InterScan Gateway Security Appliance M-Series TM Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. Should we need to make changes to this document and to the products described herein, we shall however inform you of such changes when they have occurred.Before installing and using the software, please review the readme files, release notes (if any), and the latest version of the Getting Started Guide, which are available from Trend Micro's Web site at: http://www.trendmicro.com/download/documentation/ Trend Micro, the Trend Micro t-ball logo, IntelliTrap, InterScan, ScanMail, MacroTrap, and TrendLabs are trademarks, registered trademarks, or servicemarks of Trend Micro, Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright© 2007 Trend Micro Incorporated. All rights reserved. Document Part No. SAEM12627/60117 Release Date: January 2007 Protected by U.S. Patent No. 5,623,600 and pending patents. The Trend Micro InterScan Gateway Security Appliance M-Series Administrator’s Guide is intended to provide detailed information about how to use and configure the features of the hardware device. Read it before using the software. Additional information about how to use specific features within the software is available in the online help file and the online Knowledge Base at the Trend Micro Web site. Trend Micro is always seeking to improve its documentation. If you have questions, comments, or suggestions about this or any other Trend Micro documents, please contact us at [email protected]. Your feedback is always welcome. Please evaluate this documentation on the following site: http://www.trendmicro.com/download/documentation/rating.asp Contents Contents Introduction Audience .............................................................................................xii About This Administrator’s Guide .....................................................xii Document Conventions ......................................................................xiii Chapter 1: Introducing Trend Micro InterScan Gateway Security Appliance What Is InterScan Gateway Security Appliance? ..............................1-2 Important Features and Benefits ....................................................1-3 How InterScan Gateway Security Appliance Works .....................1-5 Antivirus .....................................................................................1-6 Anti-Spyware ..............................................................................1-6 Anti-Spam ...................................................................................1-7 Anti-Phishing ..............................................................................1-7 Content and URL Filtering .........................................................1-8 Outbreak Defense .......................................................................1-8 The Appliance Hardware ...............................................................1-9 The Front Panel ...........................................................................1-9 LCD Module .............................................................................1-10 LED Indicators ..........................................................................1-11 The Back Panel .........................................................................1-12 Port Indicators ...........................................................................1-13 Preconfiguring and Deploying the Appliance .............................1-14 Connecting to the Network ..........................................................1-15 Testing the Appliance Connectivity ............................................1-15 Activating the Appliance .............................................................1-16 i Trend Micro™ InterScan Gateway Security Appliance M-Series Administrator’s Guide Chapter 2: How InterScan Gateway Security Appliance Works The Range and Types of Internet Threats ..........................................2-2 How InterScan Gateway Security Appliance Protects You ...............2-3 The Primary Functional Components ............................................2-4 Ethernet Network Interfaces ........................................................2-4 Real-Time Scan of SMTP, POP3, HTTP, and FTP Protocols .......................................................................2-5 The Web Console ........................................................................2-5 Content Filtering .........................................................................2-5 Anti-Spam ...................................................................................2-6 Using Trend Micro Anti-Spam Engine .......................................2-7 Using Approved and Blocked Senders Lists ...............................2-8 Approved and Blocked Senders ..................................................2-9 Using Network Reputation Services .........................................2-10 The Virus Scan Module .............................................................2-19 Outbreak Defense Services .......................................................2-20 Mail Notification .......................................................................2-21 The Log Module ........................................................................2-22 The Quarantine ..........................................................................2-22 The Delete Function ..................................................................2-22 Chapter 3: Getting Started with InterScan Gateway Security Appliance Preliminary Tasks ...............................................................................3-2 Accessing the Web Console ...............................................................3-3 The Summary Screen .........................................................................3-4 Information Above the Panels ........................................................3-4 Outbreak Prevention Service ..........................................................3-5 Damage Cleanup Service ...............................................................3-6 Component Version .......................................................................3-6 Antivirus .........................................................................................3-8 Anti-Spyware .................................................................................3-9 IntelliTrap .......................................................................................3-9 Anti-Spam: Content Scanning ......................................................3-10 Anti-Spam: Network Reputation Services ...................................3-11 Others ...........................................................................................3-11 Additional Screen Actions ...........................................................3-11 Navigating the Web Console .......................................................3-12 The Online Help System ..................................................................3-13 ii Contents Chapter 4: SMTP Services SMTP Services ...................................................................................4-2 Enabling Scanning of SMTP Traffic .............................................4-3 Configuring SMTP Virus Scanning ..............................................4-3 SMTP Scanning - Target ............................................................4-4 SMTP Scanning - Action ............................................................4-6 SMTP Scanning - Notification ...................................................4-8 Configuring SMTP Anti-Spyware ................................................4-9 SMTP Anti-Spyware - Target ...................................................4-10 SMTP Anti-Spyware - Action ..................................................4-12 SMTP Anti-Spyware - Notification ..........................................4-13 Configuring SMTP IntelliTrap ....................................................4-13 SMTP IntelliTrap - Target ........................................................4-14 SMTP IntelliTrap - Action ........................................................4-14 SMTP IntelliTrap - Notification ...............................................4-15 Configuring SMTP Anti-Spam: Network Reputation Services .................................................................................4-16 SMTP Anti-Spam: Network Reputation Services - Target ................................................................4-17 SMTP Anti-Spam: Network Reputation Services - Action ...............................................................4-18 Configuring SMTP Anti-Spam: Content Scanning .....................4-19 SMTP Anti-Spam: Content Scanning - Target .........................4-20 SMTP Anti-Spam: Content Scanning - Action .........................4-21 Configuring SMTP Anti-Phishing ...............................................4-22 SMTP Anti-Phishing - Target ...................................................4-23 SMTP Anti-Phishing - Action ..................................................4-23 SMTP Anti-Phishing - Notification ..........................................4-24 Configuring SMTP Content Filtering ..........................................4-25 SMTP Content Filtering - Target ..............................................4-26 SMTP Content Filtering - Action .............................................4-28 SMTP Content Filtering - Notification .....................................4-29 iii Trend Micro™ InterScan Gateway Security Appliance M-Series Administrator’s Guide Chapter 5: HTTP Services HTTP Services ....................................................................................5-2 Enabling Scanning of HTTP Traffic ..................................................5-2 Configuring HTTP Virus Scanning ....................................................5-2 HTTP Scanning - Target ................................................................5-3 Configuring Virus Scanning for HTTP Traffic ...........................5-3 About Deferred Scan for Large File Handling ............................5-5 HTTP Scanning - Action ................................................................5-6 HTTP Scanning - Notification .......................................................5-7 Configuring HTTP Anti-Spyware ......................................................5-8 HTTP Anti-Spyware - Target .........................................................5-8 HTTP Anti-Spyware - Action ......................................................5-10 HTTP Anti-Spyware - Notification ..............................................5-11 Configuring HTTP Anti-Pharming ...................................................5-12 HTTP Anti-Pharming - Target .....................................................5-12 HTTP Anti-Pharming - Action .....................................................5-12 HTTP Anti-Pharming - Notification ............................................5-13 Configuring HTTP Anti-Phishing ....................................................5-14 HTTP Anti-Phishing - Target .......................................................5-14 HTTP Anti-Phishing - Action ......................................................5-15 HTTP Anti-Phishing - Notification ..............................................5-16 Configuring HTTP URL Filtering ....................................................5-17 HTTP URL Filtering - Rules ........................................................5-17 HTTP URL Filtering - Settings ....................................................5-19 HTTP URL Filtering - Notification .............................................5-21 Configuring HTTP File Blocking .....................................................5-22 HTTP File Blocking - Target .......................................................5-22 HTTP File Blocking - Notification ..............................................5-23 Chapter 6: FTP Services FTP Services .......................................................................................6-2 Enabling Scanning of FTP Traffic .....................................................6-2 Configuring FTP Virus Scanning .......................................................6-2 FTP Scanning - Target ...................................................................6-3 FTP Scanning - Action ...................................................................6-5 FTP Scanning - Notification ..........................................................6-6 iv Contents Chapter 6: FTP Services—continued Configuring FTP Anti-Spyware .........................................................6-7 FTP Anti-Spyware - Target ...........................................................6-8 FTP Anti-Spyware - Action .........................................................6-10 FTP Anti-Spyware - Notification ................................................6-11 Configuring FTP File Blocking .......................................................6-12 FTP File Blocking - Target ..........................................................6-12 FTP File Blocking - Notification .................................................6-14 Chapter 7: POP3 Services POP3 Services ....................................................................................7-2 Enabling Scanning of POP3 Traffic ...................................................7-2 Configuring POP3 Virus Scanning ....................................................7-3 POP3 Scanning - Target ................................................................7-3 POP3 Scanning - Action ................................................................7-5 POP3 Scanning - Notification .......................................................7-7 Configuring POP3 Anti-Spyware ......................................................7-8 POP3 Anti-Spyware - Target .........................................................7-9 POP3 Anti-Spyware - Action ......................................................7-11 POP3 Anti-Spyware - Notification ..............................................7-12 Configuring POP3 IntelliTrap ..........................................................7-13 POP3 IntelliTrap - Target ............................................................7-13 POP3 IntelliTrap - Action ............................................................7-14 POP3 IntelliTrap - Notification ...................................................7-15 Configuring POP3 Anti-Spam .........................................................7-16 POP3 Anti-Spam - Target ............................................................7-16 POP3 Anti-Spam - Action ...........................................................7-18 Configuring POP3 Anti-Phishing ....................................................7-18 POP3 Anti-Phishing - Target .......................................................7-19 POP3 Anti-Phishing - Action ......................................................7-19 POP3 Anti-Phishing - Notification ..............................................7-20 Configuring POP3 Content Filtering ...............................................7-21 POP3 Content Filtering - Target ..................................................7-22 POP3 Content Filtering - Action .................................................7-24 POP3 Content Filtering - Notification .........................................7-25 v Trend Micro™ InterScan Gateway Security Appliance M-Series Administrator’s Guide Chapter 8: Outbreak Defense The Outbreak Defense Services .........................................................8-2 Current Status .....................................................................................8-3 Configuring Internal Outbreak ...........................................................8-5 Configuring Damage Cleanup ............................................................8-6 Potential Threat ..............................................................................8-7 Configuring Settings ...........................................................................8-7 Outbreak Defense - Settings ...........................................................8-8 Outbreak Defense - Notification ....................................................8-9 Yellow Alerts ............................................................................8-10 Red Alerts ..................................................................................8-10 Chapter 9: Quarantines Quarantines .........................................................................................9-2 Conducting a Query ............................................................................9-3 Performing Quarantine Maintenance .................................................9-7 Manual ............................................................................................9-7 Automatic .......................................................................................9-8 Chapter 10: Update Update ...............................................................................................10-2 Executing a Manual Update .............................................................10-3 Configuring Scheduled Updates .......................................................10-4 Configuring an Update Source .........................................................10-6 Chapter 11: Logs Logs ..................................................................................................11-2 Performing a Log Query ...................................................................11-3 Configuring Log Settings .................................................................11-5 Configuring Log Maintenance .........................................................11-6 Manual ..........................................................................................11-6 Automatic .....................................................................................11-7 vi