Spnetapp 56 GSG

TREND MICRO
ServerProtect5
TM
TM
Comprehensive server and storage virus protection

For Network Appliance Filers
TM
Trend Micro Incorporated reserves the right to make changes to this document and to
the products described herein without notice. Before installing and using the
software, please review the readme files, release notes, and the latest version of the
Quick Start Guide which are available from the Trend Micro Web site at:
http://www.trendmicro.com/dowload/documentation/
NOTE: A license to the Trend Micro Software usually includes the right to product
updates, pattern file updates, and basic technical support for one (1) year from the
date of purchase only. Maintenance should be renewed on an annual basis at the
Trend Micro then-current Maintenance fees.
Trend Micro, the Trend Micro t-ball logo, Control Manager, MacroTrap,
ServerProtect, and TrendLabs are trademarks or registered trademarks of Trend
Micro, Incorporated.
All other product or company names may be trademarks or registered trademarks of
their owners.
Copyright 1989-2003 Trend Micro Incorporated. All rights reserved. No part of
this publication may be reproduced, photocopied, stored in a retrieval system, or
transmitted without the express prior written consent of Trend Micro Incorporated.
Document Part No. SSEG51567/30718
Release Date: October 2003
Protected by U.S. Patent No. 5,951,698
The Quick Start Guide for Trend Micro ServerProtect for Network Appliance
(NetApp) Filers introduces the main features of the software and installation
instructions for your production environment. You should read it before installing or
using the software.
For technical support, please refer to Troubleshooting ServerProtect for NetApp
Filers on Page 30 for technical support information and contact details. Detailed
information about how to use specific features within the software are available in
the online help file and online Solution Bank at Trend Micros Web site.
Trend Micro is always seeking to improve its documentation. If you have questions,
comments, or suggestions about this or any Trend Micro documents, please contact
us at docs@trendmicro.com. Your feedback is always welcome. Please evaluate this
documentation on the following site:
www.trendmicro.com/download/documentation/rating.as
Contents
System requirements ..............................................................................2
Overview ................................................................................................4
ServerProtect for Windows architecture review ................................7
Enabling Trend Micro update server .................................................9
Whats new in ServerProtect for NetApp Filers? ................................10
Multi-filer support ...........................................................................10
User notification upon client infection ............................................10
NetApp Filer status available through the Management Console ...10
Conveniently update NetApp Filer logon information ....................10
Trend Micro Control Manager agent compatibility .....................10
NetApp Filer notification of new updates .......................................11
NetApp Filer RPC status notification ..............................................11
Installing ServerProtect for NetApp Filers ..........................................11
Verifying vscan is enabled ...............................................................12
Confirming the CIFS default share (C$) still exists ........................12
Deleting connections between Scan Servers and a NetApp Filer ....14
Installing a Scan Server ...................................................................14
Using multiple Scan Servers for a single NetApp Filer ..................16
Adding more NetApp Filers to a Scan Server .................................17
Removing ServerProtect for NetApp Filers .........................................19
Removing a NetApp Filer ................................................................19
Upgrading ServerProtect for NetApp Filers ........................................19
Configuring NetApp Filer options .......................................................20
Updating NetApp Filer information ................................................20
Using Scan Servers as Normal Servers ...........................................21
Scanning viruses ..............................................................................23
Notifying NetApp Filer clients upon infection ................................23
Viewing the status of a NetApp Filer ..............................................24
Configuring NetApp Filer RPC connection status notifications .....25
Notifying NetApp Filers of new update components ......................26
Registration and technical support .......................................................27
Contacting technical support and registering ServerProtect ............27
Online resources ...........................................................................28
Trend Micro Serverprotect for Network Appliance filers Quick Start Guide
Security information ........................................................................ 28

Knowledge Base .............................................................................. 29
TrendLabs .................................................................................... 29
Sending infected files to Trend Micro ............................................ 29
Upgrading the ServerProtect evaluation copy ..................................... 30
Troubleshooting ServerProtect for NetApp Filers .............................. 30
Network Appliance (NetApp) Filers do not recognize ServerProtect
for Network Appliance Filers Scan Servers ................................. 30
The Scan Server completed scan on a file but original request was
not found when scanning large files on the NetApp Filer ............ 31
Configuring the ServerProtect for Network Appliance Filers to scan
all file types .................................................................................. 32
Testing your installation ...................................................................... 33
ii
Trend Micro ServerProtect for Network Appliance (NetApp) Filers
Trend Micro ServerProtect for

Network Appliance (NetApp)
Filers
Trend Micro ServerProtect for Network Appliance (NetApp) Filers is an enhanced
version of ServerProtect developed exclusively to provide antivirus solutions for
NetApp Filers. Scalable and reliable, ServerProtect for NetApp Filers protects
NetApps line of Filer storage appliances against viruses, Trojans, and other
malicious code.
This Quick Start Guide is an addendum to the ServerProtect for Windows Getting
Started Guide (GSG). Many of the ServerProtect for NetApp features can be found in
the ServerProtect for Windows GSG.
If you cannot find information regarding a specific feature in this book, please refer
to the ServerProtect for Windows GSG.
This addendum manual includes the following sections:
System requirements
Overview
Whats new in ServerProtect for NetApp Filers
Installing ServerProtect for NetApp Filers
Removing ServerProtect for NetApp Filers
Upgrading ServerProtect for NetApp Filers
Configuring NetApp Filer options
Contacting technical support and troubleshooting
Upgrading the ServerProtect evaluation copy
Trend Micro ServerProtect for Network Appliance Filers Quick Start Guide
System requirements
ServerProtect for NetApp Filers requires the following:
Scan Server
Intel Pentium III 550MHz processor or equivalent
Operating System:
Microsoft Windows
Microsoft Windows Server 2003
Microsoft Windows 2000 Server/Advanced Server with SP3 or above
Network Protocols and Services
TCP/IP, Microsoft Network (NetBIOS Compatible Transport Protocol),

and RPC services must be running on the installed Windows server
256MB RAM or above is recommended
70MB of free disk space
Note:
In the ServerProtect for Windows documentation, the Scan Server is called

"Normal Server". However, this document uses the term "Scan Server" to describe
the machines in Information Server domains that protect the NetApp Filers.
Information Server
Intel Pentium III 550MHz processor or equivalent
Operating System:
Microsoft Windows

256MB RAM or above is recommended
70MB of free disk space
90MB free disk space (if installing with Trend Micro Control Manager agent)
Management Console
Operating System:
Microsoft Windows

Monitor with 800 x 600 or higher resolution
NetApp Filer
The NetApp Filer must be AV-enabled with an RPC agent running to

communicate with ServerProtect
The NetApp Filer must have the proprietary Operating System Data ONTAP
6.3.1 or above installed
Note:
For optimal scanning performance, Trend Micro recommends the connection

between the filer and a Scan Server to have a bandwidth of at least 1Gbps.
Overview
ServerProtect for NetApp Filers scans viruses using "on-access" mode, which takes
place on a Scan Server. In turn, the Information Server manages the Scan Servers.
FIGURE 1.
ServerProtect for NetApp Filers product architecture
When a ServerProtect for NetApp Filers user tries to access a file or store a new file
in a NetApp Filer, the NetApp Filer performs a virus check. If the filename extension
matches the file scanning criteria (For example, an ".EXE" or a ".VBS" file), the
NetApp Filer sends a manual scan request (Scan Now) to the Scan Server(s). The
Scan Server then passes back the scan result to the NetApp Filer and according to the
scan result, the user is either allowed to open/save the file or is denied access to the
file (to set NetApp Filer file scanning criteria, refer to your NetApp Filer
documentation).
Note:
Since only specific file types contain viruses, establishing the right file scanning
criteria can help optimize Scan Server performance, reduce bandwidth usage, and
minimize scanning time. To learn how ServerProtect for NetApp Filers can
efficiently and safely scan files, see IntelliScan in chapter 1 of the ServerProtect
for Windows Getting Started Guide.
If a file contains a virus, ServerProtect for NetApp Filers performs a designated

action. Refer to Scanning Viruses in chapter 3 of the ServerProtect for Windows
Getting Started Guide for additional information about scan actions. For example, if
the file is cleanable and ServerProtect for NetApp Filers is configured to perform a
Clean action the following occurs:
1.
The Scan Server cleans the file and informs the NetApp Filer that the file is no
longer infected.
2.
The NetApp Filer allows its client to access the cleaned file and replaces the
original file with the cleaned one.
Note:
The NetApp Filer "trusts" registered Scan Servers, so if a Scan Server also
functions as a Normal Server (as a file or data server) and happens to send a file to
the NetApp Filer, the latter will not request the file be scanned. To protect both the
NetApp Filer, and the Normal Server, set the ServerProtect Real-time Scan to
"Incoming & outgoing". See To set Real-time Scan to Incoming & outgoing,
do the following: on page 21.
Below is an explanation of the ServerProtect for NetApp Filers organizational flow:

RPC
Scan Server
RPC
RPC
Scan Server
RPC
(ServerprotectNormal Server)
ServerProtect
Information
Server
Download
source
HTTP
NetApp Filer
RPC
Trend Micro
Update
Server
Scan Server
RPC
FIGURE 2.
ServerProtect for NetApp Filers organizational flow
ServerProtect for NetApp Filers consists of an agent that communicates with the
NetApp Filer via remote procedure calls (RPCs). This agent performs the following
functions:
Registers the Normal Server with the NetApp Filer as a "Scan Server." This
informs the NetApp Filer of the availability and location of a Scan Server
Watches for NetApp Filer file-scanning requests
Returns scan results to the NetApp Filer
Answers any queries from the NetApp Filer
Informs the NetApp Filer of any pattern file or scan engine updates
Communicates with the NetApp Filer to check the connection between the Scan
Server and the NetApp Filer
ServerProtect for Windows architecture review

As previously mentioned, ServerProtect for NetApp Filers is an enhanced version of
ServerProtect for Windows. To understand the ServerProtect for NetApp Filers
enhancements, it is useful to review the architecture of ServerProtect for Windows.
ServerProtect for Microsoft Windows protects networks through a three-tier
architecture: the Management Console, the Information Server, and the Normal
Server. You can use the Management Console to configure the Information Server
(IS), which lets you control the Normal Servers managed by the IS.
The three components are independent from each other, yet you can install each on
one machine, on separate machines, or in a combination (for example, you can install
the Management Console on one machine, and you can install the Information Server
and the Normal Server together on a separate machine).
For additional information on ServerProtect architecture, refer to ServerProtect
Architecture in chapter 1 of the ServerProtect for Windows Getting Started Guide.
Management Console: this portable console gives you centralized control of
multiple network servers and domains. The Management Console lets you
simultaneously configure servers in the same IS domain and generate integrated virus
incident reports for all servers. The ServerProtect domain browser tree shows all the
ServerProtect servers along with the status of each server. Status information
includes the version of the virus pattern, scan engine, and program file; the type and
version of operating system; the direction of real-time scanning, and so on.
For additional information on the Management Console, refer to ServerProtect
Architecture in chapter 1 of the ServerProtect for Windows Getting Started Guide.
Information Server: a communications hub
for coordinating antivirus defense activities
within its domains. An Information Server (IS)
provides a single point of contact for assigned
Normal Servers and Scan Servers. This saves
time because the Information Server makes it
unnecessary to directly communicate with each
individual Normal Server.
What are ServerProtect domains?

In ServerProtect, domains are virtual
groupings of Normal Servers that
simplify the identification and
management of Normal Servers. You
can create, rename, or delete
domains according to your network
needs (refer to Managing
ServerProtect Domains in chapter 3
of the ServerProtect for Windows
Getting Started Guide.)
If there is a large number of Normal Servers in a domain, you can add more
Information Servers and divide the number of Normal Servers among them. For
example, if a domain has 100 Normal Servers assigned to one IS, you can share the
workload among two Information Servers by adding another IS and assigning 50
Normal Servers to each IS. The IS also collects log files.
For additional Information Server information, refer to ServerProtect Architecture in
chapter 1 of the ServerProtect for Windows Getting Started Guide.
Note:
In addition to managing Scan Servers, the ServerProtect for NetApp Filers

Information Server can also manage ServerProtect for Windows Normal Servers.
Normal Server (Scan Server): the first line of defense in the ServerProtect
architecture and where all the scanning takes place. The Normal Servers are the
machines in the organization, which typically act as file servers, data servers, etc.
Normal Servers can scan both manually and in real time.
For more Normal Server information, refer to ServerProtect Architecture in chapter 1
of the ServerProtect for Windows Getting Started Guide.
Note:
In ServerProtect for NetApp Filers, Normal Servers are referred to as "Scan

Servers". Scan Servers scan files NetApp Filer clients try to access or modify in
the NetApp Filer.
Key differences between the ServerProtect versions are listed in the following table:
ServerProtect for NetApp

Filers
ServerProtect
Protection
Focus:
NetApp Filer.
Normal Servers (the

machines in the organization
which act as file servers,
Web servers, etc.).
Normal Server
Role:
Acts as a "Scan Server" and

scans files in the NetApp Filer on
access.
Scans files on the Normal

Server.
Table 1. ServerProtect Version Comparison
Enabling Trend Micro update server

A virus scanner must have the latest updates in order to be effective. You can
configure ServerProtect for NetApp Filers to automatically download the newest
virus patterns and scan engine updates. To minimize download times and preserve
network bandwidth, Trend Micro update server distributes available updates to the
designated servers via an incremental update mechanism. This ensures ServerProtect
for NetApp Filers downloads only the latest virus signatures since the last version.
For detailed information about Trend Micro update server, refer to Configuring
Updates in chapter 3 of the ServerProtect for Windows Getting Started Guide.
Whats new in ServerProtect for NetApp Filers?

This section includes the new features in this version of ServerProtect for NetApp
Filers.
Multi-filer support
One Scan Server can scan multiple NetApp Filers at the same time. Now, network
administrators can dedicate one physical server to protect several NetApp Filers, this
can contribute to reduce the total cost of ownership. See Adding more NetApp Filers
to a Scan Server on page 17 for additional information.
User notification upon client infection

ServerProtect for NetApp Filers can get the IP address and host name of a client
causing an infection, and then alert both the user and the network administrator. This
function is only available if using Data ONTAP version 6.4 or later. See Notifying
NetApp Filer clients upon infection on page 23 for additional information.
NetApp Filer status available through the Management

Console
Network administrators can view if a registered NetApp Filer is online or offline
from the Management Console. See Viewing the status of a NetApp Filer on page 24
for additional information.
Conveniently update NetApp Filer logon information

Network administrators can update the logon information for several NetApp Filers
simultaneously. See Updating NetApp Filer information on page 20 for additional
information.
Trend Micro Control Manager agent compatibility

ServerProtect for NetApp Filers is compatible with Trend Micro Control Manager
agent for ServerProtect.
10
NetApp Filer notification of new updates

When new update components (scan engine and pattern) are downloaded to a Scan
Server, the Scan Server will notify NetApp Filers to flush the cache of previously
scanned files. This ensures that NetApp Filers continuously utilize the most current
protection. Each NetApp Filer will then begin rebuilding the cache of previously
scanned files until a new update arrives from Trend Micro update server. See
Notifying NetApp Filers of new update components on page 26 for additional
information.
NetApp Filer RPC status notification

ServerProtect for NetApp Filers monitors the RPC connection with each NetApp
Filer. If the RPC connection between a NetApp Filer and the Scan Server is inactive,
the Scan Server will attempt to reconnect to the NetApp Filer.
Upon configuration, ServerProtect for NetApp will notify network administrators
whenever a connection to a NetApp Filer succeeds or fails. You can also select the
type of notification you wish to receive. This feature can help in troubleshooting. See
Configuring NetApp Filer RPC connection status notifications on page 25 for
additional information.
Installing ServerProtect for NetApp Filers

Before installing ServerProtect for NetApp Filers, perform the following tasks.
Verify that vscan is enabled. See Verifying vscan is enabled on page 12
Confirm the default CIFS default share (C$) still exists. See Confirming the CIFS
default share (C$) still exists on page 12
Delete connections between Scan Servers and a NetApp Filer. See Deleting
connections between Scan Servers and a NetApp Filer on page 14
Note:
To verify ServerProtect for NetApp Filers functions correctly, it is important to

perform the necessary pre-installation checks and actions listed above.
11
Verifying vscan is enabled

Before installing ServerProtect, it is important to verify that vscan is enabled on the
NetApp Filer.
To verify that vscan is enabled, type vscan at the command prompt of the NetApp
Filer console.
FIGURE 3.
Virus scanning enabled
If vscan is disabled, enable it so ServerProtect for NetApp Filers can function

correctly.
To enable vscan, type vscan on at the command prompt.
For more information, at the command prompt type vscan help or refer to your
NetApp Filer documentation.
Confirming the CIFS default share (C$) still exists

It is important to confirm that the Common Internet File System (CIFS) default share
(C$) of the NetApp Filer was not removed.
12
WARNING! If you delete the default share, ServerProtect will not function correctly. To
learn more about the filer administrative operations, refer to your NetApp
Filer documentation.
To confirm the default CIFS default share (C$) of the NetApp Filer still exists, do
one of the following:
Use the FilerView administration tool
FIGURE 4.
FilerView administration screen
On the NetApp Filer console, type the command cifs shares
13
FIGURE 5.
NetApp Filer console command prompt
Deleting connections between Scan Servers and a NetApp

Filer
To prevent the Scan Server from failing to register to the NetApp Filer, delete all
original connections between the Scan Servers and the NetApp Filer. This ensures
Scan Servers use the correct credentials to make successful connections with the
NetApp Filer.
To delete connections between Scan Servers and a NetApp Filer, at the
command prompt type:
net use \\Filer-Machine\C$ /delete
Installing a Scan Server

With the exception of one step, the installation procedure for ServerProtect for
NetApp Filers is the same as for ServerProtect for Windows. For additional
information regarding installation procedures, refer to Installation Scenarios in
Note:
While performing a remote installation, the NetApp Filer information will be

copied from a source Scan Server to the target Scan Server. For more information,
refer to Installation Scenarios in chapter 2 of the ServerProtect for Windows

Getting Started Guide.
14
Installing a ServerProtect for NetApp Filers Scan Server requires the following
information:
The NetApp Filer name or IP address
Name of the domain where the NetApp Filer is located
User name and password needed to access the NetApp Filer (you need filer
backup operator or above privileges)
To install ServerProtect for NetApp Filers do the following:
1.
During installation, select Install Server as a ServerProtect Normal Server on

the Select Components screen, the Setup Filer Information screen appears.
FIGURE 6.
2.
Setup Filer Information screen
Do the following:
In the Filer name or IP address text box, type the NetApp Filer name or the
filer IP address
15
In the Domain name text box, type the name of the domain where the
NetApp Filer is located
In the User name and Password text box, type your NetApp Filer logon
credentials (you need filer backup operator or above privileges)
3.
Click Next, and then continue following the directions included in the Installing
ServerProtect section of the ServerProtect for Windows Getting Started Guide.
4.
After installation is complete, you should see the correct system log from the
View Log pane of the ServerProtect Management Console.
FIGURE 7.
System Log Detailed Information screen
Using multiple Scan Servers for a single NetApp Filer

ServerProtect for NetApp Filers provides a fully scalable enterprise antivirus solution
for organizations using NetApp Filers.
16
If there is a large volume of incoming files to the NetApp Filer, adding and
registering multiple Scan Servers with the NetApp Filer evenly distributes the
workload among the registered Scan Servers.
NetApp Filers send files to Scan Servers in "round-robin" fashion. For example, if
you have three Scan Servers and the NetApp Filer has four incoming files, the first
Scan Server scans the first file, the second Scan Server scans the second file, the third
Scan Server scans the third file, the first Scan Server scans the fourth file, and so on.
This even distribution of the workload reduces the loading of Scan Servers (load
balancing). For more information on load balancing, refer to your NetApp Filer
documentation.
The procedure for adding additional Scan Servers to a NetApp Filer is identical to the
procedure for adding Normal Servers in ServerProtect for Windows (refer to
Installing a Normal Server in chapter 2 of the ServerProtect for Windows Getting
Started Guide).
To confirm that multiple Scan Servers are working for a single NetApp Filer:
1.
Open the command prompt for the NetApp Filer that you want to verify.
2.
At the command prompt, type:

netapp> vscan scanners
The NetApp Filer displays a list of Scan Servers by IP address and NetBIOS
name.
Adding more NetApp Filers to a Scan Server

A Scan Server can protect multiple NetApp Filers at the same time. Use the
ServerProtect Management Console to conveniently add NetApp Filers to a Scan
Server. You can also assign several Scan Servers to individual NetApp Filers for load
balancing. See Using multiple Scan Servers for a single NetApp Filer on page 16.
You need the following to add a NetApp Filer in ServerProtect for NetApp Filers:
An account on the NetApp Filer with backup operator privileges or above
NetApp Filer name or IP address
NetApp Filer logon credentials (user name, password)
17
To add a NetApp Filer:
1.
Right-click a Scan Server, and then select Filer List on the domain browser tree.
The Filer List screen appears.
2.
Click Add. The Add Filer screen appears.
FIGURE 8.
3.
Do the following:
In the Filer name or IP address text box, type the name or IP address of the
NetApp Filer
NetApp Filer is located
Note:
4.
18
Add Filer screen
The domain name refers to the Windows domain in which NetApp Filers
will authenticate registered users.
credentials (requires backup operator or above privileges)
Click OK.
Removing ServerProtect for NetApp Filers

To remove ServerProtect for NetApp Filers, please refer to Removing ServerProtect
in chapter 2 of the ServerProtect for Windows Getting Started Guide
Removing a NetApp Filer

In several instances, it may be necessary to remove (delete) a NetApp Filer from a
Scan Server. For example, when changing, upgrading, or renaming a NetApp Filer.
To remove a NetApp Filer, do the following:
1.
2.
Select one or more NetApp Filers from the list. To multi-select several NetApp
Filers, press the CTRL key as you select.
3.
Click Remove. The Remove Filer confirmation screen appears.
4.
Click OK.
Upgrading ServerProtect for NetApp Filers

If you are currently using an older version of ServerProtect for NetApp Filers, you
can upgrade to this new version. The procedure for upgrading ServerProtect for
NetApp filers is the same as for ServerProtect for Windows.
Note:
After upgrading to this version ServerProtect for NetApp Filers, all configuration
options from your previous ServerProtect for NetApp Filers installation will
remain the same.
To upgrade from previous versions of ServerProtect for NetApp Filers, do the

following:
1.
Verify the system requirements for this new version.
2.
See Upgrading ServerProtect Software in chapter 4 of the ServerProtect for

Windows Getting Started Guide.
19
Configuring NetApp Filer options

This section introduces the necessary information for configuring NetApp Filer
related settings from the Management Console.
Updating NetApp Filer information

Changing a NetApp Filers system information, will require updating the NetApp
Filers logon information in ServerProtect for NetApp Filers. The following
information is necessary to update a NetApp Filers system information in
ServerProtect for NetApp Filers:
An account on the NetApp Filer with backup operator privileges or above
NetApp Filer name or IP address
NetApp Filer logon credentials (user name, password)
To update NetApp Filer information:
1.
2.
3.
Click Logon Info. The Logon Information screen appears.
4.
Do the following:
5.
20
NetApp Filer is located.
credentials (requires backup operator or above privileges)
Click Apply to update the NetApp Filer information. The Filer information
update confirmation screen appears.
FIGURE 9.
Filer information update screen
Using Scan Servers as Normal Servers

Although the ideal configuration is to have a machine act primarily as a Scan Server
to protect the NetApp Filer, there may be situations where a Scan Server must also
serve as an organizations Normal Server (file server, data server, etc.).
If you choose to use a Scan Server as a Normal Server, the Normal Servers
Real-time Scan function is enabled by default.
Real-time Scan has the following options:
incoming (default)
outgoing
incoming & outgoing
Note:
For the highest level of security set Real-time Scan to Incoming & outgoing.
However, if the computer only performs as a Scan Server, you can use the default
setting (Incoming).
To set Real-time Scan to Incoming & outgoing, do the following:
1.
Select either the Information Server, domain, or a Normal Server (Scan Server)
on the domain browser tree.
2.
Do one of the following:
Click Set Scan Option > Real-time Scan on the side bar
Click Configure > Scan Options > Real-time Scan on the main menu
The Real-time Scan configuration screen appears.
21
FIGURE 10.
Real-time Scan configuration screen
3.
Under Scan direction, click Incoming & outgoing.
4.
Click Apply.
For more information about Real-time Scan, refer to Using Real-time Scan in chapter
3 of the ServerProtect for Windows Getting Started Guide.
22
Scanning viruses
A Scan Server receives a scan request from the NetApp Filer when a user tries to
open a file that matches the file scanning criteria (to set file scanning criteria, refer to
your NetApp Filer documentation). The Scan Server then scans the file using the
ServerProtect manual scan function. For more information about manual scans, refer
to Using Scan Now in chapter 3 of the ServerProtect for Windows Getting Started
When a Scan Server detects a virus, it performs one of the following actions,
depending on what you have previously configured:
Bypass/Ignore- Skips over the file without taking any corrective action in a
manual scan
Delete: Deletes the infected file
Rename: Changes the name of the infected file by modifying the file extension
to ".VIR"
Quarantine (Move): Moves the infected file to a designated folder
Clean: Attempts to clean the virus code from the file
For more information about these actions and configuring actions, refer to Defining
Actions Against Viruses in chapter 3 of the ServerProtect for Windows Getting
Started Guide.
Note:
By default, NetApp Filers do not include ".ZIP" in the set of file extensions to be
scanned. To enable scanning for ".ZIP" and other file types, see To add any file
extension into the NetApp Filers extension table, type the following at the
NetApp Filer command prompt: on page 32. This also applies to other types of
compressed files.
Notifying NetApp Filer clients upon infection

ServerProtect can notify the user and the Network Administrator if a NetApp Filer
client has uploaded or accessed an infected file. The notification function is enabled
by default.
To notify a user of NetApp Filer client infection do the following:
1.
23
2.
Click Options. The Global Filer Options screen appears.
3.
Select Notify User of Virus Infection.
FIGURE 11.
4.
Global Filer options screen
Click OK.
Note:
This setting will affect all the NetApp Filers in the Filer list.
Viewing the status of a NetApp Filer

You can see the status of a NetApp Filer through the Management Console. NetApp
Filers may appear offline for one of the following reasons:
The NetApp Filer is shut down or is not responding
The network is not available
The NetApp Filer did not successfully register with the Information Server
To view the status of a NetApp Filer do the following:
1.
24
FIGURE 12.
2.
Filer List screen
Verify the status of a NetApp Filer by looking at the Filer name and Status fields
in the Filer List. A NetApp Filer may appear as online or offline.
Configuring NetApp Filer RPC connection status

notifications
ServerProtect can notify the network administrator whenever an RPC connection to a
NetApp Filer succeeds or fails.
To configure a NetApp Filer RPC connection status notification, do the
following:
1.
Select the Information Server, domain, or a Normal Server on the domain

browser tree.
2.
Do one of the following:
3.
Select Configure > Notifications > Standard Alert from the main menu
Click Set Notification, and then Standard Alert on the side bar
Select Filer Rpc Connection Success/Failure.
25
FIGURE 13.
4.
Standard Alert configuration screen
Click Configure Message to set up a customized notification message.

Note:
For additional information, refer to Configuring Notification Messages in

Notifying NetApp Filers of new update components

When update downloads new components (scan engine and pattern) to the Scan
Server, the Scan Servers will notify NetApp Filers to flush the cache of previously
scanned files. This ensures that all files are scanned with the latest virus pattern. Each
NetApp Filer will then begin rebuilding the cache of previously scanned files until a
new update arrives from the update server.
26
For more information on downloading updates, refer to Downloading Updates in

Registration and technical support

Here, you will find answers to frequently asked questions and you will learn how to
obtain additional ServerProtect information.
This chapter discusses the following topics
Contacting technical support and registering ServerProtect
Security information
Knowledge Base
TrendLabs
Sending infected files to Trend Micro
Contacting technical support and registering

ServerProtect
A license to Trend Micro antivirus software includes the right to receive pattern file
updates and technical support from Trend Micro or an authorized reseller, for one (1)
year. Thereafter, you must renew Maintenance on an annual basis at the Trend Micro
then-current Maintenance fees to have the right to continue receiving these services.
Trend Micro Incorporated provides worldwide support to all of our registered users.
Please register your software before contacting our offices for support. Use any of the
following methods:
Register through the web at: www.trendmicro.com/forms/register.htm
Fax the registration card to any Trend Micro office
Mail the registration card to the Trend Micro US office
27
You can download evaluation copies of all Trend Micro products from Web site,
www.trendmicro.com.
Trend Micro Incorporated
10101 N. De Anza Blvd.
Cupertino, CA 95014- 9985
Tel: +1 (408) 257-1500, +1 (800) 228-5651
Fax: +1 (408) 257-2003
For contact information in your country or region, refer to:
www.trendmicro.com/en/about/contact/overview.htm
Online resources
Email: sales@trendmicro.com
Web: www.trendmicro.com
Security information
Comprehensive security information is available at the Trend Micro Web site:
www.trendmicro.com/vinfo/
Use the Web site to learn about:

Computer virus hoaxes
A weekly virus alert, listing the viruses that will trigger during the current week
How to determine if a virus detection is a false alarm
Trend Micro Virus Encyclopedia, which includes a comprehensive list of names
and symptoms for known viruses and malicious mobile code
A basic guide to computer viruses
Trend Micro virus reading room, with dozens of articles about the latest issues in
computer viruses, including the threat posed by Java applets and ActiveX controls
Product details and white papers
28
Knowledge Base
Trend Micro provides Knowledge Base, an online database filled with answers to
technical product questions. Use it, for example, if you are getting an error message
and want to find out what to do to. Type the following URL in your browsers
address bar:
kb.trendmicro.com/solutions/
New solutions are added daily. However, if you do not find the answer you seek, you
can submit your question online, where a TrendLabs engineer will provide you with
an answer or contact you for more information.
TrendLabs
TrendLabs is Trend Micro global network of antivirus research and product support
centers that provide 24 x 7 coverage to Trend Micro customers around the world.
TrendLabs makes up the backbone of Trend Micro customer service infrastructure. It
continuously monitors potential security threats around the world and conducts
virus-related research aimed at identifying, detecting, and eliminating new viruses.
These efforts result in frequent virus pattern file updates and scan engine
refinements.
Staffed by a team of several hundred engineers and certified support personnel,
TrendLabs also provides a wide range of product and technical support services to
customers worldwide. Dedicated service centers are located in Irvine, CA, Tokyo,
Manila, Taipei, Munich, and Paris to ensure the most rapid response to virus outbreak
and urgent customer support matters.
Sending infected files to Trend Micro

You can send viruses, infected files, Trojan horse programs, and other malware to
Trend Micro. More specifically, if you have a file that you think is some kind of
malware but the scan engine is not detecting it or cleaning it, you can submit the
suspicious file to Trend Micro using the following Web address:
subwiz.trendmicro.com
Please include in the message text a brief description of the symptoms you are
experiencing. Our team of virus engineers will "dissect" the file to identify and
29
characterize any viruses it may contain and return the cleaned file to you within 48
hours.
Upgrading the ServerProtect evaluation copy

To enjoy the benefits of automatic software updates and technical support, upgrade to
a registered version of ServerProtect for NetApp Filers. Refer to the appendix of the
ServerProtect for Windows Getting Started Guide for detailed instructions on how to
upgrade your evaluation copy to the full version of ServerProtect.
Troubleshooting ServerProtect for NetApp

Filers
This section contains troubleshooting information and may assist you in finding a
solution to frequently asked questions.
Network Appliance (NetApp) Filers do not recognize

ServerProtect for Network Appliance Filers Scan Servers
Description:
After a power cycle on the Network Appliance Filer, the ServerProtect for Network
Appliance Filers Scan Server returned Event 213:
Cannot add a connection to Filer. The network path was not found.
Running the "vscan scanners" command on the NetApp filer returns the
following message:
No virus scanners are registered with the filer.
The ServerProtect for Network Appliance Filers Scan Servers still manage to obtain
pattern updates from Trend update servers.
Solution:
Confirm the following conditions exist:
30
Remote Procedure Call (RPC) is enabled on the servers
Vscan is turned "On" on the NetApp Filer
The Common Internet File System (CIFS) default share (C$) still exists
After confirming these conditions, do the following:

1.
2.
3.
Click Logon Info. The Logon Information screen appears.
4.
Verify the information is correct. Otherwise, reenter it.
5.
Click OK.
After completing these steps, repeat the registration of the Scan Server in the NetApp
Filer. If the password for the administrator account was recently changed, the
changes may not take effect until a start up/power-cycle of the NetApp Filer occurs.
The Scan Server completed scan on a file but original

request was not found when scanning large files on the
NetApp Filer
Description:
When scanning large files on the Filer in ServerProtect for Network Appliance Filers,
the following message appears:
[Server] completed scan on [FileName] but original request was
not found.
Solution:
This situation occurs because the scan period encountered a time out due to the large
size of the file. Resolve this issue by extending the Time Out period between the Filer
and the Scan Server.
To extend the Time Out period between the Filer and the Scan Server, perform
the following steps on the Scan Server:
1.
Run Regedit.
2.
Browse to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ServerProtect\CurrentVer
sion\Engine\Filers
31
3.
Set the Value Data to the desired TimeOut period in the ScanFilerTimeOut
DWORD.
The unit of ScanFilerTimeOut is in seconds; this is the timeout value for the Scan
Server to scan a file.
Note:
Default timeout period for ServerProtect is 24 seconds.
To disable this warning, add the ScanTimeOutLog DWORD Value to the following
location:
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ServerProtect\CurrentVersion
\Engine\Filers
Possible values for ScanTimeOutLog:

1 - Enable logging of files not scanned due to time out
0 - Disable logging of files not scanned due to time out
Configuring the ServerProtect for Network Appliance Filers

to scan all file types
Description:
How to configure ServerProtect for Network Appliance Filers to scan all file types?
Solution:
To scan all files placed on the NetApp Filer, change the extension table of the
NetApp Filer so it supports all file extensions.
To make sure the extension table of the NetApp Filer supports all file
extensions, type the following at the NetApp Filer command prompt:
filer> vscan extensions add ???
The above command will make the filer scan all file types regardless of their
extension. The NetApp Filer wild card is a question mark (?) and not an asterisk (*).
To add any file extension into the NetApp Filers extension table, type the
following at the NetApp Filer command prompt:
filer> vscan extensions add vbs
32
The above command will make the NetApp Filer scan file with a ".VBS" extension.
You can replace vbs with any three-letter file extension.
Scanning all files can degrade the NetApp Filers performance and slow down virus
scanning. It is recommended to scan files that are prone to viruses.
Testing your installation

The European Institute of Computer Antivirus Research (EICAR), in cooperation
with antivirus vendors, has developed a test file to check if your system can detect
viruses.
The file is not an actual virus; it will cause no harm and it will not replicate. Rather, it
is a specially created file whose "signature" has been included in the Trend Micro
virus pattern. As a result, Trend Micro scan engine will detect it.
To test your installation do the following:
1.
Download this file to the NetApp Filer from the Trend Micro Web site at:
www.trendmicro.com/vinfo/testfiles/index.htm
2.
Open or copy the test file from a NetApp Filer client. If the installation was
successful, the Scan Server will detect it and will perform the scan action
configured under Scan Now. The default scan action is Clean.
For more information about these actions and configuring actions, refer to
Defining Actions Against Viruses in chapter 3 of the ServerProtect for Windows
Getting Started Guide.
WARNING! To successfully detect the EICAR test file, the extension table of the NetApp
Filer should support the ".HTM" file type. See Configuring the
ServerProtect for Network Appliance Filers to scan all file types on
page 32.
33
34
Index
A
R
Registering ServerProtect 27
Removing ServerProtect for NetApp Filers 19
RPC 3, 6
Adding more NetApp Filers to a Scan Server 17
Scan Server 2, 23
Scanning viruses 23
Security information 28
ServerProtect
domains 7
for Windows architecture review 7
Support
TrendLabs 29
System requirements 2
Bandwidth 34, 9
C
CIFS 12
Configuring NetApp Filer
Options 20
RPC connection status notifications 25
Confirming the default CIFS default share (C$) still
exists 12
Contacting Technical Support 27
Control Manager agent 2
D
Data ONTAP 3
Deleting connections between Scan Servers and a NetApp Filer 14
T
Testing your Installation 33
Trend Micro update server 9
TrendLabs 29
Troubleshooting ServerProtect for NetApp Filers 30
Information Server 2, 7
Installing ServerProtect for NetApp Filers 11
Updating NetApp Filer information 20

Upgrading ServerProtect
evaluation copy 30
for NetApp Filers 19
Using
multiple Scan Servers for a single NetApp Filer 16
Scan Servers as Normal Servers 21
Knowledge Base 29
Verifying vscan is enabled 12

Viewing the status of a NetApp Filer 24
Virus
Sending to Trend Micro 29
vscan 12
E
Eicar 33
M
Management Console 3, 7
N
NetApp Filer 3
Normal Server 8
Notifying NetApp
Filer clients upon infection 23
Filers of new update components 26
W
Whats new in ServerProtect for NetApp Filers? 10
O
Online resources 28
I1
I2

Spnetapp 56 GSG

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Spnetapp 56 GSG

Uploaded by

Copyright:

Available Formats

TREND MICRO

Comprehensive server and storage virus protection

Security information ........................................................................ 28

Trend Micro ServerProtect for Network Appliance (NetApp) Filers

Trend Micro ServerProtect for

Whats new in ServerProtect for NetApp Filers

Installing ServerProtect for NetApp Filers

Removing ServerProtect for NetApp Filers

Upgrading ServerProtect for NetApp Filers

Configuring NetApp Filer options

Contacting technical support and troubleshooting

Upgrading the ServerProtect evaluation copy

Microsoft Windows Server 2003

Microsoft Windows 2000 Server/Advanced Server with SP3 or above

Network Protocols and Services

TCP/IP, Microsoft Network (NetBIOS Compatible Transport Protocol),

256MB RAM or above is recommended

70MB of free disk space

In the ServerProtect for Windows documentation, the Scan Server is called

Microsoft Windows Server 2003

Microsoft Windows 2000 Server/Advanced Server with SP3 or above

Network Protocols and Services

TCP/IP, Microsoft Network (NetBIOS Compatible Transport Protocol),

256MB RAM or above is recommended

70MB of free disk space

Trend Micro ServerProtect for Network Appliance (NetApp) Filers

Microsoft Windows Server 2003

Microsoft Windows 2000 Server/Advanced Server with SP3 or above

Network Protocols and Services

TCP/IP, Microsoft Network (NetBIOS Compatible Transport Protocol),

Monitor with 800 x 600 or higher resolution

The NetApp Filer must be AV-enabled with an RPC agent running to

For optimal scanning performance, Trend Micro recommends the connection

ServerProtect for NetApp Filers product architecture

If a file contains a virus, ServerProtect for NetApp Filers performs a designated

Trend Micro ServerProtect for Network Appliance (NetApp) Filers

Below is an explanation of the ServerProtect for NetApp Filers organizational flow:

ServerProtect for NetApp Filers organizational flow

Watches for NetApp Filer file-scanning requests

Returns scan results to the NetApp Filer

Answers any queries from the NetApp Filer

Trend Micro ServerProtect for Network Appliance (NetApp) Filers

ServerProtect for Windows architecture review

What are ServerProtect domains?

In addition to managing Scan Servers, the ServerProtect for NetApp Filers

In ServerProtect for NetApp Filers, Normal Servers are referred to as "Scan

Trend Micro ServerProtect for Network Appliance (NetApp) Filers

ServerProtect for NetApp

Normal Servers (the

Acts as a "Scan Server" and

Scans files on the Normal

Table 1. ServerProtect Version Comparison

Enabling Trend Micro update server

Whats new in ServerProtect for NetApp Filers?

User notification upon client infection

NetApp Filer status available through the Management

Conveniently update NetApp Filer logon information

Trend Micro Control Manager agent compatibility

Trend Micro ServerProtect for Network Appliance (NetApp) Filers

NetApp Filer notification of new updates

NetApp Filer RPC status notification

Installing ServerProtect for NetApp Filers

Verify that vscan is enabled. See Verifying vscan is enabled on page 12