Trend Micro InterScan Gateway Security Appliance M-Series

320 Pages·2007·11.9 MB·English

by  Trend Micro, Inc.

InterScan Gateway Security Appliance M-Series
TM

Trend Micro Incorporated reserves the right to make changes to this document and to the
products described herein without notice. Should we need to make changes to this document
and to the products described herein, we shall however inform you of such changes when they
have occurred.Before installing and using the software, please review the readme files, release
notes (if any), and the latest version of the Getting Started Guide, which are available from
Trend Micro's Web site at:
http://www.trendmicro.com/download/documentation/
Trend Micro, the Trend Micro t-ball logo, IntelliTrap, InterScan, ScanMail, MacroTrap, and
TrendLabs are trademarks, registered trademarks, or servicemarks of Trend Micro,
Incorporated. All other product or company names may be trademarks or registered
trademarks of their owners.
Copyright© 2007 Trend Micro Incorporated. All rights reserved.
Document Part No. SAEM12627/60117
Release Date: January 2007
Protected by U.S. Patent No. 5,623,600 and pending patents.
The Trend Micro InterScan Gateway Security Appliance M-Series Administrator’s Guide is
intended to provide detailed information about how to use and configure the features of the
hardware device. Read it before using the software.
Additional information about how to use specific features within the software is available in
the online help file and the online Knowledge Base at the Trend Micro Web site.
Trend Micro is always seeking to improve its documentation. If you have questions,
comments, or suggestions about this or any other Trend Micro documents, please contact us at
[email protected]. Your feedback is always welcome. Please evaluate this documentation
on the following site:
http://www.trendmicro.com/download/documentation/rating.asp
Contents
Contents
Introduction
Audience .............................................................................................xii
About This Administrator’s Guide .....................................................xii
Document Conventions ......................................................................xiii
Chapter 1: Introducing Trend Micro InterScan Gateway Security
Appliance
What Is InterScan Gateway Security Appliance? ..............................1-2
Important Features and Benefits ....................................................1-3
How InterScan Gateway Security Appliance Works .....................1-5
Antivirus .....................................................................................1-6
Anti-Spyware ..............................................................................1-6
Anti-Spam ...................................................................................1-7
Anti-Phishing ..............................................................................1-7
Content and URL Filtering .........................................................1-8
Outbreak Defense .......................................................................1-8
The Appliance Hardware ...............................................................1-9
The Front Panel ...........................................................................1-9
LCD Module .............................................................................1-10
LED Indicators ..........................................................................1-11
The Back Panel .........................................................................1-12
Port Indicators ...........................................................................1-13
Preconfiguring and Deploying the Appliance .............................1-14
Connecting to the Network ..........................................................1-15
Testing the Appliance Connectivity ............................................1-15
Activating the Appliance .............................................................1-16
i
Trend Micro™ InterScan Gateway Security Appliance M-Series Administrator’s Guide
Chapter 2: How InterScan Gateway Security Appliance Works
The Range and Types of Internet Threats ..........................................2-2
How InterScan Gateway Security Appliance Protects You ...............2-3
The Primary Functional Components ............................................2-4
Ethernet Network Interfaces ........................................................2-4
Real-Time Scan of SMTP, POP3, HTTP, and
FTP Protocols .......................................................................2-5
The Web Console ........................................................................2-5
Content Filtering .........................................................................2-5
Anti-Spam ...................................................................................2-6
Using Trend Micro Anti-Spam Engine .......................................2-7
Using Approved and Blocked Senders Lists ...............................2-8
Approved and Blocked Senders ..................................................2-9
Using Network Reputation Services .........................................2-10
The Virus Scan Module .............................................................2-19
Outbreak Defense Services .......................................................2-20
Mail Notification .......................................................................2-21
The Log Module ........................................................................2-22
The Quarantine ..........................................................................2-22
The Delete Function ..................................................................2-22
Chapter 3: Getting Started with InterScan Gateway Security
Appliance
Preliminary Tasks ...............................................................................3-2
Accessing the Web Console ...............................................................3-3
The Summary Screen .........................................................................3-4
Information Above the Panels ........................................................3-4
Outbreak Prevention Service ..........................................................3-5
Damage Cleanup Service ...............................................................3-6
Component Version .......................................................................3-6
Antivirus .........................................................................................3-8
Anti-Spyware .................................................................................3-9
IntelliTrap .......................................................................................3-9
Anti-Spam: Content Scanning ......................................................3-10
Anti-Spam: Network Reputation Services ...................................3-11
Others ...........................................................................................3-11
Additional Screen Actions ...........................................................3-11
Navigating the Web Console .......................................................3-12
The Online Help System ..................................................................3-13
ii
Contents
Chapter 4: SMTP Services
SMTP Services ...................................................................................4-2
Enabling Scanning of SMTP Traffic .............................................4-3
Configuring SMTP Virus Scanning ..............................................4-3
SMTP Scanning - Target ............................................................4-4
SMTP Scanning - Action ............................................................4-6
SMTP Scanning - Notification ...................................................4-8
Configuring SMTP Anti-Spyware ................................................4-9
SMTP Anti-Spyware - Target ...................................................4-10
SMTP Anti-Spyware - Action ..................................................4-12
SMTP Anti-Spyware - Notification ..........................................4-13
Configuring SMTP IntelliTrap ....................................................4-13
SMTP IntelliTrap - Target ........................................................4-14
SMTP IntelliTrap - Action ........................................................4-14
SMTP IntelliTrap - Notification ...............................................4-15
Configuring SMTP Anti-Spam: Network Reputation
Services .................................................................................4-16
SMTP Anti-Spam: Network Reputation
Services - Target ................................................................4-17
SMTP Anti-Spam: Network Reputation
Services - Action ...............................................................4-18
Configuring SMTP Anti-Spam: Content Scanning .....................4-19
SMTP Anti-Spam: Content Scanning - Target .........................4-20
SMTP Anti-Spam: Content Scanning - Action .........................4-21
Configuring SMTP Anti-Phishing ...............................................4-22
SMTP Anti-Phishing - Target ...................................................4-23
SMTP Anti-Phishing - Action ..................................................4-23
SMTP Anti-Phishing - Notification ..........................................4-24
Configuring SMTP Content Filtering ..........................................4-25
SMTP Content Filtering - Target ..............................................4-26
SMTP Content Filtering - Action .............................................4-28
SMTP Content Filtering - Notification .....................................4-29
iii
Trend Micro™ InterScan Gateway Security Appliance M-Series Administrator’s Guide
Chapter 5: HTTP Services
HTTP Services ....................................................................................5-2
Enabling Scanning of HTTP Traffic ..................................................5-2
Configuring HTTP Virus Scanning ....................................................5-2
HTTP Scanning - Target ................................................................5-3
Configuring Virus Scanning for HTTP Traffic ...........................5-3
About Deferred Scan for Large File Handling ............................5-5
HTTP Scanning - Action ................................................................5-6
HTTP Scanning - Notification .......................................................5-7
Configuring HTTP Anti-Spyware ......................................................5-8
HTTP Anti-Spyware - Target .........................................................5-8
HTTP Anti-Spyware - Action ......................................................5-10
HTTP Anti-Spyware - Notification ..............................................5-11
Configuring HTTP Anti-Pharming ...................................................5-12
HTTP Anti-Pharming - Target .....................................................5-12
HTTP Anti-Pharming - Action .....................................................5-12
HTTP Anti-Pharming - Notification ............................................5-13
Configuring HTTP Anti-Phishing ....................................................5-14
HTTP Anti-Phishing - Target .......................................................5-14
HTTP Anti-Phishing - Action ......................................................5-15
HTTP Anti-Phishing - Notification ..............................................5-16
Configuring HTTP URL Filtering ....................................................5-17
HTTP URL Filtering - Rules ........................................................5-17
HTTP URL Filtering - Settings ....................................................5-19
HTTP URL Filtering - Notification .............................................5-21
Configuring HTTP File Blocking .....................................................5-22
HTTP File Blocking - Target .......................................................5-22
HTTP File Blocking - Notification ..............................................5-23
Chapter 6: FTP Services
FTP Services .......................................................................................6-2
Enabling Scanning of FTP Traffic .....................................................6-2
Configuring FTP Virus Scanning .......................................................6-2
FTP Scanning - Target ...................................................................6-3
FTP Scanning - Action ...................................................................6-5
FTP Scanning - Notification ..........................................................6-6
iv
Contents
Chapter 6: FTP Services—continued
Configuring FTP Anti-Spyware .........................................................6-7
FTP Anti-Spyware - Target ...........................................................6-8
FTP Anti-Spyware - Action .........................................................6-10
FTP Anti-Spyware - Notification ................................................6-11
Configuring FTP File Blocking .......................................................6-12
FTP File Blocking - Target ..........................................................6-12
FTP File Blocking - Notification .................................................6-14
Chapter 7: POP3 Services
POP3 Services ....................................................................................7-2
Enabling Scanning of POP3 Traffic ...................................................7-2
Configuring POP3 Virus Scanning ....................................................7-3
POP3 Scanning - Target ................................................................7-3
POP3 Scanning - Action ................................................................7-5
POP3 Scanning - Notification .......................................................7-7
Configuring POP3 Anti-Spyware ......................................................7-8
POP3 Anti-Spyware - Target .........................................................7-9
POP3 Anti-Spyware - Action ......................................................7-11
POP3 Anti-Spyware - Notification ..............................................7-12
Configuring POP3 IntelliTrap ..........................................................7-13
POP3 IntelliTrap - Target ............................................................7-13
POP3 IntelliTrap - Action ............................................................7-14
POP3 IntelliTrap - Notification ...................................................7-15
Configuring POP3 Anti-Spam .........................................................7-16
POP3 Anti-Spam - Target ............................................................7-16
POP3 Anti-Spam - Action ...........................................................7-18
Configuring POP3 Anti-Phishing ....................................................7-18
POP3 Anti-Phishing - Target .......................................................7-19
POP3 Anti-Phishing - Action ......................................................7-19
POP3 Anti-Phishing - Notification ..............................................7-20
Configuring POP3 Content Filtering ...............................................7-21
POP3 Content Filtering - Target ..................................................7-22
POP3 Content Filtering - Action .................................................7-24
POP3 Content Filtering - Notification .........................................7-25
v
Trend Micro™ InterScan Gateway Security Appliance M-Series Administrator’s Guide
Chapter 8: Outbreak Defense
The Outbreak Defense Services .........................................................8-2
Current Status .....................................................................................8-3
Configuring Internal Outbreak ...........................................................8-5
Configuring Damage Cleanup ............................................................8-6
Potential Threat ..............................................................................8-7
Configuring Settings ...........................................................................8-7
Outbreak Defense - Settings ...........................................................8-8
Outbreak Defense - Notification ....................................................8-9
Yellow Alerts ............................................................................8-10
Red Alerts ..................................................................................8-10
Chapter 9: Quarantines
Quarantines .........................................................................................9-2
Conducting a Query ............................................................................9-3
Performing Quarantine Maintenance .................................................9-7
Manual ............................................................................................9-7
Automatic .......................................................................................9-8
Chapter 10: Update
Update ...............................................................................................10-2
Executing a Manual Update .............................................................10-3
Configuring Scheduled Updates .......................................................10-4
Configuring an Update Source .........................................................10-6
Chapter 11: Logs
Logs ..................................................................................................11-2
Performing a Log Query ...................................................................11-3
Configuring Log Settings .................................................................11-5
Configuring Log Maintenance .........................................................11-6
Manual ..........................................................................................11-6
Automatic .....................................................................................11-7
vi