Trend Micro viruswall enforcer 1500i Service manual

Network VirusWallTM
Enforcer 1500i
(R210 Series)
Network Security for Enterprise and Medium Business
Administrator’s Guide
Network Security
n
s

Trend Micro Incorporated reserves the right to make changes to this document and to
the products described herein without notice. Before installing and using the product,
please review the readme files, release notes, and the latest version of the applicable user
documentation, which are available from the Trend Micro website at:
http://docs.trendmicro.com
Trend Micro, the Trend Micro t-ball logo, ActiveUpdate, Control Manager, OfficeScan,
and Network VirusWall are trademarks or registered trademarks of Trend Micro,
Incorporated. All other product or company names may be trademarks or registered
trademarks of their owners.
Copyright© 2003-2011. Trend Micro Incorporated. All rights reserved.
Document part no. NVEM34449/100419
Release date: December 6, 2011
Product name: Trend Micro™ Network VirusWall™ Enforcer 1500i
Software version: 3.2
Protected by US patent no. 5,623,600

The user documentation for Network VirusWall Enforcer is intended to introduce the
main features of the product and installation instructions for your production
environment. You should read through it prior to installing or using the product.
Detailed information about how to use specific features within the product are available
in the online help file and the Knowledge Base at Trend Micro website.
Trend Micro is always seeking to improve its documentation. Your feedback is always
welcome at the following site:
http://docs.trendmicro.com

iii
Contents
Preface
About this Administrator’s Guide ..................................................................xii
Content Overview ........................................................................................xii
Document Set ...................................................................................................xiv
Documentation and Software Updates ...................................................xiv
Audience .............................................................................................................xv
Device and Software Version .....................................................................xv
Document Conventions .................................................................................xvi
Chapter 1: Understanding Network VirusWall Enforcer
Network VirusWall Enforcer Overview ..................................................... 1-2
What’s New ...................................................................................................... 1-3
In This Release ........................................................................................... 1-3
64-bit Platform Support for TMAgent .............................................. 1-3
Other Enhancements ........................................................................... 1-3
Carried Over from Previous Versions .................................................... 1-4
Software Version 3.1 ............................................................................ 1-4
Software Version 3.0 Patch 3 .............................................................. 1-5
Software Version 3.0 ............................................................................ 1-5
Protection Features and Capabilities ............................................................ 1-6
Endpoint Policy Enforcement ................................................................. 1-6
Network Virus Scan .................................................................................. 1-7
Network Policy Enforcement .................................................................. 1-7
Threat Mitigation with TDA .................................................................... 1-7
ARP Spoofing Prevention ........................................................................ 1-7
Technologies .................................................................................................... 1-8
Packet Scanning .......................................................................................... 1-8

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
iv
Threat Management Agent .......................................................................1-8
Platforms Supported by the Agent ..................................................... 1-9
Agent Deployment Options ................................................................1-9
Security Risks .................................................................................................1-10
Network Viruses .......................................................................................1-10
Vulnerabilities ...........................................................................................1-11
ARP Spoofing ...........................................................................................1-11
File-Based Malware ..................................................................................1-12
Unprotected Endpoints ...........................................................................1-12
Prohibited Network Use .........................................................................1-13
Enforcement Coverage .................................................................................1-14
Visibility ..........................................................................................................1-14
Endpoint Notifications ............................................................................1-14
Status Screens ............................................................................................1-15
Logs ............................................................................................................1-16
Understanding Endpoints ............................................................................1-17
Assessment Intervals ................................................................................1-18
SNMP Support ..............................................................................................1-18
MIB Security .............................................................................................1-19
SNMP Trap Limitations ..........................................................................1-20
SNMP Traps .............................................................................................1-20
SNMP Agent Messages ...........................................................................1-21
VLAN Support ..............................................................................................1-21
Tagged and Non-tagged Frames ............................................................1-22

Contents
v
Chapter 2: Setting Up the Device
Management Options ..................................................................................... 2-2
Preconfiguration Console ......................................................................... 2-2
Accessing the Preconfiguration Console Remotely ......................... 2-2
Web Console .............................................................................................. 2-3
Comparing the Consoles ........................................................................... 2-5
Logging on to the Web Console ................................................................... 2-6
Connecting to the Network .......................................................................... 2-6
Management IP Address ........................................................................... 2-7
Bridge IP Addresses .................................................................................. 2-7
Static Routes ............................................................................................... 2-9
Configuring IP Address Settings ........................................................... 2-10
Securing the Device ...................................................................................... 2-11
Changing Account Passwords ................................................................ 2-11
Configuring Access Control ................................................................... 2-12
Activating and Updating the Device .......................................................... 2-13
Update Options ........................................................................................ 2-13
Configuring Proxy Settings ..................................................................... 2-14
Specifying the Update Source ................................................................ 2-14
Activating the Device License ................................................................ 2-15
Updatable Components .......................................................................... 2-16
Updating Components ............................................................................ 2-17
Scheduling Component Updates ........................................................... 2-18
Installing Hot Fixes, Patches, and Service Pack .................................. 2-18

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
vi
Chapter 3: Preparing for Policy Enforcement
Configuring HTTP Detection Settings ........................................................ 3-2
Configuring LDAP Authentication Settings ...............................................3-2
About Single Sign-On (SSO) ....................................................................3-4
Defining URL Lists .........................................................................................3-4
Defining Network Zones ............................................................................... 3-5
Specifying Globally Exempted Endpoints ..................................................3-6
Specifying OfficeScan Detection Ports ........................................................ 3-7
Specifying Remote Login Accounts .............................................................3-7
Configuring Notifications ..............................................................................3-8
Web Notifications ......................................................................................3-9
Popup Notifications .................................................................................3-10
Email Notifications ..................................................................................3-11
Enabling or Disabling Notifications ......................................................3-12
Notification Tags ......................................................................................3-12
Formatting Tags for Web Notifications ..........................................3-13
Variable Tags for Web Notifications ................................................3-14
Variable Tags for Popup Notifications ............................................3-15
Variable Tags for Email Notifications .............................................3-15
Customizing Notification Content ........................................................3-17
Customizing Web and Popup Notification Content .....................3-17
Customizing Email Notification Content ........................................3-18
Configuring Notification Settings ..........................................................3-18
Web notification settings ....................................................................3-18
Popup notification settings ................................................................3-19
Email notification settings ..................................................................3-19
Configuring ARP Spoofing Protection ......................................................3-20
Monitoring for ARP Spoofing Malware ...............................................3-21
ARP Spoofing Prevention .......................................................................3-21
Configuring Agent Settings ..........................................................................3-22

Contents
vii
Chapter 4: Policy Creation and Deployment
Policy Enforcement Features ........................................................................ 4-2
Actions and Remediation Methods .............................................................. 4-4
Policy Matching Overview ............................................................................ 4-5
First-Match Rule ........................................................................................ 4-5
Policy Enforcement Best Practices .............................................................. 4-6
Overview of Policy Sections ......................................................................... 4-8
Creating a Policy ............................................................................................. 4-9
Step 1: Specify Endpoint Settings ......................................................... 4-10
Step 2: Specify Authentication and Network Zones .......................... 4-11
Step 3: Specify Enforcement Policy ...................................................... 4-12
Step 4: Specify Network Virus Policy ................................................... 4-15
Step 5: Specify Network Application Policy ........................................ 4-15
Step 6: Specify Threat Mitigation Rules ............................................... 4-17
Step 7: URL Exceptions ......................................................................... 4-18
Step 8: Review, Enable, and Save the Policy ....................................... 4-18
Sample Policy Creation ................................................................................ 4-18
Scenario 1: Different Policies for Different Users .............................. 4-19
Policy for Authenticated Users ......................................................... 4-19
Policy for Guest Users ....................................................................... 4-24
Catch-All Policy ................................................................................... 4-28
Scenario 2: Ensuring Platform Compliance ......................................... 4-29
Sample Deployment Scenarios ................................................................... 4-32
Deployment Scenario I: Standard Network ......................................... 4-32
Deployment Scenario II: Global Site .................................................... 4-34
Sample Policy Configuration .................................................................. 4-35
Exporting and Importing Policy Data ....................................................... 4-42

Trend Micro™ Network VirusWall™ Enforcer 1500i (R210 Series) Administrator’s Guide
viii
Chapter 5: Maintaining the Device
Configuring Administrative Accounts .........................................................5-2
Backing Up Device Settings ..........................................................................5-2
Performing Device Tasks ...............................................................................5-5
Locking the Device ....................................................................................5-5
Resetting the Device ..................................................................................5-6
Shutting Down the Device .......................................................................5-7
Replacing the HTTPS Certificate .................................................................5-8
Generating a Certificate ............................................................................. 5-8
Configuring SNMP Settings ..........................................................................5-8
Using Tools ......................................................................................................5-9
Restoring Default Settings ...........................................................................5-10
System Recovery .......................................................................................5-11
Pattern and Engine Rollback .............................................................5-11
Reinstalling the Device Image ...........................................................5-11

Contents
ix
Chapter 6: Viewing Status, Logs, and Summaries
Viewing Summary Information .................................................................... 6-2
Viewing Real-Time Status Information ....................................................... 6-3
Viewing the Pattern Release History ........................................................... 6-3
Viewing Supported Products ........................................................................ 6-4
Using Logs ....................................................................................................... 6-4
Overview of Log Types ............................................................................ 6-4
Viewing and Exporting the Event Log .................................................. 6-5
Viewing and Exporting the Network Virus Log ................................... 6-6
Viewing and Exporting the ARP Spoofing Log ................................... 6-7
Viewing and Exporting the Threat Mitigation Log .............................. 6-8
Viewing and Exporting the Endpoint History ...................................... 6-9
Endpoint Details ................................................................................. 6-10
Releasing or Quarantining an Endpoint .......................................... 6-11
About Syslog Servers .................................................................................... 6-11
Using the System Log Viewer ..................................................................... 6-12