proxy pac and IWSS

Question:
How can we configure users to point to IWSS via "Automatic Proxy Configuration"?

Answer:
1. Have a proxy.pac script ready. You can refer to this basic script.



note:192.168.1.86 is your IWSS IP address andport 8080 is the proxy port

2.Publish proxy.pac in your web server. Make sure your web server recognize the .pac extension by adding in the MIME type to the HTTP Header.





3. Specify your user's browser with the configuration




Remark:
Do feedback on the performance and capability of this configuration. Do you experience any drop in connections?

Approving youtube.com

Issue:
Customer installed IWSS 3.1 on Windows 2003 svr. They enabled the URL filtering and block access to Streaming Media / MP3 category. However, they want to approve www.youtube.com.

I have tried to add in youtube* and *youtube* in the approved URL list. But the youtube page doesn't appear correctly. Some of the page elements are missing. What's wrong.

Answer:
Please try to add the following in the HTTP> URL Filtering > Settings > Approve URL List

- Choose URL keyword and enter the following string

ytimg.com
youtube.com

Note: Actual strings shown after adding them is as follows:

*ytimg.com*
* youtube.com*

Please be informed that youtube has to retrieve files from different servers which are hosted under youtube.com and ytimg.com. The thumbnails/pictures are usually stored under ytimg.com while the actual flv files are located on servers under youtube.com. One example is the “v21.lscache2.c.youtube.com”. The retrieval of the files depends on the current location of the browser requesting the site and depends on which server hosts the requested files.

IWSS unable to do schedule update after license expire

Solution:
Recreate the scheduled task using createatasktool.exe downloaded from

http://solutionfile.trendmicro.com/solutionfile/25483/en/createatasktool.zip

IMSS 7.0 and IWSS 3.1 on the same server machine

Issue:
When running both IMSS 7.0 and IWSS 3.1 on the same server machine, I notice once the IWSS console service is up, the IMSS console service cannot start and same goes the other way. Is there any workaround for this?

Workaround:
Please note, it is not recommended to install both on the same machine.
It is because both tomcat is using same port 8005 to start the service. You need change the port on either IMSS or IWSS tomcat.

Please do EITHER of the two steps below:
A) On IMSS,
1) Go to \ui\adminUI\conf
2) Edit the file server.xml
3) Search for "8005"
4) Replace it with available port such as "8006"
5) Save
6) Start "Trend Micro IMSS Web Console" service

OR

B) On IWSS
1) Go to \ui\adminUI\conf
2) Edit the file server.xml
3) Search for "8005"
4) Replace it with available port such as "8006"
5) Save
6) Start "Trend Micro Interscan Web Security Suite Console" service

IWSS 3.1 backup and restore

You will need SQL Management Express if you don't want to go through the hassle of doing it from the command prompt.

Download and Install Microsoft SQL Server Management Studio Express
http://www.microsoft.com/downloadS/details.aspx?familyid=C243A5AE-4BD1-4E3D-94B8-5A0F62BF7796&displaylang=en#filelist

note: I installed IWSS 3.1 with the database SQL 2005 Express bundled in the installation. Database name is iwss3. Don't lose the sa password! :-)

To backup

1. Click the database name

2. Then click tasks> backup

3. Choose where you want to store the backup file and click OK


4. To restore, follow the earlier steps 1,2 in the above but this time click restore. Click OK to continue to restore.


To see the space of your database, do the following like in the screen capture:

Encountered an error while trying to download certain filev ia IWSVA/IWSS

Question/Concern/Inquiry:
Based on your email, you had encountered an error while trying to download certain filev ia IWSVA.

I had check the screenshot that you had sent and found out that the error occured was caused by popup blocker. Most if the new browser had a built in popup blocker if you were going to look on your Browser the popup to download the file had been blocked.

To resolve this issue you can do the following;

1. Log in to your IWSVA.
2. Click HTTP>HTTP SCAN>Policies
3. At the right pane click the Virus Scan Global Policy 4. Click the Virus Scan Rule tab.
5. Under Large File Hnadling Choose Deffered Scanning.
6. Click Save.

Removing spyware from "exclusion list" in your IWSS

If you add spyware into the exclusion list, it will no longer detected as spyware the next time around. Until you remove the entry from SPYWAREEXCEPTIONLIST.INI by default located in your IWSS installation folder.

Squid cache on IWSVA 3.1

The default size limit of the entire cache is 588 MB (this is defined in the cache_dir parameter). The objects in the cache will be considered STALE after the following time:

FTP – 10080 minutes or 7 days
HTTP – 4320 minutes or 3 days

This is defined by the refresh_pattern parameter. Refer to the squid.conf file for further details.

URL cache for IWSS/IWSVA3.1

IWSS/IWSVA 3.1 includes Web Reputation feature. This feature relies on DNS queries to Trend Micro data centers for each new URL request. Reputations are cached for a period of 35 minutes by default and new reputation requests for that URL are provided without the need for additional queries.

MSDE/ SQL 2005 database installation

Something to take note when you install IWSS, IMSS or TMCM which require database component and your option is to install MSDE/SQL 2005 database, make sure the option for authentication is set to 'SQL Server Authentication'. If you are installing on existing SQL server, choose Mixed Authentication Mode.

You may refer to this knowledge base from Microsoft website should you need to verify and change the system administrator password in MSDE or SQL Server 2005 Express Edition.

Verifying the build number - IMSS/IWSS/OSCE

You may need to know the build number if the support engineer asked you during the troubleshooting. How do you verify that your product is installed with the latest patch or service pack? Yes, you need to look at the build number.

For IMSS and IWSS
Logon to the console. You will be at the summary page. Look at the list of the components. Locate "build" under current version column. If you are not sure, the screen shots as below:


IWSS


IMSS


For OSCE
This one is a little different. From the console, right hand side of your screen at the top most you should be able to see Help in the drop drown menu. Click that to find About. Click on the About.



Now you already have the build number. If you need to verify against the build number of the latest patch, find it in the ReadMe file.