Symantec™ Security Gateways Reference Guide - Sawmill

20 Network security overviewSecurity considerationsDetailed packet inspectionIP fragment protectionSYN flood protectionInterface packet filterMTU checkAddress transparencyIP packet processing monitors the packet type and certain types are disallowed forsecurity reasons; ICMP redirects and source routed packets are two examples. The securitygateway also checks the reserved bit, and discards any packets with the reserved bit set.IP datagram validation is similar to IP packet processing; however, this is done with fullyre-assembled IP datagrams. This inspection examines datagrams for TCP length, TCPflags, and UDP length.IP headers, checksums, lengths, options, and addresses are scrutinized to prevent attacksagainst the local machine’s IP stack. For example, by creating a bad IP header length, anattacker could attempt to overrun a data buffer. To protect against this, packets with anincorrect header length are discarded.The Symantec driver provides its own IP fragmentation and re-assembly routines. This isdone to ensure that the reassembly of packets is consistent among platforms, and to helpguard against IP fragmentation attacks. Packets that do not reassemble correctly areimmediately dropped.SYN flood protection is interface specific and, when enabled, tracks incoming packets. Ifmultiple connection attempts are made from the same source within a defined period oftime, additional connections from that source are denied. Additionally, the driver logs anentry to show that the driver blocked the source IP address. SYN flood protection foroutgoing traffic works in conjunction with the check done on incoming packets. Thedriver ensures that a SYN received entry appears in the state table, and replaces this entrywith a SYN ACK.An interface packet filter lets you block specific traffic on each interface basis. With oneor more input or output filters in place, incoming and outgoing packets are screened. Thedriver drops packets not matching any filter.This check determines the media type and ensures that the outgoing packet is the correctnumber of bytes in size when the don’t fragment bit is set.This check looks for a transparency record that matches the packet. If a matching recordis found, the record is updated appropriately, and the packet’s destination is modifiedaccording to the information in the record. Address transparency for TCP occurs duringthis check.For incoming traffic only, if this is an authorized connection, and no record exists, a newtransparency record is created.Intrusion detection and intrusion prevention (appliance only)As part of the security process on security gateways with integrated intrusion detection and prevention,the driver communicates with the intrusion detection and prevention component to analyze packets andensure that they do not match known attack types. All driver security checks and calls to the intrusiondetection and prevention component are handled in the kernel prior to sending packets up the stack,making the process quick and efficient.Application proxiesA set of application-specific security proxies evaluates all attempts to pass data into or out of the protectednetwork. While attackers may try a variety of ways to invade a targeted system, most attacks try to exploitapplication services and their data streams. For example, attackers often use well-known Simple MailTransfer Protocol (SMTP) holes to break into internal mail systems. Other application-level attacks aredesigned to exploit services like the File Transfer Protocol (FTP) or the Hypertext Transfer Protocol(HTTP).The security gateway’s application-level access controls prevent attacks by scanning for and filtering themwithin the connection’s data stream. Working at this level, the security gateway uses dedicated securityproxies to examine the entire data stream for every connection attempt. This provides a significantadvantage over other approaches that only operate at the lower levels of the stack, and typically evaluateconnections in to and out of the protected network on a packet-by-packet basis, rather than as a whole.