Installation and Configuration of TREND MICRO

Overview

The antivirus solution on offer is Trend Deep Security – https://help.deepsecurity.trendmicro.com/20_0/on-premise/welcome.html

Activating Trend Deep Security

By default, Trend Deep Security is not activated on your organization. You must activate it manually using your Cloud Customer Area.

Go to the Service Catalog and look for the “Trend Micro Protection Management” tile.

Click on Configure.

Activate your Trend Micro tenant by clicking on Validate

Go to your Trend Micro portal. Your portal address depends on your organization.

If you wish to access the portal from a VM in a cav05 organization, you must use this URL: https://antivirus5.cloudavenue-cha.itn.intraorange:4119

Click on Forgot password ?

Enter Account Name (your cavxxxxxxocbxxxxxxx organization identifier) and Username (your e-mail address), then click on Ok.

You’ll receive an e-mail within a few minutes with instructions on how to set your password.

Portals

• Portal :                        https://antivirus1.cloudavenue.orange-business.com:4119/SignIn.screen?tenantAccount=CUSTOMER_ORG_VCD&username=CUSTOMER_ACCOUNT
• Update Source :          https://avrelay1.cloudavenue.orange-business.com:4122
• Public IP :                  195.25.13.11

Network configuration

Service area

Raccordement réseau à la zone de services (NGP)

Trend

For connectivity to Trend, you need to configure your Edge Gateway.

From the Edge Gateways tab > IP address allocations Locate the pool of IP addresses available to you starting with 100.113 (for VDR) or 100.114 (for CHA). Write it down somewhere.

Create an initial IPSET containing the networks that will access Trend (or use the one already created for the Admin Zone).

Create a second IPSET containing Trend’s IP: 195.25.13.11/32

Create a NAT rule (SNAT)

The external IP must correspond to an IP address available on the IP address pool seen previously, in 100.113

The internal IP must correspond to an address or network created by you.

Enter the following “destination IP address”: 195.25.13.11/32

Set the priority to 0.

This rule must have a higher priority than the one enabling you to access the Internet, as the route taken is the same:

Check that you have an Application Port Profile for the ports used by Trend:

4119

4120

4122

Create a Firewall rule

Authorize your networks’ IPSET to access Trend’s IPSET using the Ports configured in the Port Profile

To validate if the network configuration is successful, try resolving (195.25.13.11)

antivirus1.cloudavenue.orange-business.com

avrelay1.cloudavenue.orange-business.com

If this fails, add the addresses to your hosts file:

195.25.13.11 antivirus1.cloudavenue.orange-business.com

195.25.13.11 avrelay1.cloudavenue.orange-business.com

Network configuration

On Base Policy, check that the Anti-Malware and Web Reputation modules are enabled. These are the only free services. Other Trend services/modules are not free of charge.

In System Settings –> Agents,

Cochez la case „ Aktualisieren Sie den Eintrag für den Hostnamen, wenn eine IP als Hostname verwendet wird und eine Änderung der IP auf dem Computer nach einer vom Agenten / der Appliance initiierten Kommunikation oder Erkennung festgestellt wird “.

Sélectionnez ” Wenn bereits ein Computer mit demselben Namen existiert: Aktivieren Sie einen neuen Computer mit demselben Namen “, dies ist obligatorisch, um Probleme mit VMs mit gleichem Namen oder gleicher SID zu vermeiden.

In System Settings –> Updates

Check that the primary source selected is “Other update source”:

https://avrelay1.cloudavenue.orange-business.com:4122

Créez Relay Group, cliquez sur New Relay Group

Deploy Trend Micro

Agent installation process for different OS – https://help.deepsecurity.trendmicro.com/20_0/on-premise/agent-install.html

Installation script

Create the installation script by clicking on Support in the top right-hand corner, then on Deployment Scripts :

Choose the platform that corresponds to your VM’s OS, your Security Policy, Computer Group and the Relay Group you’ve created.

Scroll down to see the deployment script, click on Save to File or Copy to Clipboard :

Copy and run the command as Admin on your first VM, which will be the Relay. After a few minutes, the VM will appear on your DSM console, under Computers.

Click on Administration -> Updates -> Relay Management. Select the new Relay Group created at the top, then click on Add Relay. Your VM should appear, select it and click on Enable Relay and Add to Group

The VM will appear under the Relay Group with a status of Enabling :

To speed up relay deployment, on the VM, from the installation location

Windows: default C:Program FilesTrend MicroDeep Security Agent

Linux: default /opt/ds_agent/

Run the following command:

dsa_control -m

The command forces the update and installation of the Relay role on the VM. The VM will now switch to Online status :

Deploying Trend Agents

From Deployment Scripts, create a new installation script for your VMs according to their OS/role and choose the Security Policy, Computer Group and Relay Group created.

If several VMs share the same OS (2K12, 2K16…) and have the same scan exclusions, you can deploy the same script on these VMs.

Create your own deployment scripts :

Run the script on your machines.

The script downloads, installs and activates the VM

Your machine will then appear in the Trend Micro console

Known problems

1) If the Windows VM is not up to date, the agent installation may fail. The solution is to update Windows.

For Windows Server 2016/2019, check that the following KBs are installed:

KB5005112: https://www.catalog.update.microsoft.com/Search.aspx?q=KB5005112

KB5005625: https://www.catalog.update.microsoft.com/Search.aspx?q=KB5005625

2) Agent installation error when Trend URLs are not resolved

Add the URLS to your hosts file (Windows, and /etc/hosts on Linux)

195.25.13.11 antivirus1.cloudavenue.orange-business.com

195.25.13.11 avrelay1.cloudavenue.orange-business.com

3) Trend agent installation/activation error – “Anti-malware driver is offline or not installed”. This is linked to the absence of VeriSign, DigiCert, USERTrust RSA certificates…

https://success.trendmicro.com/dcx/s/solution/1104241-Updating-the-VeriSign-DigiCert-USERTrust-RSA-certificate-on-Deep-Security-and-Cloud-One-Workload-Security?language=en_US

For other agent installation/activation problems, please consult the Trend Help Centre.

https://help.deepsecurity.trendmicro.com/20_0/on-premise/agent-issues.html

---