18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Rule elements<br />

Figure 4-5. Netgroup<br />

4-12 Understanding Policy Configuration<br />

Figure 4-5 shows a sample netgroup configuration.<br />

members <strong>of</strong><br />

“sales”<br />

network<br />

group<br />

As shown in Figure 4-5, a netgroup named “Sales” is comprised <strong>of</strong><br />

two domains within a sales organization and an individual system<br />

using IP address 172.16.12.3. Suppose you want to allow users in all<br />

three <strong>of</strong> these network objects to access Telnet servers anywhere on<br />

the Internet. You need to create a rule to configure the connection,<br />

specifying ‘Sales’ as the source and a wildcard (leave the field blank to<br />

indicate a wildcard) as the destination. Without creating the Sales<br />

netgroup, you would need to make three rules to configure the Telnet<br />

access, one for each network object.<br />

You can create netgroups for network objects that are inside or<br />

outside <strong>of</strong> the <strong>Sidewinder</strong> <strong>G2</strong>. A netgroup can include nested<br />

netgroups.<br />

Service groups<br />

presales.bizco.net<br />

sales.bizco.net<br />

172.16.12.3<br />

A service group is a collection <strong>of</strong> selected proxies and/or servers.<br />

Once defined, a service group can be used in a proxy rule to regulate<br />

access to the services in the group. There are important administrative<br />

benefits gained by using service groups: While a typical proxy rule<br />

will regulate access for a single proxy or server, a proxy rule that is<br />

implemented using a service group can regulate access for multiple<br />

proxies and/or servers. Grouping services together in this manner<br />

enables you to reduce the overall number <strong>of</strong> rules you define, which<br />

in turn reduces the overall complexity <strong>of</strong> your rule database. A less<br />

complex rule database means there is less chance <strong>of</strong> introducing<br />

errors that may affect the integrity <strong>of</strong> your security policy. You can<br />

also configure Application Defense groups for rules that use service<br />

groups to specify advanced properties for each proxy included in that<br />

rule. (See “Application Defenses” on page 4-14 for an overview <strong>of</strong><br />

Application Defenses.)<br />

Note: Service groups are used only in proxy rules.<br />

internal<br />

network<br />

<strong>Sidewinder</strong> <strong>G2</strong><br />

Internet

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!