TREND MICRO. ServerProtect5. Comprehensive server and storage virus protection. For Network Appliance. Filers

Transcription

1 ServerProtect5 TM TREND MICRO Comprehensive server and storage virus protection TM For Network Appliance Filers TM

2 Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. Before installing and using the software, please review the readme files, release notes, and the latest version of the Quick Start Guide which are available from the Trend Micro Web site at: NOTE: A license to the Trend Micro Software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. Maintenance should be renewed on an annual basis at the Trend Micro then-current Maintenance fees. Trend Micro, the Trend Micro t-ball logo, Control Manager, MacroTrap, ServerProtect, and TrendLabs are trademarks or registered trademarks of Trend Micro, Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright Trend Micro Incorporated. All rights reserved. No part of this publication may be reproduced, photocopied, stored in a retrieval system, or transmitted without the express prior written consent of Trend Micro Incorporated. Document Part No. SSEG51567/30718 Release Date: October 2003 Protected by U.S. Patent No. 5,951,698

3 The Quick Start Guide for Trend Micro ServerProtect for Network Appliance (NetApp) Filers introduces the main features of the software and installation instructions for your production environment. You should read it before installing or using the software. For technical support, please refer to Troubleshooting ServerProtect for NetApp Filers on Page 30 for technical support information and contact details. Detailed information about how to use specific features within the software are available in the online help file and online Solution Bank at Trend Micro s Web site. Trend Micro is always seeking to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro documents, please contact us at docs@trendmicro.com. Your feedback is always welcome. Please evaluate this documentation on the following site:

4 Contents System requirements...2 Overview...4 ServerProtect for Windows architecture review...7 Enabling Trend Micro update server...9 What s new in ServerProtect for NetApp Filers?...10 Multi-filer support...10 User notification upon client infection...10 NetApp Filer status available through the Management Console...10 Conveniently update NetApp Filer logon information...10 Trend Micro Control Manager agent compatibility...10 NetApp Filer notification of new updates...11 NetApp Filer RPC status notification...11 Installing ServerProtect for NetApp Filers...11 Verifying vscan is enabled...12 Confirming the CIFS default share (C$) still exists...12 Deleting connections between Scan Servers and a NetApp Filer...14 Installing a Scan Server...14 Using multiple Scan Servers for a single NetApp Filer...16 Adding more NetApp Filers to a Scan Server...17 Removing ServerProtect for NetApp Filers...19 Removing a NetApp Filer...19 Upgrading ServerProtect for NetApp Filers...19 Configuring NetApp Filer options...20 Updating NetApp Filer information...20 Using Scan Servers as Normal Servers...21 Scanning viruses...23 Notifying NetApp Filer clients upon infection...23 Viewing the status of a NetApp Filer...24 Configuring NetApp Filer RPC connection status notifications...25 Notifying NetApp Filers of new update components...26 Registration and technical support...27 Contacting technical support and registering ServerProtect...27 Online resources...28 i

5 Trend Micro Serverprotect for Network Appliance filers Quick Start Guide Security information Knowledge Base TrendLabs Sending infected files to Trend Micro Upgrading the ServerProtect evaluation copy Troubleshooting ServerProtect for NetApp Filers Network Appliance (NetApp) Filers do not recognize ServerProtect for Network Appliance Filers Scan Servers The Scan Server completed scan on a file but original request was not found when scanning large files on the NetApp Filer Configuring the ServerProtect for Network Appliance Filers to scan all file types Testing your installation ii

6 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers Trend Micro ServerProtect for Network Appliance (NetApp ) Filers Trend Micro ServerProtect for Network Appliance (NetApp) Filers is an enhanced version of ServerProtect developed exclusively to provide antivirus solutions for NetApp Filers. Scalable and reliable, ServerProtect for NetApp Filers protects NetApp s line of Filer storage appliances against viruses, Trojans, and other malicious code. This Quick Start Guide is an addendum to the ServerProtect for Windows Getting Started Guide (GSG). Many of the ServerProtect for NetApp features can be found in the ServerProtect for Windows GSG. If you cannot find information regarding a specific feature in this book, please refer to the ServerProtect for Windows GSG. This addendum manual includes the following sections: System requirements Overview What s new in ServerProtect for NetApp Filers Installing ServerProtect for NetApp Filers Removing ServerProtect for NetApp Filers Upgrading ServerProtect for NetApp Filers Configuring NetApp Filer options Contacting technical support and troubleshooting Upgrading the ServerProtect evaluation copy 1

7 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide System requirements ServerProtect for NetApp Filers requires the following: Scan Server Intel Pentium III 550MHz processor or equivalent Operating System: Microsoft Windows Microsoft Windows Server 2003 Microsoft Windows 2000 Server/Advanced Server with SP3 or above Network Protocols and Services TCP/IP, Microsoft Network (NetBIOS Compatible Transport Protocol), and RPC services must be running on the installed Windows server 256MB RAM or above is recommended 70MB of free disk space Note: In the ServerProtect for Windows documentation, the Scan Server is called "Normal Server". However, this document uses the term "Scan Server" to describe the machines in Information Server domains that protect the NetApp Filers. Information Server Intel Pentium III 550MHz processor or equivalent Operating System: Microsoft Windows Microsoft Windows Server 2003 Microsoft Windows 2000 Server/Advanced Server with SP3 or above Network Protocols and Services TCP/IP, Microsoft Network (NetBIOS Compatible Transport Protocol), and RPC services must be running on the installed Windows server 256MB RAM or above is recommended 70MB of free disk space 90MB free disk space (if installing with Trend Micro Control Manager agent) 2

8 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers Management Console Operating System: Microsoft Windows Microsoft Windows Server 2003 Microsoft Windows 2000 Server/Advanced Server with SP3 or above Network Protocols and Services TCP/IP, Microsoft Network (NetBIOS Compatible Transport Protocol), and RPC services must be running on the installed Windows server Monitor with 800 x 600 or higher resolution NetApp Filer The NetApp Filer must be AV-enabled with an RPC agent running to communicate with ServerProtect The NetApp Filer must have the proprietary Operating System Data ONTAP or above installed Note: For optimal scanning performance, Trend Micro recommends the connection between the filer and a Scan Server to have a bandwidth of at least 1Gbps. 3

9 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide Overview ServerProtect for NetApp Filers scans viruses using "on-access" mode, which takes place on a Scan Server. In turn, the Information Server manages the Scan Servers. FIGURE 1. ServerProtect for NetApp Filers product architecture When a ServerProtect for NetApp Filers user tries to access a file or store a new file in a NetApp Filer, the NetApp Filer performs a virus check. If the filename extension matches the file scanning criteria (For example, an ".EXE" or a ".VBS" file), the NetApp Filer sends a manual scan request (Scan Now) to the Scan Server(s). The Scan Server then passes back the scan result to the NetApp Filer and according to the scan result, the user is either allowed to open/save the file or is denied access to the file (to set NetApp Filer file scanning criteria, refer to your NetApp Filer documentation). Note: Since only specific file types contain viruses, establishing the right file scanning criteria can help optimize Scan Server performance, reduce bandwidth usage, and minimize scanning time. To learn how ServerProtect for NetApp Filers can efficiently and safely scan files, see IntelliScan in chapter 1 of the ServerProtect for Windows Getting Started Guide. If a file contains a virus, ServerProtect for NetApp Filers performs a designated action. Refer to Scanning Viruses in chapter 3 of the ServerProtect for Windows Getting Started Guide for additional information about scan actions. For example, if 4

10 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers the file is cleanable and ServerProtect for NetApp Filers is configured to perform a Clean action the following occurs: 1. The Scan Server cleans the file and informs the NetApp Filer that the file is no longer infected. 2. The NetApp Filer allows its client to access the cleaned file and replaces the original file with the cleaned one. Note: The NetApp Filer "trusts" registered Scan Servers, so if a Scan Server also functions as a Normal Server (as a file or data server) and happens to send a file to the NetApp Filer, the latter will not request the file be scanned. To protect both the NetApp Filer, and the Normal Server, set the ServerProtect Real-time Scan to "Incoming & outgoing". See To set Real-time Scan to Incoming & outgoing, do the following: on page 21. 5

11 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide Below is an explanation of the ServerProtect for NetApp Filers organizational flow: RPC Scan Server RPC RPC Scan Server (Serverprotect- Normal Server) RPC ServerProtect Information Server Download source NetApp Filer HTTP RPC Trend Micro Update Server RPC Scan Server FIGURE 2. ServerProtect for NetApp Filers organizational flow ServerProtect for NetApp Filers consists of an agent that communicates with the NetApp Filer via remote procedure calls (RPCs). This agent performs the following functions: Registers the Normal Server with the NetApp Filer as a "Scan Server." This informs the NetApp Filer of the availability and location of a Scan Server Watches for NetApp Filer file-scanning requests Returns scan results to the NetApp Filer Answers any queries from the NetApp Filer Informs the NetApp Filer of any pattern file or scan engine updates Communicates with the NetApp Filer to check the connection between the Scan Server and the NetApp Filer 6

12 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers ServerProtect for Windows architecture review As previously mentioned, ServerProtect for NetApp Filers is an enhanced version of ServerProtect for Windows. To understand the ServerProtect for NetApp Filers enhancements, it is useful to review the architecture of ServerProtect for Windows. ServerProtect for Microsoft Windows protects networks through a three-tier architecture: the Management Console, the Information Server, and the Normal Server. You can use the Management Console to configure the Information Server (IS), which lets you control the Normal Servers managed by the IS. The three components are independent from each other, yet you can install each on one machine, on separate machines, or in a combination (for example, you can install the Management Console on one machine, and you can install the Information Server and the Normal Server together on a separate machine). For additional information on ServerProtect architecture, refer to ServerProtect Architecture in chapter 1 of the ServerProtect for Windows Getting Started Guide. Management Console: this portable console gives you centralized control of multiple network servers and domains. The Management Console lets you simultaneously configure servers in the same IS domain and generate integrated virus incident reports for all servers. The ServerProtect domain browser tree shows all the ServerProtect servers along with the status of each server. Status information includes the version of the virus pattern, scan engine, and program file; the type and version of operating system; the direction of real-time scanning, and so on. For additional information on the Management Console, refer to ServerProtect Architecture in chapter 1 of the ServerProtect for Windows Getting Started Guide. Information Server: a communications hub for coordinating antivirus defense activities within its domains. An Information Server (IS) provides a single point of contact for assigned Normal Servers and Scan Servers. This saves time because the Information Server makes it unnecessary to directly communicate with each individual Normal Server. What are ServerProtect domains? In ServerProtect, domains are virtual groupings of Normal Servers that simplify the identification and management of Normal Servers. You can create, rename, or delete domains according to your network needs (refer to Managing ServerProtect Domains in chapter 3 of the ServerProtect for Windows Getting Started Guide.) 7

13 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide If there is a large number of Normal Servers in a domain, you can add more Information Servers and divide the number of Normal Servers among them. For example, if a domain has 100 Normal Servers assigned to one IS, you can share the workload among two Information Servers by adding another IS and assigning 50 Normal Servers to each IS. The IS also collects log files. For additional Information Server information, refer to ServerProtect Architecture in chapter 1 of the ServerProtect for Windows Getting Started Guide. Note: In addition to managing Scan Servers, the ServerProtect for NetApp Filers Information Server can also manage ServerProtect for Windows Normal Servers. Normal Server (Scan Server): the first line of defense in the ServerProtect architecture and where all the scanning takes place. The Normal Servers are the machines in the organization, which typically act as file servers, data servers, etc. Normal Servers can scan both manually and in real time. For more Normal Server information, refer to ServerProtect Architecture in chapter 1 of the ServerProtect for Windows Getting Started Guide. Note: In ServerProtect for NetApp Filers, Normal Servers are referred to as "Scan Servers". Scan Servers scan files NetApp Filer clients try to access or modify in the NetApp Filer. 8

14 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers Key differences between the ServerProtect versions are listed in the following table: Protection Focus: Normal Server Role: ServerProtect for NetApp Filers NetApp Filer. Acts as a "Scan Server" and scans files in the NetApp Filer on access. ServerProtect Normal Servers (the machines in the organization which act as file servers, Web servers, etc.). Scans files on the Normal Server. Table 1. ServerProtect Version Comparison Enabling Trend Micro update server A virus scanner must have the latest updates in order to be effective. You can configure ServerProtect for NetApp Filers to automatically download the newest virus patterns and scan engine updates. To minimize download times and preserve network bandwidth, Trend Micro update server distributes available updates to the designated servers via an incremental update mechanism. This ensures ServerProtect for NetApp Filers downloads only the latest virus signatures since the last version. For detailed information about Trend Micro update server, refer to Configuring Updates in chapter 3 of the ServerProtect for Windows Getting Started Guide. 9

15 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide What s new in ServerProtect for NetApp Filers? This section includes the new features in this version of ServerProtect for NetApp Filers. Multi-filer support One Scan Server can scan multiple NetApp Filers at the same time. Now, network administrators can dedicate one physical server to protect several NetApp Filers, this can contribute to reduce the total cost of ownership. See Adding more NetApp Filers to a Scan Server on page 17 for additional information. User notification upon client infection ServerProtect for NetApp Filers can get the IP address and host name of a client causing an infection, and then alert both the user and the network administrator. This function is only available if using Data ONTAP version 6.4 or later. See Notifying NetApp Filer clients upon infection on page 23 for additional information. NetApp Filer status available through the Management Console Network administrators can view if a registered NetApp Filer is online or offline from the Management Console. See Viewing the status of a NetApp Filer on page 24 for additional information. Conveniently update NetApp Filer logon information Network administrators can update the logon information for several NetApp Filers simultaneously. See Updating NetApp Filer information on page 20 for additional information. Trend Micro Control Manager agent compatibility ServerProtect for NetApp Filers is compatible with Trend Micro Control Manager agent for ServerProtect. 10

16 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers NetApp Filer notification of new updates When new update components (scan engine and pattern) are downloaded to a Scan Server, the Scan Server will notify NetApp Filers to flush the cache of previously scanned files. This ensures that NetApp Filers continuously utilize the most current protection. Each NetApp Filer will then begin rebuilding the cache of previously scanned files until a new update arrives from Trend Micro update server. See Notifying NetApp Filers of new update components on page 26 for additional information. NetApp Filer RPC status notification ServerProtect for NetApp Filers monitors the RPC connection with each NetApp Filer. If the RPC connection between a NetApp Filer and the Scan Server is inactive, the Scan Server will attempt to reconnect to the NetApp Filer. Upon configuration, ServerProtect for NetApp will notify network administrators whenever a connection to a NetApp Filer succeeds or fails. You can also select the type of notification you wish to receive. This feature can help in troubleshooting. See Configuring NetApp Filer RPC connection status notifications on page 25 for additional information. Installing ServerProtect for NetApp Filers Before installing ServerProtect for NetApp Filers, perform the following tasks. Verify that vscan is enabled. See Verifying vscan is enabled on page 12 Confirm the default CIFS default share (C$) still exists. See Confirming the CIFS default share (C$) still exists on page 12 Delete connections between Scan Servers and a NetApp Filer. See Deleting connections between Scan Servers and a NetApp Filer on page 14 Note: To verify ServerProtect for NetApp Filers functions correctly, it is important to perform the necessary pre-installation checks and actions listed above. 11

17 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide Verifying vscan is enabled Before installing ServerProtect, it is important to verify that vscan is enabled on the NetApp Filer. To verify that vscan is enabled, type vscan at the command prompt of the NetApp Filer console. FIGURE 3. Virus scanning enabled If vscan is disabled, enable it so ServerProtect for NetApp Filers can function correctly. To enable vscan, type vscan on at the command prompt. For more information, at the command prompt type vscan help or refer to your NetApp Filer documentation. Confirming the CIFS default share (C$) still exists It is important to confirm that the Common Internet File System (CIFS) default share (C$) of the NetApp Filer was not removed. 12

18 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers WARNING! If you delete the default share, ServerProtect will not function correctly. To learn more about the filer administrative operations, refer to your NetApp Filer documentation. To confirm the default CIFS default share (C$) of the NetApp Filer still exists, do one of the following: Use the FilerView administration tool FIGURE 4. FilerView administration screen On the NetApp Filer console, type the command cifs shares 13

19 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide FIGURE 5. NetApp Filer console command prompt Deleting connections between Scan Servers and a NetApp Filer To prevent the Scan Server from failing to register to the NetApp Filer, delete all original connections between the Scan Servers and the NetApp Filer. This ensures Scan Servers use the correct credentials to make successful connections with the NetApp Filer. To delete connections between Scan Servers and a NetApp Filer, at the command prompt type: net use \\Filer-Machine\C$ /delete Installing a Scan Server With the exception of one step, the installation procedure for ServerProtect for NetApp Filers is the same as for ServerProtect for Windows. For additional information regarding installation procedures, refer to Installation Scenarios in chapter 2 of the ServerProtect for Windows Getting Started Guide. Note: While performing a remote installation, the NetApp Filer information will be copied from a source Scan Server to the target Scan Server. For more information, refer to Installation Scenarios in chapter 2 of the ServerProtect for Windows Getting Started Guide. 14

20 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers Installing a ServerProtect for NetApp Filers Scan Server requires the following information: The NetApp Filer name or IP address Name of the domain where the NetApp Filer is located User name and password needed to access the NetApp Filer (you need filer backup operator or above privileges) To install ServerProtect for NetApp Filers do the following: 1. During installation, select Install Server as a ServerProtect Normal Server on the Select Components screen, the Setup Filer Information screen appears. FIGURE 6. Setup Filer Information screen 2. Do the following: In the Filer name or IP address text box, type the NetApp Filer name or the filer IP address 15

21 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide In the Domain name text box, type the name of the domain where the NetApp Filer is located In the User name and Password text box, type your NetApp Filer logon credentials (you need filer backup operator or above privileges) 3. Click Next, and then continue following the directions included in the Installing ServerProtect section of the ServerProtect for Windows Getting Started Guide. 4. After installation is complete, you should see the correct system log from the View Log pane of the ServerProtect Management Console. FIGURE 7. System Log Detailed Information screen Using multiple Scan Servers for a single NetApp Filer ServerProtect for NetApp Filers provides a fully scalable enterprise antivirus solution for organizations using NetApp Filers. 16

22 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers If there is a large volume of incoming files to the NetApp Filer, adding and registering multiple Scan Servers with the NetApp Filer evenly distributes the workload among the registered Scan Servers. NetApp Filers send files to Scan Servers in "round-robin" fashion. For example, if you have three Scan Servers and the NetApp Filer has four incoming files, the first Scan Server scans the first file, the second Scan Server scans the second file, the third Scan Server scans the third file, the first Scan Server scans the fourth file, and so on. This even distribution of the workload reduces the loading of Scan Servers (load balancing). For more information on load balancing, refer to your NetApp Filer documentation. The procedure for adding additional Scan Servers to a NetApp Filer is identical to the procedure for adding Normal Servers in ServerProtect for Windows (refer to Installing a Normal Server in chapter 2 of the ServerProtect for Windows Getting Started Guide). To confirm that multiple Scan Servers are working for a single NetApp Filer: 1. Open the command prompt for the NetApp Filer that you want to verify. 2. At the command prompt, type: netapp> vscan scanners The NetApp Filer displays a list of Scan Servers by IP address and NetBIOS name. Adding more NetApp Filers to a Scan Server A Scan Server can protect multiple NetApp Filers at the same time. Use the ServerProtect Management Console to conveniently add NetApp Filers to a Scan Server. You can also assign several Scan Servers to individual NetApp Filers for load balancing. See Using multiple Scan Servers for a single NetApp Filer on page 16. You need the following to add a NetApp Filer in ServerProtect for NetApp Filers: An account on the NetApp Filer with backup operator privileges or above NetApp Filer name or IP address NetApp Filer logon credentials (user name, password) 17

23 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide To add a NetApp Filer: 1. Right-click a Scan Server, and then select Filer List on the domain browser tree. The Filer List screen appears. 2. Click Add. The Add Filer screen appears. FIGURE 8. Add Filer screen 3. Do the following: In the Filer name or IP address text box, type the name or IP address of the NetApp Filer In the Domain name text box, type the name of the domain where the NetApp Filer is located Note: The domain name refers to the Windows domain in which NetApp Filers will authenticate registered users. In the User name and Password text box, type your NetApp Filer logon credentials (requires backup operator or above privileges) 4. Click OK. 18

24 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers Removing ServerProtect for NetApp Filers To remove ServerProtect for NetApp Filers, please refer to Removing ServerProtect in chapter 2 of the ServerProtect for Windows Getting Started Guide Removing a NetApp Filer In several instances, it may be necessary to remove (delete) a NetApp Filer from a Scan Server. For example, when changing, upgrading, or renaming a NetApp Filer. To remove a NetApp Filer, do the following: 1. Right-click a Scan Server, and then select Filer List on the domain browser tree. The Filer List screen appears. 2. Select one or more NetApp Filers from the list. To multi-select several NetApp Filers, press the CTRL key as you select. 3. Click Remove. The Remove Filer confirmation screen appears. 4. Click OK. Upgrading ServerProtect for NetApp Filers If you are currently using an older version of ServerProtect for NetApp Filers, you can upgrade to this new version. The procedure for upgrading ServerProtect for NetApp filers is the same as for ServerProtect for Windows. Note: After upgrading to this version ServerProtect for NetApp Filers, all configuration options from your previous ServerProtect for NetApp Filers installation will remain the same. To upgrade from previous versions of ServerProtect for NetApp Filers, do the following: 1. Verify the system requirements for this new version. 2. See Upgrading ServerProtect Software in chapter 4 of the ServerProtect for Windows Getting Started Guide. 19

25 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide Configuring NetApp Filer options This section introduces the necessary information for configuring NetApp Filer related settings from the Management Console. Updating NetApp Filer information Changing a NetApp Filer s system information, will require updating the NetApp Filer s logon information in ServerProtect for NetApp Filers. The following information is necessary to update a NetApp Filer s system information in ServerProtect for NetApp Filers: An account on the NetApp Filer with backup operator privileges or above NetApp Filer name or IP address NetApp Filer logon credentials (user name, password) To update NetApp Filer information: 1. Right-click a Scan Server, and then select Filer List on the domain browser tree. The Filer List screen appears. 2. Select one or more NetApp Filers from the list. To multi-select several NetApp Filers, press the CTRL key as you select. 3. Click Logon Info. The Logon Information screen appears. 4. Do the following: In the Domain name text box, type the name of the domain where the NetApp Filer is located. In the User name and Password text box, type your NetApp Filer logon credentials (requires backup operator or above privileges) 5. Click Apply to update the NetApp Filer information. The Filer information update confirmation screen appears. 20

26 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers FIGURE 9. Filer information update screen Using Scan Servers as Normal Servers Although the ideal configuration is to have a machine act primarily as a Scan Server to protect the NetApp Filer, there may be situations where a Scan Server must also serve as an organization s Normal Server (file server, data server, etc.). If you choose to use a Scan Server as a Normal Server, the Normal Server s Real-time Scan function is enabled by default. Real-time Scan has the following options: incoming (default) outgoing incoming & outgoing Note: For the highest level of security set Real-time Scan to Incoming & outgoing. However, if the computer only performs as a Scan Server, you can use the default setting (Incoming). To set Real-time Scan to Incoming & outgoing, do the following: 1. Select either the Information Server, domain, or a Normal Server (Scan Server) on the domain browser tree. 2. Do one of the following: Click Set Scan Option > Real-time Scan on the side bar Click Configure > Scan Options > Real-time Scan on the main menu The Real-time Scan configuration screen appears. 21

27 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide FIGURE 10. Real-time Scan configuration screen 3. Under Scan direction, click Incoming & outgoing. 4. Click Apply. For more information about Real-time Scan, refer to Using Real-time Scan in chapter 3 of the ServerProtect for Windows Getting Started Guide. 22

28 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers Scanning viruses A Scan Server receives a scan request from the NetApp Filer when a user tries to open a file that matches the file scanning criteria (to set file scanning criteria, refer to your NetApp Filer documentation). The Scan Server then scans the file using the ServerProtect manual scan function. For more information about manual scans, refer to Using Scan Now in chapter 3 of the ServerProtect for Windows Getting Started When a Scan Server detects a virus, it performs one of the following actions, depending on what you have previously configured: Bypass/Ignore- Skips over the file without taking any corrective action in a manual scan Delete: Deletes the infected file Rename: Changes the name of the infected file by modifying the file extension to ".VIR" Quarantine (Move): Moves the infected file to a designated folder Clean: Attempts to clean the virus code from the file For more information about these actions and configuring actions, refer to Defining Actions Against Viruses in chapter 3 of the ServerProtect for Windows Getting Started Guide. Note: By default, NetApp Filers do not include ".ZIP" in the set of file extensions to be scanned. To enable scanning for ".ZIP" and other file types, see To add any file extension into the NetApp Filer s extension table, type the following at the NetApp Filer command prompt: on page 32. This also applies to other types of compressed files. Notifying NetApp Filer clients upon infection ServerProtect can notify the user and the Network Administrator if a NetApp Filer client has uploaded or accessed an infected file. The notification function is enabled by default. To notify a user of NetApp Filer client infection do the following: 1. Right-click a Scan Server, and then select Filer List on the domain browser tree. The Filer List screen appears. 23

29 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide 2. Click Options. The Global Filer Options screen appears. 3. Select Notify User of Virus Infection. FIGURE 11. Global Filer options screen 4. Click OK. Note: This setting will affect all the NetApp Filers in the Filer list. Viewing the status of a NetApp Filer You can see the status of a NetApp Filer through the Management Console. NetApp Filers may appear offline for one of the following reasons: The NetApp Filer is shut down or is not responding The network is not available The NetApp Filer did not successfully register with the Information Server To view the status of a NetApp Filer do the following: 1. Right-click a Scan Server, and then select Filer List on the domain browser tree. The Filer List screen appears. 24

30 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers FIGURE 12. Filer List screen 2. Verify the status of a NetApp Filer by looking at the Filer name and Status fields in the Filer List. A NetApp Filer may appear as online or offline. Configuring NetApp Filer RPC connection status notifications ServerProtect can notify the network administrator whenever an RPC connection to a NetApp Filer succeeds or fails. To configure a NetApp Filer RPC connection status notification, do the following: 1. Select the Information Server, domain, or a Normal Server on the domain browser tree. 2. Do one of the following: Select Configure > Notifications > Standard Alert from the main menu Click Set Notification, and then Standard Alert on the side bar 3. Select Filer Rpc Connection Success/Failure. 25

31 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide FIGURE 13. Standard Alert configuration screen 4. Click Configure Message to set up a customized notification message. Note: For additional information, refer to Configuring Notification Messages in chapter 3 of the ServerProtect for Windows Getting Started Guide. Notifying NetApp Filers of new update components When update downloads new components (scan engine and pattern) to the Scan Server, the Scan Servers will notify NetApp Filers to flush the cache of previously scanned files. This ensures that all files are scanned with the latest virus pattern. Each NetApp Filer will then begin rebuilding the cache of previously scanned files until a new update arrives from the update server. 26

32 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers For more information on downloading updates, refer to Downloading Updates in chapter 3 of the ServerProtect for Windows Getting Started Guide. Registration and technical support Here, you will find answers to frequently asked questions and you will learn how to obtain additional ServerProtect information. This chapter discusses the following topics Contacting technical support and registering ServerProtect Security information Knowledge Base TrendLabs Sending infected files to Trend Micro Contacting technical support and registering ServerProtect A license to Trend Micro antivirus software includes the right to receive pattern file updates and technical support from Trend Micro or an authorized reseller, for one (1) year. Thereafter, you must renew Maintenance on an annual basis at the Trend Micro then-current Maintenance fees to have the right to continue receiving these services. Trend Micro Incorporated provides worldwide support to all of our registered users. Please register your software before contacting our offices for support. Use any of the following methods: Register through the web at: Fax the registration card to any Trend Micro office Mail the registration card to the Trend Micro US office 27

33 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide You can download evaluation copies of all Trend Micro products from Web site, Trend Micro Incorporated N. De Anza Blvd. Cupertino, CA Tel: +1 (408) , +1 (800) Fax: +1 (408) For contact information in your country or region, refer to: Online resources Web: Security information Comprehensive security information is available at the Trend Micro Web site: Use the Web site to learn about: Computer virus hoaxes A weekly virus alert, listing the viruses that will trigger during the current week How to determine if a virus detection is a false alarm Trend Micro Virus Encyclopedia, which includes a comprehensive list of names and symptoms for known viruses and malicious mobile code A basic guide to computer viruses Trend Micro virus reading room, with dozens of articles about the latest issues in computer viruses, including the threat posed by Java applets and ActiveX controls Product details and white papers 28

34 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers Knowledge Base Trend Micro provides Knowledge Base, an online database filled with answers to technical product questions. Use it, for example, if you are getting an error message and want to find out what to do to. Type the following URL in your browser s address bar: kb.trendmicro.com/solutions/ New solutions are added daily. However, if you do not find the answer you seek, you can submit your question online, where a TrendLabs engineer will provide you with an answer or contact you for more information. TrendLabs TrendLabs is Trend Micro global network of antivirus research and product support centers that provide 24 x 7 coverage to Trend Micro customers around the world. TrendLabs makes up the backbone of Trend Micro customer service infrastructure. It continuously monitors potential security threats around the world and conducts virus-related research aimed at identifying, detecting, and eliminating new viruses. These efforts result in frequent virus pattern file updates and scan engine refinements. Staffed by a team of several hundred engineers and certified support personnel, TrendLabs also provides a wide range of product and technical support services to customers worldwide. Dedicated service centers are located in Irvine, CA, Tokyo, Manila, Taipei, Munich, and Paris to ensure the most rapid response to virus outbreak and urgent customer support matters. Sending infected files to Trend Micro You can send viruses, infected files, Trojan horse programs, and other malware to Trend Micro. More specifically, if you have a file that you think is some kind of malware but the scan engine is not detecting it or cleaning it, you can submit the suspicious file to Trend Micro using the following Web address: subwiz.trendmicro.com Please include in the message text a brief description of the symptoms you are experiencing. Our team of virus engineers will "dissect" the file to identify and 29

35 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide characterize any viruses it may contain and return the cleaned file to you within 48 hours. Upgrading the ServerProtect evaluation copy To enjoy the benefits of automatic software updates and technical support, upgrade to a registered version of ServerProtect for NetApp Filers. Refer to the appendix of the ServerProtect for Windows Getting Started Guide for detailed instructions on how to upgrade your evaluation copy to the full version of ServerProtect. Troubleshooting ServerProtect for NetApp Filers This section contains troubleshooting information and may assist you in finding a solution to frequently asked questions. Network Appliance (NetApp) Filers do not recognize ServerProtect for Network Appliance Filers Scan Servers Description: After a power cycle on the Network Appliance Filer, the ServerProtect for Network Appliance Filers Scan Server returned Event 213: Cannot add a connection to Filer. The network path was not found. Running the "vscan scanners" command on the NetApp filer returns the following message: No virus scanners are registered with the filer. The ServerProtect for Network Appliance Filers Scan Servers still manage to obtain pattern updates from Trend update servers. Solution: Confirm the following conditions exist: Remote Procedure Call (RPC) is enabled on the servers Vscan is turned "On" on the NetApp Filer The Common Internet File System (CIFS) default share (C$) still exists 30

36 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers After confirming these conditions, do the following: 1. Right-click a Scan Server, and then select Filer List on the domain browser tree. The Filer List screen appears. 2. Select one or more NetApp Filers from the list. To multi-select several NetApp Filers, press the CTRL key as you select. 3. Click Logon Info. The Logon Information screen appears. 4. Verify the information is correct. Otherwise, reenter it. 5. Click OK. After completing these steps, repeat the registration of the Scan Server in the NetApp Filer. If the password for the administrator account was recently changed, the changes may not take effect until a start up/power-cycle of the NetApp Filer occurs. The Scan Server completed scan on a file but original request was not found when scanning large files on the NetApp Filer Description: When scanning large files on the Filer in ServerProtect for Network Appliance Filers, the following message appears: [Server] completed scan on [FileName] but original request was not found. Solution: This situation occurs because the scan period encountered a time out due to the large size of the file. Resolve this issue by extending the Time Out period between the Filer and the Scan Server. To extend the Time Out period between the Filer and the Scan Server, perform the following steps on the Scan Server: 1. Run Regedit. 2. Browse to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ServerProtect\CurrentVer sion\engine\filers 31

37 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide 3. Set the Value Data to the desired TimeOut period in the ScanFilerTimeOut DWORD. The unit of ScanFilerTimeOut is in seconds; this is the timeout value for the Scan Server to scan a file. Note: Default timeout period for ServerProtect is 24 seconds. To disable this warning, add the ScanTimeOutLog DWORD Value to the following location: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ServerProtect\CurrentVersion \Engine\Filers Possible values for ScanTimeOutLog: 1 - Enable logging of files not scanned due to time out 0 - Disable logging of files not scanned due to time out Configuring the ServerProtect for Network Appliance Filers to scan all file types Description: How to configure ServerProtect for Network Appliance Filers to scan all file types? Solution: To scan all files placed on the NetApp Filer, change the extension table of the NetApp Filer so it supports all file extensions. To make sure the extension table of the NetApp Filer supports all file extensions, type the following at the NetApp Filer command prompt: filer> vscan extensions add??? The above command will make the filer scan all file types regardless of their extension. The NetApp Filer wild card is a question mark (?) and not an asterisk (*). To add any file extension into the NetApp Filer s extension table, type the following at the NetApp Filer command prompt: filer> vscan extensions add vbs 32

38 Trend Micro ServerProtect for Network Appliance (NetApp ) Filers The above command will make the NetApp Filer scan file with a ".VBS" extension. You can replace vbs with any three-letter file extension. Scanning all files can degrade the NetApp Filer s performance and slow down virus scanning. It is recommended to scan files that are prone to viruses. Testing your installation The European Institute of Computer Antivirus Research (EICAR), in cooperation with antivirus vendors, has developed a test file to check if your system can detect viruses. The file is not an actual virus; it will cause no harm and it will not replicate. Rather, it is a specially created file whose "signature" has been included in the Trend Micro virus pattern. As a result, Trend Micro scan engine will detect it. To test your installation do the following: 1. Download this file to the NetApp Filer from the Trend Micro Web site at: 2. Open or copy the test file from a NetApp Filer client. If the installation was successful, the Scan Server will detect it and will perform the scan action configured under Scan Now. The default scan action is Clean. For more information about these actions and configuring actions, refer to Defining Actions Against Viruses in chapter 3 of the ServerProtect for Windows Getting Started Guide. WARNING! To successfully detect the EICAR test file, the extension table of the NetApp Filer should support the ".HTM" file type. See Configuring the ServerProtect for Network Appliance Filers to scan all file types on page

39 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide 34

40 Index A Adding more NetApp Filers to a Scan Server 17 B Bandwidth 3 4, 9 C CIFS 12 Configuring NetApp Filer Options 20 RPC connection status notifications 25 Confirming the default CIFS default share (C$) still exists 12 Contacting Technical Support 27 Control Manager agent 2 D Data ONTAP 3 Deleting connections between Scan Servers and a NetApp Filer 14 E Eicar 33 I Information Server 2, 7 Installing ServerProtect for NetApp Filers 11 K Knowledge Base 29 M Management Console 3, 7 N NetApp Filer 3 Normal Server 8 Notifying NetApp Filer clients upon infection 23 Filers of new update components 26 O Online resources 28 R Registering ServerProtect 27 Removing ServerProtect for NetApp Filers 19 RPC 3, 6 S Scan Server 2, 23 Scanning viruses 23 Security information 28 ServerProtect domains 7 for Windows architecture review 7 Support TrendLabs 29 System requirements 2 T Testing your Installation 33 Trend Micro update server 9 TrendLabs 29 Troubleshooting ServerProtect for NetApp Filers 30 U Updating NetApp Filer information 20 Upgrading ServerProtect evaluation copy 30 for NetApp Filers 19 Using multiple Scan Servers for a single NetApp Filer 16 Scan Servers as Normal Servers 21 V Verifying vscan is enabled 12 Viewing the status of a NetApp Filer 24 Virus Sending to Trend Micro 29 vscan 12 W What s new in ServerProtect for NetApp Filers? 10 I 1

41 Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide I 2