Watchguard Firebox X5500E Reference Manual

Also see for Firebox X10E: Install guide Reference guide User guide Quick start guide Quick start guide

Contents

Watchguard Firebox X5500E Reference Manual Manual pdf 68 page image

Packet Filter Policies60 WatchGuard System ManagerProxy PoliciesThis section reviews the proxy policies supplied by the WatchGuard® System Manager. A proxy policyopens packets, strips out forbidden data types in the packet content, and assembles the packets againusing the source and destination headers of the proxy.You configure and activate proxies the same way you add packet filter policies.DNS-proxyDomain Name Service (DNS) matches host names to IP addresses. The DNS proxy policy examines thecontents of DNS packets to help protect your DNS servers from hackers. It puts limits on the type ofoperations allowed in a DNS query and can look for specified patterns in query names.Characteristics• Internet Protocol(s): TCP, UDP• Port Number(s): TCP 53, UDP 53FTP-proxyFile Transfer Protocol (FTP) is used to send files from one computer to a different computer over a TCP/IP network. The FTP client is usually a computer. The FTP server can be a resource that keeps files on thesame network or on a different network. The FTP client can be in one of two modes for data transfer:active or passive. In active mode, the server starts a connection to the client on source port 20. Inpassive mode, the client uses a previously negotiated port to connect to the server. The Fireware FTPproxy monitors and scans these FTP connections between your users and the FTP servers theyconnect to.Characteristics• Internet Protocol(s): TCP• Port Number: 21H323-proxyIf you use Voice-over-IP (VoIP) in your organization, you can add an H.323 proxy policy to open theports necessary to enable VoIP through your Firebox. This proxy policy has been created to work in aNAT environment to maintain security for privately addressed conferencing equipment behind theFirebox.H.323 is used commonly on older videoconferencing equipment and voice installations. With H.323,the key component of call management is known as the “GateKeeper.” The H.323 proxy supports onlypeer-to-peer connections.Characteristics• Internet Protocol(s): TCP, UDP• Port Number(s): TCP 1720, UDP 1719