VNS3 Trend Micro Agent The Trend Micro Agent for Linux VNS3 client servers lets users take advantage of both VNS3 Overlay Network and Trend Micro Deep Security central management platform to simplify and streamline security operations. Integrate your security functions across all of your Linux-based physical, virtual and cloud environments. NOTE: Client servers running Windows already support Trend Micro integration.

1. © 2016
VNS3 3.X
TrendMicro Agent
Add-on Documentation for VNS3 Integration with TrendMicro
2016

2. © 2016
Table of Contents
2
Overview 3
Downloads 4
Instructions 5
Script Usage 6
Firewall Rule 7
Test Scenario 8

3. © 2016
Overview
3
The Cohesive Trend Micro Agent runs as a Linux service. It polls a locally running Trend
Micro Deep Security Agent for firewall update events on its tun0 adapter address. If there
are firewall updates, it queries the Deep Management Security console for all its firewall
rules and updates its local IPTABLES firewall accordingly. It uses custom IPTABLES chains
so it does not interfere with other customer rules.

4. © 2016
Downloads
4
https://s3.amazonaws.com/cft.customer.downloads/vns3-trend-agent/cft_trend_agent.tgz
Cryptographic signatures:
SHA1: 4bbf9c19ee69a6674b17856731314c73b5045cb6
MD5: 8b2bdf3d20cdc187c292fa1978afcc6b

5. © 2016
Installation
5
Step 1 - Make sure Python dependencies installed
- Python 2.7
- suds module (package called ‘python-suds’ for most linux package managers)
Step 2 - Extract package and place files in following locations
- cft_trend_agent.py to /opt/cft/trend/
- cft_trend_agent(.sh) to /opt/cft/trend/bin/
- trend_initial_rules(.sh) to /etc/cft/
- all other files to /opt/cft/trend/scripts
- *Note: add_as_service(.sh) will be run as installer script, see next page
Step 3 - Create CFT_TREND_AGENT_URL Environment Variable
- supply URL to the Deep Security Manager host as the CFT_TREND_AGENT_URL environment variable
- export CFT_TRENT_AGENT_URL=https://Deep_Security_Manager_host_URL.com:4119/pathtomanager
Step 4 - Run add_as_service(.sh)
- run as root
- sudo add_as_service

6. © 2016
cft_trend_agent Usage
6
cft_trend_agent usage: cft_trend_agent {argument}
- start - backgrounds the process and logs to /usr/local/cft/trend/agentlogs
- stop - kills process
- status - checks if agent is running

7. © 2016
Automatic Firewall Chains and Rules
7
The Cohesive Trend Micro Agent creates three IPTables chains that are linked to the corresponding chains on on the local host where the
CFT Trend Micro Agent is running.
- INPUT_CFT_TREND_AGENT - input rules
- OUTPUT_CFT_TREND_AGENT - output rules
- FORWARD_CFT_TREND_AGENT - forwarding rules
The initial rules are set on client boot via the in /etc/cft/trend_initial_rules(.sh) file
- These can be edited for your topology.
- Defaults are as follows:
• iptables -A OUTPUT_CFT_TREND_AGENT -o tun+ -p tcp --dport 5274 -j ACCEPT
• iptables -A OUTPUT_CFT_TREND_AGENT -o tun+ -p tcp --dport 4122 -j ACCEPT
• iptables -A OUTPUT_CFT_TREND_AGENT -o tun+ -p tcp --dport 4120 -j ACCEPT
• iptables -A OUTPUT_CFT_TREND_AGENT -o tun+ -p tcp --dport 4119 -j ACCEPT
• iptables -A OUTPUT_CFT_TREND_AGENT -o tun+ -p udp --dport 514 -j ACCEPT
• iptables -A INPUT_CFT_TREND_AGENT -o tun+ -p tcp --sport 4118 -j ACCEPT
- The INPUT rule may need to be changed if your DSA manager is running on a port other than 4118
- These are the default rules loaded on reboot, please edit to suit your network topology. If communicating with a Deep Security Manager via
tun0 these are required.

8. © 2016
Trend Micro Test Scenario
8
On the Deep Security Manager, add a firewall rule for the tun0 address of the host
running the Cohesive Trend Micro Agent.
Check on the host running the Cohesive Trend Micro Agent that the rule has appeared
in Linux IPTABLES by running iptables -L -vn.

9. © 2016
VNS3 Document Links
9
VNS3 Product Resources - Documentation | Add-ons
VNS3 Configuration Document
Instructions and screenshots for configuring a VNS3 Controller in a single or multiple Controller topology.
Specific steps include, initializing a new Controller, generating clientpack keys, setting up peering, building
IPsec tunnels, and connecting client servers to the Overlay Network.
VNS3 Docker Instructions
Explains the value of the VNS3 3.5 Docker integration and covers uploading, allocating and exporting
application containers.
VNS3 Troubleshooting
Troubleshooting document that provides explanation issues that are more commonly experienced with VNS3.