Issue:

Is it possible to schedule monthly reporting in Messaging Security Gateway?

Resolution:

No, it's not possible. You can set a report that will be scheduled for selected days, so the longest interval is one week.

Issue:

We are in an isolated intranet environment and our clients/servers are not connected to internet. We are facing an issue that in times Client Security and Server Security clients change the update server details from default Policy Manager server URL to guts2.sp.f-secure.com. As the clients are not connected to internet, the updates check fails.

Resolution:

To disable fallback to the WithSecure update server, follow these steps to disallow the hosts from falling back to the WithSecure update server if Policy Manager is inaccessible:

1. Log in to the Policy Manager Console
2. Select a host or a policy domain from the domain tree
3. Go to the Settings tab 
4. Go to the Windows > Centralized Management settings page
5. Scroll down to the Automatic updates section and disable Allow falling back to WithSecure update server if Policy Manager Proxies are inaccessible
6. Distribute the policy (Ctrl + D)

Issue:

• How to setup the silent installation for Policy Manager Proxy 
• User is creating a policy-based upgrade and needs to export installer msi for rollout via group policies

Resolution:

Note: These instructions are not valid for version 16 and later. 

Clean installations:

For Windows

1. Open Policy Manager Console and create temporary user with full access permissions for the root domain
2. Download Policy Manager Proxy installer: fspmp-15.30.96312.exe as an example
3. Extract Policy Manager Proxy setup executable content. For 14.00 and older – via any archive manager, for 14.10 start the executable and grab all the content from temporary directory at root level of system drive
4. Transfer admin.pub from Policy Manager to the extracted content
5. Edit prodsett.ini in the same directory: uncomment and specify values for all properties in the section "F-Secure PM Proxy"
6. Use user credentials created at first step for UpstreamPmUserName and UpstreamPmUserPwd properties
7. Run "setup.exe /silent" at target host for 14.00 and older, starting from 14.10 executable is called like fspmp-15.30.96312.exe, so have to run "fspmp-15.30.96312.exe /silent"
8. Remove user created at first step

For Linux

1. Open Policy Manager Console and create temporary user with full access permissions for the root domain
2. Download installer: fspmp-15.30.96312-1.x86_64.rpm as an example
3. Put admin.pub from PM to the dir with installer
4. Create shell script with name like pmp.sh and following content:

yum -y update libstdc++

yum -y install libstdc++.i686

rpm -i fspmp-15.30.96312-1.x86_64.rpm

/opt/f-secure/fspms/bin/fspms-config << PMPCONFIG PM address PM port (usually 443) ./admin.pub PMP http port to be used (usually 80) PMP https port to be used (usually 443) PM admin username (created at first step) PM admin password (created at first step) PMPCONFIG

1. Run the script: “./pmp.sh”.
2. Remove user created at first step.

Same things with Debian/Ubuntu, but use apt and dpkg instead, so sh script will look like:

apt -y upgrade libstdc++6:

apt -y install libstdc++6:i386

dpkg -i fspmp_15.30.96312_amd64.deb

/opt/f-secure/fspms/bin/fspms-config << PMPCONFIG PM address PM port (usually 443) ./admin.pub PMP http port to be used (usually 80) PMP httpS port to be used (usually 443) PM admin username (created at first step) PM admin password (created at first step) PMPCONFIG

After the script run, if everything is ok, PMP host should appear in PMC.
 

Policy Manager Proxy upgrades:

For upgrades, as there is not need to configure PMP and generate certificates enough to just upgrade the build.

For Windows:

1. Extract PMP executable content via any archive manager
2. Run "setup.exe /silent"

For Linux:

1. rpm -U fspmp-15.30.96312-1.x86_64.rpm
2. dpkg -i fspmp_15.30.96312_amd64.deb

Issue:

How to configure Business Suite Client Security and Server Security hosts to use HTTPS instead of HTTP for downloading updates from the Policy Manager Server and from the update server? 

Resolution:

You can configure the Windows endpoint clients to use HTTPS instead of HTTP by following these steps:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Go to the Centralized management settings page
5. Scroll down to the Automatic updates section
6. Enable Use HTTPS to download updates
7. Distribute the policy (Ctrl + D)

Once the policy has been taken into use on the hosts, they will download the virus definition updates from the Policy Manager Server or update server (guts2.sp.f-secure.com) using HTTPS. Software Updater updates are not affected by this setting. 

Using HTTPS to download updates improves privacy and complies with certain certifications. However, this may increase network traffic if you use proxies, because HTTPS traffic cannot be cached in the proxies.

NOTE: For Mac and Linux endpoint clients, this is not doable.

Issue:

How can I perform FSAUA database reset in WithSecure Linux based products?

Resolution:

Steps to do FSAUA database reset are different for each of the following WithSecure Linux based products.

• Linux Security Full / Command-line Edition version 11.xx
• Linux Gateway version 5.xx
• Policy Manager for Linux version 12.xx/13.xx

You can refer to the following detailed instructions for each product.

Note: 

• All steps require root privileges
• Latest fsdbupdate9.run can be downloaded here

1. Linux Gateway

2. Policy Manager for Linux version 12.40 and older

3. Policy Manager for Linux version 13.00 and above

4. Linux Security Full Edition

5. Linux Security Command-line Edition

Issue:

I have a syslog server, how can I forward alerts from Policy Manager Server?

Resolution:

You can set Policy Manager to forward alerts to a third-party syslog server.

Currently, both TCP and UDP transport protocols are supported.

To configure syslog alert forwarding:

1. Select Tools > Server configuration from the menu.
2. Click Syslog.
3. Select Forward alerts to syslog and enter the server address.

• By default, alerts are forwarded to syslog using UDP port number 514. If you want to use a different port, enter the port number after the server address, for example, test.com:8080.

4. Select the message format.

• Both Syslog (RFC 3614) and Common Event Format messages are supported.

5. Click OK.

Issue:

How does the firewall automatic selection in Policy Manager work? How to set up the automatic selection profile?

Resolution:

To set the firewall automatic selection profile changes to work, create the auto select rule based on conditions such as gateway IP, DNS, etc.

As an example, when the Windows Firewall profile is changed to different networks (public, private, domain), there is network change happening too. This can be used as the condition for firewall automatic selection rule to trigger.

Issue:

How to centrally upgrade WithSecure Client Security or Server Security to a newer or latest version using the Policy Manager Console?

Resolution:

Both Client Security and Server Security can be centrally upgraded to a newer version from the Policy Manager Console. Follow these steps to upgrade:

1. Download the latest version of the Client Security or Server Security .JAR installation file:
   • Client Security .JAR file here.
   • Server Security .JAR file here.
2. Log in to the Policy Manager Console
3. Go to the Installation tab
4. Click Installation packages > Import to import the installation file
5. Select a policy domain or a client host from the the Domain tree
6. Click on "Upgrade" under the "Actions"
7. Select the installation package, then press OK
8. Follow the Setup Assistant
9. Distribute the policies (Ctrl-D)

Once the client receives the latest policy, it will automatically silently upgrade to the newer version. 

In case if the Setup Assistance is not offered after selecting the package, remove and re-import the package.

Issue:

• Policy Manager Server is rejecting Policy Manager Console connections from a remote host. 
• When trying to connect to Policy Manager Server running on Linux using a Windows machine, the following error is displayed: "Cannot connect to server 172.16.0.6:8080. Check that the host name and port number are correct. Port number 8080 is used by default".
• When checking netstat output on a Windows server running the Policy Manager Server, the administration module (default port 8080) is listening on Local address 127.0.0.1

Resolution:

By default WithSecure Policy Manager Server is set up to only accept connections from localhost. Follow the steps below to allow remote connections and then test the connectivity from the remote Policy Manager Console.

If Policy Manager Server is installed on a Windows OS:

1. Stop the Policy Manager Server service, use command prompt command:
   • Policy Manager 15: net stop fsms
   • Policy Manager 16: net stop wspms
2. Open the Windows registry editor (regedit)
   • Policy Manager 15: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Data Fellows\F-Secure\Management Server 5 
   • Policy Manager 16: HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server
3. Edit the value of [REG_DWORD] RestrictLocalhost to 0
4. Start the F-Secure Policy Manager Server service:
   • Policy Manager 15: net start fsms
   • Policy Manager 16: net start wspms

If Policy Manager Server is installed on a Linux OS: 

1. Stop the Policy Manager Server daemon (/etc/init.d/fspms stop)
2. Open the file /etc/opt/f-secure/fspms/fspms.conf
3. Check the line adminExtensionLocalhostRestricted value and make sure the value is set to false
4. Save the file and restart the Policy Manager Server daemon (/etc/init.d/fspms restart)

        Note: Alternatively, you could also run the following command to change the configuration to accept the remote Policy Manager Console connections.

         /opt/f-secure/fspms/bin/fspms-config

Once Policy Manager Server service has restarted, try to login from the remote Policy Manager Console.

Issue:

Steps to exclude a folder or file from real-time scanning and DeepGuard for Client Security and Server Security in Policy Manager Console

Resolution:

You can exclude a file or folder from Real-time scanning and DeepGuard by following the steps below:

1. Log into Policy Manager Console
2. Click on Settings
3. Select Standard view
4. Select Real-time scanning
5. Scroll down to Files and applications excluded from scanning
6. Select Do not scan the following files and applications
7. Click Add
8. Enter the full path for each files, folder or SHA-1 of the application. Example:

• Select File path if the file that you want to exclude always uses the same path.
• Select Folder path if you want to exclude all files in a specific folder.
• Select Application SHA-1 if the path for the file that you want to exclude may vary across different hosts.

NOTE:
If the file or folder is located in share drive, you need to add the exclusion in UNC format.
Example:
\\servername\share\folder\to\the\app.exe

If this location is also mapped to a drive letter (e.g. N:\), then another exclusion must also be added in the mapped format as the following:
N:\folder\to\the\app.exe

For more information on using wildcards in exclusions, refer here
       
        9. Click the icon to distribute the policy (Ctrl + D)