Trend Micro viruswall enforcer 1500i Service manual

Network VirusWallTM
Enforcer 1500i
(R210 Series)
Network Security for Enterprise and Medium Business
Administrator’s Guide
Network Security
n
s

Trend Micro Incorporated reserves the right to make changes to this document and to
the products described herein without notice. Before installing and using the product,
please review the readme files, release notes, and the latest version of the applicable user
documentation, which are available from the Trend Micro website at:
http://docs.trendmicro.com
Trend Micro, the Trend Micro t-ball logo, ActiveUpdate, Control Manager, OfficeScan,
and Network VirusWall are trademarks or registered trademarks of Trend Micro,
Incorporated. All other product or company names may be trademarks or registered
trademarks of their owners.
Copyright© 2003-2011. Trend Micro Incorporated. All rights reserved.
Document part no. NVEM34449/100419
Release date: December 6, 2011
Product name: Trend Micro™ Network VirusWall™ Enforcer 1500i
Software version: 3.2
Protected by US patent no. 5,623,600

The user documentation for Network VirusWall Enforcer is intended to introduce the
main features of the product and installation instructions for your production
environment. You should read through it prior to installing or using the product.
Detailed information about how to use specific features within the product are available
in the online help file and the Knowledge Base at Trend Micro website.
Trend Micro is always seeking to improve its documentation. Your feedback is always
welcome at the following site:
http://docs.trendmicro.com

iii
Contents
Preface
About this Administrator’s Guide ..................................................................xii
Content Overview ........................................................................................xii
Document Set ...................................................................................................xiv
Documentation and Software Updates ...................................................xiv
Audience .............................................................................................................xv
Device and Software Version .....................................................................xv
Document Conventions .................................................................................xvi
Chapter 1: Understanding Network VirusWall Enforcer
Network VirusWall Enforcer Overview ..................................................... 1-2
What’s New ...................................................................................................... 1-3
In This Release ........................................................................................... 1-3
64-bit Platform Support for TMAgent .............................................. 1-3
Other Enhancements ........................................................................... 1-3
Carried Over from Previous Versions .................................................... 1-4
Software Version 3.1 ............................................................................ 1-4
Software Version 3.0 Patch 3 .............................................................. 1-5
Software Version 3.0 ............................................................................ 1-5
Protection Features and Capabilities ............................................................ 1-6
Endpoint Policy Enforcement ................................................................. 1-6
Network Virus Scan .................................................................................. 1-7
Network Policy Enforcement .................................................................. 1-7
Threat Mitigation with TDA .................................................................... 1-7
ARP Spoofing Prevention ........................................................................ 1-7
Technologies .................................................................................................... 1-8
Packet Scanning .......................................................................................... 1-8

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
iv
Threat Management Agent .......................................................................1-8
Platforms Supported by the Agent ..................................................... 1-9
Agent Deployment Options ................................................................1-9
Security Risks .................................................................................................1-10
Network Viruses .......................................................................................1-10
Vulnerabilities ...........................................................................................1-11
ARP Spoofing ...........................................................................................1-11
File-Based Malware ..................................................................................1-12
Unprotected Endpoints ...........................................................................1-12
Prohibited Network Use .........................................................................1-13
Enforcement Coverage .................................................................................1-14
Visibility ..........................................................................................................1-14
Endpoint Notifications ............................................................................1-14
Status Screens ............................................................................................1-15
Logs ............................................................................................................1-16
Understanding Endpoints ............................................................................1-17
Assessment Intervals ................................................................................1-18
SNMP Support ..............................................................................................1-18
MIB Security .............................................................................................1-19
SNMP Trap Limitations ..........................................................................1-20
SNMP Traps .............................................................................................1-20
SNMP Agent Messages ...........................................................................1-21
VLAN Support ..............................................................................................1-21
Tagged and Non-tagged Frames ............................................................1-22

Contents
v
Chapter 2: Setting Up the Device
Management Options ..................................................................................... 2-2
Preconfiguration Console ......................................................................... 2-2
Accessing the Preconfiguration Console Remotely ......................... 2-2
Web Console .............................................................................................. 2-3
Comparing the Consoles ........................................................................... 2-5
Logging on to the Web Console ................................................................... 2-6
Connecting to the Network .......................................................................... 2-6
Management IP Address ........................................................................... 2-7
Bridge IP Addresses .................................................................................. 2-7
Static Routes ............................................................................................... 2-9
Configuring IP Address Settings ........................................................... 2-10
Securing the Device ...................................................................................... 2-11
Changing Account Passwords ................................................................ 2-11
Configuring Access Control ................................................................... 2-12
Activating and Updating the Device .......................................................... 2-13
Update Options ........................................................................................ 2-13
Configuring Proxy Settings ..................................................................... 2-14
Specifying the Update Source ................................................................ 2-14
Activating the Device License ................................................................ 2-15
Updatable Components .......................................................................... 2-16
Updating Components ............................................................................ 2-17
Scheduling Component Updates ........................................................... 2-18
Installing Hot Fixes, Patches, and Service Pack .................................. 2-18

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
vi
Chapter 3: Preparing for Policy Enforcement
Configuring HTTP Detection Settings ........................................................ 3-2
Configuring LDAP Authentication Settings ...............................................3-2
About Single Sign-On (SSO) ....................................................................3-4
Defining URL Lists .........................................................................................3-4
Defining Network Zones ............................................................................... 3-5
Specifying Globally Exempted Endpoints ..................................................3-6
Specifying OfficeScan Detection Ports ........................................................ 3-7
Specifying Remote Login Accounts .............................................................3-7
Configuring Notifications ..............................................................................3-8
Web Notifications ......................................................................................3-9
Popup Notifications .................................................................................3-10
Email Notifications ..................................................................................3-11
Enabling or Disabling Notifications ......................................................3-12
Notification Tags ......................................................................................3-12
Formatting Tags for Web Notifications ..........................................3-13
Variable Tags for Web Notifications ................................................3-14
Variable Tags for Popup Notifications ............................................3-15
Variable Tags for Email Notifications .............................................3-15
Customizing Notification Content ........................................................3-17
Customizing Web and Popup Notification Content .....................3-17
Customizing Email Notification Content ........................................3-18
Configuring Notification Settings ..........................................................3-18
Web notification settings ....................................................................3-18
Popup notification settings ................................................................3-19
Email notification settings ..................................................................3-19
Configuring ARP Spoofing Protection ......................................................3-20
Monitoring for ARP Spoofing Malware ...............................................3-21
ARP Spoofing Prevention .......................................................................3-21
Configuring Agent Settings ..........................................................................3-22

Contents
vii
Chapter 4: Policy Creation and Deployment
Policy Enforcement Features ........................................................................ 4-2
Actions and Remediation Methods .............................................................. 4-4
Policy Matching Overview ............................................................................ 4-5
First-Match Rule ........................................................................................ 4-5
Policy Enforcement Best Practices .............................................................. 4-6
Overview of Policy Sections ......................................................................... 4-8
Creating a Policy ............................................................................................. 4-9
Step 1: Specify Endpoint Settings ......................................................... 4-10
Step 2: Specify Authentication and Network Zones .......................... 4-11
Step 3: Specify Enforcement Policy ...................................................... 4-12
Step 4: Specify Network Virus Policy ................................................... 4-15
Step 5: Specify Network Application Policy ........................................ 4-15
Step 6: Specify Threat Mitigation Rules ............................................... 4-17
Step 7: URL Exceptions ......................................................................... 4-18
Step 8: Review, Enable, and Save the Policy ....................................... 4-18
Sample Policy Creation ................................................................................ 4-18
Scenario 1: Different Policies for Different Users .............................. 4-19
Policy for Authenticated Users ......................................................... 4-19
Policy for Guest Users ....................................................................... 4-24
Catch-All Policy ................................................................................... 4-28
Scenario 2: Ensuring Platform Compliance ......................................... 4-29
Sample Deployment Scenarios ................................................................... 4-32
Deployment Scenario I: Standard Network ......................................... 4-32
Deployment Scenario II: Global Site .................................................... 4-34
Sample Policy Configuration .................................................................. 4-35
Exporting and Importing Policy Data ....................................................... 4-42

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
viii
Chapter 5: Maintaining the Device
Configuring Administrative Accounts .........................................................5-2
Backing Up Device Settings ..........................................................................5-2
Performing Device Tasks ...............................................................................5-5
Locking the Device ....................................................................................5-5
Resetting the Device ..................................................................................5-6
Shutting Down the Device .......................................................................5-7
Replacing the HTTPS Certificate .................................................................5-8
Generating a Certificate ............................................................................. 5-8
Configuring SNMP Settings ..........................................................................5-8
Using Tools ......................................................................................................5-9
Restoring Default Settings ...........................................................................5-10
System Recovery .......................................................................................5-11
Pattern and Engine Rollback .............................................................5-11
Reinstalling the Device Image ...........................................................5-11

Contents
ix
Chapter 6: Viewing Status, Logs, and Summaries
Viewing Summary Information .................................................................... 6-2
Viewing Real-Time Status Information ....................................................... 6-3
Viewing the Pattern Release History ........................................................... 6-3
Viewing Supported Products ........................................................................ 6-4
Using Logs ....................................................................................................... 6-4
Overview of Log Types ............................................................................ 6-4
Viewing and Exporting the Event Log .................................................. 6-5
Viewing and Exporting the Network Virus Log ................................... 6-6
Viewing and Exporting the ARP Spoofing Log ................................... 6-7
Viewing and Exporting the Threat Mitigation Log .............................. 6-8
Viewing and Exporting the Endpoint History ...................................... 6-9
Endpoint Details ................................................................................. 6-10
Releasing or Quarantining an Endpoint .......................................... 6-11
About Syslog Servers .................................................................................... 6-11
Using the System Log Viewer ..................................................................... 6-12

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
x
Chapter 7: Troubleshooting and FAQs
Troubleshooting .............................................................................................. 7-2
Hardware Issues ..........................................................................................7-2
Configuration Issues ..................................................................................7-3
Control Manager Communication Issues ...............................................7-9
Frequently Asked Questions (FAQs) .........................................................7-10
Hardware and Deployment .....................................................................7-10
Network .....................................................................................................7-11
Agent ..........................................................................................................7-14
Endpoints ..................................................................................................7-15
User Authentication .................................................................................7-15
Antivirus Product Scan ............................................................................7-16
Instant Messengers ...................................................................................7-16
URL Redirection .......................................................................................7-17
Configuration Backup ..............................................................................7-18
Preconfiguration and Web Consoles .....................................................7-19
Logs ............................................................................................................7-21
Control Manager .......................................................................................7-22
Other Questions .......................................................................................7-23
Chapter 8: Getting Support
Before Contacting Technical Support ..........................................................8-2
Contacting Technical Support .......................................................................8-2
Sending Infected Files to Trend Micro ........................................................8-3
Introducing TrendLabs ..................................................................................8-3
Other Useful Resources .................................................................................8-4
Appendix A: Introducing Trend Micro Control Manager™
Control Manager Standard and Advanced ................................................. A-2
How to Use Control Manager ...................................................................... A-2
Control Manager Architecture .....................................................................A-5
Registering Network VirusWall Enforcer to Control Manager .............. A-7

Contents
xi
Control Manager User Access ..................................................................... A-8
Network VirusWall Enforcer User Access ......................................... A-10
Managed Product MCP Agent Heartbeat ................................................ A-11
Using the Schedule Bar .......................................................................... A-12
Determining the Right Heartbeat Setting ........................................... A-13
Managing Network VirusWall Enforcer from Control Manager ......... A-14
Understanding Product Directory ........................................................ A-16
Access the Product Directory .......................................................... A-18
Deploy Components Using the Product Directory ...................... A-19
View Network VirusWall Enforcer Status Summaries ................ A-19
Configure Network VirusWall Enforcer Devices
and Managed Products ....................................................... A-20
Issue Tasks to Network VirusWall Enforcer Devices
and Managed Products ....................................................... A-21
Query and View Network VirusWall Enforcer and
Managed Product Logs ...................................................... A-21
Recover Network VirusWall Enforcer Devices
Removed from the Product Directory ............................. A-23
Search for Network VirusWall Enforcer Devices,
Product Directory Folders, or Computers ...................... A-24
Refresh the Product Directory ......................................................... A-25
Understanding the Directory Management Screen ....................... A-25
Downloading and Deploying New Components ................................... A-29
Manually Downloading Components .................................................. A-30
Configuring Scheduled Download Exceptions .................................. A-36
Understanding Scheduled Downloads ................................................ A-37
Configuring Scheduled Downloads and Enabling Scheduled
Component Downloads ........................................................ A-38
Configuring Scheduled Download Settings ................................... A-42
Configuring Scheduled Download Auto-Deploy Settings .......... A-44
Understanding Deployment Plans ....................................................... A-45
Configuring Proxy Settings .................................................................... A-47
Configuring Update/Deployment Settings ......................................... A-48
Setting "Log on as batch job" Policy .............................................. A-49
Using Logs .................................................................................................... A-49
Understanding Managed Product Logs ............................................... A-50

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
xii
Querying Log Data ..................................................................................A-50
Understanding Data Views ...............................................................A-51
Working with Reports .................................................................................A-52
Understanding Control Manager Report Templates .........................A-52
Understanding Control Manager 5.0 Templates ...........................A-53
Understanding Control Manager 3.0 Templates ...........................A-54
Adding One-time Reports ......................................................................A-54
Adding Scheduled Reports ....................................................................A-54
Glossary
Index

xi
Preface
Preface
Welcome to the Administrator’s Guide for Trend Micro™ Network VirusWall™
Enforcer 1500i. This book is intended for novice and experienced users of Network
VirusWall Enforcer who want to quickly configure, deploy, and monitor the device.
This preface discusses the following topics:
•About this Administrator’s Guide on page xii
•Document Set on page xiv
•Audience on page xv
•Document Conventions on page xvi

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
xii
About this Administrator’s Guide
This document contains detailed information about how to configure and manage
Network VirusWall Enforcer. It assumes that you have read and performed the tasks
described in the Installation and Deployment Guide, particularly preconfiguring the device to
enable access to the web console.
Content Overview
This Administrator’s Guide provides the following information.
TABLE P-1. Document contents
CHAPTER CONTENT SUMMARY
Understanding Network Virus-
Wall Enforcer on page 1-1
Product overview and descriptions of features
and capabilities
Setting Up the Device on page
2-1
Initial configuration procedures, including con-
necting to the network, securing the device, and
updating components
Preparing for Policy Enforcement
on page 3-1
Configuration procedures in preparation for pol-
icy enforcement
Policy Creation and Deployment
on page 4-1
Policy creation procedures and examples
Maintaining the Device on page
5-1
Maintenance procedures, covering account
management and configuration backup
Viewing Status, Logs, and Sum-
maries on page 6-1
Procedures for viewing logs and managing
quarantined endpoints
Troubleshooting and FAQs on
page 7-1
Troubleshooting tips

Preface
xiii
Getting Support on page 8-1 How to contact technical support
Introducing Trend Micro Control
Manager™ on page A-1
Overview of Control Manager, including how to
use it to manage Network VirusWall Enforcer
Glossary on page GL-1 Definitions of relevant terms
TABLE P-1. Document contents
CHAPTER CONTENT SUMMARY

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
xiv
Document Set
The following documents are provided with your product.
Documentation and Software Updates
For the latest documentation and software updates, visit the Trend Micro Download
Center at:
http://downloadcenter.trendmicro.com/
TABLE P-2. Product documentation
DOCUMENT FORMAT LOCATION COVERAGE
Installation and
Deployment
Guide
PDF •USB flash drive
•Trend Micro
Download
Center
Guides you through device
installation, deployment,
and initial configuration
Administra-
tor’s Guide
PDF •USB flash drive
•Trend Micro
Download
Center
Explains features and
guides your through man-
aging policies, administra-
tive tasks, and
troubleshooting
Quick Start
Guide
PDF
and
print
•USB flash drive
•Trend Micro
Download
Center
•Product package
Provides an overview of
the device and initial tasks
Online Help Web
pages
•Web console Explains options on the
web console and relevant
tasks
Readme Text •USB flash drive
•Trend Micro
Download
Center
Provides late-breaking
news and software build
information

Preface
xv
Audience
This Administrator’s Guide is targeted at the following audiences:
• Network administrators who will manage deployed devices
• Decision makers who will define policies and study how they can be enforced
Network VirusWall Enforcer documentation assumes that readers have networking
knowledge and understand antivirus and content security concepts.
Device and Software Version
This Administrator’s Guide is released for administrators that are using the following
device and software version.
TABLE P-3. Target device and software
PRODUCT
INFORMATION TARGET
Device Network VirusWall Enforcer 1500i
Hardware series R210 Series
Software version 3.2

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
xvi
Document Conventions
Network VirusWall Enforcer documentation uses the following conventions.
TABLE P-4. Conventions used in the documentation
CONVENTION DESCRIPTION
ALL CAPITALS Acronyms, abbreviations, and names of certain
commands and keys on the keyboard
Bold References to user interface items, including
menus, buttons, tabs, and other labels
Italics References to other documentation
Monospace Actual text, typed commands, file names, and pro-
gram output
Note:
Important information
Tip:
Recommendations
WARNING!
Critical information

1-1
Chapter 1
Understanding Network VirusWall
Enforcer
This chapter introduces Trend Micro™ Network VirusWall™ Enforcer 1500i and
provides an overview of its capabilities and design.
This chapter discusses the following topics:
•Network VirusWall Enforcer Overview on page 1-2
•What’s New on page 1-3
•Protection Features and Capabilities on page 1-6
•Technologies on page 1-8
•Security Risks on page 1-10
•Enforcement Coverage on page 1-14
•Visibility on page 1-14
•Understanding Endpoints on page 1-17
•SNMP Support on page 1-18
•VLAN Support on page 1-21