Netgear FVS318N 사용자 설명서
Virtual Private Networking Using SSL Connections
283
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
For example, a policy that is configured for a single IP address takes precedence over a
policy that is configured for a range of addresses. And a policy that applies to a range of IP
addresses takes precedence over a policy that is applied to all IP addresses. If two or more
IP address ranges are configured, then the smallest address range takes precedence. Host
names are treated the same as individual IP addresses.
policy that is configured for a range of addresses. And a policy that applies to a range of IP
addresses takes precedence over a policy that is applied to all IP addresses. If two or more
IP address ranges are configured, then the smallest address range takes precedence. Host
names are treated the same as individual IP addresses.
Network resources are prioritized just like other address ranges. However, the prioritization is
based on the individual address or address range, not the entire network resource.
based on the individual address or address range, not the entire network resource.
For example, assume the following global policy configuration:
•
Policy 1. A Deny rule has been configured to block all services to the IP address range
10.0.0.0–10.0.0.255.
10.0.0.0–10.0.0.255.
•
Policy 2. A Deny rule has been configured to block FTP access to 10.0.1.2–10.0.1.10.
•
Policy 3. A Permit rule has been configured to allow FTP access to the predefined
network resource with the name FTP Servers. The FTP Servers network resource
includes the following addresses: 10.0.0.5–10.0.0.20 and the FQDN ftp.company.com,
which resolves to 10.0.1.3.
network resource with the name FTP Servers. The FTP Servers network resource
includes the following addresses: 10.0.0.5–10.0.0.20 and the FQDN ftp.company.com,
which resolves to 10.0.1.3.
Assuming that no conflicting user or group policies have been configured, if a user attempted
to access FTP servers at the following addresses, the actions listed would occur:
to access FTP servers at the following addresses, the actions listed would occur:
•
10.0.0.1. The user would be blocked by Policy 1.
•
10.0.1.5. The user would be blocked by Policy 2.
•
10.0.0.10. The user would be granted access by Policy 3. The IP address range
10.0.0.5–10.0.0.20 is more specific than the IP address range that is defined in Policy 1.
10.0.0.5–10.0.0.20 is more specific than the IP address range that is defined in Policy 1.
•
ftp.company.com. The user would be granted access by Policy 3. A single host name is
more specific than the IP address range that is configured in Policy 2.
more specific than the IP address range that is configured in Policy 2.
Note:
The user would not be able to access ftp.company.com using its IP
address 10.0.1.3. The wireless VPN firewall’s policy engine does not
perform reverse DNS lookups.
perform reverse DNS lookups.
View Policies
To view the existing SSL VPN policies:
1.
Select VPN > SSL VPN. The SSL VPN submenu tabs display, with the Policies screen
in view. (The following figure shows some examples.)
in view. (The following figure shows some examples.)