Symantec™ Security Gateways Reference Guide - Sawmill

54 Understanding accessProxiesThe H.323 proxyBy default, the FTP proxy protects against bounce attacks. The FTP proxy logs and disconnects the controland data connections from an offending client if the client tries to send a PORT command for an addressthat does not match the client's address. The FTP proxy does not overwrite the PORT command with itsown address if the address on the PORT command is not the client's address.H.323 is a standard for Internet audio, video, and data communications. Programs using the H.323standard can communicate and inter-operate with other compliant systems in a peer-to-peer network. Youcan configure the security gateway to act as a virtual peer accepting requests for this type of traffic, andthen passing them on to the H.323 endpoint located behind the security gateway.The security gateway does not support all elements of the H.323 standard. The following features are notsupported:Multicast addressingLDAPThe security gateway supports only unicast addressing (several point-to-point transmissions).Online Directory Lookup uses the LDAP protocol to look up addresses at an LDAP server.The HTTP proxyYou can maintain an inside directory server for your site. You can populate this server with addresses froma public server or with your inside addresses and addresses of business partners and associates. Have yourusers set this server as their default directory server.The HTTP proxy operates as a non-caching proxy between Web clients and servers. The HTTP proxysupports all major features of HTTP 1.1, and also acts as a local Web server with its own document set. Theserver primarily fulfills requests for the security gateway’s home page and icons used in the protocolconverters, but the administrator can place any files desired into the document area.HTTP proxy authorizationNo request is fulfilled until that request is authorized. The security gateway evaluates the source IPaddress, source interface, destination IP address, and destination interface. The result indicates whetherthe request can proceed, whether authentication is required, and what other limits apply, such as contentrestrictions or the proxy server to use for the rule.The HTTP proxy does not solely rely on gwcontrol to make its authorization decisions. It looks at otherfactors in the request such as whether or not the request is protocol-compliant. The HTTP proxy alsorestricts requests from contacting servers on many low numbered ports. A request is allowed only after allauthorization checks are complete, including authentication and content filtering.HTTP proxy authenticationClient connections may require authentication. The HTTP proxy determines whether to use proxyauthentication or HTTP authentication. If the HTTP proxy selects and the client’s browser supports proxyauthentication, the HTTP proxy issues a challenge to the client’s browser indicating that proxyauthentication should be used. You need to enter the required user name and password combination needsto be entered only once for each browser session.