Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 4: Understanding Policy Configuration
Proxy rule basics
– All—Allows connection service for both proxies and servers, but not
service groups.
– Proxy—Provides a connection through the Sidewinder G2 in order to
access a remote system.
– Server—Provides a service (such as Telnet) directly on the Sidewinder
G2.
– Service group—Allows multiple proxies and/or servers to be grouped
together and used to define a single proxy rule.
• type of network service requested—You can configure a proxy rule to allow
or deny connections based on the type of network service that will be
provided between the client and server. For proxy connections, the services
include FTP, Telnet, and Web (HTTP), as well as many others.
Optional criteria used to allow or deny a connection
When setting up a proxy rule, you can also specify the following optional
criteria for a connection.
Note: You can specify any of the following criteria in an ‘allow” rule. However, only
the authentication and date/time bullets apply to a ‘deny’ rule.
• the user requesting the connection—You can configure a proxy rule to
allow connections based on a group for which the user requesting the
connection is a member. A user group is comprised of multiple users
defined by the Sidewinder G2 administrator. See “Users and user groups”
on page 104 for more information on user groups.
This option is only valid when using authentication or SSO.
• authentication—You can configure a proxy rule to require the Sidewinder
G2 to authenticate the user requesting the connection before granting the
connection request. See “Supported authentication methods” on page 277
for detailed information on the types of authentication services you can use.
You can also configure a proxy rule to deny with authentication. The purpose
of this type of rule would be to allow access to everyone except a specific
group of users. For example, you might want to deny Telnet access to
your contractors but allow access for your regular employees.
Important: If you are not using SSO, configuring a deny with authentication
proxy rule in a mixed service group (authenticating and non-authenticating
services like Telnet and ping, respectively) will deny all non-authenticating
services. However, if SSO authentication is configured, initial authentication will
apply to all services contained in the service group. See “Service groups” on
page 108 for more information.
• the time and day when the connection request is made—You can
configure a proxy rule to allow or deny connections based on the time, the
day, or both.
113