Norman NetworkProtection Service manual

Antivirus
Norman SandBox
Reports & statistics
Appliance Administrator Guide
version 4.2

Limited Warranty
Norman guarantees that the enclosed CD-ROM or DVD-R and documentation do not have produc-
tion aws. If you report a aw within 30 days of purchase, Norman will replace the defective CD-ROM,
DVD-R, and/or documentation at no charge. Proof of purchase must be enclosed with any claim.
This warranty is limited to replacement of the product. Norman is not liable for any other form of loss
or damage arising from use of the software or documentation or from errors or deciencies therein,
including but not limited to loss of earnings.
With regard to defects or aws in the CD-ROM, DVD-R or documentation, or this licensing agreement,
this warranty supersedes any other warranties, expressed or implied, including but not limited to the
implied warranties of merchantability and tness for a particular purpose.
In particular, and without the limitations imposed by the licensing agreement with regard to any spe-
cial use or purpose, Norman will in no event be liable for loss of prots or other commercial damage
including but not limited to incidental or consequential damages.
This warranty expires 30 days after purchase.
The information in this document as well as the functionality of the software is subject to change with-
out notice. The software may be used in accordance with the terms of the license agreement. The
purchaser may make one copy of the software for backup purposes. No part of this documentation
may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording or information storage and retrieval systems, for any purpose other than the
purchaser’s personal use, without the explicit written permission of Norman.
The Norman logo is a registered trademark of Norman ASA.
Names of products mentioned in this documentation are either trademarks or registered trademarks of
their respective owners. They are mentioned for identication purposes only.
Norman documentation and software are Copyright © 1990-2011 Norman ASA.
All rights reserved.
Last revision May 20, 2011.
Copyright © 1990-2011 Norman ASA ii
Norman Network Protection
Administrator Guide

Incident statistics ...................................................... 37
Functions .............................................................. 37
Congure .................................................................. 38
Scanner settings .................................................... 38
Network conguration ............................................. 42
Join Endpoint Manager Realm ................................. 45
Block and Exclude settings ..................................... 46
Message handling .................................................. 48
Logging options ..................................................... 52
Blocking ................................................................ 52
Remote access ...................................................... 53
System time........................................................... 53
Change administrator password ............................... 54
Change license key ................................................ 54
Setup Wizard ......................................................... 54
Install and Update .................................................... 55
Settings ................................................................. 55
Critical updates ...................................................... 56
Support Center ......................................................... 58
Starting and stopping .............................................. 59
Troubleshooting .................................................. 60
Appendix A:
Accessing the Command Line Interface
console ................................................................. 63
Appendix B:
Using the Network Protection console .............. 64
Understanding the screen output ............................. 64
Console commands .................................................. 66
Command line conguration ..................................... 69
Conguration commands ........................................ 69
Cluster commands and parameters .......................... 71
Using port mirror mode ........................................... 73
URL blocking ......................................................... 74
Protocol/scan-related commands ............................. 74
Appendix C:
Using Network Protection in port mirror mode 77
Conguring ............................................................... 77
Nonoperative functions ............................................. 78
System requirements ................................................. 4
Obtaining Norman Network Protection ....................... 4
About this guide .......................................................... 4
Help and support ........................................................ 4
Introduction ............................................................ 5
Network virus protection ............................................. 5
The Norman approach .............................................. 5
Norman Network Protection versus proxy ................... 6
What is Norman Network Protection? ......................... 6
Implementation .......................................................... 7
Home or small ofce network ..................................... 7
Business network ..................................................... 7
Functionality ............................................................... 8
Installation ............................................................ 10
Prerequisites ............................................................ 10
Conguration ............................................................ 10
Completing the web-based Setup Wizard ................. 15
Setup wizard ............................................................. 17
Administration and conguration ...................... 25
Log in ........................................................................ 25
Home ........................................................................ 25
Navigating the user interface ................................... 26
Status ....................................................................... 26
Version and uptime ................................................. 27
Malware scans ....................................................... 27
Network Interface Cards ......................................... 27
Protocol ................................................................ 27
Restart Network Protection ...................................... 28
System monitor ........................................................ 28
System information ................................................. 28
Network information................................................ 29
Incident logs ............................................................. 29
Detailed view ......................................................... 30
Download log le .................................................... 31
Show Sandbox log ................................................. 32
Blocked URLs ........................................................... 33
Blocked URLs default expiration time ....................... 33
Detailed view ......................................................... 33
Custom URL block .................................................... 34
Trafc Statistics ........................................................ 35
Functions .............................................................. 35
Table of Contents
Copyright © 1990-2011 Norman ASA iii
Norman Network Protection
Administrator Guide

4
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide | System requirements
System requirements
The Norman Network Protection appliance contains all the needed software.
Obtaining Norman Network Protection
Please contact your nearest Norman office for your Norman Network Protection appliance. Norman
Network Protection offers a flexible and cost effective solution.
About this guide
This manual is intended for system administrators and others responsible for network security to
install, operate and maintain Norman Network Protection. This manual assumes that the reader is well
versed in network terminology and operation.
Help and support
We strongly recommend that you read this guide thoroughly before installing Norman Network
Protection, and that you use it as reference during installation. In this guide you will find instructions
on how to install and upgrade your licensed software as well as how to use it.
For training or further support issues please do not hesitate to contact your local dealer or a Norman
Office. Please see the last page of this document for information on Norman Offices.
We also encourage you to visit our web site for detailed support issues, to search in articles, or study
support issues.
Support
http://www.norman.com/support/
Other NNP links
http://www.norman.com/support/search_support_database/?searchString%3Autf8%3Austring=&os%3A
int=0&product%3Aint=58443
http://www.norman.com/support/search_support_database/?searchString%3Autf8%3Austring=&os%3A
int=0&product%3Aint=58432

5
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Introduction | Network virus protection
Introduction
Network virus protection
In large and complex networks a significant effort is often needed to protect network resources against
viruses and other malicious code. A wide range of different antivirus products is often needed in order
to ensure full protection on all servers and all clients in the network.
A full range of protection is costly to purchase, configure, and maintain. Even with an extensive range
of antivirus products in place, there is still no guarantee that every potential security risk is covered.
Virus infections and outbreaks can still occur. If one or more network clients are not updated correctly
or if one computer unknown to the administrator is unprotected, the entire network is exposed to a
virus outbreak.
The most common point of origin of viruses and other forms of malicious code is the Internet. There-
fore scanning for malicious code at the entry to a LAN would protect that network. There are different
ways to protect the LAN:
Proxy server Any data stream entering the LAN is intercepted and scanned before it is
passed on to the destination machine.
Firewall Access to certain network addresses and/or services is restricted according
to tables of rules configured in the firewall.
The main disadvantage with using a proxy server to scan incoming streams is that the entire stream
must be gathered before it is scanned. Only when the entire data stream has been scanned and
established free of malicious code it is passed on to the recipient.
A firewall provides some protection against malicious code but does not operate on data content. It is
concerned more with point of origin and direct access to services within the network. This can cause
latency in the network.
The Norman approach
Centralizing protection for all units in a network reduces the effort needed by the administrator and
provides protection for all the potential security risks in the network, whether resident or introduced by
an external source.
Norman Network Protection aims to deliver such a concept, protecting both servers and clients in the
network. By placing Network Protection between the Internet and the local network, each computer
on the network side is protected, and viruses being downloaded are stopped before they reach their
destination.
The Network Protection technology is simplicity at its best. Simply connecting the Network Protection
machine to the LAN and starting the executable can protect an entire LAN segment behind the
Network Protection.
Network Protection is independent of the network topology and the other units in the network. It is
effectively transparent to all other entities in the network, which allows them to operate uninterrupted
by Network Protection. This is a strong advantage over conventional proxy solutions where network
entities require configuration to enable the proxy.

6
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Introduction | Implementation
Norman Network Protection versus proxy
Traditional proxy solutions have several drawbacks. Most important is the latency effect because the
proxy holds back the entire stream until it has received all the data and analyzed it in its entirety.
Network Protection avoids this problem since it does not hold back more data than necessary. It takes
packets from the stream and reassembles them locally as a file. When the amount of data collected is
what the scanner engine has required, the packets are duplicated in Network Protection and the origi-
nals are passed on.
However, when the engine is busy scanning, the packets are held back until the engine returns with
status OK. In this case a slight delay in the transmission of the last packet may be experienced, but
generally there is practically no interruption to the packet flow. Packets belonging to an unsupported
session type are not scanned. As the stream is passing through the system it is scanned, and as soon
as something malicious is found, the stream is stopped.
Proxy servers require quite a bit of configuration on both servers and clients. Moreover, the proxy
solution needs maintenance when running in the network.
Network Protection is transparent to the network operation and requires no network adaptation and
very little assistance to keep it in order once it is up and running. Since Network Protection works on
packet level, the system has full control over the network flow.
What is Norman Network Protection?
Norman Network Protection is a new technology from Norman providing protection for an entire local
area network or critical segment of a network. Norman Network Protection can be installed onto an
Intel based server with three network interfaces. One network interface is reserved for alerting and
remote configuration and the remaining interfaces collect network packets for scanning from the net-
work segments they are connected to.
In a pair of connected interfaces, one interface provides an upstream or naked network connection,
while the second interface provides the downstream or protected network connection. The network
connections can be of any physical type that supports the TCP/IP protocol.
Figure 1: The Network Protection installed
In Figure 1 Network Protection runs NIC1 and NIC2 in promiscuous mode. This means that all net-
work packets from the other network will be received by the network cards regardless of their destina-
tion address.
Packets of the selected protocol type are then gathered into a group and passed on to the scanning
engine to be scanned for malicious code. If the group of packets are clean, they are passed on to the
protected zone via NIC2. If the packets contain malicious code, they are effectively blocked from the
protected zone and an alert is sent to the network via NIC0. Norman Network Protection is also avail-
able as an appliance.
NIC1 NIC2
NIC0

7
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Introduction | Implementation
Implementation
Network Protection machines can be placed anywhere within a network. Network Protection can be
used in a number of ways to protect all or parts of a network. The following paragraphs will describe
some common scenarios where it can be used to minimize the infection risk from viruses and other
malware.
Home or small office network
The most common method of connecting a network to the Internet is through a gateway server. All
requests to the Internet from the network clients are then seen to originate from this gateway server.
Traffic from the Internet to the client is also seen to originate from this server. By placing the Network
Protection server between the gateway and the LAN, as shown in Figure 2, it protects the entire LAN
from malicious code entering from the Internet.
Figure 2: Protecting a small office or home network
Business network
A business will usually connect to the Internet in the same way as a small office network. The dif-
ference is that the business network will have a number of resources it can make available to the
Internet. These resources are most likely an email server, a web server, and an FTP server. These
servers are normally placed in a demilitarized zone (DMZ) through a separate connection to the fire-
wall.
The firewall divides the network into an untrusted zone, a trusted zone, and a demilitarized zone
(DMZ). Network Protection thus protects the LAN from both the Internet and machines in the DMZ.
The DMZ is also protected from the Internet, providing a belt-and-braces security to the entire net-
work.

8
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Introduction | Functionality
Figure 3: Network Protection - protecting a business enterprise.
Functionality
Norman Network Protection works at the Data Link Layer within the OSI data transmission model.
This allows it to operate on a number of protocols and offers more features than proxy solutions.
Network Protection has configurable protocol scanning that can be enabled and disabled in real-time.
Furthermore, it can be configured to block protocols, computers and network segments depending on
the infections and the threats in the network. In addition, Network Protection uses Norman Sandbox
technology which can stop new and undiscovered viruses and worms before detection signature files
have been released.
Currently, Network Protection scans protocols with a high probability of carrying malicious traffic.
Traffic on unsupported protocols pass through unhindered. Currently supported protocols are:
● HTTP Normal web content traffic including web mail
● SMTP Outgoing email traffic
● POP3 Incoming email traffic
● RPC Remote procedure call traffic
● FTP File transfer protocol
● TFTP Trivial file transfer protocol
● Windows File Sharing Covers the protocols CIFS, SMB, and SMB2
● IRC Internet Relay Chat, a chat system protocol
● MSN Microsoft Windows Live Messenger - a real-time chat application and protocol
● BitTorrent Peer-to-peer file sharing protocol used for distributing large amounts of data
Protocol scanning does not rely on port identification. All packet headers are inspected to identify the
protocol independent of the port. If, for example, the HTTP protocol is being identified on port 4599 it
will still be scanned.
Network Protection scanning performance is dependent on the number of protocols being monitored,
the number of network segments covered and the number of network clients.
As each packet is received, it is passed on to the appropriate protocol-scanning module. Each scan-

9
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Introduction | Functionality
ning module calls the scanning engine, which in turn requests portions of data from the packet or sub-
sequent packets in the sequence.
Alternatively, if Norman Sandbox is enabled, the received packets are assembled in an emulated
environment where the code’s behavior can be analyzed. If the packet is found to contain malicious
code, it is quarantined and blocked from travelling any further in the network. Network Protection will
broadcast an alert from the alert/remote configuration connection. Network Protection offers a variety
of features to encompass operation and maintenance.
● Norman Sandbox technology
○ Enables Network Protection to detect new viruses before a detection signature has been
released by analyzing what the code does in a virtual environment before it runs on a real
machine.
● NIU signature update
○ Norman Internet Update (NIU) can be set to automatically update the virus scanning engine
and signature files at hourly intervals.
● Decompression
○ Network Protection can decompress packets representing files compressed in a number of dif-
ferent formats before scanning the content.
○ The following compressed file formats are supported:
ACE (decompression only)
ACE self extractors (decompression only)
Apple single (decompression only)
ARJ (compression/decompression)
BZip2 (compression/decompression)
CAB (decompression only)
CAB self extractors (decompression only)
CHM/ITSF (decompression only)
GZ (compression/decompression)
InnoSetup installer (decompression only)
LZH (decompression only)
Mail/MIME with base 64, QP or UUE encoding (compression/
decompression)
MSI (decompression only)
Nullsoft Installer (decompression only)
RAR version 2 (decompression only)
RAR version 3 (store/decompression)
RAR version 3 (self extractors (decompression only)
TAR (compression/decompression)
Wise SFX (decompression only)
ZIP (compression/decompression/append new objects)
ZIP self extractors (decompression only)
7Zip (decompression only)
● Real-time configuration
○ Network Protection can be configured while it is running without having to restart the applica-
tion.
● Comprehensive alert system
○ Alerts can be delivered as SNMP traps or SMTP (email message) to interested parties.
● Suitable for a wide variety of network sizes and topologies

10
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Installation | Prerequisites
Installation
The Norman Network Protection appliance is pre-installed with Norman Network Protection software.
The action required from you is to provide your network IP address details and to change the default
passwords.
Prerequisites
To take full advantage of the Network Protection functions, a good understanding of running programs
on the Linux platform and network management is recommended.
You will need to have the following available:
○ An IP address for the management network interface.
○ Access to Internet from the above-mentioned IP address.
For easier deployment you can plan your IP address, hostname, etc. before you start the installation:
Network Planning Worksheet
Host name
Network Protection Primary IP address
Default Gateway
DNS Suffix
DNS Server 1
DNS Server 2
Network speed and duplex setting (inside NIC)
Network speed and duplex setting (outside NIC)
Configuration
IMPORTANT
Do not connect the in and out interfaces to your network before you have completed the configuration.
1. Connect a monitor and a USB keyboard to the Network Protection appliance.
2. Power up the Network Protection appliance.
3. When the device has finished booting up, follow the instructions as described below. When
prompted, use the details from your ‘Network Planning Worksheet’.
If you have been provided a newer NNP version as ISO image or on USB please follow the
instructions provided.

11
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Installation | Conguration
Figure 4: Starting the installation by selecting an option.
4. Checking installation archives. The installer will check the integrity of the installation archive.:
Figure 5: Progress bar displays checking installation archives.

12
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Installation | Conguration
5. Select your keyboard layout and click Next.:
Figure 6: Select keyboard layout.
6. Select your time zone by choosing continent and then country:
Figure 7: Select time zone.

13
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Installation | Conguration
7. Root password. Enter your desired password. The password is the same for both the web-based
admin interface and the Linux console, so store it in a safe place.
Figure 8: Enter and confirm the root password.
8. Admin interface setup. You need an IP address to manage your NNP. Use your Network Planning
Worksheet now and enter the details in the appropriate fields.

14
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Installation | Conguration
Figure 9: Admin interface setup.
The optimal configuration is to use the eth0 as Admin interface, and the eth2 and eth3 as “Bridge”
interfaces.
9. Installing files from archive. The installation will resume. Click Details for verbose output.

15
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Installation | Conguration
Figure 10: Installing files from archive.
10. Configuration and installation is now complete. Click Reboot to finish and start Norman Network
Protection.
Figure 11: Installation complete.
11. After completing the configuration wizard connect the device to the network as described in the
next chapter.
Completing the web-based Setup Wizard
IMPORTANT
Do not power up the appliance before connecting it to the network.
1. Connect only the Admin interface to the appropriate switch in your network. Make sure that it is
accessible from your network, and that it is not connected behind the Eth1 interface.
2. Connect to the IP address of the appliance on port 2868 from another computer.
• Example:
http://<MyNetworkProtectionApplianceIPaddress>:2868
3. You will be asked for a username and password.
• User name: admin
• Password: the password you selected during the installation

16
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide Installation | Conguration
Figure 12: Connect to Network Protection - Username and password

17
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide | Setup wizard
Setup wizard
The first time you log in to Network Protection, the Setup wizard will guide you through the initial
configuration. Make sure that you have the license key available. You will be prompted for a valid key
as part of the setup procedure. If you need to run the wizard again, it’s located under Configure >
Setup Wizard.
1. Remote access
You can restrict access to the Network Protection web interface to single IP addresses or subnets,
using the following format:
● 192.168.0.4/255.255.255.0
This entry will accept access for the single IP address 192.168.0.4
● 192.168.0.0/255.255.255.0
This entry will accept access for the entire subnet 192.168.0.0
See also page 53.
Figure 6: Setup Wizard Remote Access
Note
IP address 0.0.0.0/0.0.0.0 is default and will provide access to all IP addresses. Please remove
this entry only after other IP addresses have been entered. IPv6 addresses are also supported. Failing
to do so will cut off all access to the web-based management interface.
2. Providing the license key
The license key enables Network Protection to be updated with signature and scanner engine
updates. The license key is provided by your local vendor. If you did not get a license key when you
purchased Norman Network Protection, please contact your local vendor or your local Norman office.
Figure 7: Setup Wizard License Key
3. Join Endpoint Manager Realm
This option allows you to manage NNP centrally from a Norman Endpoint Manager console. To man-
age this NNP centrally, you must enter the IP address, username and password for the Norman
Endpoint Manager. See also page 45.

18
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide | Setup wizard
Figure 8: Join Endpoint Manager Realm.
4. Configuring operation mode
These settings will determine how Network Protection will operate. Please select the preferred mode
in the Setup wizard.
Figure 9: Setup Wizard Operation mode
● Log only - All traffic will be scanned and malware will be detected but not
stopped. Caution using this mode.
○ This option allows all selected protocols to be scanned, but will only log malware that is detect-
ed. No malware will be stopped. Typically used for demonstration purposes. Please be cautious
using this mode, as your computers will still be vulnerable for malware.
● Bypass - No traffic will be scanned
○ This option allows all traffic to be transferred through Network Protection without being
scanned. Using this option will result in no traffic or incident statistics.
● Block - All traffic will be stopped
○ This option will effectively block all traffic from being transferred through Network Protection.
This option is known as the ‘Panic button’.
Note
Please use this option with care as absolutely all traffic in the segment/network where Network
Protection is installed will be blocked.
● Scan - All traffic will be scanned
○ The most used option. By selecting this option all traffic on supported protocols will be scanned
for malware.
● Sites blocked will be blocked for
○ The period an URL is blocked can be changed with this option. The default value is 1 week.
Select the desired value for the period a blocked URL/path should remain blocked.

19
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide | Setup wizard
Note
This value can also be changed individually per blocked URL in the Blocked URL menu.
● Maximum file size for scanning
○ This option allows you to change the default limit for the file sizes Network Protection should
scan. Files exceeding this limit will not be scanned. The default value is 32MB. All files larger
than the set value will not be scanned but allowed through to the receiver.
● Block files larger than maximum file size
○ This option will block all files larger than the maximum size specified in the previous option.
5. Protocols - configuring scanning options
These settings will decide how each protocol is handled. If you are not sure which scan setting to use
for a certain protocol, set it to Bypass for now. You can always change the scan settings later. See
“Scanner settings” on page 38.
Figure 10: Setup Wizard Protocols
The MSN and BitTorrent protocols will support the Block and Bypass options in this version.
Additional scan modes will be added in future versions. The options per protocol are:
Bypass Traffic on this protocol will pass through without being scanned.
Block Traffic on this protocol will not be allowed through Network Protection
Minimal Scan Traffic will be scanned using traditional signature scanning.
Archive files are not scanned.
The Sandbox is not used.
Medium scan Traffic will be scanned using traditional signature scanning.
Archive files are scanned.
The Sandbox is not used.
Sandbox scan Traffic will be scanned using traditional signature scanning.
Archive files are not scanned.
The Sandbox is used.
Full Scan Traffic will be scanned using traditional signature scanning.
Archive files are scanned.
The Sandbox is used.
6. Selecting logging options
Provides options for enabling and handling Network Protection logs. The main logs are the Traffic log

20
Copyright © 1990-2011 Norman ASA
Norman Network Protection
Administrator Guide | Setup wizard
and the Incident log. These log options only affect the Traffic log.
Figure 11: Setup Wizard Logging
● Enable logging/statistics
○ Select this option to log all traffic, i.e. all connections transferred through Network Protection
are logged to file.
○ Deselect this option to disable all traffic statistics.
● Log only supported protocols
○ Select this option to reduce the number of log entries. Only supported protocols are logged,
while all other connections are disregarded in the log.
○ The supported protocols are: HTTP, SMTP, IMAP4, POP3, RPC, FTP, TFTP, Windows File
Sharing (SMB, CIFS), IRC, MSN and BitTorrent.
Example
If this option is selected and a computer creates a connection to a Citrix server, this will not be visible
in the log because the ICA protocol is not supported for scan.
● Purge logs older than
○ Provides an option to delete logs that are between 1 and 60 days old. This functionality pre-
vents your hard drive to be filled up with legacy logs.
Note
Traffic logs are purged based on user setting between 1 and 60 days, but traffic statistics will still be
available in the management interface. Network Protection stores digests of all logs, enabling a digest
traffic statistics since the installation of Network Protection in your network.
See also “Logging options” on page 52.
7. Blocking - informing users that have been blocked
Provides options for how Network Protection should notify users that are blocked because malware
was detected, files that exceeded the maximum size, or a URL was blocked. This option only applies
to HTTP traffic.