How to deploy virus definitions to an isolated network

Products

Mail Security for Microsoft Exchange Protection Engine for Cloud Services Protection Engine for NAS

Issue/Introduction

Mail security for Microsoft Exchange or Protection Engine have been deployed to an isolated network without internet access, and we need a method to update virus definitions on an ongoing basis.

Resolution

This document describes a process to make available definitions inside the isolated (dark) network where there is no public internet access. This document is applicable to products like Protection Engine for NAS, Protection Engine for Cloud Services and Mail Security for Microsoft Exchange. The examples below will be provided for Protection Engine, but the same instructions can be used for SMSMSE if the product is substituted.

LUA server is deployed in the public facing network and one web server (IIS or Tomcat) is deployed in the dark network:
One LUA server deployed in the public facing network and second one inside the dark network. The second LUA provides only the distribution center and does not download definitions automatically:

The first option is generally preferred if possible as it eliminates the need for manual copying of the definition packages to the internal network, but it does require a front end server that can access both the internal and the external networks, which may not be feasible in all environments due to security policies.

For all 3 options, LiveUpdate Administrator (LUA) must be configured to download and distribute definitions for your products

Install Live Update Administrator (LUA)
Perform the Product Catalog update under Configure -> My Symantec Products -> Update Symantec Product Catalog
Add the product and version to be added. For this example we will be using Symantec Protection Engine 8.2, but you can add as many products as needed for your environment.
Once the product has been added, you'll see a list similar to the following:

Create the Download schedule. Give a meaningful Name and description.

Select the product(s) you want to download the definitions for.
Select Test Status as Skip Test
Select a schedule for definition download.
Now create a Distribution Schedule. Give a meaningful name and description
Add the products to be published and select the distribution list
Under Select Schedule – select After Download Schedule and add the download schedule created in step 5.
Verify that all three green checkmarks display In my products.

Under the Download & Distribute menu, select the download schedule created in step 5, and select Run Now to manually download and distribute the definitions for the first time. In the future this will happen on the selected schedule without the need to manually run it.

Monitor the download and publishing in the Activity Monitor to ensure the download and distribution complete successfully.

Option 1: LiveUpdate Administrator (LUA) Server connected to both public facing network and dark network

The virus definition files are published in the folder C:\Program Files(x86)\Symantec\LiveUpdate Administrator\clu-prod
In the Security properties, Add the group IIS_USRS with following permissions as shown
Next, install IIS server on the same LUA Server. For detailed directions see Microsoft Support
Launch IIS server and Add Website
Give the Site name and physical path: c:\Program Files(x86)\Symantec\LiveUpdate Administrator\clu-prod
Under Pass-Through Authentication, Click Connect As.... and select Application user or specific user based on your configuration and organization security
Check the pass through authentication
Select the internal LAN IP where you have connected the SPE pool of machines. Ensure that this website is accessible from this inside network only.
Set following, Allow Directory Browsing
Add following MIME Types so that you can download the files. Set “application/octet-stream” for following extension types
.7z,
.m35,
.flg,
.x86
Try accessing this website ( example. http://10.255.1.196/ ) for the LUA machine itself. You should see the browser listing.
Try clicking so that you can download the file. If files are not getting downloaded, please check the permissions, mime types etc.

Option 2: Setup local web server inside the Dark Network

Install Source LUA in public facing network and configure for scheduled download and publishing
Install Destination webserver (either Tomcat or IIS) inside the dark network
On Source LUA Server, copy from definitions from the folder <Drive Letter>:\Program Files\Symantec\LiveUpdate Administrator\clu-prod to a removable media. (Path may vary slightly by OS)
On Destination local web server, copy from the definitions on the removable media to
1. For IIS server <Drive Letter>:\Inetpub\wwwroot\clu-prod
2. For Tomcat/Apache htdocs\clu-prod folder

Option 3: Setup LUA inside the Dark Network

Install Source LUA in public facing network and configure for scheduled download and publishing
Install Destination LUA inside the Dark network. This LUA server will be used only to host definitions.
On Source LUA Server, copy from definitions from the folder <Drive Letter>:\Program Files\Symantec\LiveUpdate Administrator\clu-prod to a removable media. (Path may vary slightly by OS)
On Destination LUA Server, copy from the removable media to folder <Drive Letter>:\Program Files\Symantec\LiveUpdate Administrator\clu-prod
This should be accessible as https://<LUA_Server_IP>:7070/clu-prod

Configure your client application to download definitions from the source chosen above.

For Protection Engine, see How to use XMLModifier to configure Protection Engine to download definitions from internal LiveUpdate Administrator server
For Mail Security for Microsoft Exchange see About setting up your own LiveUpdate server