Symantec™ Security Gateways Reference Guide - Sawmill

24 Network security overviewManagement scenarios■■■■Managed security gateway (fault tolerant)Managed security gateway (advanced)Managed security gateway (enclave)Managed security gateway (through another security gateway)Obviously, there are many variations of these scenarios, and your systems may not match exactly. Thescenarios presented give you models to consider for your own network deployment, and highlight anypotential security issues you may face.Managed security gatewayFigure 2-1 shows that the simplest deployment scenario requires the security gateway to have twointerfaces, each on a different LAN segment. The Security Gateway Management System (SGMI) thatmanages the security gateway is normally located on the public Internet. A security gateway in thisconfiguration is typically reserved for one-way traffic, especially if one of the interfaces has direct access toa public network. Connection requests are usually initiated from the protected network and destined forexternal services. If inbound access is enabled, it is not possible to completely secure the protectednetwork. Administrators are advised not to place mail or Web servers on the protected network.Figure 2-1Basic network scenarioSGMIRouterSecurityGateway