Enabling Advanced Protection Settings; Ip Spoofing Protection; Tcp Flag Validation - Symantec 460R - Gateway Security Administrator's Manual

4
5

Enabling advanced protection settings

Advanced protection settings help you protect your network beyond attacks that can be identified by
atomic signatures.

IP spoofing protection

Any non-broadcast or multicast packet arriving on a WAN interface with a source IP address that matches
any internal subnet is blocked and flagged as an IP spoofing attempt. Internal subnets are derived from the
LAN side subnet address of the appliance and the static route entries on the appliance for the LAN
interface.
Likewise, any non-broadcast or non-multicast traffic that arrives at the internal or wireless interface with a
source IP address that does not match any predefined internal network is blocked and logged as an internal
IP spoofing attempt. Internal networks are derived from static routes on the unit and the internal LAN/
WLAN address of the unit. Spoof protection can be disabled for the internal LANs and WAN.
To enable IP spoof protection
See "IDS Protection tab field descriptions"
1
2
3

TCP flag validation

Certain port mapping tools, such as NMAP, use invalid TCP flag combinations to detect a firewall on a
network or map the security policy implemented on the firewall. Symantec Gateway Security 400 Series
blocks and logs any traffic with illegal flag combinations for traffic that is not being denied by the security
policy. Any traffic denied by the security policy that has one or more bad TCP flag combinations is
classified as one of several NMAP port scanning techniques (NMAP Null Scan, NMAP Christmas Scan, and
so on).
To enable TCP flag validation
See "IDS Protection tab field descriptions"
1
2
Next to Protection Area, select an interface to protect.
Click Update.
In the SGMI, in the left pane, click IDS/IPS.
In the right pane, on the Advanced tab, under IP Spoof Protection, check WAN or WLAN/LAN.
Click Save.
In the SGMI, in the left pane, click IDS/IPS.
In the right pane, on the Advanced tab, under TCP Flag Validation, check Enable.
on page 154.
on page 154.
Preventing attacks
Enabling advanced protection settings
91