Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 271 / 861

270 Controlling traffic at the security gateway
Creating rules and filters to control traffic through the firewall
For more information, see the following topics:
■
“Understanding and using rules” on page 271
■
“Using packet filters to allow or deny traffic” on page 289
■
“Blocking inappropriate content with content filtering” on page 295
■
“Providing remote access using VPN tunnels” on page 373
■
“Enabling remote access with clientless VPN” on page 409
Creating rules and filters to control traffic through the firewall
You create rules and filters to protect your resources from attack while making them available to
trusted users. These rules control how traffic passes through the firewall component of the security
gateway.
Controlling traffic through the firewall involves defining your network and the resources to which you
want to provide access and protection, configuring the content security components of the security
gateway, and creating the rules and packet filters that use these components.
To control traffic, you complete the following tasks:
VPN tunnels The Virtual Private Network (VPN) feature provides secure access through the security
gateway for remote users. The security gateway’s VPN functionality lets you create
encrypted tunnels for gateway-to-gateway communication and remote access for users who
have installed Symantec Client VPN on their computers. By adding a filter to a VPN policy,
you can further control the traffic.
Clientless VPN rules Clientless VPN gives any external user with a Web browser secure, controlled access to your
organization’s internal resources. Users who connect by way of clientless VPN do not have
to install software on their computers. You create role settings that specify the rules and
login privileges that control user access.
Set up your network topography. See the following:
■
“Defining security gateway routing” on page 125
■
“Configuring resource records for the security
gateway”
on page 145
Identify the resources that your rules will make
available. See “Defining traffic endpoints with network entities” on
page 160.
Create service groups that contain the protocols used
to pass traffic. See “Creating service groups” on page 183.
Enable the security gateway to pass specific kinds of
traffic by modifying the proxies that are used with the
protocols. See “Controlling full application inspection of traffic” on
page 192.
Specify the time periods during which rules are in
effect. See “Blocking inappropriate content with content
filtering” on page 295.
Create user accounts and user groups for
authentication. See the following:
■
“Configuring users for internal authentication” on
page 243
■
“Configuring user groups for internal and external
authentication”
on page 247