click GSP .
3 In the Proxy Properties: GSP dialog box, on the General tab, do the following:
Enable GSP To enable all GSP proxies, check this option.
Enable TCP GSP To enable the GSP proxy for use with TCP-based custom protocols, check this option.
Enable TCP port ranges
GSP To enable large port ranges (over 1000) to work with TCP-based custom protocols,
check this option.
Enable UDP GSP To enable the GSP proxy for use with UDP-based custom protocols, check this
option.