Symantec™ Security Gateways Reference Guide - Sawmill

38 Security gateway fundamentalsDomain Name Service (DNS)Subnet entityA subnet entity is a grouping of hosts defined by a network and subnet mask. This grouping of hosts siteither on the protected network, or on the public network. Subnet entities are normally created to define arange of IP addresses that are permitted by a rule. Defining a subnet removes the requirement to create aseparate rule for each host to grant access.By default, the security gateway ships with a subnet entity called Universe. The Universe subnet entity hasan IP address of 0.0.0.0 and a subnet mask of /0. The Universe subnet entity is similar to a wildcard thatdefines the set of all valid IP addresses. You can use this entity in rules that apply to any IP address, but youshould only use it in these rules when any host can have access; do not use this entity in a rule when youwant to restrict access to only a defined set of hosts.Domain entitySecurity gateway entityA domain entity is a group of hosts that share the network portion of their DNS-resolvable host names. Forexample, www.symantec.com and ftp.symantec.com are both members of the symantec.com domain.By definition any host that acts as a secure entry or exit point for a network is a security gateway. Mostoften, this term is assigned to firewalls or VPN servers that form an endpoint for secure connections to andfrom protected networks. Defining a security gateway entity lets the administrator set up some basiccharacteristics of one of these endpoints. The IP address assigned to this entity is usually the publiclyaccessible address of the endpoint being defined. To establish Gateway-to-Gateway VPN tunnels, you mustdefine security gateway entities for both local and remote systems that serve as the tunnel endpoints.Group entityA group entity is a collection of other network entities. This reduces the number of similar rules by lettingthe administrator create one rule and apply it to the group instead of creating separate rule for eachnetwork entity. For instance, a host entity (single machine) and a subnet entity (several machines) could becombined into a group entity. Only one rule would then be needed to grant access to both entities the hostand the subnet.VPN security entityA VPN security entity lets you combine a series of subnets and security gateways into a single entity. Thissingle entity can then be used to establish multiple tunnels simultaneously. The advantage to this is thatonly one tunnel definition has to be described on the security gateway.Domain Name Service (DNS)The security gateway includes support for the domain name service (DNS). The security gateway’s DNSimplementation supports many of the features of standard DNS implementations, including full nameresolution and reverse name resolution. DNS configuration on the security gateway may seem a bit morechallenging than a standard DNS implementations because the security gateway supports securityconsciousDNS configurations only.There are three primary functions of DNS:Name resolutionThe most common use of DNS is to resolve or translate a given domain name to itsequivalent IP address. Computers communicate through numbers, where humans prefer aspoken and written word. DNS lets humans type the alphabetic name of a host, and thentranslates that name into its numerical equivalent.