Sonicwall Signatures

Category: PROXY-ACCESS

Proxy-Access Category Description

This SonicWALL IPS signature category consists of a group of signatures that can detect and prevent unauthorized access to proxy servers. Proxy servers help provide users inside a network with freedom of access to outside network services, often by circumventing a firewall. The traffic detected by these signatures is not a threat in and of itself, but it can represent a violation of network policy and possibly open the network to future attacks.

These signatures detect several different types of proxy server traffic ranging from higher security to lower security including outbound access to SOCKS servers, various programs that provide tunneling services, and generic attempts to access HTTP proxies outside the network. SOCKS connections require some form of authentication, and represent comparatively less risk than other proxy connections. Tunneling services, on the other hand, can open holes in the firewall that recieve less scrutiny than other traffic moving into the network. Other HTTP attempts can signal that the user is using services like Instant Messengers or Peer-to-Peer filesharing clients in violation of company policy. Some types of proxies can provide remote administrative access for users outside the network to workstations inside the network and evade a perimeter firewall.

SonicWALL signatures in this category are considered low-priority and are set by default to detect this type of network traffic. These signatures can be enabled if proxy access is in violation of network policy.