Configuring Advanced Options; Enabling The Ident Port; Disabling Nat Mode - Symantec 460R - Gateway Security Administrator's Manual

62 Network traffic control

Configuring advanced options

Configuring advanced options
Symantec Gateway Security 400 Series has several advanced firewall options for special circumstances.
These include:

Enabling the IDENT port

Queries to the TCP Client Identity Protocol (IDENT) port (113) normally result in the host name and
company name information being returned. However, this service poses a security risk since attackers can
use this information to hone in their attack methodology. By default, the appliance sets all ports to stealth
mode. This configures a computer to appear invisible to those outside of the network. Some servers (like a
certain email or Microsoft Internet Relay Chat (MIRC) servers) use the IDENT port of the system accessing
them.
You can configure the appliance to enable the IDENT port. Enabling this setting makes port 113 closed (not
open) and not stealth. You should enable this setting only if there are problems accessing a server (server
time-outs).
Note: If you experience time-outs when using your mail (SMTP) service, enabling the IDENT port may
correct this problem.
To enable the IDENT Port
See
1
2
3

Disabling NAT mode

You can configure the security gateway to work as a standard network router to separate different subnets
on an internal network. Disabling NAT Mode disables the firewall security functions. This setting should
only be used for intranet deployments where the security gateway is used as a bridge on a protected
network. When the security gateway is configured for NAT mode, it behaves as a 802.1D (MAC bridge)
device.
To disable NAT Mode
See
1
2
3
Enabling the IDENT port
Disabling NAT mode
Blocking ICMP requests
Enabling WAN broadcast storm protection
Enabling IPsec pass-thru
Configuring an exposed host
"Advanced tab field descriptions"
In the SGMI, in the left pane, click Firewall.
In the right pane, on the Advanced tab, under Optional Security Settings, check Enable IDENT Port.
Click Save.
"Advanced tab field descriptions"
In the SGMI, in the left pane, click Firewall.
In the right pane, on the Advanced tab, under Optional Security Settings, check Disable NAT Mode.
Click Save.
on page 143.
on page 143.