Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 362 / 861

361 Preventing attacks
Making your network more secure by hiding addresses
4 On the Source Address Transform tab, do one of the following:
5 Optionally, on the Description tab, type a more detailed description than you typed in the Caption
text box.
6
Click OK .
7 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“Address Transform Properties—General tab” on page 669
■
“Address Transform Properties—Source Address Transform tab” on page 670
■
“Address Transform Properties—Description tab” on page 670
Mapping addresses with NAT pools
A network address transform (NAT) pool is a set of addresses that are designated as replacement
addresses for client IP addresses. You use NAT pool addressing to present a routable address to the
security gateway. This is commonly done to translate packets on non-routable networks to routable
packets for travel across public networks, or to hide external source packets and make them appear to
be internal source packets. NAT helps to guarantee that return traffic is routed back to the appropriate
security gateway.
NAT pools do not time out. As long as the connection is active, the client owns the allocated address. If
the NAT pool is being used in a VPN tunnel, the tunnel itself can time out, based on the parameters
defined. When this happens, the connection is dropped, and the NAT address is released back into the
pool.
The security gateway translates source addresses for transmitted packets and destination addresses
for received packets. NAT substitutes the source IP address of the incoming packets with an address
from the assigned pools. The security gateway maintains a table of the pairings so that return traffic is
switched back to the original IP address.
Arriving through In the Arriving through drop-down list, select the interface or secure tunnel that the
client is using to access the designated address.
Source In the Source drop-down list, select among the available network entities for the entity
that is the client or real address for a connection.
Destination In the Destination drop-down list, select the server entity that is communicating with
the client entity.
Leaving through In the Leaving through drop-down list, select the interface or the secure tunnel that the
client is using to access the designated server.
Use security gateway
address Click to have the real packet source address overwritten by the security gateway
address for the connection.
Use original source address Click to prevent the security gateway from overwriting the real source address
for the connection.
Use NAT pool Click to apply a configured NAT pool addressing scheme to a VPN tunnel or non-
tunneled connection, and then select the NAT pool from the drop-down list box.