Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

example, your network has no DNS and you are using dynamic IPs. (IDF Server Plug-in always identifies
Computers/Client Plug-ins by their unique fingerprint, not their IP addresses.)
Remote Activation
The default process of installing and activating a Client Plug-in on a Computer is as follows: the Client
Plug-in is installed on a Computer and then a User uses the IDF Server Plug-in to "activate the client plugin".
This activation sends a unique encrypted fingerprint from the Server Plug-in to the Client Plug-in. The
Client Plug-in now knows not to accept any instructions not identified as coming from the Server Plug-in
by that fingerprint. There may be circumstances, however, where it is desirable for the activation to be
initiated by the Client Plug-in rather than by the Server Plug-in. (Large, distributed installations, for
example.) In this case the Server Plug-in must be configured to allow Client Plug-ins to communicate with
it and initiate activation. Use the Remote Activation panel to set whether Client Plug-in Initiated
activations are allowed.
Client Plug-in initiated activation is performed from the command-line. The following are the Client Plugin's
activation-related command-line options:
Usage: dsa_control [/a ] [/g ] [/c ] [/r] Notes
/a
Activate client plug-in with IDF Server at specified URL. URL
format must be "dsm://hostOrIp:port/"
/g Client Plug-in URL. Defaults to "https://127.0.0.1:4118/"
/c Certificate file
/r Reset client plug-in configuration
"port" is the Server
Plug-in's Heartbeat port.
(4120 by default.)
You can instruct IDF Server Plug-in to send a default Security Profile to self-activating Client Plugins
which do not already have a Security Profile assigned to them. Use the Security Profile to assign
(when no Security Profile is currently assigned) to select a Security Profile.
Heartbeat
Heartbeat Interval (in minutes): How much time passes between heartbeats.
Number of Heartbeats that can be missed before an alert is raised : Several missed
heartbeats in a row may indicate a problem with the Client Plug-in or the Computer. This setting
determines how many missed heartbeats are allowed to go by before the Server Plug-in triggers
an alert. (For example, entering three will cause the Server Plug-in to trigger an alert on the
fourth missed heartbeat.)
Maximum change (in minutes) of the local system time on the computer between
heartbeats before an alert is raised: For Client Plug-ins that are capable of detecting changes
to the system clock (Windows Client Plug-ins) these events are reported to the Server Plug-in as
Client Plug-in Event 5004. If the change exceeds the clock change listed here then an alert is
triggered. For Client Plug-ins that do not support this capability (non-Windows Client Plug-ins),
the Server Plug-in monitors the system time reported by the Client Plug-in at each heartbeat
operation and will trigger an alert if it detects a change greater than the permissible change
specified in this setting.
Once a Computer-Clock-Changed alert is triggered, it must be dismissed manually.
Automatically Update Computers
By default, any time you make a change to any element in the IDF system, all affected Computers are
immediately updated. For example, if you edit a port list, all Computers already making use of that port
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 57 -