Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 193 / 861

193 Defining your security environment
Controlling full application inspection of traffic
Examples of traffic that the CIFS proxy supports include:
■
External users trying to access internal SMB servers from home or on the road to read mail, access
databases, or access documents. For this type of access, you configure the security gateway to
disable write access to the servers. These users connect non-transparently and use service
redirection to let the CIFS proxy hide the details about the real SMB servers.
■
Internal users trying to access external SMB servers. These types of users only need to connect
transparently to the server.
The CIFS proxy does not support authentication of the CIFS/SMB client except through Out-of-Band
Authentication. Additionally, you can create rules that include CIFS just as is done with HTTP, FTP,
Telnet, SMTP, NNTP, and other protocols.
Related information
For further information related to this topic, see the following:
■
“File control and access restrictions” on page 193
How the security gateway enforces file control and access
The security gateway manages network access connections through the use of transparent
connections, non-transparent connections, and file control and access restrictions.
Transparent connections
The CIFS proxy supports transparent connections through the security gateway. With transparent
connections, it is the target SMB server’s responsibility to perform any required user authentication.
The client must know the name of the SMB server and the name of its shares, because browsing
through the security gateway is disabled.
Non-transparent connections
For non-transparent connections, a user connects to the security gateway, and the security gateway
acts as the SMB server. The SMB protocol does not support connection redirection so you must
configure the security gateway to perform service redirection for CIFS.
The CIFS proxy uses network address translation (NAT) for non-transparent connections. Despite the
NAT functionality, however, internal share names like xxx are exposed to the outside. To avoid
exposure, go to each SMB server and create alias share names for the same directory but create
different permissions for the shares that are to be exposed. These new permissions are set up to give
less control to outside users, if so desired.
File control and access restrictions
Restrictions that relate to the security gateway CIFS proxy include the following:
■
The CIFS proxy is not an integrated SMB server and SMB proxy. Do not use in conjunction with a
real SMB server running on the security gateway.
■
The CIFS proxy does not support UDP port 137, which is used by the NetBIOS naming service. This
means that users cannot browse for any SMB servers behind the security gateway. Therefore, users
must use other naming services to access the security gateway and the SMB servers inside.
SMB clients can enable DNS for Windows name resolution. To use DNS for transparent access to
SMB servers inside the security gateway, the administrator can use the SGMI to add entries for the
SMB servers to the public hosts file.