NETGEAR STM150 - ProSecure Web And Email Threat Management... User manual

202-10519-01
1.0
September 2009
NETGEAR, Inc.
350 East Plumeria Drive
San Jose, CA 95134
ProSecure Web/Email
Security Threat
Management (STM)
Appliance Reference
Manual
DRAFT

ii
v1.0, September 2009
© 2009 by NETGEAR, Inc. All rights reserved.
Trademarks
NETGEAR and the NETGEAR logo are registered trademarks and ProSecure is a trademark of NETGEAR, Inc.
Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Other brand and product
names are registered trademarks or trademarks of their respective holders.
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to
make changes to the products described in this document without notice.
NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit
layout(s) described herein.
Federal Communications Commission (FCC) Compliance Notice:
Radio Frequency Notice
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of
the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency
energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio
communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case
the user will be required to correct the interference at his own expense.
Changes or modifications not expressly approved by NETGEAR could void the user’s authority to operate the
equipment.
EU Regulatory Compliance Statement
The ProSecure Web/Email Security Threat Management Appliance STM150, STM300, or STM600 is compliant with
the following EU Council Directives: 89/336/EEC and LVD 73/23/EEC. Compliance is verified by testing to the
following standards: EN55022 Class B, EN55024 and EN60950-1.
Bestätigung des Herstellers/Importeurs
Es wird hiermit bestätigt, daß das ProSecure Web/Email Security Threat Management Appliance STM150, STM300, or
STM600 gemäß der im BMPT-AmtsblVfg 243/1991 und Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das
vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann jedoch gewissen Beschränkungen unterliegen. Lesen
Sie dazu bitte die Anmerkungen in der Betriebsanleitung.
Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt
gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.
Certificate of the Manufacturer/Importer
It is hereby certified that the ProSecure Web/Email Security Threat Management Appliance STM150, STM300, or
STM600 has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/
1992. The operation of some equipment (for example, test transmitters) in accordance with the regulations may,
however, be subject to certain restrictions. Please refer to the notes in the operating instructions.
Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market
and has been granted the right to test the series for compliance with the regulations.
DRAFT

v1.0, September 2009
iii
Voluntary Control Council for Interference (VCCI) Statement
This equipment is in the second category (information equipment to be used in a residential area or an adjacent area
thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing
Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas.
When used near a radio or TV receiver, it may become the cause of radio interference.
Read instructions for correct handling.
Additional Copyrights
AES Copyright (c) 2001, Dr. Brian Gladman, [e-mail], Worcester, UK.
All rights reserved.
TERMS
Redistribution and use in source and binary forms, with or without modification, are permitted
subject to the following conditions:
1. Redistributions of source code must retain the above copyright notice, this list of
conditions, and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions, and the following disclaimer in the documentation and/or other materials
provided with the distribution.
3. The copyright holder’s name must not be used to endorse or promote any products
derived from this software without his specific prior written permission.
This software is provided “as is” with no express or implied warranties of correctness or fitness
for purpose.
DRAFT

v1.0, September 2009
iv
Open SSL Copyright (c) 1998–2000 The OpenSSL Project. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted
provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of
conditions, and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions, and the following disclaimer in the documentation and/or other materials
provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the
following acknowledgment: “This product includes software developed by the OpenSSL
Project for use in the OpenSSL Toolkit (http://www.openssl.org/).”
4. The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or
promote products derived from this software without prior written permission. For written
permission, contact [email protected].
5. Products derived from this software may not be called “OpenSSL” nor may “OpenSSL”
appear in their names without prior written permission of the OpenSSL Project.
6. Redistributions of any form whatsoever must retain the following acknowledgment: “This
product includes software developed by the OpenSSL Project for use in the OpenSSL
Toolkit (http://www.openssl.org/).”
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS,” AND ANY
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young ([email protected]). This
product includes software written by Tim Hudson ([email protected]).
MD5 Copyright (C) 1990, RSA Data Security, Inc. All rights reserved.
License to copy and use this software is granted provided that it is identified as the “RSA Data
Security, Inc. MD5 Message-Digest Algorithm” in all material mentioning or referencing this
software or this function. License is also granted to make and use derivative works provided
that such works are identified as “derived from the RSA Data Security, Inc. MD5 Message-
Digest Algorithm” in all material mentioning or referencing the derived work.
RSA Data Security, Inc. makes no representations concerning either the merchantability of
this software or the suitability of this software for any particular purpose. It is provided “as is”
without express or implied warranty of any kind.
These notices must be retained in any copies of any part of this documentation and/or
software.
DRAFT

v1.0, September 2009
v
Product and Publication Details
PPP Copyright (c) 1989 Carnegie Mellon University. All rights reserved.
Redistribution and use in source and binary forms are permitted provided that the above
copyright notice and this paragraph are duplicated in all such forms and that any
documentation, advertising materials, and other materials related to such distribution and use
acknowledge that the software was developed by Carnegie Mellon University. The name of
the University may not be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED “AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
Zlib zlib.h. Interface of the zlib general purpose compression library version 1.1.4, March 11th,
2002. Copyright (C) 1995–2002 Jean-loup Gailly and Mark Adler.
This software is provided “as is,” without any express or implied warranty. In no event will the
authors be held liable for any damages arising from the use of this software. Permission is
granted to anyone to use this software for any purpose, including commercial applications,
and to alter it and redistribute it freely, subject to the following restrictions:
1. The origin of this software must not be misrepresented; you must not claim that you wrote
the original software. If you use this software in a product, an acknowledgment in the
product documentation would be appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be misrepresented
as being the original software.
3. This notice may not be removed or altered from any source distribution.
Jean-loup Gailly: jl[email protected]; Mark Adler: [e-mail].
The data format used by the zlib library is described by RFCs (Request for Comments) 1950
to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt (zlib format), rfc1951.txt (deflate
format), and rfc1952.txt (gzip format).
Model Number: STM
Publication Date: September 2009
Product Family: STM
Product Name: ProSecure Web/Email Security Threat Management Appliance STM150,
STM300, or STM600
Home or Business Product: Business
Language: English
Publication Part Number: 202-10519-01
Publication Version Number 1.0
DRAFT

v1.0, September 2009
vi
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
vii
v1.0, September 2009
Contents
About This Manual
Conventions, Formats, and Scope ..................................................................................xiii
How to Print This Manual ................................................................................................xiv
Revision History ...............................................................................................................xv
Chapter 1
Introduction
What Is the ProSecure Web/Email Security Threat Management Appliance STM150, STM300,
or STM600? ....................................................................................................................1-1
What Can You Do with an STM? ....................................................................................1-2
Key Features and Capabilities ........................................................................................1-3
Stream Scanning for Content Filtering .....................................................................1-4
Autosensing Ethernet Connections with Auto Uplink ...............................................1-4
Easy Installation and Management ..........................................................................1-5
Maintenance and Support ........................................................................................1-5
STM Model Comparison ..........................................................................................1-5
Service Registration Card with License Keys .................................................................1-6
Package Contents ..........................................................................................................1-7
Hardware Features .........................................................................................................1-7
Front Panel Ports and Status LEDs .........................................................................1-7
Rear Panel Features ....................................................................................................1-14
Bottom Panel With Product Label ..........................................................................1-15
Choosing a Location for the STM .................................................................................1-17
Using the Rack-Mounting Kit ..................................................................................1-18
Chapter 2
Using the Setup Wizard to Provision the STM in Your Network
Choosing a Deployment Scenario ..................................................................................2-1
Gateway Deployment ...............................................................................................2-1
Server Group ............................................................................................................2-2
Segmented LAN Deployment ...................................................................................2-3
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
viii
v1.0, September 2009
Understanding the Steps for Initial Connection ..............................................................2-4
Qualified Web Browsers ...........................................................................................2-5
Logging In to the STM ....................................................................................................2-5
Understanding the Web Management Interface Menu Layout .................................2-8
Using the Setup Wizard to Perform the Initial Configuration ........................................2-10
Setup Wizard Step 1 of 10: Introduction ................................................................2-10
Setup Wizard Step 2 of 11: Networking Settings ....................................................2-11
Setup Wizard Step 3 of 11: Time Zone ...................................................................2-13
Setup Wizard Step 4 of 11: Email Security .............................................................2-15
Setup Wizard Step 5 of 11: Web Security ..............................................................2-17
Setup Wizard Step 6 of 11: Email Notification Server Settings ..............................2-20
Setup Wizard Step 7 of 11: Update Settings ..........................................................2-21
Setup Wizard Step 8 of 11: HTTP Proxy Settings ..................................................2-23
Setup Wizard Step 9 of 11: Web Categories ..........................................................2-24
Setup Wizard Step 10 of 11: Configuration Summary ............................................2-26
Setup Wizard Step 11 of 11: Restarting the System ..............................................2-27
Verifying Proper Installation ..........................................................................................2-27
Testing Connectivity ...............................................................................................2-27
Testing HTTP Scanning .........................................................................................2-27
Registering the STM with NETGEAR ...........................................................................2-28
What to Do Next ...........................................................................................................2-30
Chapter 3
Performing Network and System Management
Configuring Network Settings .........................................................................................3-1
Configuring Session Limits and Timeouts ......................................................................3-5
Configuring the HTTP Proxy Settings .............................................................................3-7
About Users with Administrative and Guest Privileges ...................................................3-9
Changing Administrative Passwords and Timeouts .................................................3-9
Configuring Remote Management Access ...................................................................3-11
Using an SNMP Manager .............................................................................................3-13
Supported MIB Browsers .......................................................................................3-15
Managing the Configuration File ...................................................................................3-16
Backup Settings .....................................................................................................3-16
Restore Settings .....................................................................................................3-17
Reverting to Factory Default Settings ....................................................................3-18
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
ix
v1.0, September 2009
Updating the Software ..................................................................................................3-18
Scheduling Updates ...............................................................................................3-19
Performing a Manual Update .................................................................................3-21
Critical Updates That Require a Restart ................................................................3-22
Configuring Date and Time Service ..............................................................................3-23
Managing Digital Certificates ........................................................................................3-25
Managing the Certificate for HTTPS Scans ...........................................................3-27
Managing Untrusted Certificates ............................................................................3-30
Managing the Quarantine Settings ...............................................................................3-31
Performance Management ...........................................................................................3-32
Chapter 4
Content Filtering and Optimizing Scans
About Content Filtering and Scans .................................................................................4-1
Default E-mail and Web Scan Settings ....................................................................4-2
Configuring E-mail Protection .........................................................................................4-4
Customizing E-mail Protocol Scan Settings .............................................................4-4
Customizing E-mail Anti-Virus Settings ....................................................................4-5
E-mail Content Filtering ..........................................................................................4-12
Protecting Against E-mail Spam .............................................................................4-15
Configuring Web and Services Protection ....................................................................4-23
Customizing Web Protocol Scan Settings ..............................................................4-23
Configuring Web Malware Scans ...........................................................................4-25
Configuring Web Content Filtering .........................................................................4-27
Configuring Web URL Filtering ..............................................................................4-34
HTTPS Scan Settings ............................................................................................4-38
Specifying Trusted Hosts .......................................................................................4-41
Configuring FTP Scans ..........................................................................................4-43
Configuring Application Control ....................................................................................4-46
Setting Scanning Exclusions and Web Access Exceptions ..........................................4-49
Setting Scanning Exclusions ..................................................................................4-49
Setting Web Access Exception Rules ....................................................................4-50
Chapter 5
Managing Users, Groups, and Authentication
About Users, Groups, and Domains ...............................................................................5-1
Configuring Groups ........................................................................................................5-2
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
x
v1.0, September 2009
Creating and Deleting Groups by Name ..................................................................5-3
Editing Groups by Name ..........................................................................................5-4
Creating and Deleting Groups by IP Address and Subnet .......................................5-6
Configuring User Accounts .............................................................................................5-7
Creating and Deleting User Accounts ......................................................................5-7
Editing User Accounts ..............................................................................................5-8
Configuring Authentication .............................................................................................5-9
Understanding Active Directories and LDAP Configurations .................................5-11
How an Active Directory Works ..............................................................................5-12
How to Bind a ‘dn’ in an in LDAP Configuration .....................................................5-12
Creating and Deleting LDAP and Active Directory Domains ..................................5-16
Editing LDAP and Active Directory Domains .........................................................5-19
Creating and Deleting RADIUS Domains ...............................................................5-19
Editing RADIUS Domains and Configuring VLANs ................................................5-22
Global User Settings .....................................................................................................5-24
Viewing and Logging Out Active Users ........................................................................5-26
Chapter 6
Monitoring System Access and Performance
Configuring Logging, Alerts, and Event Notifications .....................................................6-1
Configuring the E-mail Notification Server ...............................................................6-2
Configuring and Activating System, E-mail, and Syslog Logs .................................6-3
Configuring Alerts .....................................................................................................6-8
Monitoring Real-Time Traffic, Security, Statistics, and Web Usage ..............................6-10
Understanding the Information on the Dashboard Screen .....................................6-11
Monitoring Web Usage ...........................................................................................6-18
Viewing System Status .................................................................................................6-19
Querying Logs and Generating Reports .......................................................................6-21
Querying the Logs ..................................................................................................6-22
Scheduling and Generating Reports ......................................................................6-29
Viewing and Managing the Quarantine Files ................................................................6-33
Using Diagnostics Utilities ............................................................................................6-40
Using the Network Diagnostic Tools .......................................................................6-41
Using the Realtime Traffic Diagnostics Tool ...........................................................6-42
Gathering Important Log Information and Generating a Network Statistics Report 6-43
Restarting and Shutting Down the STM .................................................................6-45
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
xi
v1.0, September 2009
Chapter 7
Troubleshooting and Using Online Support
Basic Functioning ...........................................................................................................7-2
Power LED Not On ...................................................................................................7-2
Test LED (STM150) or Status LED (STM300 and STM600) Never Turns Off .........7-2
LAN or WAN Port LEDs Not On ...............................................................................7-3
Troubleshooting the Web Management Interface ...........................................................7-3
When You Enter a URL or IP Address a Time-out Error Occurs ....................................7-4
Troubleshooting a TCP/IP Network Using a Ping Utility .................................................7-4
Testing the LAN Path to Your STM ..........................................................................7-4
Testing the Path from Your PC to a Remote Device ................................................7-5
Restoring the Default Configuration and Password ........................................................7-6
Problems with Date and Time .........................................................................................7-7
Using Online Support .....................................................................................................7-7
Enabling Remote Troubleshooting ...........................................................................7-7
Installing Hot Fixes ...................................................................................................7-8
Sending Suspicious Files to NETGEAR for Analysis .............................................7-10
Accessing the Knowledge Base and Documentation .............................................7-11
Appendix A
Default Settings and Technical Specifications
Appendix B
Related Documents
Index
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
xii
v1.0, September 2009
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
xiii
v1.0, September 2009
About This Manual
<<Roland: checkbox or check box>. Do search. TBD prior to final draft.>>
<<Roland: Bold all GUI field names and GUI section names? TBD prior to final draft.>>
The NETGEAR®ProSecure™ Web/Email Security Threat Management Appliance STM Reference
Manual describes how to configure and troubleshoot a ProSecure Web/Email Security Threat
Management Appliance STM150, STM300, or STM600. The information in this manual is
intended for readers with intermediate computer and networking skills.
Conventions, Formats, and Scope
The conventions, formats, and scope of this manual are described in the following paragraphs:
•Typographical conventions.This manual uses the following typographical conventions:
•Formats.This manual uses the following formats to highlight special messages:
Italic Emphasis, books, CDs
Bold User input, IP addresses, GUI screen text
Fixed Command prompt, CLI text, code
italic URL links
Note: This format is used to highlight information of importance or special interest.
Tip: This format is used to highlight a procedure that will save time or resources.
Warning: Ignoring this type of note might result in a malfunction or damage to the
equipment.
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
xiv
v1.0, September 2009
•Scope.This manual is written for the STM according to these specifications:
For more information about network, Internet, firewall, and VPN technologies, click the links to
the NETGEAR website in Appendix B, “Related Documents.”
How to Print This Manual
To print this manual, your computer must have the free Adobe Acrobat reader installed in order to
view and print PDF files. The Acrobat reader is available on the Adobe Web site at
http://www.adobe.com.
Danger: This is a safety warning. Failure to take heed of this notice might result in
personal injury or death.
Product ProSecure Web/Email Security Threat Management Appliance
STM150, STM300, or STM600
Manual Publication Date September 2009
Note: Product updates are available on the NETGEAR, Inc. website at
http://prosecure.netgear.com.
Note: Go to http://prosecure.netgear.com/community/forum.php for information about
the ProSecure™ forum and to become part of the ProSecure™ community.
Tip: If your printer supports printing two pages on a single sheet of paper, you can save
paper and printer ink by selecting this feature.
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
xv
v1.0, September 2009
Revision History
Manual Part
Number
Manual
Version
Number
Publication
Date Description
202-10519-01 1.0 September 2009 Initial publication of this reference manual.
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
xvi
v1.0, September 2009
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
Introduction 1-1
v1.0, September 2009
Chapter 1
Introduction
This chapter provides an overview of the features and capabilities of the ProSecure Web/Email
Security Threat Management Appliance STM150, STM300, or STM600. It also identifies the
physical features of the appliances and the contents of the product packages.
This chapter contains the following sections:
•“What Is the ProSecure Web/Email Security Threat Management Appliance STM150,
STM300, or STM600? on this page.
•“What Can You Do with an STM?” on page 1-2.
•“Key Features and Capabilities” on page 1-3.
•“Service Registration Card with License Keys” on page 1-6.
•“Rear Panel Features” on page 1-14.
•“Bottom Panel With Product Label” on page 1-15.
•“Choosing a Location for the STM” on page 1-17.
What Is the ProSecure Web/Email Security Threat
Management Appliance STM150, STM300, or STM600?
The ProSecure Web/Email Security Threat Management Appliance STM150, STM300, or
STM600, hereafter referred to as the STM, is an appliance-based, Web security solution that
protects the network perimeter against Web-borne threats from spyware, viruses, and e-mail, and
blended threats. Ideally deployed at the gateway, it serves as the network’s first line of defense
against all types of threats and complements firewalls, Intrusion Detection Systems (IDS)/
Intrusion Prevention Systems (IPS), dedicated Intranet security products, and endpoint antivirus
and anti-spyware software.
Powered by patent-pending Stream Scanning technology and backed by one of the most
comprehensive malware databases in the industry, the STM can detect and stop all known spyware
and viruses at the gateway, preventing them from reaching your desktops and servers, where
cleanup would be much more difficult.
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
1-2 Introduction
v1.0, September 2009
In addition to scanning HTTP, HTTPS, FTP, SMTP, POP3, and IMAP traffic, the STM protects
networks against spam phishing attacks and unwanted Web use. The STM is a plug-and-play
device that can be installed and configured within minutes.
What Can You Do with an STM?
The STM combines robust protection against malware with ease of use and advanced reporting
and notification features to help you deploy and manage the device with minimal effort.
Here are some of the things that you can do with the STM:
•Protect the network instantly. The STM is a plug-and-play security solution that can be
instantly added to networks without requiring network reconfiguration.
•Scan network traffic for malware. Using the patent-pending Stream Scanning technology,
you can configure the STM to scan HTTP, SMTP, POP3, HTTPS, IMAP, and FTP protocols.
Unlike traditional batch-based scan engines that need to cache the entire file before they can
scan, this scan engine checks traffic as it enters the network, ensuring unimpeded network
performance.
•Set access policies for individual users or groups. You can configure Web and e-mail access
access policies for individual users and groups based on the STM’s local database, on group IP
address, on LDAP domain, group, or user, or on RADIUS VLAN.
•Receive real-time alerts and generate comprehensive reports. You can configure the STM
to send alerts when a malware or an outbreak is detected on the network. Real-time alerts can
be sent by e-mail, allowing you to monitor malware events wherever you are.
By configuring the STM to send malware alerts, you can isolate and clean the infected
computer before the malware incident can develop into a full-blown outbreak. The STM also
provides comprehensive reports that you can use to analyze network and malware trends.
•Manage through SNMP support. You can enable and configure the STM’s SNMP settings to
receive SNMP traps through a supported MIB browser.
•Allow automated component updates. Downloading components regularly is the key to
ensuring updated protection against new threats. The STM makes this administrative task
easier by supporting automatic malware pattern, program, and engine updates.
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
Introduction 1-3
v1.0, September 2009
Key Features and Capabilities
The STM provides the following key features and capabilities:
• Up to two pairs of 10/100/1000 Mbps Gigabit Ethernet WAN ports (see “STM Model
Comparison” on page 1-5).
• Scalable support (see “STM Model Comparison” on page 1-5) for:
– up to 600 concurrent users
– up to 4000 concurrently scanned HTTP sessions
– up to 239 MB/s HTTP throughput
– up to 960,000 e-mails per hour SMTP throughput.
• Patent-pending Stream Scanning technology that enables scanning of real-time protocols such
as HTTP.
• Comprehensive Web and e-mail inbound and outbound security, covering six major network
protocols: HTTP, HTTPS, FTP, SMTP, POP3, and IMAP.
• URL content filtering with 64 categories.
• Malware database containing hundreds of thousands of signatures of spyware, viruses, and
other malware.
• Automatically updated malware signatures, as frequently as every 15 minutes.
• Multiple anti-spam technologies to provide extensive protection against unwanted mail.
• Spam and malware quarantine for easy analysis.
• Web application control, including access control for instant messaging, media applications,
peer-to-peer applications, and Web-based tools and toolbars.
• User management with LDAP, Active Directory, and RADIUS integration, allowing access
policy configuration per user and per group.
• Easy, Web-based wizard setup for installation and management.
• SNMP-manageable.
• Dedicated management interface (model dependent, see “STM Model Comparison” on
page 1-5).
• Hardware bypass port to prevent network disruption in case of subscription expiration or
failure (model dependent, see “STM Model Comparison” on page 1-5).
• Front panel LEDs for easy monitoring of status and activity.
• Internal universal switching power supply.
DRAFT

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual
1-4 Introduction
v1.0, September 2009
Stream Scanning for Content Filtering
Stream Scanning is based on the simple observation that network traffic travels in streams. The
STM scan engine starts receiving and analyzing traffic as the stream enters the network. As soon
as a number of bytes are available, scanning starts. The scan engine continues to scan more bytes
as they become available, while at the same time another thread starts to deliver the bytes that have
been scanned.
This multithreaded approach, in which the receiving, scanning, and delivering processes occur
concurrently, ensures that network performance remains unimpeded. The result is file scanning is
up to five times faster than with traditional antivirus solutions—a performance advantage that you
will notice.
Stream Scanning also enables organizations to withstand massive spikes in traffic, as in the event
of a malware outbreak. The scan engine has the following capabilities:
•Real-time protection. The patent-pending Stream Scanning technology enables scanning of
previously undefended real-time protocols, such as HTTP. Network activities susceptible to
latency (for example, Web browsing) are no longer brought to a standstill.
•Comprehensive protection. Provides both Web and e-mail security, covering six major
network protocols: HTTP, HTTPS, FTP, SMTP, POP3, and IMAP. The STM uses enterprise-
class scan engines employing both signature-based and Distributed Spam Analysis to stop
both known and unknown threats. The malware database contains hundreds of thousands of
signatures of spyware, viruses, and other malware.
•Objectionable traffic protection. The STM prevents objectionable content from reaching
your computers. You can control access to the Internet content by screening for Web
categories, Web addresses, and Web services. You can log and report attempts to access
objectionable Internet sites.
•Automatic signature updates. Malware signatures are automatically updated as frequently as
every 15 minutes.
Autosensing Ethernet Connections with Auto Uplink
With its internal 10/100/1000 ports, the STM can connect to either a 10 Mbps standard Ethernet
network, a 100 Mbps Fast Ethernet network, or a 1000 Mbps Gigabit Ethernet network. The
interfaces are autosensing and capable of full-duplex or half-duplex operation.
The STM incorporates Auto UplinkTM technology. Each Ethernet port will automatically sense
whether the Ethernet cable plugged into the port should have a “normal” connection such as to a
PC or an “uplink” connection such as to a switch or hub. That port will then configure itself to the
correct configuration. This feature eliminates the need to worry about crossover cables, as Auto
Uplink will accommodate either type of cable to make the right connection.
DRAFT