Trend Micro viruswall enforcer 1500i User manual

Network VirusWallTM
Enforcer 1500i
(CR100 Series)
Network Security for Enterprise and Medium Business
Installation and Deployment Guide
Network Security
n
s

Trend Micro Incorporated reserves the right to make changes to this document and to
the products described herein without notice. Before installing and using the product,
please review the readme files, release notes, and the latest version of the applicable user
documentation, which are available from the Trend Micro Web site at:
http://www.trendmicro.com/download
Trend Micro, the Trend Micro t-ball logo, ActiveUpdate, OfficeScan, Control Manager,
and Network VirusWall are trademarks or registered trademarks of Trend Micro,
Incorporated. All other product or company names may be trademarks or registered
trademarks of their owners.
Copyright © 2003-2010. Trend Micro Incorporated. All rights reserved.
Document part no. NVEM34453/100419
Release date: August 6, 2010 (Version 3.0 Patch 3)
Product name: Trend Micro™ Network VirusWall™ Enforcer 1500i
Protected by US patent no. 5,623,600

The user documentation for Network VirusWall Enforcer is intended to introduce the
main features of the product and installation instructions for your production
environment. Read through it prior to installing or using the product.
Detailed information about how to use specific features within the product are available
in the Online Help and the Knowledge Base at the Trend Micro Web site.
Trend Micro is always seeking to improve its documentation. Your feedback is always
welcome. Please evaluate this documentation on the following site:
http://www.trendmicro.com/download/documentation/rating.asp

iii
Contents
Preface
Network VirusWall Enforcer Documentation ............................................viii
About This Installation and Deployment Guide ..........................................ix
Audience ..............................................................................................................ix
Document Conventions .................................................................................... x
Chapter 1: Introducing Network VirusWall Enforcer
Network VirusWall Enforcer Overview ..................................................... 1-2
Key Concepts .................................................................................................. 1-3
Device Ports .................................................................................................... 1-3
Port Functions ............................................................................................ 1-4
Chapter 2: Getting Started
Package Contents ............................................................................................ 2-2
Front Panel ...................................................................................................... 2-4
Installing the Bezel ..................................................................................... 2-7
Back Panel ........................................................................................................ 2-9
Network Port Indicators ......................................................................... 2-10
Indicators on Onboard Ports ............................................................ 2-10
Indicators on the Copper Expansion Cards ................................... 2-11
Technical Specifications ............................................................................... 2-11
Installing the Device ..................................................................................... 2-12

Trend Micro™ Network VirusWall™ Enforcer 1500i (CR100 Series) Installation and Deployment Guide
iv
Chapter 3: Deploying Network VirusWall Enforcer
Planning for Deployment ...............................................................................3-2
Deployment Overview .............................................................................. 3-2
Phase 1: Plan the Deployment ............................................................3-2
Phase 2: Perform Preconfiguration ....................................................3-3
Phase 3: Manage Devices .....................................................................3-3
Deployment Notes .....................................................................................3-3
Identifying What to Protect ........................................................................... 3-4
Remote Access Endpoints ........................................................................3-5
Guest Endpoints ........................................................................................3-8
Key Segments and Critical Assets ............................................................3-9
Dual-Switch VLAN Environment .........................................................3-10
Single-Switch VLAN Environment .......................................................3-12
Networks with IPv6 Addresses ..............................................................3-13
IPv6 Limitations ..................................................................................3-13
Pure IPv6 Environments ...................................................................3-14
Dual-Stack and Mixed Environments ..............................................3-14
Planning for Network Traffic ......................................................................3-15
Determining the Number of Devices to Deploy ................................3-15
Conducting a Pilot Deployment .................................................................3-16
Choosing a Pilot Site ................................................................................3-16
Creating a Contingency Plan ..................................................................3-16
Deploying and Evaluating your Pilot ....................................................3-16
Redefining Your Deployment Strategy ......................................................3-16
Deployment Scenarios ..................................................................................3-17
Basic Deployment Scenario ....................................................................3-17
Failopen Considerations .....................................................................3-18

Contents
v
Chapter 4: Preconfiguring Network VirusWall Enforcer
Before Preconfiguration ................................................................................ 4-2
Verifying Network Support ...................................................................... 4-2
Preparing for Preconfiguration ................................................................ 4-2
Understanding Preconfiguration .................................................................. 4-3
The Preconfiguration Console ...................................................................... 4-3
Performing Preconfiguration ........................................................................ 4-4
Logging on the Preconfiguration Console ............................................. 4-4
Configuring Device Settings ..................................................................... 4-6
Enabling Ports and Selecting Port Functions ........................................ 4-7
Setting the Interface Speed and Duplex Mode ..................................... 4-9
Connecting to the Network ........................................................................ 4-10
Configuring Network VirusWall Enforcer ............................................... 4-10
Chapter 5: Troubleshooting and Technical Support
Device Issues ................................................................................................... 5-2
Getting Technical Support ............................................................................ 5-3
Before Contacting Technical Support .................................................... 5-3
Contacting Technical Support ................................................................. 5-3
Index

Trend Micro™ Network VirusWall™ Enforcer 1500i (CR100 Series) Installation and Deployment Guide
vi

vii
Preface
Preface
Welcome to the Trend Micro™ Network VirusWall™ Enforcer 1500i Installation and
Deployment Guide. This book contains basic information about the tasks you need to
perform to deploy the device. It is intended for novice and advanced users of who want
to plan, deploy, and preconfigure Network VirusWall Enforcer.
This preface discusses the following topics:
•Network VirusWall Enforcer Documentation on page viii
•About This Installation and Deployment Guide on page ix
•Audience on page ix
•Document Conventions on page x

Trend Micro™ Network VirusWall™ Enforcer 1500i (CR100 Series) Installation and Deployment Guide
viii
Network VirusWall Enforcer Documentation
The Network VirusWall Enforcer documentation set consists of the following
documents:
• Dell™ Product Information Guide—this printed document provides safety,
environmental, and regulatory information about the device. Read the safety
information in this document before using Network VirusWall Enforcer.
• Readme—a text file on the USB flash drive, the Readme covers basic getting started
instructions, new features, known issues, and late-breaking information.
• Online Help—Web-based documentation that is accessible from the device’s Web
console; the Online Help explains product screens and discusses administrative
tasks and relevant concepts.
• Installation and Deployment Guide (IDG)—PDF documentation that is accessible
from the provided USB flash drive or downloadable from the Trend Micro Web site.
This IDG contains instructions for deploying the device, a task that includes
planning, testing, and preconfiguration. See About This Installation and Deployment
Guide for chapters available in this book.
If you are planning a large-scale deployment or have a complex network and need
more details about the product and deployment scenarios, refer to the Network
VirusWall Enforcer Administrator’s Guide.
• Administrator’s Guide (AG)—PDF documentation that is accessible from the
provided USB flash drive or downloadable from the Trend Micro Web site.
The AG provides a comprehensive overview of the device and its capabilities. It
discusses policy enforcement scenarios and provides instructions on how to
configure and administer the device using the applicable management tools. It also
includes sections covering frequently asked questions and troubleshooting and
provides a glossary of relevant terms.
Tip: Trend Micro recommends checking the Update Center
(http://www.trendmicro.com/download) for updates to documentation and product
components.

Preface
ix
About This Installation and Deployment Guide
The Network VirusWall Enforcer Installation and Deployment Guide discusses the following
topics:
•Introducing Network VirusWall Enforcer—an overview of the device and its
components
•Getting Started—details of the actual device and its specifications, including
instructions for mounting and powering on the device
•Deploying Network VirusWall Enforcer—recommendations to help you plan for the
deployment of one or more devices
•Preconfiguring Network VirusWall Enforcer—considerations and procedures on how to
perform preconfiguration
•Troubleshooting and Technical Support—troubleshooting tips for issues encountered
during preconfiguration
•Ethernet Cable Usage Guidelines—information on the cables to use depending on port
speed and duplex modes
Audience
This Installation and Deployment Guide is targeted at network administrators who will
deploy the device. Network VirusWall Enforcer documentation assumes basic
understanding of security and networking concepts, including:
• Antivirus and content security protection
• Network concepts (such as IP addressing, subnet masks, dual-stack networks)
• Various network topologies
• Network devices and their administration
• Network configuration (such as the use of VLAN, SNMP)

Trend Micro™ Network VirusWall™ Enforcer 1500i (CR100 Series) Installation and Deployment Guide
x
Document Conventions
To help you locate and interpret information easily, this document uses the following
conventions.
TABLE P-1. Conventions used in this document
CONVENTION DESCRIPTION
ALL CAPITALS Acronyms, abbreviations, and names of certain
commands and keys on the keyboard
Bold References to user interface items, including
menus, buttons, tabs, and other labels
Italics References to other documentation
Monospace Actual text, typed commands, URLs, file names,
and program output
Note:
Important information
Tip:
Recommendations
WARNING!
Critical information

1-1
Chapter 1
Introducing Network VirusWall
Enforcer
This chapter introduces Trend Micro™ Network VirusWall™ Enforcer 1500i and
provides an overview of important concepts and features.
This chapter discusses the following topics:
•Network VirusWall Enforcer Overview on page 1-2
•Key Concepts on page 1-3
•Device Ports on page 1-3

Trend Micro™ Network VirusWall™ Enforcer 1500i (CR100 Series) Installation and Deployment Guide
1-2
Network VirusWall Enforcer Overview
Network VirusWall Enforcer is an outbreak prevention and policy enforcement
appliance. It helps stop network viruses (Internet worms), block high-threat
vulnerabilities during outbreaks, and quarantine and clean up infection sources. Network
VirusWall Enforcer, deployed at the network layer, uses threat intelligence from Trend
Micro to protect against threats as they enter the network. The device scans all the
traffic on a specific network segment and applies one policy to an endpoint based on a
first-match rule.
FIGURE 1-1. The device monitors network packets and events that could
indicate an attack
Tip: Refer to Understanding Network VirusWall Enforcer in the Administrator’s Guide for a more
comprehensive overview of Network VirusWall Enforcer.
Network VirusWall
Enforcer
L2 Switch
L3 Switch
L3 Switch
L3 Switch
Endpoint

Introducing Network VirusWall Enforcer
1-3
Key Concepts
Before proceeding to the succeeding sections of this document, take note of the
following concepts. These concepts are discussed in detail in the Administrator’s Guide.
•Ethernet—located on the back panel, these ports link to other devices (usually
Layer 2 or Layer 3 devices).
The documentation sometimes refers to copper ports as ports or interfaces (see Device
Ports on page 1-3). Each port functions as one of the following:
•Management port (RJ-45)—dedicated for management purposes. You can
specify only one management port.
•Mirror port (RJ-45)—sends all traffic passing the device to a computer to
capture all data. The data can then be used for debugging purposes. You can
specify one mirror port. Using this port type can impact performance.
•Regular port (RJ-45)—carries analyzed traffic to and from segments. You can
specify multiple regular ports.
•Failopen —a fault-tolerance solution also known as "LAN bypass" that allows the
Network VirusWall Enforcer device to continue to pass traffic even if a software or
hardware failure occurs within the device.
•Link-state failover—a port group setting that turns off the working port if only
one port in a port group is left connected. This ensures that switches immediately
recognize the port group failure and can channel traffic to another route.
Device Ports
Network VirusWall Enforcer supports four network ports, with the first two ports (port
1 and 2) providing management functionality. More specifically, these ports can be
configured as management (MGMT) or mirror (MIRR) ports. Ports 3 and 4 are regular
data ports that connect to the network and provide security functionality. The device
applies its protection features to packets that pass through these data ports.

Trend Micro™ Network VirusWall™ Enforcer 1500i (CR100 Series) Installation and Deployment Guide
1-4
FIGURE 1-2. Network VirusWall Enforcer ports
Port Functions
Network VirusWall Enforcer ports can be classified based on their function. As
described earlier, there are regular data ports and management ports. Management ports
can be assigned different functions as shown in the table below.
TABLE 1-1. Port types
TYPE
(INTERFACE
TYPE; PORT
NUMBER)
FUNCTION
(CODE)
DEFAULT
STATE DESCRIPTION
Data (Copper
or Fiber; ports
3 onwards)
Regular
(REG)
Enabled These are the standard ports
used for policy enforcement.
Network VirusWall Enforcer
can assess endpoints con-
nected to this port through L2
or L3 switches.
Data ports 3 and 4
Management ports
1 and 2

Introducing Network VirusWall Enforcer
1-5
While the management ports are onboard ports, Network VirusWall Enforcer data ports
are provided using Silicom PEG2BPi-SD-RoHS (Dual port Copper Gigabit Ethernet
PCI Express Bypass Server Adapter). This server adapter provides maximum network
uptime with copper bypass circuitry.
By using bypass server adapters, Network VirusWall Enforcer data ports provide a
fault-tolerance solution known as "failopen" or "LAN bypass". This solution allows the
Network VirusWall Enforcer to continue passing network traffic even if other device
components fail or when the device loses power.
Note: Management ports do not support failopen.
Management
(Copper;
ports 1 to 2)
Manage-
ment
(MGMT)
Disabled You can access the Web con-
sole through all regular ports,
but you can also dedicate a
single port for accessing the
Web console and managing the
device.
Mirror
(MIRR)
Assign this function to send all
traffic going through this port.
You can use this port to capture
all scanning data, which can be
used for debugging. Note that
having a mirror port can impact
performance.
TABLE 1-1. Port types (Continued)
TYPE
(INTERFACE
TYPE; PORT
NUMBER)
FUNCTION
(CODE)
DEFAULT
STATE DESCRIPTION

Trend Micro™ Network VirusWall™ Enforcer 1500i (CR100 Series) Installation and Deployment Guide
1-6

2-1
Chapter 2
Getting Started
This chapter guides you through setting up and powering on a Trend Micro™ Network
VirusWall™ Enforcer 1500i device.
This chapter discusses the following topics:
•Package Contents on page 2-2
•Front Panel on page 2-4
•Back Panel on page 2-9
•Technical Specifications on page 2-11
•Installing the Device on page 2-12

Trend Micro™ Network VirusWall™ Enforcer 1500i (CR100 Series) Installation and Deployment Guide
2-2
Package Contents
Figure 2-1 illustrates the package contents.
FIGURE 2-1. Package contents
Note: The actual items in your package may appear slightly different from those shown in
this document.
Refer to Table 2-1 to check whether the package is complete. If any of the items is
missing, please contact Trend Micro support (see Getting Technical Support on page 5-3).
Device with bezel Power cord
Rack kit Documents
and USB drive

Getting Started
2-3
TABLE 2-1. Network VirusWall Enforcer package contents
QUANTITY ITEM DESCRIPTION
1 unit Network VirusWall
Enforcer device
The device and the lockable bezel
1 piece Power cord Supplies power to the device
1 set Rack kit Mounts the device to a standard 19-inch
rack cabinet
1 unit Network VirusWall
Enforcer USB flash
drive
Bootable USB flash drive that can be
used to restore the device operating sys-
tem and software. This flash drive also
includes tools and device documenta-
tion, specifically:
•Image file for the Network VirusWall
Enforcer operating system
•Security Appliance License
Agreement
•Third-party License Attributions
•Administrator’s Guide
•Installation and Deployment Guide
•Quick Start Guide
•Readme
•Trend Micro™ Control Manager™
patches
•Syslog and TFTP tools
Note: Refer to the troubleshooting
section in the Administrator’s
Guide for instructions on how to
use the provided tools.