Issue:

What is considered "new infection" in the F-Secure Policy Manager Web Reporting view?

Resolution:

1. Log on to your Policy Manager Console
2. Select the Policy domain or Host you want to edit
3. Switch to the Alerts tab
4. Every item in the list, which is not marked as "read" will be considered as "new" in the Web Reporting

Note: As long as an item in the Policy Manager Console Alerts list is not marked as "read", it will appear in the Web Reporting in the list for "New top 10" and "New infection details".

Issue:

What happens when the F-Secure Messaging Security Gateway (MSG) license has expired or been deactivated? Will emails be blocked or bypass the MSG appliance?

Resolution:

In the event that the MSG license has expired or been deactivated, for license migration purposes. The appliance itself will keep functioning:

• Mails will not be blocked, mail will flow normally
• The appliance will not receive Anti-Virus or spam-definitions 
• Some modules will not be accessible, for example Smart Search and Encryption
• Current rules in place will still be applied

Issue:

The network access requirements for F-Secure Linux Security 64 (LS 64) installation and normal operation

Resolution:

Below are the requirements for network access when you install F-Secure Linux Security 6 as centrally managed mode:

1. HTTPS

• *.fsapi.com
• *.sp.f-secure.com
• Policy Manager Server address (applicable in case of Policy Manager managed installation)

2. HTTP:

• guts2.sp.f-secure.com
• *.orsp.f-secure.com
• orsp.f-secure.com
• Policy Manager Server address (applicable in case of Policy Manager managed installation)

Issue:

What are the main differences between WithSecure Linux Security 64 and WithSecure Linux Security 11.x?
 

Resolution:

Linux Security 64 is a native 64-bit application, however there are some differences compared to the previous released version Linux Security 11.x, most notably:

• no support for Protection Service for Business (PSB) installation mode
• no firewall
• no web user interface (for remote management with browser)
• no support for unattended (scripted) installations

The list of supported Linux distributions is also different with some legacy distributions only being supported by Linux Security 11.x. 
Also note, that while the installer for Linux Security 64 is created / exported in Policy Manager Console, neither Linux Security 11 nor Linux Security 64 can be deployed / pushed to hosts using Policy Manager Console.

Issue:

Where can I find the WithSecure Policy Manager Server's management public key (admin.pub) used by clients to verify the validity of distributed policies?

Resolution:

You can export the public key (admin.pub) from the Policy Manager Console. To do so, follow the steps below:

Method A – Export the key with the WithSecure Policy Manager Console

1. Log on to your WithSecure Policy Manager Console.
2. From the top menu panel, select Tools > Server Configuration….
3. Select the Keys tab.
4. Under "Export signing keys", select the button Export….

Method B – Downloading the key from the WithSecure Policy Manager Server

From any of the managed hosts:

1. Open a web browser.
2. In the address bar type in the address of the WithSecure Policy Manager Server that this host is connected to, for example:

   https://fspms-local.example:443

3. If the connection to your WithSecure Policy Manager Server is successful, a web page indicating that the Policy Manager Server is operating correctly is shown.
4. Find the paragraph about the "WithSecure Policy Manager Server's public key".
5. Download the key from the highlighted download button/hyperlink (here) in that paragraph.

Issue:

Where can I find the key code for the latest version of my Business Suite software?

• Client Security for Windows or Mac
• Server Security 
• Email and Server Security 
• Linux Security 64

Resolution:

You can find all the key codes of my Business Suite products in your license certificate.

If you do not have the latest version of the license certificate that includes the license keys for the latest version, request a new license certificate from your reseller or distributor.

Partner can find the latest Business Suite license keys from the Partner Portal:

1. Log in to the Partner Portal: https://partnerportal.withsecure.com/
2. Go to the Downloads tab
3. Go to the KeyCodes tab
4. Click on the download here button

This will download a .pdf document with all the license keys available for Business Suite products. 
 

Issue:

What is the recommendation for Windows/Windows SQL server scanning settings? Should the SQL databases and logs be excluded in the virus scanning settings?

Resolution:

As a general rule we always advise to follow Microsoft's official recommendations from their KB base about exclusions on Microsoft corporate software.

You can read more about this subject here: https://support.microsoft.com/en-my/help/822158/virus-scanning-recommendations-for-enterprise-computers-that-are-runni.

More information for SQL Servers: https://support.microsoft.com/en-us/help/309422/choosing-antivirus-software-for-computers-that-run-sql-server

Check our community article for details on how to exclude files and folders from Real Time Scanning. 

How to exclude a file or folder from Real-Time Scanning or DeepGuard for Elements Endpoint Protection? – WithSecure Community

Issue:

What are the default ports used by Policy Manager Server and Policy Manager Proxy?

This article lists the network ports that WithSecure Policy Manager Server and WithSecure  Policy Manager Proxy uses. If you use any port filtering devices or software, verify that the required ports are available. Port filtering devices and software include firewalls, routers, proxy servers or IPsec.
 

Resolution:

Default TCP-Ports: WithSecure Policy Manager: 

• 8080 Default https-port used for Admin module used for communication with Policy Manager Console.
• 8081 Default https-port for WithSecure Policy Manager Web Reporting, the graphical reporting system included in Policy Manager Server.
• 443 Default https-port used for the host module used for communication with the hosts, excluding client database-updates.
• 80 Default http-port used for the host module used for communication with the hosts (legacy F-Secure clients). All WithSecure  clients by default download database updates using this port.

Default TCP-Ports: WithSecure Policy Manager Proxy:

• 443 Default https-port used for the host module used for communication with the hosts, excluding client database-updates.
• 80 Default http-port used for the host module used for communication with the hosts (legacy F-Secure clients). All WithSecure clients by default download database updates using this port.

Note: WithSecure Web Reporting might not be enabled in your configuration. The Policy Manager Server admin module is not by default exposed to other network interfaces than localhost. Software Updater (SWUP) updates are downloaded on port 80.
 

Issue:

The file conf\channels.json contains a list of the channels to be updated for a closed environment. For additional information related to channels.json, see this page:Updating malware definitions on isolated Client Security hosts | Policy Manager | 16.00 | WithSecure User Guides

Which updates are needed for different WithSecure clients?

Resolution:

You can define the needed updates in the channels.json file, it is located here:
<fspm-definitions-update-tool root directory>\conf\channels.json

You can open it using Notepad, and content looks like this:

Updates for version 15 and 16:
[
"capricorn-win32",
"deepguard-db",
"hydra-win32",
"lynx-win32",
"nifcore-win32",
"nifweb-win32",
"sccore-win32",
"sensor-win32",
"ulcore-win32",
"ulupdater-win32",
"uss-win32",
"virgo-win32",
"capricorn-win64",
"hydra-win64",
"lynx-win64",
"nifcore-win64",
"nifweb-win64",
"sccore-win64",
"sensor-win64",
"ulcore-win64",
"ulupdater-win64",
"uss-win64",
"virgo-win64",
"swup-win",
"swup-win-db", 
"pinned-certificates-win"
]

Updates for version 12:
[
"avmisc",
 "gemdb", 
"hipscfg", 
"hydrawin", 
"hydralinux",
 "mlcwin", 
"capricorn-win32", 
"orsp-win-v2", 
"css_720_bin", 
"aqualnx32", 
"commtouchunix", 
"fmlibunix", 
"fsav_1100_bin", 
"hipsn", 
"nifbin", 
"fsoftupd", 
"sidegrade", 
"ASPAM"
]

Updates for version 13 and newer:

64bit:
[
"ulupdater-win64",
"hydra-win64",
"virgo-win64",
"uss-win64",
"nif-win64",
"ulcore-win64",
"ols-win64",
"capricorn-win64",
"lynx-win64",
"swup-win-db"
]

32bit:
[
"ulupdater-win32",
"hydra-win32",
"virgo-win32",
"uss-win32",
"nif-win32",
"ulcore-win32",
"ols-win32",
"capricorn-win32",
"lynx-win32",
"swup-win-db"
]

Sidegrade:
"sidegrade"

Deepguard:
"deepguard-db"

If you have pure closed Windows enviroment, without Anti-Virus for Exchange, Anti-Virus for Sharepoint, and no Software Updater. Then it is enough to have these on the list:

Updates for version 12:
"avmisc",
 "gemdb", 
"hipscfg", 
"hydrawin",
"mlcwin", 
"capricorn-win32", 
"orsp-win-v2",
"fsav_1100_bin", 
"hipsn", 
"nifbin", 
"sidegrade",

Updates for version 13 and newer:
"ulupdater-win64" or/and "ulupdater-win32"
"hydra-win64" or/and "hydra-win32"
"virgo-win64" or/and "virgo-win32"
"uss-win64" or/and "uss-win32"
"nif-win64" or/and "nif-win32"
"ulcore-win64" or/and "ulcore-win32"
"ols-win64" or/and "ols-win32"
"capricorn-win64" or/and "capricorn-win32"
"lynx-win64" or/and "lynx-win32"

These are for Linux Security 11 and MAC OS:
"hydralinux",
"aqualnx32", 
"commtouchunix", 
"fmlibunix",

These are for Linux Security 64:
"fsbspamd-100-linux-x86_64",
"aqualnx64",
"capricorn-linux64",
"fmlibunix64",
"hydra-linux64",
"baseguard-100-linux-x86_64",
"fsbg-100-linux-x86_64",
"linuxsecurity-1200-linux-x86_64", 
"pinned-certificates-unix"

 
This one is for Anti-Virus for Exchange and Anti-Virus for Sharepoint:
"css_720_bin",
 
Anti-Virus for Exchange spam database:
"ASPAM"
 
Software Updater Database:
"fsoftupd",
"swup-win",
"swup-win-db"

Issue:

Why are some Policy Manager Proxy (PMP) hosts not connecting or showing up in the Policy Manager Console (PMC)?

Resolution:

The cause for this can be that the Policy Manager Proxy cannot report to the Policy Manager due to the fact that its certificate is missing. To resolve the issue follow these steps:

1. Run the certificate enrollment tool located at: c:\Program Files (x86)\F-Secure\Management Server 5\bin\fspmp-enroll-tls-certificate.bat 
2. Restart the Policy Manager proxy
   • Other than this, in case you have Policy Manager Proxy Server 15.20 in use, we recommend to upgrade to version 15.21 or later.
3. Double-check that admin.pub used for Policy Manager Proxy deployment matches the one used at the Policy Manager. 

Easiest way is to redownload the admin.pub from the Policy Manager welcome page via HTTP browser https://<PMaddress>/fsms/fsmsh.dll?FSMSCommand=GetPublicKey