Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Computers
Communication Direction
Bi-directional: By default, communications are bi-directional. This means that the Client Plug-in
normally initiates the heartbeat but still listens on the Client Plug-in port for Server Plug-in
connections. The Server Plug-in is still free to contact the Client Plug-in in order to perform
operations as required. This allows the Server Plug-in to apply changes to the security
configuration to the Client Plug-in as they occur.
Server Plug-in Initiated: With this option selected, all Server Plug-in-Client Plug-in
communications are initiated by the Server Plug-in. This includes security configuration updates,
heartbeat operations, and requests for Event logs.
Client Plug-in Initiated: With this option selected, the Client Plug-in does not listen on port
4118. Instead it contacts the Server Plug-in on the heartbeat port (4120 by default) as dictated
by the heartbeat settings. Once the Client Plug-in has established a TCP connection with the
Server Plug-in all normal communication takes place: the Server Plug-in first asks the Client
Plug-in for its status and for any events. (This is the heartbeat operation). If there are
outstanding operations that need to be performed on the Computer (e.g., the Security Profile
needs to be updated), these operations are performed before the connection is closed. In this
mode, communications between the Server Plug-in and the Client Plug-in only occur on every
heartbeat. If a Client Plug-in's security configuration has changed, it will not be updated until the
next heartbeat.
Before configuring a Client Plug-in for Client Plug-in initiated Communication, ensure that the
Server Plug-in URL and heartbeat port can be reached by the Client Plug-in. If the Client Plug-in is
unable to resolve the Server Plug-in URL or is unable to reach the IP and port, Client Plug-in initiated
communications will fail for this Client Plug-in.
Note that Client Plug-ins look for the IDF Server Plug-in on the network by the Server Plug-in's
hostname. Therefore the Server Plug-in hostname must be in your local DNS for Client Plug-in
initiated or bi-directional communication to work.
To enable communications between the Server Plug-in and the Client Plug-ins, the Server Plug-in
automatically implements a (hidden) Firewall Rule (priority four, Bypass) which opens port 4118 on
the Client Plug-ins to incoming TCP/IP traffic. The default settings open the port to any IP address and
any MAC address. You can restrict incoming traffic on this port by creating a new priority 4, Force
Allow or Bypass Firewall Rule, which only allows incoming TCP/IP traffic from specific IP and/or MAC
addresses. This new Firewall Rule will replace the hidden Firewall Rule if the settings match the
following:
rule action: force allow or bypass
priority: 4 - highest
packet's direction: incoming
frame type: IP
protocol: TCP
packet's destination port: 4118 (or a list or range that includes 4118)
As long as these settings are in effect, the new rule will replace the hidden rule. You can then enter
Packet Source information for IP and/or MAC addresses to restrict traffic to the Computer.
Hostnames
Update the "Hostname" entry if an IP is used as a hostname and a change in IP is detected on
the Computer after client plug-in initiated communication or discovery: Turn this option on if, for
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 56 -