Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 228 / 861

228 Defining your security environment
Controlling full application inspection of traffic
For example, in the network shown in Figure 6-2 , the security gateway protects the 192.168.10.x
network segment. An email client is running on the host 192.168.10.150 (EC-1) and there is a corporate
email server with IP address 192.168.10.10 (ES-1). If EC-1 is trying to send an email to EC-2, the email
leaves EC-1 and is sent directly to ES-1. ES-1 understands that it does not handle email for the intended
recipient, but notices that ES-2 does. The only path for ES-1 to connect to ES-2 is through the security
gateway.
Figure 6-2 Outbound (SMTP) mail example
Having the email pass through the security gateway lets the security gateway examine (pass to the
SMTP proxy) the outbound email before it is sent to its intended destination. This ensures that the
email is correctly formatted prior to leaving the boundaries of your corporate network and potentially
helps to prevent the spread of an email-based virus or threat that originates from within. The email is
then forwarded on to the destination mail server (ES-2) and is eventually received by the intended
recipient (EC-2) when they retrieve their email.
Note: There are two different ways in which SMTP mail can arrive at the security gateway: it can
originate from within the protected network (internal users sending out email) or it can arrive from an
external email server with mail intended for users on the protected network. Each of these requires a
different rule as the SMTP mail’s source and destination are different.
Inbound email example
If you let your employees retrieve email from sources other than a protected corporate mail server, you
have to take steps to insure that the incoming email does not contain anything harmful to your
corporate network or resources. Email messages can just be bothersome (spam), but are also often the
carriers for more vicious attacks (viruses and trojan horses). Often, email is innocuously disguised as a
note from a relative or friend, making it very difficult to distinguish between what is safe to open and
what is not. Using the security gateway, you can safely protect your corporate resources, removing
malicious content or unnecessary junk email, without infringing upon employee privacy.
ES-1
ES-2
EC-1 EC-2
192.168.10.150
192.168.10.10
192.168.10.5
10.172.15.5 10.172.15.1 172.16.10.1
172.16.10.15
172.16.10.153