Symantec™ Security Gateways Reference Guide - Sawmill

Preventing attacksAddress transforms121Understanding address transformsTo protect the real source or destination IP address, the security gateway uses address transforms tomodify source and destination IP addresses in packet headers as packets pass through. An addresstransform instructs the security gateway to change the source IP address, source port, destination IPaddress, destination port, or any combination of these just before the packet leaves the security gateway.Address transparency, redirected services, and network address translation (NAT) all employ some type ofaddress transform, and each has its own reason for being used.Packet headers hold the source IP address, source port, destination IP address, and destination port. Tobetter understand how each type of address transform differs, this section assigns names to these fourfields both before and after the packet passes through the security gateway. These names are used in thefollowing sections on address transparency, redirected services, and network address translation to showbefore and after header values.Table 9-2 shows the four header fields before passing through the security gateway.Table 9-2NamesrcsrcportdstdstportHeader information from the original source packetDescriptionReal source IP address.Real source port.Perceived destination IP address.Perceived destination port.Table 9-3 shows the same fields in the packet after the packet leaves the security gateway. However, thenames have been altered slightly because there is a possibility that the security gateway changed one ormore of the fields.Table 9-3Namesrc’srcport’dst’dstport’Modified header information after packet exits the security gatewayDescriptionPerceived source IP address.Perceived source port.Real destination IP address.Real destination port.Address transparencyAddress transparency determines whether or not one side of a proxied connection (either the client or theserver) is permitted to see the real IP address of the other side. Depending on the type of transparency(client-side or server-side), the security gateway modifies either the source or destination IP addresses inthe packet header. If enabled, this modification takes place on the outbound connection.However, you should not use the terms inbound and outbound to describe address transparency. Thesecurity gateway treats all traffic that originates outside of the security gateway as an inbound connectionand all traffic that originates from an interface on the security gateway as an outbound connection. Everyconnection that passes through the security gateway incorporates both of these. The connection originatesfrom a host, enters the security gateway through one interface as an inbound connection, is processed bythe security gateway, and then handed to another interface as an outbound connection for exit. Instead,think about transparency in terms of client and server.