Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 241 / 861

241 Defining your security environment
Controlling full application inspection of traffic
Enabling support for traceroute
Traceroute has an option to specify a source route or to record the route taken. By default, the security
gateway has these features turned off for security reasons, since they could compromise information
about your inside networks. A ping request using one of these features is dropped and logged. Support
for this is re-enabled by adding the variable ping.preserve.ttl to the Advanced Services tab. Adding this
variable lets the security gateway respond properly to the traceroute command.
Prerequisites
Complete the following task before beginning this procedure:
■
“Configuring access for ICMP traffic” on page 239
To enable support for traceroute
1 In the SGMI, in the left pane, under Policy, click Firewall .
2 In the right pane, on the Rules tab, highlight the rule you created to pass ICMP traffic, and then
click
Properties .
3
In the Rule Properties dialog box, on the Advanced Services tab, in the Parameter text box, type:
ping.preserve.ttl
4 Click Add .
5 Click OK .
6 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“Rule Properties—Advanced Services tab” on page 594