18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Proxy rule basics<br />

the user requesting the connection—You can configure a proxy rule<br />

to allow connections based on a group for which the user<br />

requesting the connection is a member. A user group is comprised<br />

<strong>of</strong> multiple users defined by the <strong>Sidewinder</strong> <strong>G2</strong> administrator (see<br />

“Users and user groups” on page 4-8 for more information on user<br />

groups). This option is only valid when using authentication or<br />

SSO.<br />

authentication—You can configure a proxy rule to require the<br />

<strong>Sidewinder</strong> <strong>G2</strong> to authenticate the user requesting the connection<br />

before granting the connection request. Refer to “Supported<br />

authentication methods” on page 9-5 for detailed information on<br />

the types <strong>of</strong> authentication services you can use.<br />

You can also configure a proxy rule to deny with authentication.<br />

The purpose <strong>of</strong> this type <strong>of</strong> rule would be to allow access to everyone<br />

except a specific group <strong>of</strong> users. For example, you might want<br />

to deny Telnet access to your contractors but allow access for your<br />

regular employees.<br />

Important: If you are not using SSO, configuring a deny with authentication proxy<br />

rule in a mixed service group (authenticating and non-authenticating services like<br />

Telnet and ping, respectively) will deny all non-authenticating services. However, if<br />

SSO authentication is configured, initial authentication will apply to all services<br />

contained in the service group. See “Service groups” on page 4-12 for more<br />

information.<br />

the time and day when the connection request is made—You can<br />

configure a proxy rule to allow or deny connections based on the<br />

time, the day, or both.<br />

Application Defense properties—You can configure a proxy rule to<br />

allow connections based on advanced application-specific<br />

parameters by selecting the appropriate Application Defense. You<br />

can also configure whether the connection will be transparent or<br />

non-transparent for some proxies. See “Application Defenses” on<br />

page 4-14 for information.<br />

Using NAT and redirection in proxy rules<br />

You can configure proxy rules to perform Network Address<br />

Translation (NAT) and/or redirection. On the <strong>Sidewinder</strong> <strong>G2</strong>, NAT<br />

refers to rewriting the source address <strong>of</strong> the packet, while redirection<br />

refers to rewriting the destination address <strong>of</strong> the packet. This protects<br />

IP addresses behind the <strong>Sidewinder</strong> <strong>G2</strong> (on your internal network).<br />

The following scenarios demonstrate how NAT and redirection work.<br />

Understanding Policy Configuration 4-19

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!