Chapter 16: Proxy Map - Tavve zoneranger User Manual

Chapter 16: Proxy Map

The Proxy Map service in the Ranger Gateway supports the handling of management traffic originated
by management applications and destined for managed devices (e.g. ICMP request, SNMP Get/Set
request, HTTPS, SSH, FTP), enabling users to configure which ZoneRangers should be used to proxy
traffic for given managed devices. Traffic originated by managed devices is typically governed by
configuration rules within the ZoneRanger (e.g. forwarding rules, TACACS+/RADIUS server groups),
and is outside of the scope of the Proxy Map service.
The Proxy Map service provides the following functions:
•
For each proxy transaction (for example, ICMP echo request, SNMP request, SSH session
request), the Proxy Map service identifies one or more joined ZoneRangers that are able to
relay the proxy traffic to the target device, and selects one of these ZoneRangers to handle the
given transaction.
•
If network address translation (NAT) is in effect, the Proxy Map service translates the target
device address associated with the request at the Ranger Gateway to the corresponding device
address that the selected ZoneRanger must to communicate with the target device.
In simple ZoneRanger installations, the default Proxy Map configuration settings might be sufficient for
the Proxy Map service to operate. For example, if a Ranger Gateway is joined to a single ZoneRanger,
and no NAT is in effect, the Proxy Map service does not need additional configuration information to
select a ZoneRanger and identify the target address for a proxy transaction. In general, the Proxy Map
service configuration must be modified if any of the following conditions are true:
•
The Ranger Gateway is joined to multiple ZoneRangers that are managing different devices
(that is, the proxy map service cannot assume that any ZoneRanger can proxy traffic to any
managed device).
•
The firewall(s) associated with one or more of the network zones where joined ZoneRangers
are installed are configured for NAT.
•
IP Address Aliasing is being used (see Appendix D) and the alias IP addresses defined for
managed devices do not match the actual IP addresses.
ZoneRanger 5.5 User's Guide 48