InterScan Web Security for Virtual Appliances 5.1 Administrator's Guide

518 Pages·2011·4.71 MB·English

by  Luanne Oleas

i-i
i-ii
Trend Micro Incorporated reserves the right to make changes to this document and to
the products described herein without notice. Before installing and using the software,
please review the readme files, release notes and the latest version of the Installation
Guide, which are available from Trend Micro’s Web site at:
http://www.trendmicro.com/download/documentation/
Trend Micro, the Trend Micro t-ball logo, InterScan, TrendLabs, Trend Micro Control
Manager, and Trend Micro Damage Cleanup Services are trademarks or registered
trademarks of Trend Micro, Incorporated. All other product or company names may be
trademarks or registered trademarks of their owners.
Copyright© 2010 Trend Micro Incorporated. All rights reserved. No part of this
publication may be reproduced, photocopied, stored in a retrieval system, or transmitted
without the express prior written consent of Trend Micro Incorporated.
Release Date: December 2010/Updated February 2011
Protected by U.S. Patent No. 5,951,698
The Administrator’s Guide for Trend Micro is intended to provide in-depth information
about the main features of the software. You should read through it prior to installing or
using the software.
For technical support, please refer to the Technical Support and Troubleshooting
chapter for information and contact details. Detailed information about how to use
specific features within the software are available in the online help file and online
Knowledge Base at Trend Micro’s Web site.
Trend Micro is always seeking to improve its documentation. If you have questions,
comments, or suggestions about this or any Trend Micro documents, please contact us
at [email protected]. Your feedback is always welcome. Please evaluate this
documentation on the following site:
http://www.trendmicro.com/download/documentation/rating.asp
ii
Contents
Preface
IWSVA Documentation ..................................................................................xx
Audience ............................................................................................................xxi
Document Conventions .................................................................................xxi
About Trend Micro ........................................................................................xxii
Chapter 1: Introducing Trend Micro™ InterScan™ Web
Security Virtual Appliance
Web Traffic Security Risk Overview ...........................................................1-2
Smart Search Support ................................................................................1-3
Hardware Specifications ................................................................................1-4
Compatible Directory Servers ..................................................................1-5
Integration with ICAP 1.0-compliant Caching Devices ......................1-5
X-Authenticated ICAP Headers Support ..........................................1-5
What’s New ....................................................................................................1-6
Performance ................................................................................................1-6
Resource Usage and Scalability ................................................................1-6
Usability .......................................................................................................1-6
Deployment Wizard ..............................................................................1-6
Fail open/LAN bypass .........................................................................1-6
Notification Message Enhancement ..................................................1-6
Smart Search ..........................................................................................1-7
URL Filtering Access Warning Mode ................................................1-7
LDAP Integration Policy Improvement ...........................................1-7
Product License .....................................................................................1-7
Content Cache .......................................................................................1-7
HTTPS Scanning ..................................................................................1-8
X-Forwarded-For Header ....................................................................1-8
Administration and Management ............................................................1-8
Virus Scan Technology Enhancement ...................................................1-8
iii
Main Features ...................................................................................................1-9
Support for Multiple Trend Micro™ InterScan™ Web Security Virtual
Appliance Installations ..............................................................1-9
HTTP Virus Scanning ...............................................................................1-9
FTP Scanning ..............................................................................................1-9
Improved Deferred Scanning for HTTP and FTP Large
File Scans ...................................................................................1-10
Applets and ActiveX Security .................................................................1-10
URL Filtering ............................................................................................1-10
Direct URL Filter Category Selection ...................................................1-10
Access Quota Policies ..............................................................................1-11
URL Access Control ................................................................................1-11
IP Address, Host Name and LDAP Client Identification .................1-11
Server and Port Access Control Restrictions .......................................1-12
Notifications ..............................................................................................1-12
PhishTrap ..................................................................................................1-12
Web Reputation ........................................................................................1-13
Anti-phishing and Anti-pharming Based on Web Reputation .....1-13
IntelliTrap ..................................................................................................1-13
IntelliTunnel ..............................................................................................1-14
Easier Collection of System Information for Support Diagnosis .....1-14
True File-type Blocking Within Compressed Files .............................1-14
Real-time Statistics and Alerts ................................................................1-14
Configurable Threshold Warning ..........................................................1-15
Reverse Proxy Support ............................................................................1-15
Logs and Reports ......................................................................................1-16
Additional Reporting Information .........................................................1-16
Integration with Cisco WCCP ................................................................1-17
Command Line Interface ........................................................................1-18
HTTPS Decryption ..................................................................................1-18
Secure Shell (SSH) Configuration in Web Console ............................1-18
Per-policy Exception ...............................................................................1-18
Compressed File Handling Actions .......................................................1-19
Custom Category ......................................................................................1-19
URL Monitoring Mode ...........................................................................1-19
Reporting ...................................................................................................1-19
Web Page Analysis ...................................................................................1-19
iv
Safe Search Engine ..................................................................................1-20
User/group Name Authentication in Transparent Mode (WCCP and
Bridge mode) ............................................................................1-20
White List for User/group Name Authentication ..............................1-20
Network Interface Configuration and PING Management ..............1-20
System Event Logs ..................................................................................1-20
Syslog Support ..........................................................................................1-21
System Shutdown or Restart ..................................................................1-21
Configuration Backup and Restore .......................................................1-21
License Management in Control Manager ...........................................1-21
Manual Component Update Button .....................................................1-21
Advanced Reporting and Management Integration ...........................1-21
Chapter 2: Deployment Wizard
Overview of the Deployment Wizard .........................................................2-2
Mode Selection ................................................................................................2-2
Transparent Bridge Mode .........................................................................2-3
Forward Proxy Mode ................................................................................2-4
Reverse Proxy Mode .................................................................................2-6
ICAP Mode .................................................................................................2-7
Deploying IWSVA in ICAP Mode in the Deployment Wizard ....2-8
Simple Transparency Mode ......................................................................2-8
Web Cache Coordination Protocol (WCCP) Mode ...........................2-10
Mode-specific Settings .................................................................................2-11
Proxy Settings ...........................................................................................2-11
Forward Proxy Mode .........................................................................2-12
Reverse Proxy Settings .......................................................................2-15
ICAP Settings ...........................................................................................2-16
Simple Transparency Settings ................................................................2-18
WCCP Settings .........................................................................................2-19
Network Interface .........................................................................................2-20
Host Information .....................................................................................2-21
Interface Status ....................................................................................2-21
Data Interface ......................................................................................2-22
Separate Management Interface ........................................................2-24
v
Miscellaneous Settings .............................................................................2-24
Static Routes ...................................................................................................2-26
Product Activation ........................................................................................2-27
About Licenses .........................................................................................2-27
Third-party Licensing Agreements ...................................................2-27
Registering Online ....................................................................................2-28
About Activation Codes ..........................................................................2-29
System Time Settings ....................................................................................2-30
Summary .........................................................................................................2-31
Results .............................................................................................................2-31
Deployment Status ..............................................................................2-32
Post Deployment ...........................................................................................2-32
LAN-bypass Function .............................................................................2-33
Enabling the LAN-bypass Function ................................................2-33
Setting Up IWSVA ICAP .......................................................................2-35
Setting up an ICAP 1.0-compliant Cache Server ...........................2-35
Configuring Virus-scanning Server Clusters ........................................2-41
Deleting a Cluster Configuration or Entry ......................................2-42
Flushing Existing Cached Content from the Appliance ....................2-42
Verifying that InterScan Web Security Virtual Appliance is Listening
for ICAP Requests ................................................................2-43
Understanding the Differences between Request Mode and Response
Mode ..........................................................................................2-45
Triggering a Request Mode Action ...................................................2-45
Triggering a Response Mode Action ................................................2-45
Chapter 3: Updates
Product Maintenance ......................................................................................3-2
Renewing Your Maintenance Agreement ..............................................3-2
About ActiveUpdate .......................................................................................3-3
Updating From the IWSVA Web Console ............................................3-3
Proxy Settings for Updates ............................................................................3-3
Updatable Program Components .................................................................3-4
vi
Virus Pattern File .......................................................................................3-5
How it Works ........................................................................................3-6
Phish Pattern File .......................................................................................3-7
Page Analysis Pattern ................................................................................3-7
Spyware/Grayware Pattern File ...............................................................3-7
IntelliTrap Pattern and IntelliTrap Exception Pattern Files ...............3-8
Scan Engine ................................................................................................3-8
About Scan Engine Updates ...............................................................3-9
Web Reputation Database ......................................................................3-10
Incremental Updates of the Pattern Files and Engines .....................3-10
Component Version Information .........................................................3-10
Manual Updates ............................................................................................3-11
Forced Manual Updates ..........................................................................3-11
Scheduled Updates ........................................................................................3-12
Maintaining Updates .....................................................................................3-13
Verifying a Successful Update ................................................................3-13
Update Notifications ...............................................................................3-13
Rolling Back an Update ..........................................................................3-14
Deleting Old Pattern Files ......................................................................3-14
Controlled Virus Pattern Releases ..............................................................3-15
Chapter 4: HTTP Configuration
Enabling the HTTP(s) Traffic Flow ............................................................4-2
Specifying a Proxy Configuration and Related Settings ............................4-2
Proxy Configurations ................................................................................4-4
No Upstream Proxy (Stand-alone Mode) .........................................4-4
Upstream Proxy (Dependent Mode) .................................................4-5
Transparent Proxy ................................................................................4-7
Reverse Proxy ........................................................................................4-9
Proxy-related Settings ..............................................................................4-10
HTTP Listening Port .........................................................................4-10
Anonymous FTP Logon Over HTTP Email Address ..................4-11
Network Configuration and Load Handling ............................................4-11
Configuring an IWSVA Server Farm .........................................................4-12
vii
Shared Policy after Registering to ARM ...............................................4-13
Configuring Internet Access Control Settings ..........................................4-14
Identifying Clients and Servers ...............................................................4-14
Client IP .....................................................................................................4-14
Server IP White List .................................................................................4-15
Destination Port Restrictions .................................................................4-17
HTTPS Ports ............................................................................................4-18
Chapter 5: Policies and User Identification Method
How Policies Work .........................................................................................5-2
Default Global and Guest Policies ...............................................................5-3
About the Guest Policy .............................................................................5-4
Enabling the Guest Port ...........................................................................5-4
Deploying Policies ...........................................................................................5-4
Configuring the User Identification Method ..............................................5-5
IP Address ...................................................................................................5-6
Host Name ..................................................................................................5-7
Client Registration Utility .....................................................................5-8
User/Group Name Authentication .........................................................5-9
LDAP Authentication Method ...........................................................5-9
LDAP Communication Flows ...........................................................5-12
LDAP Authentication in Transparent Mode .......................................5-14
Configuring LDAP Settings ...............................................................5-16
LDAP Query Matching Across Main and Referral Servers ..........5-21
Cross Domain Active Directory Object Queries ...........................5-22
Configuring the Scope of a Policy .........................................................5-22
Configuring Policies Using IP Addresses ........................................5-23
Configuring Policies Using Host Names .........................................5-24
Configuring Policies Using LDAP ....................................................5-24
Login Accounts .............................................................................................5-25
About Access Rights ................................................................................5-25
Adding a Login Account .........................................................................5-26
Changing a Login Account .....................................................................5-26
viii