Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Firewall and DPI
Network Engine Mode
The Client Plug-in‟s network engine can operate Inline or in Tap Mode. When operating Inline, the live
packet stream passes through the network engine. Stateful tables are maintained, Firewall Rules are
applied and traffic normalization is carried out so that DPI Rules can be applied to payload content. When
operating in Tap Mode, the live packet stream is cloned and diverted from the main stream. In Tap Mode,
the live packet stream is not modified; all operations are carried out on the cloned stream.
Firewall Events
You can set the maximum size of each individual log file and how many of the most recent files are kept.
Firewall Event log files will be written to until they reach the maximum allowed size, at which point a new
file will be created and written to until it reaches the maximum size and so on. Once the maximum
number of files is reached, the oldest will be deleted before a new file is created.
Maximum size of the event log files (on client plug-in): (see above)
Number of event log files to retain (on client plug-in): (see above)
Collect Firewall Events from Client Plug-in: Retrieve the latest Firewall Events from the
Client Plug-in at every Heartbeat.
Events are records of individual events. Counters are a record of the number of times individual
events have occurred. Events are used to populate the "Events" screens. Counters are used to
populate the Dashboard Widgets (number of Firewall Events over the last 7 days, etc.) and the
Reports. You might want to collect only counters if, for example, you are using syslog for event
collection; events can potentially take up a lot of disk space and you may not want to store the data
twice.
Do Not Record Events with Source IP of: This option is useful if you want IDF to not make
record Events for traffic from certain trusted Computers.
The following three settings let you fine tune Event aggregation. To save disk space, IDF Client
Plug-ins will take multiple occurrences of identical events and aggregate them into a single entry and
append a "repeat count", a "first occurrence" timestamp, and a "last occurrence" timestamp. To
aggregate event entries, IDF Client Plug-ins need to cache the entries in memory while they are being
aggregated before writing them to disk.
Cache Size: Determines how many types of events to track at any given time. Setting a value of
10 means that 10 types of events will be tracked (with a repeat count, first occurrence
timestamp, and last occurrence timestamp). When a new type of event occurs, the oldest of the
10 aggregated events will be flushed from the cache and written to disk.
Cache Lifetime: Determines how long to keep a record in the cache before flushing it to disk. If
this value is 10 minutes and nothing else causes the record to be flushed, any record that
reaches an age of 10 minutes gets flushed to disk.
Cache Staletime: Determines how long to keep a record whose repeat count has not been
recently incremented. If Cache Lifetime is 10 minutes and Cache Staletime is two minutes, an
event record which has gone two minutes without being incremented will be flushed and written
to disk.
The cache is always flushed whenever Events are sent to the IDF Server Plug-in.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 59 -