Amer-networks E5Web GUI Manual do Utilizador descarregar pdf (Página 507)

100

101

interface of the SAT rule must be set to any. The correct second rule for the external or internal

traffic is then selected based on the source interface. In this example, the internal clients are

allowed any type of access to the DMZ, not just HTTP access.

# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action

1 SAT any all-nets core wan_ip all_services Destination IP: 10.10.10.5

2 Allow wan all-nets core wan_ip http

3 NAT lan lan_net any all-nets all_services

Here, only one SAT rule is needed and once it triggers it will be used with whichever rule is

triggered next. The ordering of the Allow and NAT rules don't matter but they must be found

after the SAT rule.

The Importance of SAT Rule Ordering

To demonstrate how IP rules are processed for SAT, consider another simple case of a web server

with a private IPv4 address located on an internal network that will be accessed by both external

and internal users.

Assume the following IPv4 addresses:

• wan_ip (195.55.66.77): the security gateway's public IPv4 address

• lan_ip (10.0.0.1): the local network's private IPv4 address

• wwwsrv_ip (10.0.0.2): the web server's private IPv4 address

• client_ip (10.0.0.3): the local client's private IPv4 address

The IP rules that are needed for external and internal access to the web server could be specified

as follows:

# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action

1 SAT any all-nets core wan_ip all_services Destination IP: wwwsrv_ip Port: 80

2 Allow any all-nets core wan_ip http

3 NAT lan lan_net core wan_ip all_services

With the above rules, the following will happen to traffic:

• The local client sends a packet to wan_ip to reach the web server.

10.0.0.3:1038 => 195.55.66.77:80

• cOS Core translates the address in accordance with SAT rule 1 and forwards the packet in

accordance with Allow rule 2:

10.0.0.3:1038 => 10.0.0.2:80

• The server at wwwsrv_ip processes the packet and replies:

10.0.0.2:80 => 10.0.0.3:1038

This reply arrives directly to the local client without passing through the Clavister Security

Gateway and this causes problems because the client expects a reply from 195.55.66.77:80 and

not 10.0.0.2:80. The unexpected reply is therefore discarded and the client continues to wait for a

response from 195.55.66.77:80 which will never arrive.

Chapter 7: Address Translation

507

1 2 ... 502 503 504 505 506 507 508 509 510 511 512 ... 776 777

Comentários a estes Manuais

Sem comentários

Amer-networks E5Web GUI Manual do Utilizador Página 507

Comentários a estes Manuais

Manuais e produtos relacionados com Acessórios para Computador Amer-networks E5Web GUI