Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 4: Understanding Policy Configuration
Rule elements
108
Service groups
A service group is a collection of selected proxies and/or servers. Once
defined, a service group can be used in a proxy rule to regulate access to the
services in the group. There are important administrative benefits gained by
using service groups: While a typical proxy rule will regulate access for a single
proxy or server, a proxy rule that is implemented using a service group can
regulate access for multiple proxies and/or servers. Grouping services together
in this manner enables you to reduce the overall number of rules you define,
which in turn reduces the overall complexity of your rule database. A less
complex rule database means there is less chance of introducing errors that
may affect the integrity of your security policy. You can also configure
Application Defense groups for rules that use service groups to specify
advanced properties for each proxy included in that rule. (See “Application
Defenses” on page 109 for an overview of Application Defenses.)
Example of a rule that uses a service group
Here’s an example that illustrates the power of a service group.
Assume you have a netgroup named eng_net_grp that consists of all the
engineers in your organization. If you want to grant Web, FTP, and Telnet
access to this group, you might do so by defining three separate rules. Table 9
illustrates how these three rules might look in the rule database.
Table 9: Typical rules not using service groups
No. Name Service Service Type Enabled Action
1 http_out HTTP proxy Enabled Allow
2 ftp_out FTP proxy Enabled Allow
3 telnet_out Telnet proxy Enabled Allow
A better option, however, is to use a service group. This enables you to
accomplish the same thing with one proxy rule. Create a service group that
contains the HTTP, FTP, and Telnet proxies, then use this service group when
defining the proxy rule. Table 10 illustrates the service group you might create,
and Table 11 illustrates how the resulting proxy rule will appear in a rule.
Table 10: Sample service group
Service Group Name Selected Proxies Selected Servers
EngServGrp HTTP, FTP, Telnet