Symantec™ Security Gateways Reference Guide - Sawmill

12 Introducing Symantec security gatewaysAbout Symantec security gatewaysAbout Symantec security gatewaysIndustry-tested firewallVirtual private networkingContent filteringSymantec security gateways are software and hardware solutions that employ a multi-layered securityapproach, integrating core Symantec technologies to effectively prevent security breaches at theperimeter. Each product incorporates an industry-tested firewall, virtual private networking, contentfiltering, and high availability and load balancing, all easily configurable through a platform-independentmanagement interface. The appliance products also offer antivirus and intrusion detection and preventioncomponents.Symantec security gateways are designed for small and medium size companies that may not have adedicated security staff and equipment for a full security architecture but need protection against the mostcommon types of threats, to the largest companies that demand the strongest levels of enterpriseprotection.The foundation of the security gateway is the firewall component. With an impeccable security record, themature Symantec Enterprise Firewall-based component protects at the network layer with a custom driverthat scrutinizes every packet, and at the application layer with full application inspection proxies thatprovide protection against a variety of application-based attacks.The core of the firewall component is the Symantec driver. The driver incorporates several securityfeatures including fragment reassembly, header and datagram validation, and SYN flood protection. Youcan view the driver as a security guard that checks the credentials and integrity of both incoming packets(packets originating from any source other than the security gateway) and outgoing packets (packetsoriginating from the security gateway), and determines whether or not those packets go on to moresophisticated checks.Similar to standard proxies, Symantec’s application proxies reduce overhead, create access to services thatmay not exist on the security gateway, and provide security by creating a virtual air gap between the clientand the server. However, Symantec’s application proxies also prevent attacks by scanning and filtering forthem within the data stream. Working at this level, Symantec’s application proxies analyze the entire datastream of every connection attempt. This provides a considerable advantage over other approaches thatonly work at lower levels of the protocol stack.The security gateway incorporates a robust VPN component, letting organizations securely extend theirnetwork. The VPN component is a standards-based solution, that establishes encrypted connections fromremote locations. The security gateway uses IPsec tunnels to send encrypted and encapsulated trafficacross public networks to other IPsec-compliant endpoints.A central piece of any VPN implementation is the algorithms used to provide encryption and integritychecks. The security gateway supports the Advanced Encryption Standard (AES) algorithm for strongersecurity and improved performance over Triple DES and DES implementations. Triple DES and DES arealso supported, as well as MD5 and SHA1 for packet integrity.Symantec security gateways include a strong content filtering component that lets administrators simplyand efficiently deny access to Web sites and Web site content. Content filtering is supported through aninternal, categorized URL database of Web sites. When you purchase a subscription, the internal databaseis periodically updated to reflect new Web sites. You can make manual entries to the Web site database.When content filtering is used with rules that prevent access to sites that may fall outside a company’sacceptable use policy, attempted access is logged, and the browser displays a “Forbidden by ratings check”to the end user.