Symantec™ Security Gateways Reference Guide - Sawmill

Understanding accessRules63A service group consists of the service group name, an assigned ratings profile (if appropriate), both a shortand long description, assigned protocols, and any additional parameters. Some of the included protocolsassigned to a service group allow additional options to be defined by highlighting the protocol in theIncluded Protocols window and clicking on Configure. For example, HTTP lets you configure antivirusscanning.RulesWhen the security gateway receives a connection request, it searches for rules that match the time windowand definition of the connection request. From this list of possible matches, the security gateway thenselects the rule that most closely matches the source address, destination address, protocol, and interfaceor VPN tunnel. The rule that best fits is then applied; the connection is either allowed or denied. If there areno rules either within the time window or that match to allow the connection, and the connection is notpart of a VPN tunnel, the connection is denied.Note: You should not add a second, return-traffic rule when creating rules. Returning traffic isautomatically allowed for connections that match existing rules. Adding a return-traffic rule may openunnecessary holes in the security gateway.Additionally, there is an implicit rule that lets an administrator initiate a connection from the securitygateway. You do not have to create a rule for this, or for the return traffic.Rule definitionsRule definitions consist of several editable fields that define such things as the name or number of the rule,whether the rule is active or not, source, destination, description, and so forth. Rules are granular, and rulebehavior is modified by changing the appropriate field. Table 4-7 lists each configurable entry, along withits description.Table 4-7ComponentRule nameEnableNumberArriving throughSourceDestinationLeaving throughService groupRule componentsDescriptionAlphanumeric name for the rule. Acceptable characters include letters and numbers only,with no spaces.Check box to enable or disable a rule.Generated number for a rule that shows up in log entries.Connection point on the security gateway where traffic arrives. This is a selectable list thatshows all potential connection points. Selectable options include (traffic fromanywhere), (traffic from any VPN connection), all defined network interfaces,and any Gateway-to-Gateway or Client-to-Gateway VPN tunnels.Denotes the network entity where traffic should originate. This is a host, subnet, user,group, security gateway, or universe.Denotes the network entity where traffic is destined.Connection point on the security gateway where traffic leaves. This is a selectable list thatshows all potential connection points. Selectable options include (traffic toanywhere), (traffic to any VPN connection), all defined network interfaces,and any Gateway-to-Gateway or Client-to-Gateway VPN tunnels.Connections matching this rule are granted access to the services or protocols defined inthis group.