Symantec Web Security for Microsoft ISA Server 2004

Transcription

1 Getting Started Symantec Web Security for Microsoft ISA Server 2004 Welcome to Symantec Web Security for Microsoft ISA Server 2004 Symantec Web Security provides virus, spyware, and adware detection as well as URL filtering for Microsoft ISA Server System requirements for Symantec Web Security Ensure that your environment meets the following system requirements. Table 1-1 Component Processor Hard disk Memory Recommended hardware requirements Requirement 2.4 Ghz Pentium IV or later or equivalent NTFS-formatted local partition with 150 MB of available hard-disk space for ISA Server 2004; additional space will be required for Web cache content. 750 MB for Symantec Web Security, 50 GB for temporary files. 1 GB

2 2 Symantec Web Security for Microsoft ISA Server 2004 Before you install Table 1-1 Component Recommended hardware requirements Requirement Other devices A network adapter for each network to which the computer is connected One additional network adapter is required for intra-array communications for ISA Server 2004 Enterprise Edition integrated NLB CD-ROM or DVD-ROM drive VGA or higher-resolution monitor Keyboard and Microsoft Mouse or compatible pointing device Table 1-2 Component Operating system Software requirements Requirement Microsoft Windows Server 2003, Standard or Enterprise Edition, with SP1. Enterprise Edition is recommended. Microsoft Internet Security and Acceleration Server 2004 Java Runtime Environment Directory service Privileges Standard with SP1 or Enterprise Edition. Enterprise Edition is recommended. Version 1.4 or 5.0 Not required Symantec Web Security must be installed and run by a user with administrative privileges Before you install Before installing Symantec Web Security, perform the following tasks: Install Java Runtime Environment Create a user dedicated to polling service administration (for ISA Enterprise Edition)

3 Symantec Web Security for Microsoft ISA Server 2004 Before you install 3 Installing the Java Runtime Environment Version 1.4 or 5.0 of the Java Runtime Environment (JRE) must be installed on each ISA server on which Symantec Web Security will be installed. These download steps explain one method of downloading the JRE. A variety of download methods are available. Depending on your ISA server s firewall settings, you may need to download the JRE file on another computer on your network and transfer it to the ISA server. To download and install the Java Runtime Environment 1 Open the following URL in a web browser: 2 Click Manual Download. 3 Click the Download button next to Windows (Offline installation). 4 Save the file to your computer. 5 Click Run after the file finishes downloading. 6 Complete the installation by accepting the license agreement and choosing the Typical setup type. You can test the installation by restarting your browser, returning to the java.com Web site, and clicking Verify Installation. Creating a polling service user (ISA Enterprise Edition) Before installing the Symantec Web Security on ISA Server 2004 Enterprise Edition, you must create a user dedicated to the polling service. The polling service periodically gathers data for Symantec Web Security.

4 4 Symantec Web Security for Microsoft ISA Server 2004 Installing Symantec Web Security Refer to your Microsoft Windows Server 2003 documentation for instructions on creating a user and assigning it to a group. Note: The polling user must belong to the Admin group. If the ISA array is in an Active Directory domain, the polling user must belong to the Domain Admins group. Table 1-3 Item User name Full name Description Suggested values for polling user Suggested value poller Polling Service Admin Account for Polling Service administration The polling service must be enabled after installation. See Ensuring that the polling and Microsoft Firewall services are running on page 7. Installing Symantec Web Security You can install Symantec Web Security using either the wizard-based Windows Installer (described below), or using the msiexec.exe command line installer (described in the Symantec Web Security for Microsoft ISA Server 2004 Implementation Guide). Installing on ISA Standard Edition using the Windows Installer Follow these instructions to install Symantec Web Security on ISA Server 2004 Standard Edition. To install Symantec Web Security on ISA Standard Edition 1 Log in as administrator. 2 Locate the installer file on the CD and double-click it. 3 On the welcome page, click Next. 4 On the License Agreement page, click I accept the terms in the license agreement and click Next. 5 On the Setup Type page, click Full Install and click Next.

5 Symantec Web Security for Microsoft ISA Server 2004 Installing Symantec Web Security 5 6 On the Web Filter Priority page, select the priority for the web filter and click Next. The priority, along with the order number on the Web Filters page in ISA, determines the order in which ISA web filters run. 7 On the Destination Folder page, accept the default folder location listed or change it, and then click Next. You can specify the location for the Symantec Web Security files, but the web filter must be installed in the Microsoft ISA Server folder. 8 On the Temporary Folders page, accept the default folder locations listed or change them, and then click Next. Ensure that there is enough space on the disk containing the temporary folders. The inbound and scanning temporary folders can be set to the same folder. Inbound temporary folder Scanning temporary folder Used by the web filter Used by the scanning process of the web filter 9 On the Ready to Install the Program Page, click Install. 10 On the InstallShield Wizard Completed page, click Finish. Installing on ISA Enterprise Edition using the Windows Installer Follow these instructions to install Symantec Web Security on ISA Server 2004 Enterprise Edition. Symantec Web Security must be installed on each server in the ISA array. To install Symantec Web Security on ISA Enterprise Edition 1 Log in as administrator. 2 Locate the installer file on the CD and double-click it. 3 On the welcome page, click Next. 4 On the License Agreement page, click I accept the terms in the license agreement and click Next. 5 On the Microsoft ISA Server 2004 Enterprise Edition Detected page, click Next. 6 On the Setup Type page, click Full Install and click Next.

6 6 Symantec Web Security for Microsoft ISA Server On the Web Filter Priority page, select the priority for the web filter and click Next. The priority, along with the order number on the Web Filters page in ISA, determines the order in which ISA web filters run. 8 On the Polling Service Logon Information page, type the user name and password for the polling service user you created before running this installation. 9 On the Destination Folder page, accept the default folder location listed or change it, and then click Next. You can specify the location for the Symantec Web Security files on the first server in an array, but the web filter must be installed in the Microsoft ISA Server folder. Ensure that you install the Symantec Web Security files on the same folder on every server in an array. 10 On the Temporary Folders page, accept the default folder locations listed or change them, and then click Next. Specify the same temporary folders on every server in an array. Ensure that there is enough space on the disk containing the temporary folders. The inbound and scanning temporary folders can be set to the same folder. Inbound temporary folder Scanning temporary folder Used by the web filter Used by the scanning process of the web filter 11 On the Ready to Install the Program Page, click Install. 12 On the InstallShield Wizard Completed page, click Finish. After installing Symantec Web Security, perform the following tasks: Ensuring that the polling and Microsoft Firewall services are running Excluding temporary folders from local antivirus scanning Enabling access to LiveUpdate servers Activating licenses Running LiveUpdate Enabling Symantec Web Security Testing installation success

7 Symantec Web Security for Microsoft ISA Server Ensuring that the polling and Microsoft Firewall services are running The polling service and Microsoft Firewall service must be running for Symantec Web Security to function. Table 1-4 Services used by Symantec Web Security Service Service name Description Symantec Web Security for Microsoft ISA 2004 Poller swsmsisapoller Periodically checks for data. Must be started before Microsoft Firewall. Microsoft Firewall fwsrv Firewall for ISA Server. Upon starting, it loads the Symantec Web Filter. Verify status of services Follow the steps in the first procedure below to verify that the required services are running. Note: The poller must be started before the Microsoft Firewall service, or URL filtering won t function properly. If this happens, follow the steps in the second procedure below. To verify that required services are running 1 On the Windows taskbar, click Start > Administrative Tools > Services. 2 Locate the service called Symantec Web Security for Microsoft ISA 2004 Poller. 3 Ensure that the poller Status indicates Started, and the Startup Type is Automatic. 4 Locate Microsoft Firewall. 5 Ensure that Microsoft Firewall its status is Started, and the Startup Type is Automatic. To restart services in the required order 1 On the Windows taskbar, click Start > Administrative Tools > Services. 2 Locate the service called Symantec Web Security for Microsoft ISA 2004 Poller. 3 Stop the poller service. 4 Locate Microsoft Firewall. 5 Stop the Microsoft Firewall service.

8 8 Symantec Web Security for Microsoft ISA Server Start the poller service. 7 Start the Microsoft Firewall service. Decoding polling service errors Due to limitations, polling service errors in the Event Viewer only include numbers corresponding to Windows System Error Codes described in MSDN, not descriptive text. Error code 5 indicates that the polling service failed Active Directory authentication. For example, this error would occur if the polling service user was disabled in Active Directory. Excluding temporary folders from local antivirus scanning If you have antivirus software running on any of the ISA servers, exclude the inbound and scanning temporary folders from local real-time and scheduled antivirus scanning by the other antivirus software. The paths to these folders are configurable during installation, but by default are: C:\Program Files\Symantec\Symantec Web Security for Microsoft ISA Server 2004\Inbound\ C:\Program Files\Symantec\Symantec Web Security for Microsoft ISA Server 2004\ScanTemp\ Enabling access to LiveUpdate servers You must allow Symantec Web Security to access the LiveUpdate servers to download new definitions. This can be done using the ISA firewall policy or configuring ISA access rules. Enabling access to LiveUpdate servers using the system firewall policy The ISA firewall policy must allow access to the Symantec LiveUpdate servers. To enable access to LiveUpdate servers using the system firewall policy 1 On the Windows taskbar, click Start > All Programs > Microsoft ISA Server > ISA Server Management to open the ISA MMC. 2 Open a server on which Symantec Web Security is installed. 3 Right-click Firewall Policy and click Edit System Policy. 4 Under the configuration group Various, click Allowed Sites (at the bottom).

9 Symantec Web Security for Microsoft ISA Server Activating licenses 5 Ensure that Enable is checked. 6 Click the To tab. 7 Click System Policy Allowed Sites and then click Edit. 8 Click New and type the address for each of these URLs: liveupdate.symantecliveupdate.com liveupdate.symantec.com 9 Click OK in the System Policy Allowed Sites Properties window, and click OK in the System Policy Editor. 10 In the MMC, click Apply and then click OK in the Saving Configuration Changes window. Enabling access to LiveUpdate servers using access rules You can also enable access to the LiveUpdate servers by adding them as part of one or more ISA access rules. If using access rules, allow http and ftp access, and include ftp://update.symantec.com in addition to the two addresses listed in the procedure above. The request for LiveUpdate servers will come from the ISA server, localhost. You activate key features for Symantec Web Security, including antivirus scanning, content filtering, and related updates, by installing the appropriate license. For complete scanning functionality and definitions updates, you need the following licenses: Product license Content license The product license enables content filtering in Symantec Web Security. It can expire for trialware versions of Symantec Web Security, in which case content is no longer scanned. It does not expire for purchased versions of Symantec Web Security. The content license enables LiveUpdate to download the antivirus, URL filtering, and DDR filtering definitions, and must be renewed periodically. If it expires, Symantec Web Security continues to scan content based on the last-retrieved definitions.

10 10 Symantec Web Security for Microsoft ISA Server 2004 You must do the following to activate a license: Obtain a license file from Symantec. See Obtaining a license file on page 10. Install the license file. See Installing a license file on page 11. For more information about licensing, see the Symantec Web Security for Microsoft ISA Server 2004 Implementation Guide. Obtaining a license file To request a license file, you must have the serial number that is required for activation. (Each license has a separate serial number.) The serial number is used to request a license file and to register for support. The serial number is printed on the license certificate that was mailed to you. The format of the serial number is a letter followed by 10 digits, for example, F Your license certificate should arrive within three to five business days of when you receive your software. If you do not receive the license certificate, contact Symantec Customer Service at or your reseller to check the status of your order. If you have lost your license certificate, contact License Support. If you purchase multiple types of licenses but register them one at a time, Symantec will send you a separate license file for each license, and you must install each of these license files separately. If you register multiple licenses at the same time, Symantec sends you a single license file that contains all of your licences. The license file that Symantec sends to you is contained within an attached.zip file. The.slf file that is contained within the.zip file is the actual license file. You should ensure that your inbound environment allows.zip message attachments. Note: License files are digitally signed. If you try to edit a license file, you will corrupt the file and render it invalid. To obtain a license file 1 On the Internet, go to the following URL: 2 In the Serial Number box, type the 11-digit serial number that is provided on the license certificate, and then click Next.

11 Symantec Web Security for Microsoft ISA Server If you are registering multiple licenses, type one of the serial numbers, and then click Next. Follow the on-screen instructions to add additional serial numbers. 3 Follow the on-screen instructions to register your license and receive your license file. Symantec will send you an message that contains the license file in an attachment. If the message has not arrived within two hours, you may have entered the address incorrectly, or another error may have occurred. Return to the Symantec Web site and repeat this procedure. Installing a license file A license file contains the information that is required to activate one or more features in a product or to update the product and its associated content. A license file can contain one or more types of licenses, depending on whether you registered the license serial numbers separately or at the same time. Perform the following procedure once for each ISA array. When one ISA server is licensed for Symantec Web Security, the rest of the servers in the array are also licensed. To install the license file 1 Open the Symantec Web Security properties page. See Enabling Symantec Web Security on page 12 for information about how to open the Symantec Web Security properties page. 2 Click the Licensing tab. 3 Under License File, type or paste the path to the license file or click Browse and navigate to the license file location. Alternatively, you can type or paste a license key under License Key. 4 Click Register. 5 Click OK. 6 In the MMC, click Apply and then click OK in the Saving Configuration Changes window. 7 To verify that the license has been applied, open the Symantec Web Filter Properties window again and click Refresh on the Licensing tab. Note: Do not delete the license file called swsmsisa-csapi.slf located in C:\Program Files\Common Files\Symantec Shared\Licenses. If you delete it, you must reinstall Symantec Web Security to restore functionality.

12 12 Symantec Web Security for Microsoft ISA Server 2004 Running LiveUpdate Run LiveUpdate to get the latest definitions. If the Initiate LiveUpdate button is not active, the content license has not been activated or has expired. See Installing a license file on page 11. Note: Sometimes the LiveUpdate button may not be active immediately after activating a license. If that happens, close the Symantec Web Security properties page and reopen it. To run LiveUpdate immediately 1 Open the Symantec Web Security properties page. 2 Click the LiveUpdate tab. 3 Click Initiate LiveUpdate. LiveUpdate runs after you click Apply in the MMC as described below. 4 Click OK. 5 In the MMC, click Apply and then click OK in the Saving Configuration Changes window. LiveUpdate runs on each server in an ISA array on which Symantec Web Security is installed. After running LiveUpdate, you can verify that new definitions have been received by clicking Refresh on the LiveUpdate tab. Enabling Symantec Web Security After installation, Symantec Web Security is not enabled by default. Follow these steps to enable it. Enable Symantec Web Security After opening the Symantec Web Security properties page, click enable on the General tab as described. After enabling Symantec Web Security on one member of the array, it will be automatically enabled on all array members. To open the Symantec Web Security properties page 1 On the Windows taskbar, click Start > All Programs > Microsoft ISA Server > ISA Server Management to open the ISA MMC. 2 Open a server on which Symantec Web Security is installed. 3 Expand Configuration.

13 Symantec Web Security for Microsoft ISA Server 2004 What s next 13 4 Click Add-ins. 5 Click the Web Filters tab. 6 Double-click Symantec Web Filter. To enable Symantec Web Security 1 Click the General tab. 2 Check Enable this filter. 3 Click OK. Testing installation success What s next 4 In the MMC, click Apply and then click OK in the Saving Configuration Changes window. To determine if Symantec Web Security is installed, check for a listing for Symantec Web Filter in the Add-ins section of the ISA MMC. If the ISA MMC was open during the installation, close and reopen it before checking for the Symantec Web Filter listing. Running LiveUpdate on page 12 describes how to access the Add-ins section. For a more thorough test, enable Symantec Web Security and then enable virus detection. Then attempt to download the eicar.com file from anti_virus_test_file.htm. The eicar.com file contains a harmless test virus. You should see the Access Denied page in your browser if Symantec Web Security is working properly. After installation, refer to the Implementation Guide to learn how to perform the following next steps: Install the administration snap-in to access Symantec Web Security from computers that only have ISA Server 2004 remote MMC installed on them. Configure LiveUpdate to run at regular intervals. Configure virus/risk scanning and detection, as well as related options. Configure content filtering. Configure user browser settings.

14 14 Symantec Web Security for Microsoft ISA Server 2004 What s next Copyright 2006 Symantec Corporation. All rights reserved. Printed in the U.S.A. PN: Symantec and the Symantec logo are U.S. registered trademarks of Symantec Corporation. Symantec AntiVirus is a trademark of Symantec Corporation. Other brands and products are trademarks of their respective holder/s.