Trend Micro VirusWall 2500 Service manual

Network VirusWallTM Enforcer 2500
Administrator's Guide

Trend Micro Incorporated reserves the right to make changes to this document and to
the products described herein without notice. Before installing and using the
software, please review the readme files, release notes, and the latest version of the
applicable user documentation, which are available from the Trend Micro Web site
at:
http://www.trendmicro.com/download
Trend Micro, the Trend Micro t-ball logo, OfficeScan, PC-cillin, ServerProtect,
TrendLabs, VirusWall, Trend Micro Control Manager, Trend Micro Damage
Cleanup Services, Trend Micro Outbreak Prevention Services, and Trend Micro
Vulnerability Assessment are trademarks or registered trademarks of Trend Micro,
Incorporated. All other product or company names may be trademarks or registered
trademarks of their owners.
Copyright© 2003-2006 Trend Micro Incorporated. All rights reserved.
Document Part No. NVEM12219/50301
Release Date: August 2006
Protected by U.S. Patent No. 5,623,600 and pending patents.

The user documentation for Trend Micro Network VirusWall Enforcer 2500 is
intended to introduce the main features of the software and installation instructions
for your production environment. You should read through it prior to installing or
using the software.
Detailed information about how to use specific features within the software are
available in the online help file and the online Knowledge Base at Trend Micro’s
Web site.
Trend Micro is always seeking to improve its documentation. Your feedback is
always welcome. Please evaluate this documentation on the following site:
http://www.trendmicro.com/download/documentation/rating.asp

i
Contents
Preface Network VirusWall Enforcer 2500 Documentation ..........................P-2
About This Administrator’s Guide ....................................................P-3
Audience ............................................................................................P-4
Document Conventions...................................................................... P-4
Chapter 1: Understanding Trend Micro™ Network VirusWall™
Enforcer 2500
Trend Micro™ Network VirusWall Enforcer 2500 ........................... 1-2
Functions and Capabilities ................................................................. 1-2
Network VirusWall Enforcer 2500 Architecture ............................... 1-5
Components ................................................................................... 1-5
Device(s) ..................................................................................... 1-5
Management ................................................................................ 1-5
Antivirus Technology .................................................................. 1-10
Understanding Security Risks ................................................... 1-11
Protection Principle ..................................................................... 1-13
Protecting Your Network .............................................................1-14
Understanding Endpoints ............................................................. 1-17
Global Endpoint Exceptions List .............................................. 1-17
Quarantined Endpoints ............................................................. 1-17
Endpoints that Violate a Policy ................................................ 1-17
IP Address Settings ...................................................................... 1-18
Management IP Address ........................................................... 1-18

Trend Micro™ Network VirusWall™ Enforcer 2500 Administrator’s Guide
ii
Bridge IP Address .....................................................................1-18
Static Routes ..............................................................................1-20
An Example of When a Bridge IP Address and
Static Route is Necessary ..........................................................1-20
SNMP ...........................................................................................1-22
Security ......................................................................................1-22
SNMP Trap Limitations ............................................................1-24
SNMP Traps ..............................................................................1-24
SNMP Agent Messages .............................................................1-25
VLAN ...........................................................................................1-25
Tagged and Non-tagged Frames ...............................................1-25
Native VLAN ............................................................................1-26
Network VirusWall Enforcer 2500 ..................................................1-27
Nine User-definable LAN Ports ...................................................1-27
High Availability ..........................................................................1-28
Redundant Ports and Devices ....................................................1-28
Failover ......................................................................................1-29
Failopen .....................................................................................1-30
Policy Prioritization and Creation .............................................1-33
Sample Policy Creation ....................................................................1-37
Policy Scenario 1: Authenticated users need to have
antivirus software and Guest users need to have a
certain registry key. ......................................................................1-37
Sample Policy 1: Authenticated users .......................................1-37
Sample Policy 2: Guest users ....................................................1-41
Sample Policy 3: Catchall .........................................................1-44
Sample Deployment Scenarios .........................................................1-50
Deployment Scenario I: Standard Network .................................1-50
Deployment Scenario II: Global Site ...........................................1-52
Deployment Scenario III: Very Large Enterprise or
Internet Service Provider ..............................................................1-53
Sample Policy Configuration ....................................................1-54

Contents
iii
Chapter 2: Configuring Policy Enforcement and Device Settings
Getting Started with Network VirusWall Enforcer 2500 ...................2-2
Configuring Policy Enforcement Settings ......................................... 2-2
Configuring Policy Enforcement Settings .................................. 2-3
Configuring Network Zones ........................................................ 2-12
Configuring the URL List ............................................................ 2-13
Specifying Global Endpoint Exceptions ...................................... 2-14
Configuring Endpoint Notifications ............................................ 2-14
Configuring OfficeScan Settings ................................................. 2-15
HTTP Detection Settings ............................................................. 2-16
Remote Login Accounts .............................................................. 2-16
Exporting and Importing Policy Data .......................................... 2-17
Configuring Device and System Settings ........................................ 2-18
Configuring Access Control ........................................................ 2-18
Configuring Administrative Accounts ......................................... 2-19
Using Backup Configuration ....................................................... 2-19
Performing Device Tasks ............................................................ 2-21
Replacing the HTTPS Certificate ................................................2-24
Configuring IP Address Settings ................................................. 2-24
Configuring LDAP Settings ........................................................2-25
Configuring Proxy Settings ......................................................... 2-26
Configuring SNMP Settings ........................................................ 2-26
Using Tools ...................................................................................... 2-28
Restoring Default Settings ............................................................... 2-28
System Recovery ...................................................................... 2-29
Chapter 3: Updating Components
Understanding Updatable Components ............................................. 3-2
Updating Components ........................................................................ 3-4
Updating Components Manually ................................................... 3-5
Updating Components Automatically ........................................... 3-5
Setting the Update Source .............................................................3-6
Chapter 4: Viewing Status, Logs, and Summaries
Viewing Summary Information ......................................................... 4-2
Viewing Real-time Status Information .............................................. 4-2
Viewing the Pattern Release History ................................................. 4-2

Trend Micro™ Network VirusWall™ Enforcer 2500 Administrator’s Guide
iv
Viewing Supported Products ..............................................................4-3
Understanding Logs ............................................................................4-3
Types of Network VirusWall Enforcer 2500 Logs ........................4-3
Viewing the Event Log ...............................................................4-3
Endpoint History .........................................................................4-4
Configuring Log Settings ...............................................................4-4
LCD Module Log Format and Interpretation .................................4-4
Asset Tag Logs ............................................................................4-5
Hardware Logs ............................................................................4-7
LCD Module Error Logs .............................................................4-8
Using the Log Viewer ......................................................................4-11
Chapter 5: Troubleshooting and FAQs
Using Network VirusWall Enforcer 2500 Utilities ............................5-2
Entering Rescue Mode .......................................................................5-2
Uploading the Program File and Boot Loader ...................................5-4
Uploading with the Network VirusWall Enforcer
2500 Appliance Firmware Flash Utility .........................................5-5
Flashing the BIOS and BMC ..............................................................5-7
Before Running the Appliance Firmware Flash Utility .................5-7
Running the Appliance Firmware Flash Utility .............................5-9
After Running the Appliance Firmware Flash Utility ..................5-12
Troubleshooting ................................................................................5-13
Hardware Issues ...........................................................................5-14
Configuration Issues .....................................................................5-15
Control Manager and Network VirusWall Enforcer
2500 Communication Issues ........................................................5-22
Frequently Asked Questions (FAQs) ...............................................5-24
Chapter 6: Getting Support
Before Contacting Technical Support ................................................6-2
Contacting Technical Support ............................................................6-2
Sending Infected Files to Trend Micro ...............................................6-3
Introducing TrendLabs .......................................................................6-3
Other Useful Resources ......................................................................6-4
Appendix A: Device Specifications

Contents
v
Appendix B: Introducing Trend Micro Control Manager™
Control Manager Basic Features ........................................................B-2
Understanding Trend Micro Management
Communication Protocol ...................................................................B-3
Reduced Network Loading and Package Size ...............................B-3
NAT and Firewall Traversal Support ............................................B-4
HTTPS Support .............................................................................B-5
One-Way and Two-Way Communication Support .......................B-6
One-Way Communication ..........................................................B-6
Two-Way Communication .........................................................B-6
Single Sign-on (SSO) Support .......................................................B-6
Cluster Node Support ....................................................................B-7
Control Manager Agent Heartbeat .....................................................B-7
Using the Schedule Bar .................................................................B-8
Determining the Right Heartbeat Setting ......................................B-9
Registering Network VirusWall Enforcer 2500 to
Control Manager ................................................................................B-9
Managing Network VirusWall Enforcer 2500 From
Control Manager ..............................................................................B-11
Understanding Product Directory ................................................B-11
Accessing a Network VirusWall Enforcer 2500
Device's Default Folder ...............................................................B-13
Access Product Directory .........................................................B-13
Manually Deploy New Components Using the
Product Directory ......................................................................B-14
View Network VirusWall Enforcer 2500 Devices
Status Summaries ......................................................................B-15
Configure Network VirusWall Enforcer 2500
Devices and Managed Products ...................................................B-16
Issue Tasks to Network VirusWall Enforcer 2500
Devices and Managed Products ...................................................B-17
Query and View Network VirusWall Enforcer 2500
Device and Managed Product Logs .............................................B-17
Recover Network VirusWall Enforcer 2500 Devices
Removed From the Product Directory ......................................B-19
Search for Network VirusWall Enforcer 2500 Devices,
Product Directory Folders or Computers ..................................B-20

Trend Micro™ Network VirusWall™ Enforcer 2500 Administrator’s Guide
vi
Refresh the Product Directory ..................................................B-21
Understanding Directory Manager ..................................................B-21
Using the Directory Manager Options ........................................ B-22
Access Directory Manager .......................................................B-23
Create Folders .............................................................................B-23
Renaming Folders or Network VirusWall Enforcer
2500 Devices ............................................................................B-23
Move Folders or Network VirusWall Enforcer
2500 Devices ............................................................................B-24
Delete User-Defined Folders ....................................................B-24
Understanding Temp ....................................................................... B-25
Using Temp .................................................................................B-25
Access Temp ............................................................................B-25
Adding Network VirusWall Enforcer 2500
Devices to Temp ....................................................................... B-26
Removing Network VirusWall Enforcer 2500
Devices From Temp ................................................................. B-28
Download and Deploy New Components From
Control Manager ..............................................................................B-29
Understanding Update Manager .................................................B-29
Understanding Manual Downloads .............................................B-30
Manually Download Components ............................................ B-30
Configure Scheduled Download Exceptions ..............................B-37
Understanding Scheduled Downloads ........................................ B-38
Configure Scheduled Downloads and Enable
Scheduled Component Downloads .......................................... B-39
Use Reports .....................................................................................B-46
Local Reports ...........................................................................B-46
Global Reports ..........................................................................B-46
Understanding Report Templates ................................................ B-47
Understanding Report Profiles ....................................................B-48
Create Report Profiles ..............................................................B-48
Review Report Profile Settings ................................................ B-54
Enable Scheduled Report Profiles ............................................ B-55
Generate On-demand Scheduled Reports ...................................B-55
View Generated Reports .......................................................... B-56

Contents
vii
Appendix C: Supported Antivirus Products
Supported Products for Endpoints with Windows
98 or ME Operating Systems .............................................................C-2
Supported Products for Endpoints with Windows
XP, 2000, or 2003 Operating Systems ...............................................C-4
Appendix D: Glossary
Index

P-1
Preface
Preface
Welcome to the Administrator’s Guide for Trend Micro™ Network VirusWall™
Enforcer 2500. This book contains information about the tasks you need to configure
Network VirusWall Enforcer 2500. This book is intended for novice and experienced
users of Trend Micro Network VirusWall Enforcer 2500 who want to quickly
configure, administer, and monitor the product.
The Network VirusWall Enforcer 2500 package includes the Trend Micro Solutions
CD for Network VirusWall Enforcer 2500. If you are planning large-scale
deployment of Network VirusWall Enforcer 2500 or have complex network
architecture, refer to the Network VirusWall Enforcer 2500 Getting Started Guide
PDF files on the Solutions CD.
This Preface discusses the following topics:
•Network VirusWall Enforcer 2500 Documentation on page 2
•About This Administrator’s Guide on page 3
•Audience on page 4
•Document Conventions on page 4

Trend Micro™ Network VirusWall™ Enforcer 2500 Administrator’s Guide
P-2
Network VirusWall Enforcer 2500
Documentation
The Network VirusWall Enforcer 2500 documentation consists of the following:
• Online Help—Web-based documentation that is accessible from the Network
VirusWall Enforcer 2500 Web console.
The Network VirusWall Enforcer 2500 Online Help contains explanations about
the Network VirusWall Enforcer 2500 components and features.
• Upgrade Guide (UG)—PDF documentation that is accessible from the Solutions
CD for Network VirusWall Enforcer 2500 or downloadable from the Trend
Micro Web site.
The UG contains explanations about upgrading from Network VirusWall 2500
1.5 and 1.8 to Network VirusWall Enforcer 2500.
• Getting Started Guide (GSG)—PDF documentation that is accessible from the
Trend Micro Solutions CD for Network VirusWall Enforcer 2500 or
downloadable from the Trend Micro Web site
The GSG contains instructions on how to deploy Network VirusWall Enforcer
2500, a task that includes planning, testing, and preconfiguration.
• Administrator’s Guide (AG)—PDF documentation that is accessible from the
Trend Micro Solutions CD for Network VirusWall Enforcer 2500 or
downloadable from the Trend Micro Web site
This AG contains detailed instructions on how to configure and administer
Network VirusWall Enforcer 2500 from the applicable management tools, as well
as explanations on the Network VirusWall Enforcer 2500 concepts and features.
See About This Administrator’s Guide for chapters available in this book.
Note: Trend Micro recommends checking the Update Center for updates to the Network
VirusWall Enforcer 2500 documentation and program file. You can download the
latest versions of the Upgrade Guide and Administrator’s Guide from the following
location:
http://www.trendmicro.com/en/products/network/nvwe/evaluate/overview.htm

Preface
P-3
About This Administrator’s Guide
The Network VirusWall Enforcer 2500 Administrator’s Guide, which is in PDF,
provides the following information:
• Overview of the product and its architecture, and description of all new features
in Network VirusWall Enforcer 2500, see Understanding Trend Micro™
Network VirusWall™ Enforcer 2500 on page 1-1
• Procedures to configure and administer Network VirusWall Enforcer 2500 from
the applicable management tools, see Configuring Policy Enforcement and
Device Settings on page 2-1
• Procedures to update Network VirusWall Enforcer 2500 components, see
Updating Components on page 3-1
• Instructions to access antivirus information to evaluate your organization’s virus
protection policies and identify endpoints that are at a high risk of infection, see
Viewing Status, Logs, and Summaries on page 4-1
• Troubleshooting tips for issues encountered during device administration, which
includes debug and error logs interpretation, see Troubleshooting and FAQs on
page 5-1
• Guidelines to obtain more information, see Getting Support on page 6-1

Trend Micro™ Network VirusWall™ Enforcer 2500 Administrator’s Guide
P-4
Audience
The Network VirusWall Enforcer 2500 documentation assumes a basic knowledge of
security systems, including:
• Antivirus and content security protection
• Network concepts (such as IP address, netmask, topology, LAN settings)
• Various network topologies
• Network devices and their administration
• Network configuration (such as the use of VLAN, SNMP)
Document Conventions
To help you locate and interpret information easily, the Network VirusWall Enforcer
2500 documentation uses the following conventions.
CONVENTION DESCRIPTION
ALL CAPITALS Acronyms, abbreviations, and names of certain com-
mands and keys on the keyboard
Bold Menus and menu commands, command buttons,
tabs, options, and Network VirusWall Enforcer 2500
tasks
Italics References to other documentation
Monospace Examples, sample command lines, program code,
Web URL, file name, and program output
Note: Configuration notes
Tip: Recommendations
WARNING! Reminders on actions or configurations that should be
avoided
FAILOVER Network VirusWall Enforcer 2500 interface connected
to the device in a failover pair
TABLE 1. Conventions used in the Network VirusWall Enforcer 2500
documentation

1-1
Chapter 1
Understanding Trend Micro™
Network VirusWall™ Enforcer 2500
This chapter introduces Trend Micro Network VirusWall Enforcer 2500 and provides
an overview of its technology, capabilities, and hardware connections.
The topics discussed in this chapter include:
•Trend Micro™ Network VirusWall Enforcer 2500 on page 1-2
•Functions and Capabilities on page 1-2
•Network VirusWall Enforcer 2500 Architecture on page 1-5
•Network VirusWall Enforcer 2500 on page 1-27
•Sample Deployment Scenarios on page 1-50

Trend Micro™ Network VirusWall™ Enforcer 2500 Administrator’s Guide
1-2
Trend Micro™ Network VirusWall Enforcer 2500
Trend Micro Network VirusWall Enforcer 2500 is an outbreak prevention appliance
that helps organizations stop network viruses (Internet worms), block high-threat
vulnerabilities during outbreaks, and quarantine and clean up infection sources
including unprotected devices as they enter the network, using threat-specific
knowledge from Trend Micro deployed at the network layer.
Unlike security solutions that only monitor threats or provide threat information,
Network VirusWall Enforcer 2500 helps organizations take precise outbreak security
actions and proactively detect, prevent or contain, and eliminate outbreaks. By
deploying Network VirusWall Enforcer 2500 in network LAN segments,
organizations can significantly reduce their security risk, network downtime, and
outbreak management burden. Network VirusWall Enforcer 2500 supports the Trend
Micro™ Enterprise Protection Strategy.
Network VirusWall Enforcer 2500 monitors network packets and events that could
indicate an attack against a network. Endpoint security prevents endpoints from
becoming sources of network outbreaks. The device scans all the traffic to guard
against security risks from passing between segments. Deploy Network VirusWall
Enforcer 2500 in a switch or router environment.
Functions and Capabilities
From the Web console, you can accomplish the following administrative tasks:
•View a Summary of Your Network’s Protection Against Viruses
•Enforce Antivirus Policies
•Update Your Protection
•Analyze Your Network’s Protection Against Viruses
•Perform Administrative Tasks

Understanding Trend Micro™ Network VirusWall™ Enforcer 2500
1-3
View a Summary of Your Network’s Protection Against Viruses
Use the Summary and Real-time status screens to help you monitor your network’s
protection against viruses.
View the following from the Summary screen:
• Policy Enforcement Status—Use this information to determine statistics on
policy compliance and violations. Click the number under Violations to view the
Endpoint History for more information.
• Top 5 Policies with Violations—Use this information to determine the most
common or largest number of policy violations. Click the number under
Violations to view additional information.
• AV Product Detection Status—Use this information to determine statistics on
detected Protected Endpoints, Undetectable Endpoints (includes endpoints that
do not have antivirus software and endpoints that can’t be assessed), Total
Endpoints, Virus Protection Ratio (the percentage of endpoints with antivirus
software in relation to the total number of detected endpoints). Click Export to
save the information to a file.
• Component Status—Use this information to determine whether your Network
VirusWall Enforcer 2500 components are current. After an update use this
information to determine if all components are current.
View the following from the Real-time Status screen:
• LED Status—Use this information to help determine the state of the device.
Network VirusWall Enforcer 2500 has five light-emitting diodes (LEDs) that
indicate the POWER, UID, SYSTEM, INSPECTION, and OUTBREAK status.
• Performance Status—Use this information to determine the device resource
usage. You can view CPU usage, memory usage, and concurrent connections.
• High Availability Status—Use this information to determine High Availability
status. View Mode (Failover/Failopen), Primary Device, Secondary Device,
Management Device, Switchback mode (On/Off), and Asymmetric Route.
• Interface Configuration Status—use this information to determine the
configuration of the ports. View connection mode, port speed, and port type.

Trend Micro™ Network VirusWall™ Enforcer 2500 Administrator’s Guide
1-4
Enforce Antivirus Policies
Network VirusWall Enforcer 2500 monitors endpoints and determines the status of
their antivirus protection. Based on this information, configure antivirus policy
settings to block, monitor, or redirect traffic, including traffic from specified TCP and
UDP ports. In this release, you can specify multiple policies for each segment in your
network by configuring network zones.
Specify Damage Cleanup as a remedy when an endpoint is infected with a virus.
Damage Cleanup performs the following:
• Removes unwanted registry entries created by worms or Trojans
• Removes memory resident worms or Trojans
• Removes garbage and viral files dropped by viruses
• Repairs system file configurations (such as system.ini), after they have been
altered or infected by malicious code
• Returns the system to an active and clean state
Update Your Protection
Virus writers write and release new viruses through different media every day,
especially the Internet. To help ensure your protection against the latest threats is
current, periodically update Network VirusWall Enforcer 2500 components,
including the network virus pattern file, network scan engine, file virus pattern, file
virus scan engine, vulnerability assessment pattern, vulnerability engine, Damage
Cleanup engine, Damage Cleanup pattern, program file, and Pattern Release History.
Analyze Your Network’s Protection Against Viruses
Network VirusWall Enforcer 2500 generates various types of logs, including security
and event logs. Use these logs to verify module updates and network outbreaks and
view viruses found in network packets.
Perform Administrative Tasks
Network VirusWall Enforcer 2500 supports Simple Network Management Protocol
(SNMP) v2 and can send traps to specific network management stations. For added
security, you can require network management stations to authenticate before gaining
access to the Network VirusWall Enforcer 2500 Management Information Base
(MIB).

Understanding Trend Micro™ Network VirusWall™ Enforcer 2500
1-5
Network VirusWall Enforcer 2500 Architecture
This section describes the Network VirusWall Enforcer 2500 components and
antivirus defenses, which includes discussion about its antivirus technology and
types of network threats.
Components
Two major components make up a Network VirusWall Enforcer 2500 system:
•Device(s)
•Management
Device(s)
Unlike security solutions that only monitor threats or provide threat information,
Network VirusWall Enforcer 2500 helps organizations take precise outbreak security
actions and proactively detect, prevent or contain, and eliminate outbreaks. By
deploying Network VirusWall Enforcer 2500 devices in network LAN segments,
organizations can significantly reduce their security risk, network downtime, and
outbreak management burden. Refer to the Network VirusWall Enforcer 2500 for
information about ports, port grouping, and fiber card installation.
Management
Network VirusWall Enforcer 2500 provides the following management tools:
• Preconfiguration console
• Web console
• LCD module (also known as LCM console)

Trend Micro™ Network VirusWall™ Enforcer 2500 Administrator’s Guide
1-6
Preconfiguration Console
The Preconfiguration console allows you to perform the network configuration and
set the device settings by directly connecting to the Network VirusWall Enforcer 2500
device using a terminal communication application.
You can view the Preconfiguration console by using either a console connection to
Network VirusWall Enforcer 2500 or using SSH. There are certain settings you
cannot alter if you login using SSH. The settings you cannot alter using SSH include
disabling SSH connection from the Access Control menu and setting the device to
Enable Failover. Due to this difference, the corresponding numbers for features may
be different depending on the method you use to connect to the Preconfiguration
console.
FIGURE 1-1. The Preconfiguration console login screen
Note: If you access the Preconfiguration console using SSH, type root at the login as
prompt. You do not need a password to access the Network VirusWall Enforcer
2500 login screen.