spnetapp56gsg

7/21/2019 spnetapp56gsg

http://slidepdf.com/reader/full/spnetapp56gsg 1/41

ServerProtectServerProtectComprehensive server and storage virus protection

TM

TREND MICROTM

For Network ApplianceTM

Filers



Trend Micro Incorporated reserves the right to make changes to this document and to

the products described herein without notice. Before installing and using the

software, please review the readme files, release notes, and the latest version of the

Quick Start Guide which are available from the Trend Micro Web site at:

http://www.trendmicro.com/dowload/documentation/

NOTE: A license to the Trend Micro Software usually includes the right to product

updates, pattern file updates, and basic technical support for one (1) year from the

date of purchase only. Maintenance should be renewed on an annual basis at the

Trend Micro then-current Maintenance fees.

Trend Micro, the Trend Micro t-ball logo, Control Manager, MacroTrap,ServerProtect, and TrendLabs are trademarks or registered trademarks of Trend

Micro, Incorporated.

All other product or company names may be trademarks or registered trademarks of

their owners.

Copyright© 1989-2003 Trend Micro Incorporated. All rights reserved. No part of

this publication may be reproduced, photocopied, stored in a retrieval system, or

transmitted without the express prior written consent of Trend Micro Incorporated.

Document Part No. SSEG51567/30718

Release Date: October 2003

Protected by U.S. Patent No. 5,951,698



The Quick Start Guide for Trend Micro ServerProtect for Network Appliance

(NetApp) Filers introduces the main features of the software and installationinstructions for your production environment. You should read it before installing or

using the software.

For technical support, please refer to Troubleshooting ServerProtect for NetApp

Filers on Page 30 for technical support information and contact details. Detailed

information about how to use specific features within the software are available in

the online help file and online Solution Bank at Trend Micro’s Web site.

Trend Micro is always seeking to improve its documentation. If you have questions,comments, or suggestions about this or any Trend Micro documents, please contact

us at [email protected]. Your feedback is always welcome. Please evaluate this

documentation on the following site:

www.trendmicro.com/download/documentation/rating.as



i

ContentsSystem requirements ..............................................................................2

Overview ................................................................................................4

ServerProtect for Windows architecture review ................................7

Enabling Trend Micro update server .................................................9

What’s new in ServerProtect for NetApp Filers? ................................10

Multi-filer support ...........................................................................10

User notification upon client infection ............................................10

NetApp Filer status available through the Management Console ...10

Conveniently update NetApp Filer logon information ....................10

Trend Micro Control Manager™ agent compatibility .....................10

NetApp Filer notification of new updates .......................................11

NetApp Filer RPC status notification ..............................................11

Installing ServerProtect for NetApp Filers ..........................................11Verifying vscan is enabled ...............................................................12

Confirming the CIFS default share (C$) still exists ........................12

Deleting connections between Scan Servers and a NetApp Filer ....14

Installing a Scan Server ...................................................................14

Using multiple Scan Servers for a single NetApp Filer ..................16

Adding more NetApp Filers to a Scan Server .................................17

Removing ServerProtect for NetApp Filers .........................................19Removing a NetApp Filer ................................................................19

Upgrading ServerProtect for NetApp Filers ........................................19

Configuring NetApp Filer options .......................................................20

Updating NetApp Filer information ................................................20

Using Scan Servers as Normal Servers ...........................................21

Scanning viruses ..............................................................................23

Notifying NetApp Filer clients upon infection ................................23

Viewing the status of a NetApp Filer ..............................................24

Configuring NetApp Filer RPC connection status notifications .....25

Notifying NetApp Filers of new update components ......................26

Registration and technical support .......................................................27

Contacting technical support and registering ServerProtect ............27

Online resources ...........................................................................28



Trend Micro™ Serverprotect for Network Appliance filers™ Quick Start Guide

ii

Security information ........................................................................ 28

Knowledge Base .............................................................................. 29TrendLabs™ .................................................................................... 29

Sending infected files to Trend Micro ............................................ 29

Upgrading the ServerProtect evaluation copy ..................................... 30

Troubleshooting ServerProtect for NetApp Filers .............................. 30

Network Appliance (NetApp) Filers do not recognize ServerProtect

for Network Appliance Filers Scan Servers ................................. 30

The Scan Server completed scan on a file but original request was

not found when scanning large files on the NetApp Filer ............ 31

Configuring the ServerProtect for Network Appliance Filers to scan

all file types .................................................................................. 32

Testing your installation ...................................................................... 33







Trend Micro™ ServerProtect™ for Network Appliance™ (NetApp™) Filers

3

Management Console

• Operating System:

Microsoft Windows

• Microsoft Windows Server 2003

• Microsoft Windows 2000 Server/Advanced Server with SP3 or above

Network Protocols and Services

• TCP/IP, Microsoft Network (NetBIOS Compatible Transport Protocol),

and RPC services must be running on the installed Windows server

• Monitor with 800 x 600 or higher resolution

NetApp Filer

• The NetApp Filer must be AV-enabled with an RPC agent running to

communicate with ServerProtect

• The NetApp Filer must have the proprietary Operating System Data ONTAP™

6.3.1 or above installed

Note: For optimal scanning performance, Trend Micro recommends the connection

between the filer and a Scan Server to have a bandwidth of at least 1Gbps.



Trend Micro™ ServerProtect™ for Network Appliance Filers™ Quick Start Guide

4

OverviewServerProtect for NetApp Filers scans viruses using "on-access" mode, which takes

place on a Scan Server. In turn, the Information Server manages the Scan Servers.

FIGURE 1. ServerProtect for NetApp Filers product architecture

When a ServerProtect for NetApp Filers user tries to access a file or store a new file

in a NetApp Filer, the NetApp Filer performs a virus check. If the filename extension

matches the file scanning criteria (For example, an ".EXE" or a ".VBS" file), the

NetApp Filer sends a manual scan request (Scan Now) to the Scan Server(s). The

Scan Server then passes back the scan result to the NetApp Filer and according to the

scan result, the user is either allowed to open/save the file or is denied access to thefile (to set NetApp Filer file scanning criteria, refer to your NetApp Filer

documentation).

Note: Since only specific file types contain viruses, establishing the right file scanning

criteria can help optimize Scan Server performance, reduce bandwidth usage, and

minimize scanning time. To learn how ServerProtect for NetApp Filers can

efficiently and safely scan files, see IntelliScan in chapter 1 of the ServerProtect

for Windows Getting Started Guide.

If a file contains a virus, ServerProtect for NetApp Filers performs a designated

action. Refer to Scanning Viruses in chapter 3 of the ServerProtect for Windows

Getting Started Guide for additional information about scan actions. For example, if




5

the file is cleanable and ServerProtect for NetApp Filers is configured to perform a

Clean action the following occurs:1. The Scan Server cleans the file and informs the NetApp Filer that the file is no

longer infected.

2. The NetApp Filer allows its client to access the cleaned file and replaces the

original file with the cleaned one.

Note: The NetApp Filer "trusts" registered Scan Servers, so if a Scan Server also

functions as a Normal Server (as a file or data server) and happens to send a file to

the NetApp Filer, the latter will not request the file be scanned. To protect both the

NetApp Filer, and the Normal Server, set the ServerProtect Real-time Scan to

"Incoming & outgoing". See To set Real-time Scan to Incoming & outgoing,do the following: on page 21.




6

Below is an explanation of the ServerProtect for NetApp Filers organizational flow:

FIGURE 2. ServerProtect for NetApp Filers organizational flow

ServerProtect for NetApp Filers consists of an agent that communicates with the NetApp Filer via remote procedure calls (RPCs). This agent performs the following

functions:

• Registers the Normal Server with the NetApp Filer as a "Scan Server." This

informs the NetApp Filer of the availability and location of a Scan Server

• Watches for NetApp Filer file-scanning requests

• Returns scan results to the NetApp Filer • Answers any queries from the NetApp Filer

• Informs the NetApp Filer of any pattern file or scan engine updates

• Communicates with the NetApp Filer to check the connection between the Scan

Server and the NetApp Filer

Scan Server

ServerProtect

Information

Server

Scan Server

(Serverprotect-

Normal Server)

Trend Micro

UpdateServer

RPC

RPC

RPC

RPC

RPC

RPC

Scan Server

NetApp Filer HTTP

Download

source




7

ServerProtect for Windows architecture review

As previously mentioned, ServerProtect for NetApp Filers is an enhanced version of

ServerProtect for Windows. To understand the ServerProtect for NetApp Filers

enhancements, it is useful to review the architecture of ServerProtect for Windows.

ServerProtect for Microsoft Windows protects networks through a three-tier

architecture: the Management Console, the Information Server, and the Normal

Server. You can use the Management Console to configure the Information Server

(IS), which lets you control the Normal Servers managed by the IS.

The three components are independent from each other, yet you can install each on

one machine, on separate machines, or in a combination (for example, you can install

the Management Console on one machine, and you can install the Information Server

and the Normal Server together on a separate machine).

For additional information on ServerProtect architecture, refer to ServerProtect

Architecture in chapter 1 of the ServerProtect for Windows Getting Started Guide.

Management Console: this portable console gives you centralized control of

multiple network servers and domains. The Management Console lets you

simultaneously configure servers in the same IS domain and generate integrated virus

incident reports for all servers. The ServerProtect domain browser tree shows all the

ServerProtect servers along with the status of each server. Status information

includes the version of the virus pattern, scan engine, and program file; the type and

version of operating system; the direction of real-time scanning, and so on.

For additional information on the Management Console, refer to ServerProtect

Architecture in chapter 1 of the ServerProtect for Windows Getting Started Guide.

Information Server: a communications hub

for coordinating antivirus defense activities

within its domains. An Information Server (IS)

provides a single point of contact for assigned

Normal Servers and Scan Servers. This savestime because the Information Server makes it

unnecessary to directly communicate with each

individual Normal Server.

What are ServerProtect domains?

In ServerProtect, domains are virtualgroupings of Normal Servers thatsimplify the identification and

management of Normal Servers. Youcan create, rename, or deletedomains according to your networkneeds (refer to ManagingServerProtect Domains in chapter 3of the ServerProtect for WindowsGetting Started Guide.)

T d Mi ™ S P t t™ f N t k A li Fil ™ Q i k St t G id




8

If there is a large number of Normal Servers in a domain, you can add more

Information Servers and divide the number of Normal Servers among them. Forexample, if a domain has 100 Normal Servers assigned to one IS, you can share the

workload among two Information Servers by adding another IS and assigning 50

Normal Servers to each IS. The IS also collects log files.

For additional Information Server information, refer to ServerProtect Architecture in

chapter 1 of the ServerProtect for Windows Getting Started Guide.

Note: In addition to managing Scan Servers, the ServerProtect for NetApp FilersInformation Server can also manage ServerProtect for Windows Normal Servers.

Normal Server (Scan Server): the first line of defense in the ServerProtect

architecture and where all the scanning takes place. The Normal Servers are the

machines in the organization, which typically act as file servers, data servers, etc.

Normal Servers can scan both manually and in real time.

For more Normal Server information, refer to ServerProtect Architecture in chapter 1

of the ServerProtect for Windows Getting Started Guide.

Note: In ServerProtect for NetApp Filers, Normal Servers are referred to as "Scan

Servers". Scan Servers scan files NetApp Filer clients try to access or modify in

the NetApp Filer.





9

Key differences between the ServerProtect versions are listed in the following table:

Table 1. ServerProtect Version Comparison

Enabling Trend Micro update server

A virus scanner must have the latest updates in order to be effective. You can

configure ServerProtect for NetApp Filers to automatically download the newest

virus patterns and scan engine updates. To minimize download times and preserve

network bandwidth, Trend Micro update server distributes available updates to the

designated servers via an incremental update mechanism. This ensures ServerProtect

for NetApp Filers downloads only the latest virus signatures since the last version.

For detailed information about Trend Micro update server, refer to Configuring

Updates in chapter 3 of the ServerProtect for Windows Getting Started Guide.

ServerProtect for NetAppFilers

ServerProtect

Protection

Focus:

NetApp Filer. Normal Servers (the

machines in the organization

which act as file servers,Web servers, etc.).

Normal Server

Role:

Acts as a "Scan Server" and

scans files in the NetApp Filer on

access.

Scans files on the Normal

Server.




Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide

10

What’s new in ServerProtect for NetApp Filers?This section includes the new features in this version of ServerProtect for NetApp

Filers.

Multi-filer support

One Scan Server can scan multiple NetApp Filers at the same time. Now, network

administrators can dedicate one physical server to protect several NetApp Filers, this

can contribute to reduce the total cost of ownership. See Adding more NetApp Filers

to a Scan Server on page 17 for additional information.

User notification upon client infection

ServerProtect for NetApp Filers can get the IP address and host name of a client

causing an infection, and then alert both the user and the network administrator. This

function is only available if using Data ONTAP version 6.4 or later. See Notifying NetApp Filer clients upon infection on page 23 for additional information.

NetApp Filer status available through the ManagementConsole

Network administrators can view if a registered NetApp Filer is online or offline

from the Management Console. See Viewing the status of a NetApp Filer on page 24for additional information.

Conveniently update NetApp Filer logon information

Network administrators can update the logon information for several NetApp Filers

simultaneously. See Updating NetApp Filer information on page 20 for additional

information.

Trend Micro Control Manager™ agent compatibility

ServerProtect for NetApp Filers is compatible with Trend Micro Control Manager

agent for ServerProtect.








13

WARNING! If you delete the default share, ServerProtect will not function correctly. To

learn more about the filer administrative operations, refer to your NetApp

Filer documentation.

To confirm the default CIFS default share (C$) of the NetApp Filer still exists, doone of the following:

• Use the FilerView™ administration tool

FIGURE 4. FilerView administration screen

• On the NetApp Filer console, type the command cifs shares




14

FIGURE 5. NetApp Filer console command prompt

Deleting connections between Scan Servers and a NetAppFiler

To prevent the Scan Server from failing to register to the NetApp Filer, delete alloriginal connections between the Scan Servers and the NetApp Filer. This ensures

Scan Servers use the correct credentials to make successful connections with the

NetApp Filer.

To delete connections between Scan Servers and a NetApp Filer, at thecommand prompt type:

net use \\Filer-Machine\C$ /delete

Installing a Scan Server

With the exception of one step, the installation procedure for ServerProtect for

NetApp Filers is the same as for ServerProtect for Windows. For additional

information regarding installation procedures, refer to Installation Scenarios in


Note: While performing a remote installation, the NetApp Filer information will be

copied from a source Scan Server to the target Scan Server. For more information,

refer to Installation Scenarios in chapter 2 of the ServerProtect for WindowsGetting Started Guide.




15

Installing a ServerProtect for NetApp Filers Scan Server requires the following

information:• The NetApp Filer name or IP address

• Name of the domain where the NetApp Filer is located

• User name and password needed to access the NetApp Filer (you need filer

backup operator or above privileges)

To install ServerProtect for NetApp Filers do the following:

1. During installation, select Install Server as a ServerProtect Normal Server onthe Select Components screen, the Setup Filer Information screen appears.

FIGURE 6. Setup Filer Information screen

2. Do the following:

• In the Filer name or IP address text box, type the NetApp Filer name or the

filer IP address




16

• In the Domain name text box, type the name of the domain where the

NetApp Filer is located• In the User name and Password text box, type your NetApp Filer logon

credentials (you need filer backup operator or above privileges)

3. Click Next, and then continue following the directions included in the Installing

ServerProtect section of the ServerProtect for Windows Getting Started Guide.

4. After installation is complete, you should see the correct system log from the

View Log pane of the ServerProtect Management Console.

FIGURE 7. System Log Detailed Information screen

Using multiple Scan Servers for a single NetApp Filer

ServerProtect for NetApp Filers provides a fully scalable enterprise antivirus solution

for organizations using NetApp Filers.




17

If there is a large volume of incoming files to the NetApp Filer, adding and

registering multiple Scan Servers with the NetApp Filer evenly distributes the

workload among the registered Scan Servers.

NetApp Filers send files to Scan Servers in "round-robin" fashion. For example, if

you have three Scan Servers and the NetApp Filer has four incoming files, the first

Scan Server scans the first file, the second Scan Server scans the second file, the third

Scan Server scans the third file, the first Scan Server scans the fourth file, and so on.

This even distribution of the workload reduces the loading of Scan Servers (load

balancing). For more information on load balancing, refer to your NetApp Filerdocumentation.

The procedure for adding additional Scan Servers to a NetApp Filer is identical to the

procedure for adding Normal Servers in ServerProtect for Windows (refer to

Installing a Normal Server in chapter 2 of the ServerProtect for Windows Getting

Started Guide).

To confirm that multiple Scan Servers are working for a single NetApp Filer:1. Open the command prompt for the NetApp Filer that you want to verify.

2. At the command prompt, type:

netapp> vscan scanners

The NetApp Filer displays a list of Scan Servers by IP address and NetBIOS

name.

Adding more NetApp Filers to a Scan Server

A Scan Server can protect multiple NetApp Filers at the same time. Use the

ServerProtect Management Console to conveniently add NetApp Filers to a Scan

Server. You can also assign several Scan Servers to individual NetApp Filers for load

balancing. See Using multiple Scan Servers for a single NetApp Filer on page 16.

You need the following to add a NetApp Filer in ServerProtect for NetApp Filers:

• An account on the NetApp Filer with backup operator privileges or above

• NetApp Filer name or IP address

• NetApp Filer logon credentials (user name, password)




18

To add a NetApp Filer:

1. Right-click a Scan Server, and then select Filer List on the domain browser tree.The Filer List screen appears.

2. Click Add. The Add Filer screen appears.

FIGURE 8. Add Filer screen


• In the Filer name or IP address text box, type the name or IP address of the

NetApp Filer • In the Domain name text box, type the name of the domain where the

NetApp Filer is located

Note: The domain name refers to the Windows domain in which NetApp Filers

will authenticate registered users.

• In the User name and Password text box, type your NetApp Filer logoncredentials (requires backup operator or above privileges)

4. Click OK .




19

Removing ServerProtect for NetApp FilersTo remove ServerProtect for NetApp Filers, please refer to Removing ServerProtect

in chapter 2 of the ServerProtect for Windows Getting Started Guide

Removing a NetApp Filer

In several instances, it may be necessary to remove (delete) a NetApp Filer from a

Scan Server. For example, when changing, upgrading, or renaming a NetApp Filer.

To remove a NetApp Filer, do the following:

1. Right-click a Scan Server, and then select Filer List on the domain browser tree.

The Filer List screen appears.

2. Select one or more NetApp Filers from the list. To multi-select several NetApp

Filers, press the CTRL key as you select.

3. Click Remove. The Remove Filer confirmation screen appears.

4. Click OK .

Upgrading ServerProtect for NetApp FilersIf you are currently using an older version of ServerProtect for NetApp Filers, you

can upgrade to this new version. The procedure for upgrading ServerProtect for

NetApp filers is the same as for ServerProtect for Windows.

Note: After upgrading to this version ServerProtect for NetApp Filers, all configuration

options from your previous ServerProtect for NetApp Filers installation will

remain the same.

To upgrade from previous versions of ServerProtect for NetApp Filers, do the

following:1. Verify the system requirements for this new version.

2. See Upgrading ServerProtect Software in chapter 4 of the ServerProtect for

Windows Getting Started Guide.




20

Configuring NetApp Filer optionsThis section introduces the necessary information for configuring NetApp Filer

related settings from the Management Console.

Updating NetApp Filer information

Changing a NetApp Filer’s system information, will require updating the NetApp

Filer’s logon information in ServerProtect for NetApp Filers. The following

information is necessary to update a NetApp Filer’s system information inServerProtect for NetApp Filers:

• An account on the NetApp Filer with backup operator privileges or above

• NetApp Filer name or IP address

• NetApp Filer logon credentials (user name, password)

To update NetApp Filer information:





3. Click Logon Info. The Logon Information screen appears.


• In the Domain name text box, type the name of the domain where the NetApp Filer is located.

• In the User name and Password text box, type your NetApp Filer logon

credentials (requires backup operator or above privileges)

5. Click Apply to update the NetApp Filer information. The Filer information

update confirmation screen appears.




21

FIGURE 9. Filer information update screen

Using Scan Servers as Normal Servers

Although the ideal configuration is to have a machine act primarily as a Scan Server

to protect the NetApp Filer, there may be situations where a Scan Server must also

serve as an organization’s Normal Server (file server, data server, etc.).

If you choose to use a Scan Server as a Normal Server, the Normal Server’s

Real-time Scan function is enabled by default.

Real-time Scan has the following options:

• incoming (default)

• outgoing

• incoming & outgoing

Note: For the highest level of security set Real-time Scan to Incoming & outgoing.

However, if the computer only performs as a Scan Server, you can use the default

setting (Incoming).

To set Real-time Scan to Incoming & outgoing, do the following:

1. Select either the Information Server, domain, or a Normal Server (Scan Server)

on the domain browser tree.

2. Do one of the following:

• Click Set Scan Option > Real-time Scan on the side bar

• Click Configure > Scan Options > Real-time Scan on the main menu

The Real-time Scan configuration screen appears.




22

FIGURE 10. Real-time Scan configuration screen

3. Under Scan direction, click Incoming & outgoing.

4. Click Apply.

For more information about Real-time Scan, refer to Using Real-time Scan in chapter

3 of the ServerProtect for Windows Getting Started Guide.




23

Scanning viruses

A Scan Server receives a scan request from the NetApp Filer when a user tries toopen a file that matches the file scanning criteria (to set file scanning criteria, refer to

your NetApp Filer documentation). The Scan Server then scans the file using the

ServerProtect manual scan function. For more information about manual scans, refer

to Using Scan Now in chapter 3 of the ServerProtect for Windows Getting Started

When a Scan Server detects a virus, it performs one of the following actions,

depending on what you have previously configured:

• Bypass/Ignore- Skips over the file without taking any corrective action in amanual scan

• Delete: Deletes the infected file

• Rename: Changes the name of the infected file by modifying the file extension

to ".VIR"

• Quarantine (Move): Moves the infected file to a designated folder

• Clean: Attempts to clean the virus code from the fileFor more information about these actions and configuring actions, refer to Defining

Actions Against Viruses in chapter 3 of the ServerProtect for Windows Getting

Started Guide.

Note: By default, NetApp Filers do not include ".ZIP" in the set of file extensions to be

scanned. To enable scanning for ".ZIP" and other file types, see To add any file

extension into the NetApp Filer’s extension table, type the following at the NetApp Filer command prompt: on page 32. This also applies to other types of

compressed files.

Notifying NetApp Filer clients upon infection

ServerProtect can notify the user and the Network Administrator if a NetApp Filerclient has uploaded or accessed an infected file. The notification function is enabled

by default.

To notify a user of NetApp Filer client infection do the following:






24

2. Click Options. The Global Filer Options screen appears.

3. Select Notify User of Virus Infection.

FIGURE 11. Global Filer options screen

4. Click OK .

Note: This setting will affect all the NetApp Filers in the Filer list.

Viewing the status of a NetApp Filer

You can see the status of a NetApp Filer through the Management Console. NetApp

Filers may appear offline for one of the following reasons:

• The NetApp Filer is shut down or is not responding

• The network is not available• The NetApp Filer did not successfully register with the Information Server

To view the status of a NetApp Filer do the following:






25

FIGURE 12. Filer List screen

2. Verify the status of a NetApp Filer by looking at the Filer name and Status fields

in the Filer List. A NetApp Filer may appear as online or offline.

Configuring NetApp Filer RPC connection statusnotifications

ServerProtect can notify the network administrator whenever an RPC connection to a

NetApp Filer succeeds or fails.

To configure a NetApp Filer RPC connection status notification, do thefollowing:

1. Select the Information Server, domain, or a Normal Server on the domain

browser tree.

2. Do one of the following:

• Select Configure > Notifications > Standard Alert from the main menu

• Click Set Notification, and then Standard Alert on the side bar

3. Select Filer Rpc Connection Success/Failure.




26

FIGURE 13. Standard Alert configuration screen

4. Click Configure Message to set up a customized notification message.

Note: For additional information, refer to Configuring Notification Messages in


Notifying NetApp Filers of new update components

When update downloads new components (scan engine and pattern) to the ScanServer, the Scan Servers will notify NetApp Filers to flush the cache of previously

scanned files. This ensures that all files are scanned with the latest virus pattern. Each

NetApp Filer will then begin rebuilding the cache of previously scanned files until a

new update arrives from the update server.




27

For more information on downloading updates, refer to Downloading Updates in


Registration and technical supportHere, you will find answers to frequently asked questions and you will learn how to

obtain additional ServerProtect information.

This chapter discusses the following topics

• Contacting technical support and registering ServerProtect

• Security information

• Knowledge Base

• TrendLabs

• Sending infected files to Trend Micro

Contacting technical support and registeringServerProtect

A license to Trend Micro antivirus software includes the right to receive pattern file

updates and technical support from Trend Micro or an authorized reseller, for one (1)

year. Thereafter, you must renew Maintenance on an annual basis at the Trend Micro

then-current Maintenance fees to have the right to continue receiving these services.

Trend Micro Incorporated provides worldwide support to all of our registered users.

Please register your software before contacting our offices for support. Use any of the

following methods:

• Register through the web at: www.trendmicro.com/forms/register.htm

• Fax the registration card to any Trend Micro office

• Mail the registration card to the Trend Micro US office




28

You can download evaluation copies of all Trend Micro products from Web site,

www.trendmicro.com.

Trend Micro Incorporated

10101 N. De Anza Blvd.

Cupertino, CA 95014- 9985

Tel: +1 (408) 257-1500, +1 (800) 228-5651

Fax: +1 (408) 257-2003

For contact information in your country or region, refer to:

www.trendmicro.com/en/about/contact/overview.htm

Online resources

Email: [email protected]

Web: www.trendmicro.com

Security information

Comprehensive security information is available at the Trend Micro Web site:

www.trendmicro.com/vinfo/

Use the Web site to learn about:• Computer virus hoaxes

• A weekly virus alert, listing the viruses that will trigger during the current week

• How to determine if a virus detection is a false alarm

• Trend Micro Virus Encyclopedia, which includes a comprehensive list of names

and symptoms for known viruses and malicious mobile code

• A basic guide to computer viruses• Trend Micro virus reading room, with dozens of articles about the latest issues in

computer viruses, including the threat posed by Java applets and ActiveX controls

• Product details and white papers




29

Knowledge Base

Trend Micro provides Knowledge Base, an online database filled with answers totechnical product questions. Use it, for example, if you are getting an error message

and want to find out what to do to. Type the following URL in your browser’s

address bar:

kb.trendmicro.com/solutions/

New solutions are added daily. However, if you do not find the answer you seek, you

can submit your question online, where a TrendLabs engineer will provide you with

an answer or contact you for more information.

TrendLabs™

TrendLabs is Trend Micro global network of antivirus research and product support

centers that provide 24 x 7 coverage to Trend Micro customers around the world.

TrendLabs makes up the backbone of Trend Micro customer service infrastructure. Itcontinuously monitors potential security threats around the world and conducts

virus-related research aimed at identifying, detecting, and eliminating new viruses.

These efforts result in frequent virus pattern file updates and scan engine

refinements.

Staffed by a team of several hundred engineers and certified support personnel,

TrendLabs also provides a wide range of product and technical support services to

customers worldwide. Dedicated service centers are located in Irvine, CA, Tokyo,Manila, Taipei, Munich, and Paris to ensure the most rapid response to virus outbreak

and urgent customer support matters.

Sending infected files to Trend Micro

You can send viruses, infected files, Trojan horse programs, and other malware to

Trend Micro. More specifically, if you have a file that you think is some kind ofmalware but the scan engine is not detecting it or cleaning it, you can submit the

suspicious file to Trend Micro using the following Web address:

subwiz.trendmicro.com

Please include in the message text a brief description of the symptoms you are

experiencing. Our team of virus engineers will "dissect" the file to identify and




30

characterize any viruses it may contain and return the cleaned file to you within 48

hours.

Upgrading the ServerProtect evaluation copyTo enjoy the benefits of automatic software updates and technical support, upgrade to

a registered version of ServerProtect for NetApp Filers. Refer to the appendix of the

ServerProtect for Windows Getting Started Guide for detailed instructions on how to

upgrade your evaluation copy to the full version of ServerProtect.

Troubleshooting ServerProtect for NetAppFilers

This section contains troubleshooting information and may assist you in finding a

solution to frequently asked questions.

Network Appliance (NetApp) Filers do not recognizeServerProtect for Network Appliance Filers Scan Servers

Description:

After a power cycle on the Network Appliance Filer, the ServerProtect for Network

Appliance Filers Scan Server returned Event 213:

Cannot add a connection to Filer. The network path was not found.

Running the "vscan scanners" command on the NetApp filer returns the

following message:

No virus scanners are registered with the filer.

The ServerProtect for Network Appliance Filers Scan Servers still manage to obtain

pattern updates from Trend update servers.

Solution:

Confirm the following conditions exist:

• Remote Procedure Call (RPC) is enabled on the servers

• Vscan is turned "On" on the NetApp Filer

• The Common Internet File System (CIFS) default share (C$) still exists




31

After confirming these conditions, do the following:

1. Right-click a Scan Server, and then select Filer List on the domain browser tree.The Filer List screen appears.



3. Click Logon Info. The Logon Information screen appears.

4. Verify the information is correct. Otherwise, reenter it.

5. Click OK .

After completing these steps, repeat the registration of the Scan Server in the NetApp

Filer. If the password for the administrator account was recently changed, the

changes may not take effect until a start up/power-cycle of the NetApp Filer occurs.

The Scan Server completed scan on a file but originalrequest was not found when scanning large files on the

NetApp Filer Description:

When scanning large files on the Filer in ServerProtect for Network Appliance Filers,

the following message appears:

[Server] completed scan on [FileName] but original request was

not found.

Solution:

This situation occurs because the scan period encountered a time out due to the large

size of the file. Resolve this issue by extending the Time Out period between the Filer

and the Scan Server.

To extend the Time Out period between the Filer and the Scan Server, performthe following steps on the Scan Server:

1. Run Regedit.2. Browse to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ServerProtect\CurrentVer

sion\Engine\Filers




32

3. Set the Value Data to the desired TimeOut period in the ScanFilerTimeOut

DWORD.

The unit of ScanFilerTimeOut is in seconds; this is the timeout value for the Scan

Server to scan a file.

Note: Default timeout period for ServerProtect is 24 seconds.

To disable this warning, add the ScanTimeOutLog DWORD Value to the following

location:

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ServerProtect\CurrentVersion

\Engine\Filers

Possible values for ScanTimeOutLog:

1 - Enable logging of files not scanned due to time out

0 - Disable logging of files not scanned due to time out

Configuring the ServerProtect for Network Appliance Filersto scan all file types

Description:

How to configure ServerProtect for Network Appliance Filers to scan all file types?

Solution:

To scan all files placed on the NetApp Filer, change the extension table of the

NetApp Filer so it supports all file extensions.

To make sure the extension table of the NetApp Filer supports all fileextensions, type the following at the NetApp Filer command prompt:

filer> vscan extensions add ???

The above command will make the filer scan all file types regardless of theirextension. The NetApp Filer wild card is a question mark (?) and not an asterisk (*).

To add any file extension into the NetApp Filer’s extension table, type thefollowing at the NetApp Filer command prompt:

filer> vscan extensions add vbs




33

The above command will make the NetApp Filer scan file with a ".VBS" extension.

You can replace vbs with any three-letter file extension.

Scanning all files can degrade the NetApp Filer’s performance and slow down virus

scanning. It is recommended to scan files that are prone to viruses.

Testing your installationThe European Institute of Computer Antivirus Research (EICAR), in cooperation

with antivirus vendors, has developed a test file to check if your system can detectviruses.

The file is not an actual virus; it will cause no harm and it will not replicate. Rather, it

is a specially created file whose "signature" has been included in the Trend Micro

virus pattern. As a result, Trend Micro scan engine will detect it.

To test your installation do the following:

1. Download this file to the NetApp Filer from the Trend Micro Web site at:www.trendmicro.com/vinfo/testfiles/index.htm

2. Open or copy the test file from a NetApp Filer client. If the installation was

successful, the Scan Server will detect it and will perform the scan action

configured under Scan Now. The default scan action is Clean.

For more information about these actions and configuring actions, refer to

Defining Actions Against Viruses in chapter 3 of the ServerProtect for Windows

Getting Started Guide.

WARNING! To successfully detect the EICAR test file, the extension table of the NetApp

Filer should support the ".HTM" file type. See Configuring theServerProtect for Network Appliance Filers to scan all file types on

page 32.




34



I–1

IndexAAdding more NetApp Filers to a Scan Server 17

BBandwidth 3– 4, 9

CCIFS 12

Configuring NetApp Filer Options 20

RPC connection status notifications 25

Confirming the default CIFS default share (C$) still

exists 12

Contacting Technical Support 27

Control Manager agent 2

DData ONTAP 3Deleting connections between Scan Servers and a Ne-

tApp Filer 14

EEicar 33

IInformation Server 2, 7

Installing ServerProtect for NetApp Filers 11

KKnowledge Base 29

MManagement Console 3, 7

N NetApp Filer 3

Normal Server 8

Notifying NetApp

Filer clients upon infection 23

Filers of new update components 26

OOnline resources 28

RRegistering ServerProtect 27

Removing ServerProtect for NetApp Filers 19RPC 3, 6

SScan Server 2, 23

Scanning viruses 23

Security information 28

ServerProtect

domains 7

for Windows architecture review 7Support

TrendLabs 29

System requirements 2

TTesting your Installation 33

Trend Micro update server 9

TrendLabs 29

Troubleshooting ServerProtect for NetApp Filers 30

UUpdating NetApp Filer information 20

Upgrading ServerProtect

evaluation copy 30

for NetApp Filers 19

Using

multiple Scan Servers for a single NetApp Filer 16

Scan Servers as Normal Servers 21

VVerifying vscan is enabled 12

Viewing the status of a NetApp Filer 24

Virus

Sending to Trend Micro 29

vscan 12

WWhat’s new in ServerProtect for NetApp Filers? 10




I–2

spnetapp56gsg

Documents