Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 272 / 861

271 Controlling traffic at the security gateway
Understanding and using rules
Understanding and using rules
The most flexible way to control access to and from your private networks is by creating rules. Basic
rules identify the source and destination of traffic, the interface or secure tunnel
through which the
traffic traverses the security gateway, and the protocols that apply.
You can further refine access by using time restraints and by designating authentication requirements
for specific users or groups. You can also apply antivirus, antispam, and content filtering protections
selectively to rules. You can enable suspicious activity monitoring by designating alert thresholds, that
generate notifications when they are exceeded.
The rules you create form the framework of your security policy. You can write general rules to cover a
wide range of common connection cases and then refine those rules to make them meet your specific
security needs.
This section describes the following:
■
How rules are applied
■
Planning to create rules
■
Configuring rules
■
Rule examples
■
Using protocols and proxies for specific rules
How rules are applied
When the security gateway receives a connection request, it scans the rules that you have defined and
selects the most appropriate rule to apply.
In the first scan, it searches for rules that match the time window and definition of the connection
request. From this list of possible matches, the security gateway selects the rule that most closely
matches the source address, destination address, protocol, and interface or VPN tunnel.
If there is only one match, and the rule does not require authentication, it is picked and the traffic is
allowed or denied. If authentication is required, the requesting user is prompted to enter the
appropriate credentials and is authenticated before any action is taken.
Configure authentication servers and schemes. See the following:
■
“Authenticating with an external authentication
server”
on page 253
■
“Authenticating with an external authentication
server”
on page 253
Create and deploy intrusion detection and prevention
(IDS/IPS) policies. See “Blocking suspicious or malicious traffic with IDS” on
page 319.
Configure the protections provided by the antivirus
component. See “Protecting your network resources from virus
infections” on page 333.
Configure options for preventing spamming. See “Increasing productivity by identifying spam email”
on page 349.
Create rules that allow or deny access through the
security gateway. See “Understanding and using rules” on page 271.
Create filters to be applied to traffic through the
security gateway interfaces. See “Using packet filters to allow or deny traffic” on
page 289.