Trend Micro™ InterScan™ Web Security Virtual Appliance Administrator's Guide

763 Pages·2012·7.46 MB·English

i-ii
Trend Micro Incorporated reserves the right to make changes to this document and to
the products described herein without notice. Before installing and using the software,
please review the readme files, release notes and the latest version of the Installation
Guide, which are available from Trend Micro’s Web site at:
http://www.trendmicro.com/download/documentation/
Trend Micro, the Trend Micro t-ball logo, InterScan, TrendLabs, Trend Micro Control
Manager, and Trend Micro Damage Cleanup Services are trademarks or registered
trademarks of Trend Micro Incorporated. All other product or company names may be
trademarks or registered trademarks of their owners.
Copyright© 2012 Trend Micro Incorporated. All rights reserved. No part of this
publication may be reproduced, photocopied, stored in a retrieval system, or transmitted
without the express prior written consent of Trend Micro Incorporated.
Release Date: June 2012
Protected by U.S. Patent No. 5,951,698
The Administrator’s Guide for Trend Micro is intended to provide in-depth information
about the main features of the software. You should read through it prior to installing or
using the software.
For technical support, please refer to the Technical Support and Troubleshooting
chapter for information and contact details. Detailed information about how to use
specific features within the software are available in the online help file and online
Knowledge Base at Trend Micro’s Web site.
Trend Micro is always seeking to improve its documentation. If you have questions,
comments, or suggestions about this or any Trend Micro documents, please contact us
at [email protected]. Your feedback is always welcome. Please evaluate this
documentation on the following site:
http://www.trendmicro.com/download/documentation/rating.asp
ii
Contents
Preface
IWSVA Documentation ...............................................................................xxiv
Audience ...........................................................................................................xxv
Document Conventions ................................................................................xxv
About Trend Micro .......................................................................................xxvi
Chapter 1: Introducing Trend Micro™ InterScan™ Web
Security Virtual Appliance
Web Traffic Security Risk Overview ...........................................................1-2
Smart Search Support ................................................................................1-3
System Specifications .....................................................................................1-4
Web-based Browser Requirements .........................................................1-4
Hardware Requirements ...........................................................................1-4
Compatible Directory Servers for End-User Authentication .............1-5
Integration with ICAP 1.0-compliant Caching Devices ......................1-5
X-Authenticated ICAP Headers Support ..........................................1-6
What’s New ....................................................................................................1-7
Main Features ..................................................................................................1-8
Application Control ...................................................................................1-8
Traffic Monitoring and Reporting ...........................................................1-8
HTTP Inspection .......................................................................................1-9
Password Override Action for Blocked URL Filtering Categories ....1-9
Time Limit Action for URL Filtering .....................................................1-9
Time Quota Extension for URL Filtering Time Limit Action ...........1-9
HTTP Malware Scanning .......................................................................1-10
HTTPS Decryption .................................................................................1-10
Web Reputation .......................................................................................1-10
High Availability .......................................................................................1-11
FTP Scanning ...........................................................................................1-11
iii
URL Filtering ............................................................................................1-11
Content Caching .......................................................................................1-11
IP Address, Host Name and LDAP-based Client Identification ......1-12
Hyper-V Installation Support .................................................................1-12
Notifications ..............................................................................................1-12
Real-time Statistics and Alerts ................................................................1-12
Logs and Reports ......................................................................................1-13
Syslog Support ..........................................................................................1-14
Integration with Cisco WCCP ................................................................1-14
Reverse Proxy Support ............................................................................1-15
Support for Multiple Trend Micro™ InterScan™ Web Security Virtual
Appliance Installations ............................................................1-15
Advanced Reporting and Management Integration ............................1-15
Command Line Interface ........................................................................1-15
Chapter 2: Deployment Wizard
Overview of the Deployment Wizard ..........................................................2-2
Mode Selection ................................................................................................2-2
Transparent Bridge Mode .........................................................................2-3
Transparent Bridge Mode - High Availability ........................................2-5
About Cluster IP Addresses ................................................................2-6
About Weighted Priority Election ......................................................2-6
Create a New Cluster ............................................................................2-6
Join an Existing Cluster ........................................................................2-8
Forward Proxy Mode .................................................................................2-9
Reverse Proxy Mode ................................................................................2-10
ICAP Mode ...............................................................................................2-11
Deploying IWSVA in ICAP Mode in the Deployment Wizard ...2-12
Simple Transparency Mode ....................................................................2-13
Web Cache Coordination Protocol (WCCP) Mode ............................2-14
Mode-specific Settings ..................................................................................2-15
Proxy Settings ...........................................................................................2-16
Forward Proxy Mode ..........................................................................2-16
Reverse Proxy Settings .......................................................................2-18
ICAP Settings ............................................................................................2-19
Simple Transparency Settings .................................................................2-21
iv
WCCP Settings .........................................................................................2-22
Network Interface .........................................................................................2-26
Host Information .....................................................................................2-26
Interface Status ....................................................................................2-26
Data Interface ......................................................................................2-29
Separate Management Interface ........................................................2-31
Miscellaneous Settings (IPv4 and IPv6) ...............................................2-32
Static Routes ..................................................................................................2-33
Product Activation ........................................................................................2-34
About Licenses .........................................................................................2-34
Third-party Licensing Agreements ...................................................2-35
Registering Online ...................................................................................2-35
About Activation Codes .........................................................................2-36
System Time Settings ...................................................................................2-37
Summary .........................................................................................................2-38
Results .............................................................................................................2-39
Deployment Status ..............................................................................2-39
Post Deployment ..........................................................................................2-40
LAN Bypass Function .............................................................................2-41
Enabling the LAN Bypass Function ................................................2-41
Setting Up IWSVA ICAP .......................................................................2-43
Setting up an ICAP 1.0-compliant Cache Server ...........................2-43
Configuring Virus-scanning Server Clusters ........................................2-50
Deleting a Cluster Configuration or Entry .....................................2-50
Flushing Existing Cached Content from the Appliance ....................2-51
Verifying that InterScan Web Security Virtual Appliance is Listening
for ICAP Requests ...............................................................2-51
Understanding the Differences between Request Mode and Response
Mode ..........................................................................................2-53
Triggering a Request Mode Action ..................................................2-54
Triggering a Response Mode Action ...............................................2-54
v
Chapter 3: High Availability and Cluster Management for
Transparent Bridge Mode
High Availability Overview ............................................................................3-2
About Active/Passive Pairs ......................................................................3-3
The HA Agent Handles Status Changes ............................................3-4
Failover vs. Switchover .........................................................................3-4
HA Agent and Interfaces ...............................................................................3-4
About the Deployment Wizard ................................................................3-4
Creating a Cluster ..................................................................................3-5
Joining a Cluster .....................................................................................3-5
About the Application Health Monitor ..................................................3-5
Link Loss Detection ..............................................................................3-6
About Central Management .....................................................................3-6
Centrally Managed and Non-centrally Managed Features ..............3-8
About Cluster Management ....................................................................3-10
Cluster Configuration .........................................................................3-11
Node Configuration ............................................................................3-11
Cluster Logs and Notifications ..........................................................3-12
Accessing the Cluster ..........................................................................3-13
Cluster Management Web Console Page .........................................3-15
Chapter 4: Updates
Product Maintenance ......................................................................................4-2
Renewing Your Maintenance Agreement ..............................................4-2
About ActiveUpdate .......................................................................................4-3
Updating From the IWSVA Web Console ............................................4-3
Proxy Settings for Updates ............................................................................4-3
Updatable Program Components .................................................................4-4
Virus Pattern File ........................................................................................4-5
How it Works .........................................................................................4-5
Phish Pattern File .......................................................................................4-6
Page Analysis Pattern .................................................................................4-7
Spyware/Grayware Pattern File ...............................................................4-7
IntelliTrap Pattern and IntelliTrap Exception Pattern Files ................4-7
vi
Scan Engine ................................................................................................4-8
About Scan Engine Updates ...............................................................4-9
Web Reputation Database ........................................................................4-9
Incremental Updates of the Pattern Files and Engines .....................4-10
Component Version Information .........................................................4-10
Manual Updates ............................................................................................4-10
Forced Manual Updates ..........................................................................4-11
Scheduled Updates ........................................................................................4-12
Maintaining Updates .....................................................................................4-13
Update Notifications ...............................................................................4-13
Rolling Back an Update ..........................................................................4-13
Deleting Old Pattern Files ......................................................................4-14
Controlled Virus Pattern Releases ..............................................................4-14
Chapter 5: Application Control
Application Control Overview .....................................................................5-2
Application Control Policy List ....................................................................5-2
Add Policies: Select Accounts ..................................................................5-4
Adding an Application Control Policy ..............................................5-5
Add or Edit Policies: Specify Rules for Application Control Policies 5-5
Specifying Application Control Policy Rules ....................................5-6
Application Control Settings ....................................................................5-7
Traffic Monitoring Overview ........................................................................5-8
Chapter 6: HTTP Configuration
Enabling the HTTP/HTTPS Traffic Flow ................................................6-2
Specifying a Proxy Configuration and Related Settings ............................6-2
Proxy Configurations ................................................................................6-4
No Upstream Proxy (Stand-alone Mode) .........................................6-4
Upstream Proxy (Dependent Mode) .................................................6-5
Transparent Proxy ................................................................................6-7
Reverse Proxy ........................................................................................6-9
Proxy-related Settings ..............................................................................6-10
vii
HTTP Listening Port ..........................................................................6-10
Anonymous FTP Logon Over HTTP Email Address ..................6-11
Network Configuration and Load Handling .............................................6-11
Shared Policy after Registering to ARM ...............................................6-12
Configuring Internet Access Control Settings ..........................................6-13
Identifying Clients and Servers ...............................................................6-13
Client IP .....................................................................................................6-14
Server IP White List .................................................................................6-15
Destination Port Restrictions .................................................................6-16
HTTPS Ports ............................................................................................6-17
Chapter 7: Policies and User Identification Method
How Policies Work .........................................................................................7-2
Default Global and Guest Policies ...............................................................7-4
About the Guest Policy .............................................................................7-4
Enabling the Guest Account ....................................................................7-4
Policy Queries .............................................................................................7-5
Deploying Policies ...........................................................................................7-5
Configuring the User Identification Method ..............................................7-6
IP Address ...................................................................................................7-7
Host Name ..................................................................................................7-7
Client Registration Utility .....................................................................7-9
User/Group Name Authentication .......................................................7-10
LDAP Authentication Method .........................................................7-10
LDAP Communication Flows ...........................................................7-11
LDAP Authentication in Transparent Mode .......................................7-12
Configuring LDAP Settings ...............................................................7-13
Cross Domain Active Directory Object Queries ...........................7-17
Configuring the Scope of a Policy .........................................................7-17
Configuring Policies Using IP Addresses ........................................7-18
Configuring Policies Using Host Names .........................................7-19
Configuring Policies Using LDAP ....................................................7-19
Login Accounts .............................................................................................7-20
About Access Rights ................................................................................7-21
viii