Chapter 20 Security Policy
USG20(W)-VPN Series User’s Guide
321
User Specific Security Policies
You can specify users or user groups in Security Policies. For example, to allow a specific user from
any computer to access a zone by logging in to the USG, you can set up a policy based on the user
name only. If you also apply a schedule to the Security Policy, the user can only access the network
at the scheduled time. A user-aware Security Policy is activated whenever the user logs in to the
USG and will be disabled after the user logs out of the USG.
Session Limits
Accessing the USG or network resources through the USG requires a NAT session and
corresponding Security Policy session. Peer to peer applications, such as file sharing applications,
may use a large number of NAT sessions. A single client could use all of the available NAT sessions
and prevent others from connecting to or through the USG. The USG lets you limit the number of
concurrent NAT/Security Policy sessions a client can use.
20.4 The Security Policy Screen
Asymmetrical Routes
If an alternate gateway on the LAN has an IP address in the same subnet as the USG’s LAN IP
address, return traffic may not go through the USG. This is called an asymmetrical or “triangle”
route. This causes the USG to reset the connection, as the connection has not been acknowledged.
You can have the USG permit the use of asymmetrical route topology on the network (not reset the
connection). However, allowing asymmetrical routes may let traffic from the WAN go directly to the
LAN without passing through the USG. A better solution is to use virtual interfaces to put the USG
and the backup gateway on separate subnets. Virtual interfaces allow you to partition your network
into logical sections over the same interface. See the chapter about interfaces for more information.
By putting LAN 1 and the alternate gateway (
A
in the figure) in different subnets, all returning
network traffic must pass through the USG to the LAN. The following steps and figure describe such
a scenario.
1
A computer on the LAN1 initiates a connection by sending a SYN packet to a receiving server on the
WAN.
2
The USG
reroutes the packet to gateway
A
, which is in
Subnet 2
.
3
The reply from the WAN goes to the USG.
4
The USG then sends it to the computer on the LAN1 in
Subnet 1
.
Summary of Contents for ZyWall USG20-VPN
Page 17: ...17 PART I User s Guide ...
Page 18: ...18 ...
Page 99: ...99 PART II Technical Reference ...
Page 100: ...100 ...
