Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 1: Introduction
Additional Sidewinder G2 operating characteristics
Most proxies are disabled by default and must be enabled on the
Services Configuration > Proxies window before that type of traffic can pass
through Sidewinder G2. Once a proxy is enabled, you can configure which
internal users can use each type of proxy by creating proxy rules and
organizing them into rule groups that enforce your site’s security policy. For
example, you can configure rules that allow all internal users to access all
Internet Web sites, or you can prohibit users from accessing the Web from
specific internal systems or from accessing specific Web sites. can configure
advanced, application-specific properties for your proxy rules using Application
Defenses.
Note: See Chapter 4 for a detailed description of proxy rules and Application
Defenses. See Chapter 9 for a detailed description of the Sidewinder G2 proxies
and procedures for configuring them.
IP filtering
You can configure the Sidewinder G2 to securely forward IP packets between
networks using IP Filter rules. Unlike proxies, which operate at the application
layer and in most cases on TCP or UDP traffic, IP Filter operates directly on IP
packets allowing non-TCP/UDP (as well as TCP/UDP) traffic to pass between
the networks. For example, with IP Filter you can pass encrypted VPN
sessions through the Sidewinder G2.
IP Filter works by inspecting many of the fields within a packet, including the
source and destination IP address, port, and protocol. Each packet that arrives
at the Sidewinder G2 will be inspected and compared to an active IP Filter rule
group that you have configured. Matching packets will then be forwarded on to
the destination network.
You can configure IP Filter to inspect TCP, UDP, and many other protocols.
With TCP, UDP, and ICMP, the Sidewinder G2 can actively track individual
sessions by performing stateful inspection. This ensures that only packets valid
for a new session or a portion of an existing session are sent on to the final
destination. In addition, the Sidewinder G2 supports the ability to perform
Network Address Translation (NAT) and redirection when using IP Filter.
Using NAT, the source address of outgoing IP packets is translated from the
client's IP address to the external address of the Sidewinder G2. Using
redirection, the destination address of an incoming packet is rewritten to a
redirect host. Using NAT and/or redirection allows the IP addresses of
machines behind the Sidewinder G2 to be hidden. You can also allow a private,
non-routeable network (such as 10.0.0.0) to access the Internet using NAT.
Note: See Chapter 4 for information on using IP Filter rules.
11