Norman NetworkProtection Service manual

Antivirus

Norman SandBox

Reports & statistics

Appliance Administrator Guide

version 4.2

Limited Warranty

Norman guarantees that the enclosed CD-ROM or DVD-R and documentation do not have produc-

tion aws. If you report a aw within 30 days of purchase, Norman will replace the defective CD-ROM,

DVD-R, and/or documentation at no charge. Proof of purchase must be enclosed with any claim.

This warranty is limited to replacement of the product. Norman is not liable for any other form of loss

or damage arising from use of the software or documentation or from errors or deciencies therein,

including but not limited to loss of earnings.

With regard to defects or aws in the CD-ROM, DVD-R or documentation, or this licensing agreement,

this warranty supersedes any other warranties, expressed or implied, including but not limited to the

implied warranties of merchantability and tness for a particular purpose.

In particular, and without the limitations imposed by the licensing agreement with regard to any spe-

cial use or purpose, Norman will in no event be liable for loss of prots or other commercial damage

including but not limited to incidental or consequential damages.

This warranty expires 30 days after purchase.

The information in this document as well as the functionality of the software is subject to change with-

out notice. The software may be used in accordance with the terms of the license agreement. The

purchaser may make one copy of the software for backup purposes. No part of this documentation

may be reproduced or transmitted in any form or by any means, electronic or mechanical, including

photocopying, recording or information storage and retrieval systems, for any purpose other than the

purchaser’s personal use, without the explicit written permission of Norman.

The Norman logo is a registered trademark of Norman ASA.

Names of products mentioned in this documentation are either trademarks or registered trademarks of

their respective owners. They are mentioned for identication purposes only.

Last revision May 20, 2011.

Norman Network Protection

Administrator Guide

Incident statistics ...................................................... 37

Functions .............................................................. 37

Congure .................................................................. 38

Scanner settings .................................................... 38

Network conguration ............................................. 42

Join Endpoint Manager Realm ................................. 45

Block and Exclude settings ..................................... 46

Message handling .................................................. 48

Logging options ..................................................... 52

Blocking ................................................................ 52

Remote access ...................................................... 53

System time........................................................... 53

Change administrator password ............................... 54

Change license key ................................................ 54

Setup Wizard ......................................................... 54

Install and Update .................................................... 55

Settings ................................................................. 55

Critical updates ...................................................... 56

Support Center ......................................................... 58

Starting and stopping .............................................. 59

Troubleshooting .................................................. 60

Appendix A:

Accessing the Command Line Interface

console ................................................................. 63

Appendix B:

Using the Network Protection console .............. 64

Understanding the screen output ............................. 64

Console commands .................................................. 66

Command line conguration ..................................... 69

Conguration commands ........................................ 69

Cluster commands and parameters .......................... 71

Using port mirror mode ........................................... 73

URL blocking ......................................................... 74

Protocol/scan-related commands ............................. 74

Appendix C:

Using Network Protection in port mirror mode 77

Conguring ............................................................... 77

Nonoperative functions ............................................. 78

System requirements ................................................. 4

Obtaining Norman Network Protection ....................... 4

About this guide .......................................................... 4

Help and support ........................................................ 4

Introduction ............................................................ 5

Network virus protection ............................................. 5

The Norman approach .............................................. 5

Norman Network Protection versus proxy ................... 6

What is Norman Network Protection? ......................... 6

Implementation .......................................................... 7

Home or small ofce network ..................................... 7

Business network ..................................................... 7

Functionality ............................................................... 8

Installation ............................................................ 10

Prerequisites ............................................................ 10

Conguration ............................................................ 10

Completing the web-based Setup Wizard ................. 15

Setup wizard ............................................................. 17

Administration and conguration ...................... 25

Home ........................................................................ 25

Navigating the user interface ................................... 26

Status ....................................................................... 26

Version and uptime ................................................. 27

Malware scans ....................................................... 27

Network Interface Cards ......................................... 27

Protocol ................................................................ 27

Restart Network Protection ...................................... 28

System monitor ........................................................ 28

System information ................................................. 28

Network information................................................ 29

Incident logs ............................................................. 29

Detailed view ......................................................... 30

Download log le .................................................... 31

Show Sandbox log ................................................. 32

Blocked URLs ........................................................... 33

Blocked URLs default expiration time ....................... 33

Detailed view ......................................................... 33

Custom URL block .................................................... 34

Trafc Statistics ........................................................ 35

Functions .............................................................. 35

Table of Contents

Norman Network Protection

Administrator Guide

Norman Network Protection

Administrator Guide | System requirements

System requirements

The Norman Network Protection appliance contains all the needed software.

Obtaining Norman Network Protection

Please contact your nearest Norman office for your Norman Network Protection appliance. Norman

Network Protection offers a flexible and cost effective solution.

About this guide

This manual is intended for system administrators and others responsible for network security to

install, operate and maintain Norman Network Protection. This manual assumes that the reader is well

versed in network terminology and operation.

Help and support

We strongly recommend that you read this guide thoroughly before installing Norman Network

Protection, and that you use it as reference during installation. In this guide you will find instructions

on how to install and upgrade your licensed software as well as how to use it.

For training or further support issues please do not hesitate to contact your local dealer or a Norman

Office. Please see the last page of this document for information on Norman Offices.

We also encourage you to visit our web site for detailed support issues, to search in articles, or study

support issues.

Support

http://www.norman.com/support/

Other NNP links

http://www.norman.com/support/search_support_database/?searchString%3Autf8%3Austring=&os%3A

int=0&product%3Aint=58443

http://www.norman.com/support/search_support_database/?searchString%3Autf8%3Austring=&os%3A

int=0&product%3Aint=58432

Norman Network Protection

Administrator Guide Introduction | Network virus protection

Introduction

Network virus protection

In large and complex networks a significant effort is often needed to protect network resources against

viruses and other malicious code. A wide range of different antivirus products is often needed in order

to ensure full protection on all servers and all clients in the network.

A full range of protection is costly to purchase, configure, and maintain. Even with an extensive range

of antivirus products in place, there is still no guarantee that every potential security risk is covered.

Virus infections and outbreaks can still occur. If one or more network clients are not updated correctly

or if one computer unknown to the administrator is unprotected, the entire network is exposed to a

virus outbreak.

The most common point of origin of viruses and other forms of malicious code is the Internet. There-

fore scanning for malicious code at the entry to a LAN would protect that network. There are different

ways to protect the LAN:

Proxy server Any data stream entering the LAN is intercepted and scanned before it is

passed on to the destination machine.

Firewall Access to certain network addresses and/or services is restricted according

to tables of rules configured in the firewall.

The main disadvantage with using a proxy server to scan incoming streams is that the entire stream

must be gathered before it is scanned. Only when the entire data stream has been scanned and

established free of malicious code it is passed on to the recipient.

A firewall provides some protection against malicious code but does not operate on data content. It is

concerned more with point of origin and direct access to services within the network. This can cause

latency in the network.

The Norman approach

Centralizing protection for all units in a network reduces the effort needed by the administrator and

provides protection for all the potential security risks in the network, whether resident or introduced by

an external source.

Norman Network Protection aims to deliver such a concept, protecting both servers and clients in the

network. By placing Network Protection between the Internet and the local network, each computer

on the network side is protected, and viruses being downloaded are stopped before they reach their

destination.

The Network Protection technology is simplicity at its best. Simply connecting the Network Protection

machine to the LAN and starting the executable can protect an entire LAN segment behind the

Network Protection.

Network Protection is independent of the network topology and the other units in the network. It is

effectively transparent to all other entities in the network, which allows them to operate uninterrupted

by Network Protection. This is a strong advantage over conventional proxy solutions where network

entities require configuration to enable the proxy.

Norman Network Protection

Administrator Guide Introduction | Implementation

Norman Network Protection versus proxy

Traditional proxy solutions have several drawbacks. Most important is the latency effect because the

proxy holds back the entire stream until it has received all the data and analyzed it in its entirety.

Network Protection avoids this problem since it does not hold back more data than necessary. It takes

packets from the stream and reassembles them locally as a file. When the amount of data collected is

what the scanner engine has required, the packets are duplicated in Network Protection and the origi-

nals are passed on.

However, when the engine is busy scanning, the packets are held back until the engine returns with

status OK. In this case a slight delay in the transmission of the last packet may be experienced, but

generally there is practically no interruption to the packet flow. Packets belonging to an unsupported

session type are not scanned. As the stream is passing through the system it is scanned, and as soon

as something malicious is found, the stream is stopped.

Proxy servers require quite a bit of configuration on both servers and clients. Moreover, the proxy

solution needs maintenance when running in the network.

Network Protection is transparent to the network operation and requires no network adaptation and

very little assistance to keep it in order once it is up and running. Since Network Protection works on

packet level, the system has full control over the network flow.

What is Norman Network Protection?

Norman Network Protection is a new technology from Norman providing protection for an entire local

area network or critical segment of a network. Norman Network Protection can be installed onto an

Intel based server with three network interfaces. One network interface is reserved for alerting and

remote configuration and the remaining interfaces collect network packets for scanning from the net-

work segments they are connected to.

In a pair of connected interfaces, one interface provides an upstream or naked network connection,

while the second interface provides the downstream or protected network connection. The network

connections can be of any physical type that supports the TCP/IP protocol.

Figure 1: The Network Protection installed

In Figure 1 Network Protection runs NIC1 and NIC2 in promiscuous mode. This means that all net-

work packets from the other network will be received by the network cards regardless of their destina-

tion address.

Packets of the selected protocol type are then gathered into a group and passed on to the scanning

engine to be scanned for malicious code. If the group of packets are clean, they are passed on to the

protected zone via NIC2. If the packets contain malicious code, they are effectively blocked from the

protected zone and an alert is sent to the network via NIC0. Norman Network Protection is also avail-

able as an appliance.

NIC1 NIC2

NIC0

Norman Network Protection

Administrator Guide Introduction | Implementation

Implementation

Network Protection machines can be placed anywhere within a network. Network Protection can be

used in a number of ways to protect all or parts of a network. The following paragraphs will describe

some common scenarios where it can be used to minimize the infection risk from viruses and other

malware.

Home or small office network

The most common method of connecting a network to the Internet is through a gateway server. All

requests to the Internet from the network clients are then seen to originate from this gateway server.

Traffic from the Internet to the client is also seen to originate from this server. By placing the Network

Protection server between the gateway and the LAN, as shown in Figure 2, it protects the entire LAN

from malicious code entering from the Internet.

Figure 2: Protecting a small office or home network

Business network

A business will usually connect to the Internet in the same way as a small office network. The dif-

ference is that the business network will have a number of resources it can make available to the

Internet. These resources are most likely an email server, a web server, and an FTP server. These

servers are normally placed in a demilitarized zone (DMZ) through a separate connection to the fire-

wall.

The firewall divides the network into an untrusted zone, a trusted zone, and a demilitarized zone

(DMZ). Network Protection thus protects the LAN from both the Internet and machines in the DMZ.

The DMZ is also protected from the Internet, providing a belt-and-braces security to the entire net-

work.

Norman Network Protection

Administrator Guide Introduction | Functionality

Figure 3: Network Protection - protecting a business enterprise.

Functionality

Norman Network Protection works at the Data Link Layer within the OSI data transmission model.

This allows it to operate on a number of protocols and offers more features than proxy solutions.

Network Protection has configurable protocol scanning that can be enabled and disabled in real-time.

Furthermore, it can be configured to block protocols, computers and network segments depending on

the infections and the threats in the network. In addition, Network Protection uses Norman Sandbox

technology which can stop new and undiscovered viruses and worms before detection signature files

have been released.

Currently, Network Protection scans protocols with a high probability of carrying malicious traffic.

Traffic on unsupported protocols pass through unhindered. Currently supported protocols are:

● HTTP Normal web content traffic including web mail

● SMTP Outgoing email traffic

● POP3 Incoming email traffic

● RPC Remote procedure call traffic

● FTP File transfer protocol

● TFTP Trivial file transfer protocol

● Windows File Sharing Covers the protocols CIFS, SMB, and SMB2

● IRC Internet Relay Chat, a chat system protocol

● MSN Microsoft Windows Live Messenger - a real-time chat application and protocol

● BitTorrent Peer-to-peer file sharing protocol used for distributing large amounts of data

Protocol scanning does not rely on port identification. All packet headers are inspected to identify the

protocol independent of the port. If, for example, the HTTP protocol is being identified on port 4599 it

will still be scanned.

Network Protection scanning performance is dependent on the number of protocols being monitored,

the number of network segments covered and the number of network clients.

As each packet is received, it is passed on to the appropriate protocol-scanning module. Each scan-

Norman Network Protection

Administrator Guide Introduction | Functionality

ning module calls the scanning engine, which in turn requests portions of data from the packet or sub-

sequent packets in the sequence.

Alternatively, if Norman Sandbox is enabled, the received packets are assembled in an emulated

environment where the code’s behavior can be analyzed. If the packet is found to contain malicious

code, it is quarantined and blocked from travelling any further in the network. Network Protection will

broadcast an alert from the alert/remote configuration connection. Network Protection offers a variety

of features to encompass operation and maintenance.

● Norman Sandbox technology

○ Enables Network Protection to detect new viruses before a detection signature has been

released by analyzing what the code does in a virtual environment before it runs on a real

machine.

● NIU signature update

○ Norman Internet Update (NIU) can be set to automatically update the virus scanning engine

and signature files at hourly intervals.

● Decompression

○ Network Protection can decompress packets representing files compressed in a number of dif-

ferent formats before scanning the content.

○ The following compressed file formats are supported:

ACE (decompression only)

ACE self extractors (decompression only)

Apple single (decompression only)

ARJ (compression/decompression)

BZip2 (compression/decompression)

CAB (decompression only)

CAB self extractors (decompression only)

CHM/ITSF (decompression only)

GZ (compression/decompression)

InnoSetup installer (decompression only)

LZH (decompression only)

Mail/MIME with base 64, QP or UUE encoding (compression/

decompression)

MSI (decompression only)

Nullsoft Installer (decompression only)

RAR version 2 (decompression only)

RAR version 3 (store/decompression)

RAR version 3 (self extractors (decompression only)

TAR (compression/decompression)

Wise SFX (decompression only)

ZIP (compression/decompression/append new objects)

ZIP self extractors (decompression only)

7Zip (decompression only)

● Real-time configuration

○ Network Protection can be configured while it is running without having to restart the applica-

tion.

● Comprehensive alert system

○ Alerts can be delivered as SNMP traps or SMTP (email message) to interested parties.

● Suitable for a wide variety of network sizes and topologies

Norman Network Protection

Administrator Guide Installation | Prerequisites

Installation

The Norman Network Protection appliance is pre-installed with Norman Network Protection software.

The action required from you is to provide your network IP address details and to change the default

passwords.

Prerequisites

To take full advantage of the Network Protection functions, a good understanding of running programs

on the Linux platform and network management is recommended.

You will need to have the following available:

○ An IP address for the management network interface.

○ Access to Internet from the above-mentioned IP address.

For easier deployment you can plan your IP address, hostname, etc. before you start the installation:

Network Planning Worksheet

Host name

Network Protection Primary IP address

Default Gateway

DNS Suffix

DNS Server 1

DNS Server 2

Network speed and duplex setting (inside NIC)

Network speed and duplex setting (outside NIC)

Configuration

IMPORTANT

Do not connect the in and out interfaces to your network before you have completed the configuration.

1. Connect a monitor and a USB keyboard to the Network Protection appliance.

2. Power up the Network Protection appliance.

3. When the device has finished booting up, follow the instructions as described below. When

prompted, use the details from your ‘Network Planning Worksheet’.

If you have been provided a newer NNP version as ISO image or on USB please follow the

instructions provided.

Table of contents

Other Norman Firewall manuals

Norman

Norman Network Protection User manual

Popular Firewall manuals by other brands

Cisco

Cisco S190 quick start guide

Fortinet

Fortinet FortiGate Voice Series install guide

ADTRAN

ADTRAN NetVanta 2300 Specifications

SecureLogix

SecureLogix ETM System installation guide

NETGEAR

NETGEAR ProSafe FVX538 Reference manual

Lanner

Lanner FW-8877 user manual

Huawei

Huawei USG6000 Series Upgrade guide

H3C

H3C SecPath F5000-AI-15 installation guide

Nexcom

Nexcom DNA 1150 user manual

Fortinet

Fortinet FortiGate-60 series install guide

Cisco

Cisco 3110 Hardware installation guide

Draytek

Draytek Vigor2860 Series user guide

Lanner electronics

Lanner electronics FW-7650 Series user manual

Swisscom

Swisscom Internet Backup manual

SonicWALL

SonicWALL NSa 5700 quick start guide

DPtech

DPtech FW1000 SERIES Maintenance manual

FEITIAN

FEITIAN MultiPass FIDO product manual

EBLOCKER

EBLOCKER PRO user manual