-
Cisco Content Security and Control SSM Administrator Guide, 6.1
-
Preface
-
Introducing the Content Security and Control SSM
-
Verifying Initial Setup
-
Configuring Mail Traffic (SMTP and POP3)
-
Configuring Web (HTTP) and File Transfer (FTP) Traffic
-
Managing Updates and Log Queries
-
Administering Trend Micro InterScan for Cisco CSC SSM
-
Monitoring Content Security
-
Troubleshooting Trend Micro InterScan for Cisco CSC SSM
-
Reimaging and Configuring the CSC SSM Using the Command Line
-
Using CSC SSM with Trend Micro Control Manager
-
Glossary
-
Index
-
Feedback
Table Of Contents
Understand SSM Management Port Traffic
Verifying Initial Setup
This chapter describes how to verify that Trend Micro InterScan for Cisco CSC SSM is operating correctly, and includes the following sections:
•
Understand SSM Management Port Traffic
Verify ASA Clock Setup
To begin setup verification, first confirm that the ASA clock has been set correctly. To do so, click Configuration > Properties. From the Properties menu, expand the Device Administration topic and click Clock. For more information, see the Cisco ASA 5500 Series Adaptive Security Appliance Getting Started Guide.
Verify CSC SSM Activation
Next, verify that the CSC SSM has been correctly activated. If you have physical access to the device, check the status LED on the back of the device. The status LED should be green. If the LED is amber, either solid or blinking, the card is not activated, or service is not started. See View the Status LED for more information.
If you do not have physical access to the device, check the Content Security tab in the ASDM (see Figure 1-9 on page 1-11). You should see the device model number, management IP, version, and so on displayed in the upper left corner of the Content Security tab. If you do not, contact Cisco TAC for assistance.
Verify Scanning
Trend Micro InterScan for Cisco CSC SSM starts scanning for viruses and other malware as soon as you configure ASA to divert traffic to the SSM, even before you log on to the CSC SSM console. Scanning runs whether or not you are logged on, and continues to run unless you manually turn it off.
To verify that Trend Micro InterScan for Cisco CSC SSM is scanning your SMTP network traffic:
•
•
Note
Figure 2-1 Verify Scanning on the Summary Window
The message activity counters increment as traffic passes through your network. Click the Refresh link to update the counters.
Note
Click the Mail (POP3) tab to perform a similar test for your POP3 traffic, or view the Email Scanned Count graph in ASDM, which includes counts for POP3 traffic.
Test the Antivirus Feature
The European Institute for Computer Antivirus Research (EICAR) has developed a harmless test virus that is detected as a real virus by antivirus technology such as Trend Micro InterScan for Cisco CSC SSM. The test virus is a text file with a .com extension that does not contain any fragments of viral code. Use the test virus to trigger a virus incident and confirm that email notifications and virus logs work properly.
To perform the test, open a browser window and go to the following URL:
http://www.eicar.com/anti_virus_test_file.htm
Scroll down until you see the information box shown in Figure 2-2.
Figure 2-2 EICAR Download Area
Click the eicar.com link. You should get an immediate notification in your browser that a security event has occurred. You should now be able to query the virus/malware log file by navigating in the CSC SSM console to Logs > Query to see the test virus detection recorded in the log. Also, a notification is sent to the administrator email address that you chose during installation (on the Host Configuration installation window).
If this does not happen:
1.
2.
3.
Verify Component Status
To find out whether you have the most current virus pattern file and scan engine, spyware pattern file, PhishTrap pattern, anti-spam rules, and anti-spam engine, in the CSC SSM console, click Update > Manual to display the Manual Update window, shown in Figure 2-3.
Figure 2-3 Manual Update Window
If a more current version is available, the update version number displays in red in the Available column. Choose components to be updated and click Update to download the most recent version of the selected component.
Tip
1. The Trend Micro ActiveUpdate server is down.
2. There's a network problem.
3. There are no new components available; everything really is current.
4. Trend Micro InterScan for Cisco CSC SSM is not configured correctly.To help avoid the uncertainty, click Update > Scheduled to display the Scheduled Update window, shown in Figure 2-4.
Figure 2-4 Scheduled Update Window
By default, Trend Micro InterScan for Cisco CSC SSM updates components periodically, with an automatic notification after a scheduled update has taken place. You can modify the scheduled update interval to occur more or less frequently.
View the Status LED
On the back of the appliance, locate the Status LED in the ASA SSM indicators shown in Figure 2-5.
Figure 2-5 ASA SSM Indicators
The Status LED is labeled 2. There are several states for the Status LED, which are described in the following table.
Note
Understand SSM Management Port Traffic
During installation (on the IP Configuration installation window), you chose an IP address, gateway IP, and mask IP for your management interface. Here is a list of traffic that uses the management port:
•
•
•
•
•
•
