Trend MicroTM

Deep Discovery Inspector

6.7

Installation and Deployment Guide
Breakthrough Protection Against APT’s and Targeted Attacks

Trend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:https://docs.trendmicro.com
Trend Micro, the Trend Micro t-ball logo, Deep Discovery Advisor, Deep
Discovery Analyzer, and Deep Discovery Inspector are trademarks orregistered trademarks of Trend Micro Incorporated. All other product orcompany names may be trademarks or registered trademarks of theirowners.
Copyright © 2023. Trend Micro Incorporated. All rights reserved.
Document Part No.: APEM69874/231211
Release Date: December 2023
Protected by U.S. Patent No.: 8595840; 8925074; 7707635; 8505094

This documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Privacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback
regarding product usage and detection information to Trend Micro. Some ofthis data is considered personal in certain jurisdictions and under certain
regulations. If you do not want Trend Micro to collect personal data, youmust ensure that you disable the related features.
The following link outlines the types of data that Deep Discovery Inspector
collects and provides detailed instructions on how to disable the specificfeatures that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend
Micro Privacy Notice:https://www.trendmicro.com/privacy

Table of Contents
Part I: Introduction
Chapter 1: Introduction
About Deep Discovery Inspector .......................................... 1-2
What's New ........................................................................ 1-2
Features and Benefits .......................................................... 1-3
Threat Management Capabilities ................................... 1-4
APT Attack Sequence .................................................... 1-4
Host Severity ................................................................ 1-6
Advanced Threat Scan Engine ....................................... 1-8
Virtual Analyzer ........................................................... 1-9

Part II: Hardware Appliance Installation and
Deployment
Chapter 2: About Your System
Package Contents ............................................................... 2-2
The Deep Discovery Inspector Appliance ............................. 2-3
Front Panel .................................................................. 2-4
Front Panel - 530/1300 Appliance ............................. 2-4
Front Panel - 4300/9300 Appliance ............................ 2-5
Back Panel ................................................................... 2-5
Back Panel - 530/1300 Appliance .............................. 2-6
Back Panel - 4300/9300 Appliance ............................. 2-7
Network Cards .............................................................. 2-9
Port Order .............................................................. 2-9
Port Order - 530/1300 Appliance ......................... 2-9
Port Order - 4300/9300 Appliance ..................... 2-10iDeep Discovery Inspector Installation and Deployment Guide

NIC Indicators ...................................................... 2-13
NIC Indicators - 530/1300 ................................. 2-13
NIC Indicators - 4300/9300 ............................... 2-15
Data port Indicators - 4300/9300 1 Gbps ...... 2-16
Data NIC Indicators - 4300/9300 10/25 Gbps . 2-18
Power Supply Indicators .............................................. 2-19
Setting Up the Hardware ................................................... 2-20
Product Specifications ....................................................... 2-21
Product Specifications - 530/1300 Appliance .................. 2-22
Product Specifications - 4300/9300 Appliance ................ 2-22

Chapter 3: Hardware Appliance Deployment
Deployment Overview ......................................................... 3-2
Hardware Appliance Deployment Planning .......................... 3-2
Deployment Scenarios .................................................. 3-3Out-of-Band ................................................................. 3-4
Mirroring Trunk Links ............................................ 3-5
Multiple Port Monitoring ........................................ 3-6
Network Tap Monitoring ......................................... 3-6
Proxy Monitoring ................................................... 3-7
Redundant Networks .............................................. 3-9
Remote Port or VLAN Mirroring .............................. 3-9
Single Port Monitoring .......................................... 3-10
VLAN-based Port Monitoring ................................. 3-12
VMware Port Mirroring ......................................... 3-12
Inline ......................................................................... 3-12
Transparent Bridge ............................................... 3-12
Hardware Appliance Installation Requirements .................. 3-14
Hardware Appliance System Requirements .................. 3-15
Hardware Appliance Requirements ........................ 3-15
Preconfiguration Console Requirements ................ 3-16
Management Console Requirements ...................... 3-16
Virtual Analyzer Image Operating System Requirements............................................................................. 3-17ii

Table of Contents

Chapter 4: Installation on a Hardware Appliance
Configuring Options ........................................................... 4-2
Setting JavaScript Options for Chrome ........................... 4-2
Setting JavaScript Options for Firefox ............................. 4-2
Deep Discovery Inspector Hardware Appliance Installation .. 4-3
Installing Deep Discovery Inspector on Hardware
Appliances with an Optical Drive ................................... 4-3
Installing Deep Discovery Inspector on Hardware
Appliances Without an Optical Drive ............................ 4-10
Restoring to Factory Mode ................................................. 4-15

Chapter 5: Port Mirroring on a VMware Virtual Distributed
SwitchCreating a VMware vSphere Distributed Switch (VDS) ........... 5-2
Deep Discovery Inspector Hardware Appliance with a VDS ... 5-5
Hardware Appliance - Configuring Mirrored Traffic
Monitoring from a VDS with Encapsulated Remote
Mirroring ..................................................................... 5-5
Hardware Appliance - Configuring Mirrored Traffic
Monitoring from a VDS with Remote Mirroring .............. 5-9

Part III: Virtual Appliance Installation and
Deployment
Chapter 6: Virtual Appliance Deployment
Deployment Overview ......................................................... 6-2
Virtual Appliance Deployment Planning .............................. 6-2
Deployment Scenarios .................................................. 6-3
VMware Port Mirroring ................................................. 6-4

iii

Deep Discovery Inspector Installation and Deployment Guide

Virtual Appliance Installation Requirements ........................ 6-4
Virtual Appliance System Requirements ........................ 6-5
Virtual Host Appliance Requirements ...................... 6-5
Management Console Requirements ........................ 6-6

Chapter 7: Create a New Virtual Appliance
Create a VMware ESXi Virtual Appliance .............................. 7-2
Requirements for a Virtual Machine in VMware ESXi ...... 7-2
Configuring the VMware ESXi Server Network .......... 7-2
Creating a Virtual Machine in VMware ESXi ................... 7-7
Enabling Hardware-assisted Virtualization in VMware
ESXi ..................................................................... 7-13
Create a Microsoft Hyper-V Virtual Appliance ..................... 7-14
Creating a Virtual Machine in Microsoft Hyper-V .......... 7-14
Configure Traffic Mirroring in Microsoft Hyper-V ......... 7-36
Configuring External Traffic Mirroring in Microsoft
Hyper-V ............................................................... 7-37
Configuring Internal VM Traffic Mirroring in Microsoft
Hyper-V ............................................................... 7-39

Chapter 8: Installation on a Virtual Appliance
Configuring Options ........................................................... 8-2
Setting JavaScript Options for Chrome ........................... 8-2
Setting JavaScript Options for Firefox ............................. 8-2
Setting Options for Virtual Appliance in ESXi ................. 8-3
Deep Discovery Inspector Virtual Appliance Installation ....... 8-4

Chapter 9: Port Mirroring on a VMware Virtual Distributed
SwitchCreating a VMware vSphere Distributed Switch (VDS) ........... 9-2
Deep Discovery Inspector Virtual Appliance with a VDS ........ 9-5
Requirements for Virtual Appliances with a VDS ............ 9-5
iv

Table of Contents

Virtual Appliance - Monitoring Mirrored External Network
Traffic using a VDS ....................................................... 9-7
Virtual Appliance - Configuring Mirrored External
Network Traffic Monitoring with Encapsulated Remote
Mirroring ............................................................... 9-8
Virtual Appliance - Configuring Mirrored External
Network Traffic Monitoring with Remote Mirroring 9-10
Virtual Appliance - Monitoring Mirrored VM Traffic from a
VDS ............................................................................ 9-14
Virtual Appliance - Monitoring Mirrored Traffic fromDifferent ESXi Hosts .............................................. 9-14
Virtual Appliance - Configuring Mirrored VM Traffic
Monitoring with Encapsulated Remote Mirroring ....
9-15
Virtual Appliance - Configuring Mirrored VM Traffic
Monitoring with Remote Mirroring .................. 9-20
Virtual Appliance - Monitoring Mirrored Traffic fromthe Same ESXi Host ............................................... 9-26
Virtual Appliance - Configuring Distributed Port
Mirroring on a VDS ......................................... 9-27

Part IV: Post Installation
Chapter 10: Preconfiguration
Preconfiguration Console .................................................. 10-2
Preconfiguration Console Access ................................. 10-2
Accessing the Preconfiguration Console with a VGA Port............................................................................. 10-3
Accessing the Preconfiguration Console with a SerialPort ...................................................................... 10-3
Preconfiguration Console Main Menu ................................ 10-4
Viewing Appliance Information and Status ................... 10-5
Modifying Device Settings ........................................... 10-6
Modifying Interface Settings ........................................ 10-8v

Deep Discovery Inspector Installation and Deployment Guide

Chapter 11: System Tasks
System Tasks Overview ...................................................... 11-2
Performing a Diagnostic Test ....................................... 11-2
Performing a Ping Test ................................................ 11-3
Restarting Deep Discovery Inspector ............................ 11-4
Changing the Root Password ........................................ 11-4
Logging Off ................................................................. 11-5
Configuring Manual Traffic Bypass .............................. 11-5

Chapter 12: TroubleshootFrequently Asked Questions (FAQs) .................................... 12-2
FAQs - Appliance Rescue ............................................. 12-2
FAQs - Configuration ................................................... 12-3
FAQs - Detections ........................................................ 12-3
FAQs - Installation ....................................................... 12-3
FAQs - Upgrade ........................................................... 12-4
FAQs - Virtual Analyzer Image ..................................... 12-4
Troubleshooting ............................................................... 12-5
Slow Management Console Response ........................... 12-5
Detections .................................................................. 12-6
No Detections on All Detections Screen .................. 12-6
"Unregistered Service" Server Displays in All Detections
Query ................................................................... 12-7
Unknown IP Addresses Display on a Screen ............ 12-7
Known Safe Objects Flagged as Malicious ............... 12-7
"Database is Corrupt" Alert Displays ............................. 12-8
Virtual Analyzer .......................................................... 12-8
Cannot Upload OVA ............................................... 12-8
No Virtual Analyzer Response to File Submissions .. 12-8
Virtual Analyzer Images .............................................. 12-9
Installation CD/DVD Won't Start ............................. 12-9
"Found New Hardware" Wizard ............................ 12-10
An Image Displays a Blue Screen .......................... 12-10
Cannot Connect to Network Services .......................... 12-11
Diagnostics ............................................................... 12-11vi

Table of Contents

Inline Deployment and TLS Inspection ....................... 12-12
Network Connectivity Issue ................................. 12-13
TLS Connection Issue .......................................... 12-14

Part V: Technical Support
Chapter 13: Troubleshooting Resources
Using the Support Portal ................................................... 13-2
Threat Encyclopedia ......................................................... 13-2

Chapter 14: Contacting Trend Micro
Speeding Up the Support Call ............................................ 14-2

Chapter 15: Sending Suspicious Content to Trend Micro
Email Reputation Services ................................................. 15-2
File Reputation Services .................................................... 15-2
Web Reputation Services ................................................... 15-2

Chapter 16: Other Resources
Download Center .............................................................. 16-2
Documentation Feedback .................................................. 16-2

Appendix A: Ports Used by the Appliancevii

Preface

Preface
Learn more about the following topics:• Documentation on page 2• Audience on page 3• Document Conventions on page 3

1

Deep Discovery Inspector Installation and Deployment Guide

Documentation
The documentation set for Deep Discovery Inspector includes the following:
Table 1. Product Documentation
Document2

Description

Administrator's Guide

The Administrator's Guide contains detailed instructions on
how to configure and manage Deep Discovery Inspector, andexplanations on Deep Discovery Inspector concepts andfeatures.

AWS Deployment Guide

The AWS Deployment Guide contains information about
requirements and procedures for planning deployment,
deploying, and troubleshooting Deep Discovery Inspector
deployment on AWS.

Inline (LAN bypass) Network
Interface Card Installation
Guide

The Inline (LAN bypass) Network Interface Card Installation
Guide contains information about requirements andprocedures for installing an additional bypass network
interface card on supported Deep Discovery Inspector
appliances.

Installation and Deployment
Guide

The Installation and Deployment Guide contains information
about requirements and procedures for planning deployment,
installing Deep Discovery Inspector, and using thePreconfiguration Console to set initial configurations andperform system tasks.

Syslog Content Mapping
Guide

The Syslog Content Mapping Guide provides information about
log management standards and syntaxes for implementing
syslog events in Deep Discovery Inspector.

Quick Start Card

The Quick Start Card provides user-friendly instructions onconnecting Deep Discovery Inspector to your network and on
performing the initial configuration.

ReadmeThe Readme contains late-breaking product information that is
not found in the online or printed documentation. Topics
include a description of new features, known issues, andproduct release history.

Preface

Document
Online Help

Description
Web-based documentation that is accessible from the Deep
Discovery Inspector management console.
The Online Help contains explanations of Deep Discovery
Inspector components and features, as well as procedures
needed to configure Deep Discovery Inspector.

Support Portal

The Support Portal is an online database of problem-solving
and troubleshooting information. It provides the latest
information about known product issues. To access the
Support Portal, go to the following website:
https://success.trendmicro.com

View and download product documentation from the Trend Micro Online
Help Center:
https://docs.trendmicro.com/en-us/home.aspx

Audience
The Deep Discovery Inspector documentation is written for IT
administrators and security analysts. The documentation assumes that thereader has an in-depth knowledge of networking and information security,
including the following topics:• Network topologies• Database management• Antivirus and content security protection
The documentation does not assume the reader has any knowledge ofsandbox environments or threat event correlation.

Document Conventions
The documentation uses the following conventions:3

Deep Discovery Inspector Installation and Deployment Guide

Table 2. Document Conventions
Convention

Description

UPPER CASE

Acronyms, abbreviations, and names of certain commands
and keys on the keyboard

Bold

Menus and menu commands, command buttons, tabs, andoptions

Italics

References to other documents

Monospace

Sample command lines, program code, web URLs, file names,and program output

Navigation > Path

The navigation path to reach a particular screen
For example, File > Save means, click File and then click
Save on the interface

Note

Tip

Important

WARNING!

4

Configuration notes

Recommendations or suggestions

Information regarding required or default configuration
settings and product limitations

Critical actions and configuration options

Part I
Introduction

Chapter 1

Introduction
Learn about product features, capabilities, and security technology in thefollowing topics:• About Deep Discovery Inspector on page 1-2• Features and Benefits on page 1-3• Threat Management Capabilities on page 1-4• APT Attack Sequence on page 1-4• Host Severity on page 1-6• Advanced Threat Scan Engine on page 1-8• Virtual Analyzer on page 1-9

1-1Deep Discovery Inspector Installation and Deployment Guide

About Deep Discovery Inspector
Deep Discovery Inspector is a third-generation threat management solution
designed and architected to deliver breakthrough targeted attack andadvanced threat visibility, insight, and control. Deep Discovery Inspector
provides IT administrators with critical security information, alerts, andreports.
Trend Micro developed Deep Discovery Inspector to meet the requirementsof G1000 organizations and government around the world. Deep Discovery
Inspector integrates global intelligence and scanning technology to catchtraditional signature-based threats and more sophisticated threats requiring
heuristic analysis.

What's New
The following table outlines the new features in Deep Discovery Inspector
6.7.
Description

FeatureCentralized
managementfrom Trend
Vision One

You can now use the Network Inventory app of Trend Vision One to manage
the following settings on Deep Discovery Inspector:• Detection exceptions• Packet capture• SSH access• Hypersensitive mode

Connection to
Trend Vision One
using a Service
Gateway

1-2

Deep Discovery Inspector can now connect to Trend Vision One using aService Gateway as a proxy.

Introduction

FeatureDescription

Information
sharing withTrend Vision One

Deep Discovery Inspector can now send the following information to Trend
Vision One:• Throughput information: Deep Discovery Inspector can now send
network throughput logs to the Monitored Network Throughput
widget in Trend Vision One.
• Network security configuration: Deep Discovery Inspector can now
send user settings and other usage statistics to Trend Vision One. You
can now see the overall status of your Deep Discovery Inspector
appliances from the Executive Dashboard.

New hardware
appliances

The new 4300/9300 Deep Discovery Inspector appliance models are now
available.

Enhanced
hypervisor
supportYou can now deploy the Deep Discovery Inspector virtual appliance to:• KVM on Red Hat Enterprise Linux (RHEL) 9.
• VMware ESXi 8.

Features and Benefits
Deep Discovery Inspector offers sophisticated detection capabilities using
multiple advanced detection engines to present detailed information about
custom and signature-based threats passing through various network
protocols. Deep Discovery Inspector detects targeted attacks and advanced
threats, and helps remediate targeted attacks with automated processes.
Deep Discovery Inspector includes the following features:• Threat Management Capabilities on page 1-4• APT Attack Sequence on page 1-4• Host Severity on page 1-6• Advanced Threat Scan Engine on page 1-8• Virtual Analyzer on page 1-9

1-3Deep Discovery Inspector Installation and Deployment Guide

Threat Management Capabilities
Deep Discovery Inspector detects and identifies evasive threats in real-time,and provides in-depth analysis and actionable intelligence needed to
discover, prevent, and contain attacks against corporate data.
Table 1-1. Threat Management Capabilities
Capability

Description

Expanded APT and targeted
attack detection

Deep Discovery Inspector detection engines deliver expanded
APT and targeted attack detection including custom sandbox
analysis. New discovery and correlation rules detect malicious
content, communication, and behavior across every stage of an
attack sequence.

Visibility, analysis, andactionUsing an intuitive multi-level format, the Deep Discovery
Inspector management console provides real-time threat
visibility and analysis. This allows security professionals tofocus on the real risks, perform forensic analysis, and rapidly
implement containment and remediation procedures.

High capacity platforms

Deep Discovery Inspector features a high-performancearchitecture that meets the demanding and diverse capacity
requirements of large organizations.
Deep Discovery Inspector features are useful for a company of
any size, and are vital to larger organizations needing to reduce
the risk of targeted attacks.

APT Attack Sequence
Targeted attacks and advanced persistent threats (APTs) are organized,
focused efforts that are custom-created to penetrate enterprises andgovernment agencies for access to internal systems, data, and other assets.
Each attack is customized to its target, but follows a consistent life cycle toinfiltrate and operate inside an organization.
In targeted attacks, the APT life cycle follows a continuous process of six key
phases.

1-4Introduction

Table 1-2. APT Attack Sequence
Phase

Description

Intelligence Gathering

Identify and research target individuals using public sources (forexample, social media websites) and prepare a customized attack

Point of Entry

An initial compromise typically from zero-day malware delivered via
social engineering (email/IM or drive-by download)
A backdoor is created and the network can now be infiltrated.
Alternatively, a website exploitation or direct network hack may be
employed.

Command & Control(C&C)
Communication

Lateral Movement

Communications used throughout an attack to instruct and control
the malware used
C&C communication allows the attacker to exploit compromised
machines, move laterally within the network, and exfiltrate data.
An attack that compromises additional machines
Once inside the network, an attacker can harvest credentials, escalate
privilege levels, and maintain persistent control beyond the initial
target.

Asset/Data Discovery

Several techniques (for example, port scanning) used to identify
noteworthy servers and services that house data of interest

Data Exfiltration

Unauthorized data transmission to external locations
Once sensitive information is gathered, the data is funneled to aninternal staging server where it is chunked, compressed, and often
encrypted for transmission to external locations under an attacker’s
control.

Deep Discovery Inspector is purpose-built for detecting APT and targeted
attacks. It identifies malicious content, communications, and behavior that
may indicate advanced malware or attacker activity across every stage of theattack sequence.

1-5

Deep Discovery Inspector Installation and Deployment Guide

Host Severity
In Deep Discovery Inspector, host severity is the impact on a host as
determined from aggregated detections by Trend Micro products andservices.
Investigating beyond event security, the host severity numerical scale
exposes the most vulnerable hosts and allows you to prioritize and quickly
respond.
Host severity is based on the aggregation and correlation of the severity ofthe events that affect a host. If several events affect a host and have nodetected connection, the host severity will be based on the highest event
severity of those events. However, if the events have a detected correlation,
the host severity level will increase accordingly.
For example: Of five events affecting a host, the highest risk level ismoderate. If the events have no correlation, the host severity level will bebased on the moderate risk level of that event. However, if the events arecorrelated, then the host severity level will increase based on the detected
correlation.
The host severity scale consolidates threat information from multiple
detection technologies and simplifies the interpretation of overall severity.
You can prioritize your responses based on this information and your related
threat response policies.
Table 1-3. Host Severity Scale
Category
CriticalHost exhibits behavior thatdefinitely indicates host iscompromised

1-6

Level
10

Description
Host shows evidence of compromise including
but not limited to the following:• Data exfiltration• Multiple compromised hosts/servers

Introduction

Category

Level
9

Description
Host exhibits an indication of compromise from
APTs including but not limited to the following:• Connection to an IP address associated witha known APT• Access to a URL associated with a known
APT• A downloaded file associated with a known
APT• Evidence of lateral movement

8

Host may exhibit the following:• A high severity network event• Connection to a C&C Server detected by
Web Reputation Services• A downloaded file rated as high risk by
Virtual Analyzer

Major
Host is targeted by a known
malicious behavior or attackand exhibits behavior thatlikely indicates host iscompromised

7

Host may exhibit the following:• Inbound malware downloads; no evidenceof user infection• An inbound Exploit detection

6

Host may exhibit the following:• Connection to a dangerous site detected by
Web Reputation Services

5

Host may exhibit the following:• A downloaded medium- or low-risk
potentially malicious file with no evidenceof user infection

4

Host may exhibit the following:• A medium severity network event• A downloaded file rated as medium risk by
Virtual Analyzer

1-7Deep Discovery Inspector Installation and Deployment Guide

Category
Minor

Level
3

Description
Host may exhibit the following:• Repeated unsuccessful logon attempts orabnormal patterns of usage

Host exhibits anomalous or
suspicious behavior that may
be benign or indicate a threat• A downloaded or propagated packed
executable or suspicious file
• Evidence of running IRC, TOR, or outboundtunneling software
2

Host may exhibit the following:• A low severity network event• Evidence of receiving an email message that
contains a dangerous URL• A downloaded file rated as low risk by
Virtual Analyzer

Trivial1

Host exhibits normal
behavior that may be benign
or indicate a threat in future
identification of malicious
activities

Host may exhibit the following:• An informational severity network event• Connection to a site rated as untested or to a
new domain detected by Web Reputation
Services• Evidence of a running disruptive applicationsuch as P2P

Advanced Threat Scan Engine
Advanced Threat Scan Engine uses a combination of signature file-based
scanning and heuristic rule-based scanning to detect and document exploits
and other threats used in targeted attacks.
Major features include the following:• Detection of zero-day threats• Detection of embedded exploit code
• Detection rules for known vulnerabilities

1-8Introduction• Enhanced parsers for handling file deformities

Virtual Analyzer
Virtual Analyzer is a secure virtual environment that manages and analyzes
objects submitted by integrated products, administrators, and investigators.
Custom sandbox images enable observation of files, URLs, registry entries,
API calls, and other objects in environments that match your system
configuration.
Virtual Analyzer performs static and dynamic analysis to identify an object's
notable characteristics in the following categories:• Anti-security and self-preservation• Autostart or other system configuration• Deception and social engineering• File drop, download, sharing, or replication• Hijack, redirection, or data theft• Malformed, defective, or with known malware traits• Process, service, or memory object change• Rootkit, cloaking• Suspicious network or messaging activity
During analysis, Virtual Analyzer rates the characteristics in context andthen assigns a risk level to the object based on the accumulated ratings.
Virtual Analyzer also generates analysis reports, suspicious object lists, PCAP
files, and OpenIOC and STIX files that can be used in investigations.

1-9

Part II
Hardware Appliance Installation
and Deployment

Chapter 2

About Your System
Learn about the Deep Discovery Inspector appliance in the following topics:• Package Contents on page 2-2• The Deep Discovery Inspector Appliance on page 2-3• Setting Up the Hardware on page 2-20
• Product Specifications on page 2-21

2-1

Deep Discovery Inspector Installation and Deployment Guide

Package Contents
Examine the Deep Discovery Inspector appliance package contents andhardware to correctly configure the appliance in your network.
The following illustration shows the items that are included in the Deep
Discovery Inspector appliance package.

Figure 2-1. Package Contents
Table 2-1. Deep Discovery Inspector Package Contents
#
1

Name
Slide and rail sets (2)Description
Secure the appliance (fixed mount) or use to secure andallow the appliance to slide in and out of a four-post rack
(sliding mount).
Note
The rail is assembled with the slide when the
package is shipped. Remove the rail from the slide
before mounting the appliance.

2-2

About Your System

#

Name

2

Trend Micro Installation
DVD for Deep Discovery
Inspector (1)Deep Discovery Inspector
Quick Start Card

Description
The Installation DVD contains installers and the PDF
documentation set, including the following:• Trend Micro Deep Discovery Inspector Administrator's
Guide• Trend Micro Deep Discovery Inspector Installation and
Deployment Guide
The Quick Start Card provides user-friendly instructions onconnecting Deep Discovery Inspector to your network andon performing the initial configuration.

3

Power cords (2)Supply power to the appliance (length is 79 in/200 cm)

4

Deep Discovery Inspector(1)

The appliance

The Deep Discovery Inspector ApplianceDeep Discovery Inspector 6.7 supports the following hardware appliancemodels. You can view the model number on the front sticker of your physicalappliance.
• 520
• 530
• 1100• 1200• 1300• 4100• 4200• 4300• 9200• 93002-3

Deep Discovery Inspector Installation and Deployment Guide

Front Panel
Front Panel - 530/1300 Appliance

Figure 2-2. Deep Discovery Inspector 530/1300 Front Panel

The following table outlines the front panel features of the 530/1300
appliance.
#

2-4

FeatureDescription

1

Status LED indicators

Displays system ID, status information,and system error messages

2

Optical drive

DVD drive

3

Video connector

Connects a VGA display to the appliance

4Power-on indicator• Lights when the system power is on

Power button• Controls the power supply output
to the appliance5

USB connector

Connects USB devices (for example,
keyboard or mouse) to the appliance

6

iDRAC Direct port (Micro-AB USB)

Enables you to access the iDRAC Direct(Micro-AB) features

7

Hard drives (2)3.5-inch, hot-swappableAbout Your System

Front Panel - 4300/9300 Appliance

Figure 2-3. Deep Discovery Inspector 4300/9300 Front Panel

The following table outlines the front panel features of the 4300/9300
appliance.
#

FeatureDescription

1

Status LED indicators

Displays system ID, status information,and system error messages

2

Front ID button/indicator

Not supported by Deep Discovery
Inspector

3Power-on button/indicator• Lights when the system power is on• Controls the power supply output
to the appliance4

USB connector

Allows you to connect USB devices tothe appliance

5Video connector

Allows you to connect a VGA display tothe appliance

6

iDRAC Direct port (Micro-AB USB)

Enables you to access the iDRAC Direct(Micro-AB) features

7

Hard drives (4)3.5-inch, hot-swappable hard drive

Back Panel

2-5

Deep Discovery Inspector Installation and Deployment Guide

Back Panel - 530/1300 Appliance

Figure 2-4. Deep Discovery Inspector 530/1300 Back Panel

The following table outlines the back panel features of the 530/1300
appliance.
#

2-6

FeatureDescription1

RS-232 serial connector

Connects to the serial port of acomputer with an RS-232 typeconnection to perform preconfiguration

2

Management port

Connects to a management network forcommunication and interaction withother products and services

3

iDRAC port

Connects to a dedicated management
port on the iDRAC card4

USB connectors (2)Connects USB devices (for example,
keyboard or mouse) to the appliance

5Video connector

Connects a VGA display to the applianceAbout Your System#
6

FeaturePower supply connectors (2)Description
Two 800-watt hot-plug power supply
units:• Main power supply• Backup power supply
Note"Hot-plug" refers to the ability
to replace the power supply
while the appliance is running.
Deep Discovery Inspector
automatically and safely
recognizes the change without
operational interruption or risk.
Use the power cord included in the
package (for details, see Package
Contents on page 2-2).

7

Data ports (5)Five integrated 1 Gbps NIC connectors

Back Panel - 4300/9300 Appliance

Figure 2-5. Deep Discovery Inspector 4300/9300 Back Panel

2-7

Deep Discovery Inspector Installation and Deployment Guide

The following table outlines the back panel features of the 4330/9300
appliance.
#

FeatureDescription

8

Management port

Connects to a management network forcommunication and interaction with otherproducts and services

9

iDRAC port

Connects to a dedicated management port on
an iDRAC card10

1 Gbps data ports (5)Five integrated 10/100/1000 Mbps Base-T NIC
connectors

11

10/25 Gbps data ports (4)Four 10/25 Gbps NIC connectors

12

USB connectors (2)Connects USB devices (for example, keyboard
or mouse) to the appliance

13

Video connector

Connects a VGA display to the appliance

14Power supply connectors (2)Two 800-watt (4300) or 1100-watt (9300) hotplug power supply units (see your device
labels for wattage):• Main power supply• Backup power supply
Note"Hot-plug" refers to the ability toreplace the power supply while theappliance is running. Deep Discovery
Inspector automatically and safely
recognizes the change without
operational interruption or risk.
Use the power cord included in the package(for details, see Package Contents on page
2-2).

2-8

About Your System#
15

FeatureDescription

Appliance ID button / appliancestatus indicator

Not supported by Deep Discovery Inspector

Network Cards
Port OrderPort Order - 530/1300 ApplianceTip
To see information about the card slots, go to Administration > System
Settings > Network Interface in the Deep Discovery Inspector management
console.

The following table outlines the port order of the network cards in the
530/1300 appliance.

2-9

Deep Discovery Inspector Installation and Deployment Guide

NIC

Slot

Dedicated_Quad_Por
t_1GbE_Copper

Dedicated

Dual_Port_1GbE_Cop
per_Bypass_Card

Slot 1

Dual_Port_10GbE_Fi
ber-SR_Bypass_Card

Slot 1

Port orderPort Order - 4300/9300 ApplianceTo see information about the card slots, go to Administration > System
Settings > Network Interface in the Deep Discovery Inspector management
console.

2-10

About Your System

Important• Slot 1 is a RAID controller.
• Slot 5 and slot 6 are not available for use on the 4300 appliance.

The following table outlines the port order of the network cards in the4300/9300 appliance.
NIC
Dedicated_Quad_Por
t_10/25GbE_SFP28

Slot

Port order• Dedicated2-11

Deep Discovery Inspector Installation and Deployment Guide

NIC
Quad_Port_1GbE_Co
pper

Slot
• Slot 3• Slot 4• Slot 2• Slot 5 (9300
only)• Slot 6 (9300
only)

2-12

Port orderAbout Your System

NIC
Dual_Port_10GbE_Fi
ber-SR_Bypass_Card

Slot

Port order

Slot 2NIC Indicators
NIC Indicators - 530/1300
For out-of-band deployment, Deep Discovery Inspector 530/1300 has fiveuser-configurable copper-based Ethernet NIC ports. All accept integrated
10/100/1000 Mbps connectors.

2-13

Deep Discovery Inspector Installation and Deployment Guide

Each port has an indicator showing the current state of the port.

Figure 2-6. The two port types found in the Deep Discovery Inspector 530/1300 appliance

The following table describes the NIC indicators in the 530/1300 appliance.

2-14

About Your System

Indicator1

2

Description

Indicator pattern

Indicates the connection status and data
activity status.

• Off: No network connection.

Indicates the data transmission speed.

• Yellow: 10 Mbps or 100 Mbps

• Green, flashing: Network data is
being sent or received.

• Green: 1000 Mbps

NIC Indicators - 4300/9300

2-15Deep Discovery Inspector Installation and Deployment Guide

Data port Indicators - 4300/9300 1 Gbps

Each port has an indicator showing the current state of the port.

The following table describes the 1 Gbps port indicators in the 4300/9300
appliance.

2-16

About Your System

Indicator1

2

Description

Indicator pattern

Indicates the connection status and data
activity status.

• Off: No network connection.

Indicates the data transmission speed.

• Yellow: 10 Mbps or 100 Mbps

• Green, flashing: The port is sendingor receiving data.

• Green: 1000 Mbps

2-17

Deep Discovery Inspector Installation and Deployment Guide

Data NIC Indicators - 4300/9300 10/25 Gbps

Each port has an indicator showing the current state of the port.

2-18

About Your System

The following table describes the 10/25 Gbps NIC indicators in the 4300/9300
appliance.
Indicator1

2

Description

Indicator pattern

Indicates the connection status and data
activity status.

• Off: No network connection.

Indicates the data transmission speed.

• Yellow: 10 Gbps

• Green, flashing: Network data is
being sent or received.

• Green: 25 Gbps

Power Supply Indicators
The following table outlines the power supply status indicators.
Description

Indicator Pattern
Not litPower is not connectedGreen

A valid power source is connected to the power supply and thepower supply is operational

Flashing green

When hot-adding a power supply, indicates the power supply ismismatched with the other power supply (in terms of efficiency,
feature set, health status, and supported voltage)
Replace the power supply that has the flashing indicator with apower supply that matches the capacity of the other installed
power supply.

2-19

Deep Discovery Inspector Installation and Deployment Guide

Indicator Pattern
Flashing amber

Description
Indicates a problem with the power supply
Important
When correcting a power supply mismatch, replace only
the power supply with the flashing indicator. Swapping
the opposite power supply to make a matched pair can
result in an error condition and an unexpected system
shutdown.
To change from a high output configuration to a low
output configuration or vice versa, first power down thesystem.
AC power supplies support both 220 V and 110 V input
voltages. When two identical power supplies receive
different input voltages, they may output different
wattages and trigger a mismatch.
If two power supplies are used, they must be of the same
type and have the same maximum output power.

Setting Up the Hardware
Procedure
1.

Mount the appliance in a standard 19-inch 4-post rack, or on a freestanding object, such as a sturdy desktop.
Note
When mounting the appliance, leave at least two inches of clearance on
all sides for proper ventilation and cooling.

2.

2-20

Connect the appliance to a power source.

About Your System

Deep Discovery Inspector has two power supply units. One unit acts as
the main power supply and the other as a backup.
3.

Connect the monitor to the VGA port at the back panel.
See Back Panel on page 2-5 for a diagram.

4.

Connect the keyboard and mouse to the USB ports on the back panel.

5.

Connect the management port to your network.

6.

Power on the appliance.
The power button is found on the front panel of the appliance, behindthe bezel. See Front Panel on page 2-4 for a diagram.

A screen similar to the following appears:

Figure 2-7. Power-on self-test (POST)

What to do next
If applicable, perform initial preconfiguration using the Preconfiguration
Console. For details, see Preconfiguration on page 10-1.

Product Specifications
Standard Deep Discovery Inspector appliances have the following
specifications.

2-21

Deep Discovery Inspector Installation and Deployment Guide

Contact Trend Micro if the appliance you are using does not meet these
hardware specifications.
Note
Hardware vendors and specifications may vary for customers in China, Japan,
and other regions.

Product Specifications - 530/1300 Appliance
Table 2-2. Deep Discovery Inspector 530/1300
FeatureSpecifications

Rack size

1U 19-inch standard rack

Availability

Raid 1 configuration

Storage size

2 x 2 TB 3.5-inch SATA

Connectivity• Management: 1 x 1 GB/100/10Base copper• Data: 5 x 1 GB/100/10Base copper

Dimensions (WxDxH)

482.0 mm (18.97 inches) x 748.79 mm (29.48 inches) x 42.8 mm(1.68 inches)

Maximum weight

18.62 kg (41.05 lb)

Operating temperature

10°C to 35°C at 10% to 80% relative humidity (RH)

Power

800W, 100-240 VAC 50/60 Hz

Product Specifications - 4300/9300 Appliance
Table 2-3. Deep Discovery Inspector 4200/9200 Appliance
Specifications

Feature2-22

Rack size

2U 19-inch standard rack

Availability

Raid 10 configuration

Storage size

4 x 2 TB 3.5-inch SATA

About Your System

FeatureConnectivity

Specifications• Management: 1 x 1 GB/100/10Base copper• Data:4 x 10/25 GB SFP28 DAC, Optics, And AOC's
5 x 1 GB/100/10Base copper

Dimensions (WxDxH)

482.0 mm (18.97 inches) x 685.78 mm (26.99 inches) x 86.8 mm(3.41 inches)

Maximum weight28.82 kg (63.53 lb)

Operating temperature

10°C to 35°C at 10% to 80% relative humidity (RH)

Power

800W (4300) / 1100W (9300), 100-240 VAC 50/60 Hz

2-23

Chapter 3

Hardware Appliance Deployment
Learn tips, suggestions, and requirements for installing a Deep Discovery
Inspector hardware appliance in the following sections.

3-1

Deep Discovery Inspector Installation and Deployment Guide

Deployment Overview
Procedure
1.

Plan the deployment.
See Hardware Appliance Deployment Planning on page 3-2.

2.

Review the installation requirements.
See Hardware Appliance Installation Requirements on page 3-14.

3.

Review the system requirements.
See Hardware Appliance System Requirements on page 3-15.

4.

Install Deep Discovery Inspector.
See Installation on a Hardware Appliance on page 4-1.

5.

Preconfigure Deep Discovery Inspector.
See Preconfiguration on page 10-1.

Hardware Appliance Deployment Planning
Plan how to best deploy Deep Discovery Inspector by doing the following:• Determine the segments of your network that need protection.
• Plan for network traffic, considering the location of appliances critical toyour operations such as email, web, and application servers.
• Determine both the number of appliances needed to meet your security
needs and their locations on the network• Conduct a pilot deployment on a test segment of your network.
• Redefine your deployment strategy based on the results of the pilot
deployment.
• Use the following examples to plan a customized Deep Discovery
Inspector deployment.
3-2

Hardware Appliance Deployment

Deployment Scenarios
Deep Discovery Inspector can be deployed as a hardware appliance or as a
virtual appliance.
• Hardware appliance: Deep Discovery Inspector can be deployed either
inline or out-of-band.
• Inline: Deep Discovery Inspector acts as a transparent bridge andcan inspect decrypted TLS traffic. When deployed inline, only traffic
flowing through the inline ports is inspected.
Note
Installing an additional inline (LAN Bypass) network interface card
is needed for inline deployment. For installation instructions andcompatible Deep Discovery Inspector appliance models, refer to theInline (LAN Bypass) Network Interface Card Installation Guide.

• Out-of-band: Deep Discovery Inspector monitors network traffic byconnecting to the mirror port on a switch for minimal to no
network interruption. When deployed out-of-band, only traffic
mirrored to the data ports is inspected.
• Virtual appliance: Deep Discovery Inspector can only be deployed outof-band. Deep Discovery Inspector monitors network traffic byconnecting to the mirror port on a switch for minimal to no network
interruption.

3-3

Deep Discovery Inspector Installation and Deployment Guide

The figure below provides a high-level overview of supported deployments.

Out-of-Band
When deployed out-of-band, Deep Discovery Inspector monitors network
traffic by connecting to the mirror port on a switch for minimal to no
network interruption.

3-4

Hardware Appliance Deployment

Mirroring Trunk Links
When multiple VLANs encapsulate the same physical link, mirror the source
port from a trunk link. Make sure that the switch mirrors the correct VLAN
tag to Deep Discovery Inspector for both directions.

3-5

Deep Discovery Inspector Installation and Deployment Guide

Multiple Port Monitoring
Deep Discovery Inspector can monitor different network segments using
different data ports. Deep Discovery Inspector data ports are connected tothe mirror ports of access or distribution switches.

Network Tap Monitoring
Network taps monitor the data flowing across the network frominterconnected switches, routers, and clients. Multiple Deep Discovery
Inspector appliances can be connected to a network tap.

3-6

Hardware Appliance Deployment

Note
If using network taps, make sure that they copy DHCP traffic to Deep
Discovery Inspector instead of filtering DHCP traffic.

Proxy Monitoring
When configuring Deep Discovery Inspector in proxy environments outside
the proxy server, enable XFF on the proxy server.

3-7

Deep Discovery Inspector Installation and Deployment Guide

To avoid false alarms when configuring Deep Discovery Inspector in proxyenvironments inside or outside the proxy server, add HTTP Proxy as aregistered service on Deep Discovery Inspector.

3-8Hardware Appliance Deployment

Redundant Networks
Many enterprise environments use redundant networks to provide highavailability. When available, an asymmetric route connects Deep Discovery
Inspector to redundant switches.

Remote Port or VLAN Mirroring
Use remote mirroring in the following conditions:• Monitoring switches• Local switches do not have enough physical ports• Port speed on local switches do not match (GB versus MB)

3-9

Deep Discovery Inspector Installation and Deployment Guide

Note
In this diagram, the dotted line displays the remote mirror, and the solid line
displays the direct mirror.

Single Port Monitoring
The Deep Discovery Inspector data port connects to the mirror port of thecore switch, which mirrors the traffic through the port to the firewall.
(Optional) Configure the mirror port to mirror inbound/outbound traffic
from single or multiple source ports.
Note
Mirrored traffic should not exceed the capacity of the network interface card.

3-10Hardware Appliance Deployment

3-11

Deep Discovery Inspector Installation and Deployment Guide

VLAN-based Port Monitoring
VLAN-based port mirroring allows users to choose to monitor traffic on all
ports belonging to a particular VLAN. In this scenario, connect Deep
Discovery Inspector to a switch if the mirror configuration is VLAN-based.

VMware Port Mirroring
Use VMware port mirroring when traffic passes through a virtual distributed
switch.
For more details, see Port Mirroring on a VMware Virtual Distributed Switch on
page 5-1.

InlineWhen deployed inline, Deep Discovery Inspector acts as a transparent bridgeand can inspect decrypted TLS traffic.
Note
Installing an additional inline (LAN Bypass) network interface card is needed
for inline deployment. For installation instructions and compatible Deep
Discovery Inspector appliance models, refer to the Inline (LAN Bypass) Network
Interface Card Installation Guide.

Traffic cannot be blocked by Deep Discovery Inspector. When Deep
Discovery Inspector is deployed inline, traffic is only inspected or notinspected.

Transparent Bridge
Transparent bridge deployment is suitable when you want to use Deep
Discovery Inspector as an inline device. Transparent bridge deployment isrequired for TLS traffic inspection.
When deployed as a transparent bridge, Deep Discovery Inspector acts as alayer 2 bridge between network devices and is transparent on the network

3-12

Hardware Appliance Deployment

and you do not need to reconfigure your network as you need only place theappliance in the network path that you want to monitor.

3-13

Deep Discovery Inspector Installation and Deployment Guide

Hardware Appliance Installation Requirements
Ensure the following before installing Deep Discovery Inspector.
Requirement
Match port speeds

Description
The destination port speed should be the same as the source port
speed to ensure equal port mirroring. If the destination port is unable
to handle the faster speed of the source port, the destination port may
drop some data.
For Deep Discovery Inspector 530/1300, the speed of inline ports isdowngraded if not matched.
For Deep Discovery Inspector 4200/9200, the inline ports are disabled
if not matched.

Configure Virtual
Analyzer data ports

When enabling an internal Virtual Analyzer, select one of the following
network options and make sure the data ports are configured asfollows:• No Network
Virtual Analyzer does not exchange data with the Internet.
• Custom Network
Virtual Analyzer uses an additional specified data port toexchange data with the Internet.
• Management Network
Virtual Analyzer uses a management port to exchange data with
the Internet.
For details, see Internal Virtual Analyzer in the Deep Discovery Inspector
Administrator's Guide.

3-14

Hardware Appliance Deployment

Requirement
Monitor all data

Description
Deep Discovery Inspector monitors all inbound and outboundnetwork traffic.
Note
For better performance when installing Deep Discovery
Inspector, Trend Micro recommends using a plug-in NIC
rather than an onboard NIC as a data port.
Note
To ensure Deep Discovery Inspector captures traffic from both
directions, configure the mirror port, and make sure that
traffic in both directions is mirrored to the port.

Hardware Appliance System Requirements
Deep Discovery Inspector requires the following:• Hardware Appliance Requirements on page 3-15
• Preconfiguration Console Requirements on page 3-16
• Management Console Requirements on page 3-16
• Virtual Analyzer Image Operating System Requirements on page 3-17

Hardware Appliance Requirements
Trend Micro provides the Deep Discovery Inspector appliance hardware. No
other hardware is supported.
Installing an additional inline (LAN Bypass) network interface card is needed
for inline deployment. For installation instructions and compatible Deep
Discovery Inspector appliance models, refer to the Inline (LAN Bypass) Network
Interface Card Installation Guide.

3-15

Deep Discovery Inspector Installation and Deployment Guide

Preconfiguration Console Requirements
The Deep Discovery Inspector Preconfiguration Console is a terminal
communications program used to configure the network and system settings
that are required to access the Deep Discovery Inspector management
console.
For details, see Preconfiguration Console on page 10-2
Access to the Preconfiguration Console requires the following:• VGA connections:• Monitor with a VGA port
• USB keyboard• VGA cable• Serial connections:• Computer with a serial port
• RS-232 serial cable• Serial communication application (HyperTerminal)

Management Console Requirements
Deep Discovery Inspector provides a built-in online management console forviewing system status, configuring and viewing threat detections and logs,
running reports, administering Deep Discovery Inspector, updating
components, and obtaining help.
For details, see Management Console in the Deep Discovery Inspector
Administrator's Guide.
The Deep Discovery Inspector management console supports the following
web browsers:• Google™ Chrome™
• Mozilla™ FireFox™

3-16

Hardware Appliance Deployment• Microsoft™ Edge
Recommended resolution rate: 1280x800

Virtual Analyzer Image Operating System Requirements
Windows operating systems and other Microsoft products are available
separately from Microsoft and Microsoft channel partners.
Important
Trend Micro does not provide any Microsoft Windows operating systems or
Microsoft Office products required for installation on Virtual Analyzer images
or sandbox instances you create in Deep Discovery Inspector. You must
provide the operating system and Microsoft Office installation media andappropriate licensing rights necessary for you to create any sandboxes.

3-17Chapter 4

Installation on a Hardware Appliance
Learn the steps for installing Deep Discovery Inspector as a hardware
appliance in the following sections.

4-1

Deep Discovery Inspector Installation and Deployment Guide

Configuring Options
Set the following options to enable Deep Discovery Inspector management
console navigation.
• Setting JavaScript Options for Chrome on page 4-2• Setting JavaScript Options for Firefox on page 4-2

Setting JavaScript Options for Chrome
Procedure
1.

On the browser, go to Settings.

2.

Click Show advanced settings....

3.

Under Privacy, click Content settings....

4.

Under JavaScript, click Allow all sites to run JavaScript(recommended).

5.

Click Done.

Setting JavaScript Options for Firefox
Procedure
1.

2.

4-2

For Firefox versions lower than 23, do the following.
a.

On the browser, go to the Options > Content tab.

b.

Verify that Enable JavaScript is selected.

c.

Click OK.

For Firefox version 23 or higher, do the following.
a.

In the address bar, type about:config and press ENTER.

b.

Click I'll be careful, I promise!.

Installation on a Hardware Appliancec.

Verify that the Value of Preference Name javascript.enabled is set
to true.

Deep Discovery Inspector Hardware Appliance
Installation• Trend Micro provides a bare metal server with Deep Discovery
Inspector pre-installed.
• Trend Micro provides Deep Discovery Inspector packaged as an ISO fileon an installation DVD.
Install the Deep Discovery Inspector software on a bare metal serverthat meets the requirements listed in Hardware Appliance Installation
Requirements on page 3-14.

Installing Deep Discovery Inspector on Hardware Applianceswith an Optical Drive
Procedure1.

Back up any pre-existing data on the target hard drive before installing
Deep Discovery Inspector.
The installation process formats and repartitions the hard drive andremoves all existing data.
Tip
If you are reinstalling Deep Discovery Inspector, you can back up yourcurrent settings by going to Administration > System Maintenance >Backup / Restore in the Deep Discovery Inspector management console.

2.

Connect a VGA screen to the video connector of the appliance.

3.

Insert the Deep Discovery Inspector installation DVD into the CD/DVD
drive.
4-3

Deep Discovery Inspector Installation and Deployment Guide

4.

Turn on the appliance.
The BIOS screen appears.

5.

4-4

Press F11.

Installation on a Hardware Appliance

The Boot Manager appears.

6.

Select BIOS Boot Menu and press ENTER.
Important
When installing Deep Discovery Inspector through a serial connection,press ESC and simultaneously press SHIFT and 1 to enter the BIOS Boot
Manager.

4-5

Deep Discovery Inspector Installation and Deployment Guide

The BIOS Boot Manager appears.

7.

Select TSSTcorp DVD-ROM SN-108BB and press ENTER.
The Installation DVD screen appears.

8.

Press ENTER.
Important
When installing Deep Discovery Inspector through a serial connection,
type serial and press ENTER

4-6

Installation on a Hardware Appliance

The System Information screen appears.

9.

For trial deployments, type 3 and press ENTER to skip the system
requirements check.
Note
By default, the installer checks system requirements before installing
Deep Discovery Inspector to confirm that the appliance has thenecessary resources to run the product.

10. If you need to obtain installation logs for troubleshooting, type 4 andpress ENTER.
11. Start the installation by typing 2 and pressing ENTER.
The Management Port Selection screen appears.

4-7

Deep Discovery Inspector Installation and Deployment Guide

Deep Discovery Inspector automatically detects the active link cards(indicated by Link UP) available for use as a management port.

Figure 4-1. Management Port Selection
Important
You cannot select ports from an inline NIC as the management port.

12. Verify that the network port status and the actual port status match.
If a status conflict exists, select Re-detect and press ENTER.
13. Check which active link card connects to the management domain by
doing the steps listed on the Management Port Selection screen.

4-8

Installation on a Hardware Appliance

14. Select an active link card and press ENTER.
The installation continues and completes.
15. If you enabled installation log export on the System Information screen,save the installation logs.
a.

Select a storage device and press ENTER.
If your storage device is not listed, Go to Re-detect and press
ENTER to refresh the list.

b.

When the installation log file name appears, press ENTER.
Record the file name for future reference. The file name uses thefollowing format:
install.log.YYYY-MM-DD-hh-mm-ss
Tip
Trend Micro recommends saving exported installation logs to
sda11.

The system automatically restarts and the Preconfiguration Console
appears. If used, the installation DVD ejects from the CD/DVD drive.
16. (Optional) Remove the DVD to prevent reinstallation.
17. Configure the Deep Discovery Inspector network settings.
• Access the preconfiguration console and change the device settings.
For details, see Preconfiguration on page 10-1.
• Open the management console and change the appliance IP
settings.
For details, see the Get Started chapter of the Deep Discovery Inspector
Administrator's Guide.

4-9

Deep Discovery Inspector Installation and Deployment Guide

What to do next
See the Deep Discovery Inspector Administrator's Guide for details about
configuring and administering Deep Discovery Inspector.
Tip
Trend Micro recommends that you configure iDRAC (Integrated Dell Remote
Access) on the appliance to allow remote system management andtroubleshooting.

Installing Deep Discovery Inspector on Hardware Appliances
Without an Optical Drive

Procedure1.

Back up any pre-existing data on the target hard drive before installing
Deep Discovery Inspector.
The installation process formats and repartitions the hard drive andremoves all existing data.
Tip
If you are reinstalling Deep Discovery Inspector, you can back up yourcurrent settings by going to Administration > System Maintenance >Backup / Restore in the Deep Discovery Inspector management console.

4-10

2.

Download the Deep Discovery Inspector installation ISO from theBusiness Success Portal at https://success.trendmicro.com/dcx/s/license.

3.

Enable the iDRAC Direct USB port in the Integrated Devices screen of
the BIOS of the Deep Discovery Inspector appliance.

4.

Connect your computer to the Deep Discovery Inspector appliance usinga USB to micro-USB cable and access the iDRAC interface over the USB
port.

Installation on a Hardware Appliance

For more information, see the dell documentation at https://www.dell.com/support/kbdoc/en-us/000130077/.
5.

Use the virtual media function on iDRAC9 to launch the Deep Discovery
Inspector installer.
For more information, see the dell documentation at https://www.dell.com/support/kbdoc/en-us/000124001/.
The Installation DVD screen appears.

6.

Press ENTER.
Important
When installing Deep Discovery Inspector through a serial connection,
type serial and press ENTER

4-11

Deep Discovery Inspector Installation and Deployment Guide

The System Information screen appears.

7.

For trial deployments, type 3 and press ENTER to skip the system
requirements check.
Note
By default, the installer checks system requirements before installing
Deep Discovery Inspector to confirm that the appliance has thenecessary resources to run the product.

8.

If you need to obtain installation logs for troubleshooting, type 4 andpress ENTER.

9.

Start the installation by typing 2 and pressing ENTER.
The Management Port Selection screen appears.

4-12Installation on a Hardware ApplianceDeep Discovery Inspector automatically detects the active link cards(indicated by Link UP) available for use as a management port.

Figure 4-2. Management Port Selection
Important
You cannot select ports from an inline NIC as the management port.

10. Verify that the network port status and the actual port status match.
If a status conflict exists, select Re-detect and press ENTER.
11. Check which active link card connects to the management domain by
doing the steps listed on the Management Port Selection screen.

4-13

Deep Discovery Inspector Installation and Deployment Guide

12. Select an active link card and press ENTER.
The installation continues and completes.
13. If you enabled installation log export on the System Information screen,save the installation logs.
a.

Select a storage device and press ENTER.
If your storage device is not listed, Go to Re-detect and press
ENTER to refresh the list.

b.

When the installation log file name appears, press ENTER.
Record the file name for future reference. The file name uses thefollowing format:
install.log.YYYY-MM-DD-hh-mm-ss
Tip
Trend Micro recommends saving exported installation logs to
sda11.

The system automatically restarts and the Preconfiguration Console
appears. If used, the installation DVD ejects from the CD/DVD drive.
14. (Optional) Remove the DVD to prevent reinstallation.
15. Configure the Deep Discovery Inspector network settings.
• Access the preconfiguration console and change the device settings.
For details, see Preconfiguration on page 10-1.
• Open the management console and change the appliance IP
settings.
For details, see the Get Started chapter of the Deep Discovery Inspector
Administrator's Guide.

4-14

Installation on a Hardware Appliance

What to do next
See the Deep Discovery Inspector Administrator's Guide for details about
configuring and administering Deep Discovery Inspector.
Tip
Trend Micro recommends that you configure iDRAC (Integrated Dell Remote
Access) on the appliance to allow remote system management andtroubleshooting.

Restoring to Factory Mode
Reset Deep Discovery Inspector by restoring the default settings that shippedwith the product.
Procedure
1.

Power on Deep Discovery Inspector with a monitor connected to a VGA
port.
When Deep Discovery Inspector is starting and before thePreconfiguration Console opens, the Press ESC key to enter the menu
prompt appears. If no action is performed, the system will automaticallyboot within 10 seconds.

2.

Press the ESC key to enter the boot system options menu.

3.

Using the arrow key, select Restore to factory mode and press ENTER.
Deep Discovery Inspector restarts and the Preconfiguration Console
opens.

4-15

Chapter 5

Port Mirroring on a VMware Virtual
Distributed Switch
Deep Discovery Inspector can monitor mirrored traffic using virtual
distributed switches. Learn how to create a virtual distributed switch andconfigure Deep Discovery Inspector hardware appliances to monitor
mirrored traffic in the following sections.
• Creating a VMware vSphere Distributed Switch (VDS) on page 5-2• Deep Discovery Inspector Hardware Appliance with a VDS on page 5-5

5-1

Deep Discovery Inspector Installation and Deployment Guide

Creating a VMware vSphere Distributed Switch(VDS)
Procedure
1.

Create a new virtual distributed switch.
a.

Log in to the vSphere Web Client.

b.

Click Networking.

c.

In the left panel, select your data center.

d.

In the right panel, click the Create a new distributed switch icon.
The New Distributed Switch window appears.

e.

Type a name for the switch and then click Next.

f.

Select the distributed switch version and then click Next.

g.

For Number of uplinks, set at least 2 if your SPAN traffic is on a
dedicated NIC. Otherwise, set this value to 1.
Note
Trend Micro recommends using a dedicated NIC.

h.

For Network I/O Control, select one of the following options.
• Disabled: If your SPAN traffic on a dedicated NIC.
Note
Trend Micro recommends using a dedicated NIC.

• Enabled: If your SPAN traffic is on the same NIC as yourmonitored traffic.

5-2

i.

Uncheck Create a default port group.

j.

Click Next.

Port Mirroring on a VMware Virtual Distributed Switchk.
2.

Verify that the summary information is correct and then click
Finish.

Configure the virtual switch.
a.

Right-click the virtual distributed switch you created in the previous
steps, and then select Settings > Edit Settings.
The Edit Settings window appears.

b.

Click Advanced.
The advanced settings appear.

c.
3.

For MTU (Bytes), specify 1600.

Add port groups to the virtual distributed switch.
a.

Click Networking.

b.

Right-click the virtual distributed switch you created in the previous
steps, and then select Distributed Port Group > New Distributed
Port Group.
The New Distributed Port Group window appears.

c.

Type a name for the port group and then click Next.

d.

For Port binding, select Static binding.

e.

For Port allocation, select Fixed.

f.

For Number of ports, type the number of ports that you want toconnect.

g.

Click Next.

h.

Verify that the settings on the summary screen are correct and thenclick Finish.
The new port group appears on the Manage tab.

4.

(Optional) Repeat step 3 to add additional port groups.

5.

Add an ESXi host to the virtual distributed switch.

5-3

Deep Discovery Inspector Installation and Deployment Guidea.

Right-click the virtual switch you created in the previous steps, andthen select Add and Manage Hosts.
The Add and Manage Hosts window appears.

b.

For Select task, select Add host and manage host networking(advanced).

c.

Click Next.

d.

For Select hosts, click + New hosts to add managed ESXi hosts.

e.

Click Next.

f.

For Selet network adapter tasks, add a checkmark to Manage
physical adapters and Migrate virtual machine networking.

g.

Click Next.

h.

For Manage physical network adapters, manage the physicalnetwork adapters according to your network environment.

i.

Click Next.

j.

For Analyze impact, specify No impact.

k.

Click Next.

l.

For Migrate VM networking, migrate the VM networking according
to your network environment.

m. Click Next.
n.

For Ready to complete, click Finish.
The Add and Manage Hosts window closes.

o.

5-4

Click the virtual switch you created in the previous steps, click theConfigure tab, and then click Topology to verify the virtual switch
topology that you configured.

Port Mirroring on a VMware Virtual Distributed Switch

Deep Discovery Inspector Hardware Appliancewith a VDS
Deep Discovery Inspector hardware appliances can monitor mirrored traffic
from a virtual distributed switch using encapsulated remote mirroring or
remote mirroring. Learn how to configure Deep Discovery Inspector and thevirtual distrbuted switch in the following sections.
• Hardware Appliance - Configuring Mirrored Traffic Monitoring from a VDS
with Encapsulated Remote Mirroring on page 5-5• Hardware Appliance - Configuring Mirrored Traffic Monitoring from a VDS
with Remote Mirroring on page 5-9

Hardware Appliance - Configuring Mirrored Traffic Monitoringfrom a VDS with Encapsulated Remote Mirroring
Encapsulated Remote Mirroring enables you to monitor traffic on multiple
network interfaces or VLANs and send the monitored traffic to one or more
destinations.

Figure 5-1. Mirrored Traffic Monitoring from a VDS with Encapsulated Remote Mirroring

5-5

Deep Discovery Inspector Installation and Deployment Guide

By default, encapsulated remote mirroring on the virtual switch uses the
management VMkernel port of the ESXi host as the encapsulation source IP
address.
In the steps below, the mirroring source and mirroring destination are thefollowing:• Mirroring source: Virtual distributed switch that forwards mirrored
traffic• Mirroring destination: Deep Discovery Inspector
Procedure
1.

Configure the mirroring source to forward encapsulated remotemirrored traffic.
a.

Log in to the vSphere Web Client.

b.

Select your virtual distributed switch in the left column and thenclick Configure.

c.

Click Port Mirroring.
The Port mirroring screen appears.

d.

Click New....
The Add Port Mirroring Sessions window appears.

5-6Port Mirroring on a VMware Virtual Distributed Switche.

Select Encapsulated Remote Mirroring (L3) Source.

f.

Click Next.
The Edit properties screen appears.

g.

In Name, type a session name.

5-7Deep Discovery Inspector Installation and Deployment Guideh.

For Status, select Enabled.

i.

For Encapsulation type, select the encapsulation type.
Note
Using ERSPAN THREE may cause issues. Trend Micro recommends
using GRE or ERSPAN TWO

j.

Click Next.
The Select sources screen appears.

k.

Click the plus icon(
) to add the source virtual machines that you want to monitor.

l.

Click Next.
The Select destinations screen appears.

m. Click the plus icon to add an IP address as a destination.
Note
The destination IP address is the address that you configure on
Deep Discovery Inspector in the next step.

n.

Click Next.
The Ready to complete screen appears.

o.
2.

Verify that the settings are correct and then click Finish.

Configure the mirroring destination to receive encapsulated remotemirrored traffic.
a.

In the Deep Discovery Inspector console, go to Administration >System Settings > Network Interface.
The Network Interface screen appears.

5-8Port Mirroring on a VMware Virtual Distributed Switchb.

Locate a data port, and then click the right arrow() at the beginning of the row.

c.

Select Encapsulated Remote Mirroring.

d.

Specify the encapsulated remote mirroring destination address.
Important
The encapsulated remote mirroring destination address must be
routable from the management VMkernel port of the ESXi host.

e.

Click Save.

Hardware Appliance - Configuring Mirrored Traffic Monitoringfrom a VDS with Remote Mirroring
Remote mirroring enables you to monitor traffic on one switch through adevice on another switch and send the monitored traffic to one or more
destinations.

Figure 5-2. Mirrored Traffic Monitoring from a VDS with Remote Mirroring

5-9

Deep Discovery Inspector Installation and Deployment Guide

Remote mirroring requires that you configure a remote mirroring VLAN on
your physical switches. If you cannot configure a remote mirroring VLAN,
consider using encapsulated remote mirroring as an alternative.
In the steps below, the mirroring source and mirroring destination are thefollowing:• Mirroring source: Virtual distributed switch that fowards mirrored
traffic• Mirroring destination: Physical switch that receives mirrored traffic andthat can route the traffic to Deep Discovery Inspector
Before you begin, verify that the uplink ports of the ESXi hosts that receive
traffic are linked to the physical switch trunk port.
Procedure
1.

Configure the mirroring source to forward remote mirrored traffic to thedestination.
a.

Log in to the vSphere Web Client.

b.

Select your virtual distributed switch in the left column and thenclick Configure.

c.

Click Port Mirroring.
The Port mirroring screen appears.

5-10

Port Mirroring on a VMware Virtual Distributed Switchd.

Click New....
The Add Port Mirroring Sessions window appears.

e.

Select Remote Mirroring Source.

f.

Click Next.
The Edit properties screen appears.

5-11

Deep Discovery Inspector Installation and Deployment Guideg.

In Name, type a session name.

h.

For Status, select Enabled.

i.

In Encapsulation VLAN ID, specify the VLAN ID.
NoteThis is the remote mirroring VLAN ID configured on the VDS.

j.

Click Next.
The Select sources screen appears.

k.

Click the plus icon(
) to add the source virtual machines that you want to monitor.

l.

Click Next.
The Select destinations screen appears.

m. Add uplink in Available uplinks to Selected uplinks.

5-12

Port Mirroring on a VMware Virtual Distributed Switchn.

Click Next.
The Ready to complete screen appears.

o.
2.

Verify that the settings are correct and then click Finish.

Configure the mirroring destination to forward encapsulated remotemirrored traffic to Deep Discovery Inspector.

5-13Part III
Virtual Appliance Installation and
Deployment

Chapter 6

Virtual Appliance Deployment
Learn tips, suggestions, and requirements for installing a Deep Discovery
Inspector virtual appliance in the following sections.

6-1

Deep Discovery Inspector Installation and Deployment Guide

Deployment Overview
Procedure
1.

Plan the deployment.
See Virtual Appliance Deployment Planning on page 6-2.

2.

Review the installation requirements.
See Virtual Appliance Installation Requirements on page 6-4.

3.

Review the system requirements.
See Virtual Appliance System Requirements on page 6-5.

4.

Create a virtual appliance.
See Create a New Virtual Appliance on page 7-1.

5.

Install Deep Discovery Inspector.
See Deep Discovery Inspector Virtual Appliance Installation on page 8-4.

6.

Preconfigure Deep Discovery Inspector.
See Preconfiguration on page 10-1.

Virtual Appliance Deployment Planning
Plan how to best deploy Deep Discovery Inspector by doing the following:• Determine the segments of your network that need protection.
• Plan for network traffic, considering the location of appliances critical toyour operations such as email, web, and application servers.
• Determine both the number of appliances needed to meet your security
needs and their locations on the network• Conduct a pilot deployment on a test segment of your network.
• Redefine your deployment strategy based on the results of the pilot
deployment.
6-2

Virtual Appliance Deployment• Use the following examples to plan a customized Deep Discovery
Inspector deployment.

Deployment Scenarios
Deep Discovery Inspector can be deployed as a hardware appliance or as a
virtual appliance.
• Hardware appliance: Deep Discovery Inspector can be deployed either
inline or out-of-band.
• Inline: Deep Discovery Inspector acts as a transparent bridge andcan inspect decrypted TLS traffic. When deployed inline, only traffic
flowing through the inline ports is inspected.
Note
Installing an additional inline (LAN Bypass) network interface card
is needed for inline deployment. For installation instructions andcompatible Deep Discovery Inspector appliance models, refer to theInline (LAN Bypass) Network Interface Card Installation Guide.

• Out-of-band: Deep Discovery Inspector monitors network traffic byconnecting to the mirror port on a switch for minimal to no
network interruption. When deployed out-of-band, only traffic
mirrored to the data ports is inspected.
• Virtual appliance: Deep Discovery Inspector can only be deployed outof-band. Deep Discovery Inspector monitors network traffic byconnecting to the mirror port on a switch for minimal to no network
interruption.

6-3

Deep Discovery Inspector Installation and Deployment Guide

The figure below provides a high-level overview of supported deployments.

VMware Port Mirroring
Use VMware port mirroring when traffic passes through a virtual distributed
switch.
For more details, see Port Mirroring on a VMware Virtual Distributed Switch on
page 9-1.

Virtual Appliance Installation Requirements
Ensure the following before installing Deep Discovery Inspector.
Requirement
Match port speeds

6-4

Description
The destination port speed should be the same as the source port
speed to ensure equal port mirroring. If the destination port is unable
to handle the faster speed of the source port, the destination port may
drop some data.

Virtual Appliance Deployment

Requirement
Monitor all data

Description
Deep Discovery Inspector monitors all inbound and outboundnetwork traffic.
Note
To ensure Deep Discovery Inspector captures traffic from both
directions, configure the mirror port, and make sure that
traffic in both directions is mirrored to the port.

Virtual Appliance System Requirements
Deep Discovery Inspector requires the following:• Virtual Host Appliance Requirements on page 6-5• Management Console Requirements on page 3-16

Virtual Host Appliance Requirements
You can install Deep Discovery Inspector on:• VMware ESXi 7.0 or 8.0.
• Microsoft Hyper-V on Windows Server 2019 or 2022.
• RHEL 9.2 KVM.
Deep Discovery Inspector virtual appliances do not support nested virtual
machines. When using a Deep Discovery Inspector virtual appliance with
Virtual Analyzer, only external Virtual Analyzers and Sandbox as a Service
are supported.
Trend Micro recommends the following minimum specifications based on
the throughput of your licensed model.

6-5Deep Discovery Inspector Installation and Deployment Guide

Table 6-1. Virtual Appliance Specifications
Throughput(Mbps)

VirtualCPUs*

VirtualMemory(GB)

VirtualDisk (GB)Sandbox asa Service
Support

Virtual
NICs**

250

6

32

500

2

Yes

500

6

32

500

2

Yes

1000

12

32

1000

3

Yes

Note
• * Virtual CPUs require a minimum speed of 2.5 GHz with hyper-threading
support, Virtualization Technology (VT), and 64-bit architecture.
• ** Trend Micro recommends using the VMXNET 3 network adapter on
ESXi, and the VirtIO or E1000 network adapters on RHEL KVM.

Management Console Requirements
Deep Discovery Inspector provides a built-in online management console forviewing system status, configuring and viewing threat detections and logs,
running reports, administering Deep Discovery Inspector, updating
components, and obtaining help.
For details, see Management Console in the Deep Discovery Inspector
Administrator's Guide.
The Deep Discovery Inspector management console supports the following
web browsers:• Google™ Chrome™
• Mozilla™ FireFox™
• Microsoft™ Edge
Recommended resolution rate: 1280x800

6-6Chapter 7

Create a New Virtual Appliance
Learn how to create a virtual appliance using VMware ESXi or Microsoft
Hyper-V in the following sections:• Create a VMware ESXi Virtual Appliance on page 7-2• Create a Microsoft Hyper-V Virtual Appliance on page 7-14
For details about the minimum virtual host appliance system requirements
and supported hypervisors, see Virtual Host Appliance Requirements on page
6-5.

7-1

Deep Discovery Inspector Installation and Deployment Guide

Create a VMware ESXi Virtual Appliance
Learn how to create a virtual appliance using VMware ESXi in the following
topics:• Requirements for a Virtual Machine in VMware ESXi on page 7-2• Configuring the VMware ESXi Server Network on page 7-2• Creating a Virtual Machine in VMware ESXi on page 7-7• Enabling Hardware-assisted Virtualization in VMware ESXi on page 7-13

Requirements for a Virtual Machine in VMware ESXi
Important
You must separately license VMware ESXi and such use is subject to the terms
and conditions of the VMware license agreement for that product.

To install Deep Discovery Inspector in a VMware ESXi server, ensure thatyour server has:
• VMware ESXi server version 7.0 or 8.0 .
• Two or more NICs on the VMware ESXi server: one manager network,and at least one data network.
For details, see Configuring the VMware ESXi Server Network on page 7-2.
• Virtualization Technology (VT) enabled on your VMware host and in the
VMware vSphere configuration.
For details about the VMware vSphere configuration, see Enabling
Hardware-assisted Virtualization in VMware ESXi on page 7-13.

Configuring the VMware ESXi Server Network
Use a browser to connect the ESXi server.

7-2

Create a New Virtual Appliance

Procedure
1.

Sign into the VMware ESXi server.

2.

Go to Networking > Virtual switches. Observe the initial state.

3.

Click Add standard virtual switches and configure the settings.

7-3

Deep Discovery Inspector Installation and Deployment Guidea.

For vSwitch Name, type Data Network.

b.

For MTU, type 1600.

c.

For Uplink 1, select a NIC card for a Data Network.

d.

Expand Security and configure the settings.
1. For Promiscuous mode, select Reject.
2. For MAC address changes, select Accept.
3. For Forged transmits, select Accept.

e.

7-4

Click Add.

Create a New Virtual Appliance4.

Click on the Port groups tab and observe the initial state.

5.

Click Add port group and configure the settings.

a.

For Name, type Data Port Group.

b.

For VLAN ID, type 4095.

c.

For Virtual switch, select a Data Network.

7-5

Deep Discovery Inspector Installation and Deployment Guided.

Expand Security and configure the settings.
1. For Promiscuous mode, select Accept.
2. For both Mac Address changes and Forged transmits, selectInherit from vSwitch.

7-6

6.

Click Add.

7.

In the Port groups tab, click Data port group and verify that it isconnected to the Data Network.

Create a New Virtual Appliance

Creating a Virtual Machine in VMware ESXi
Procedure
1.

Click Virtual machines and then click Create / Register VM.

2.

On the Select creation type screen, click Create a new virtual machine
and then click Next.

7-7

Deep Discovery Inspector Installation and Deployment Guide

3.

7-8

On the Select a name and guest OS screen, configure the settings.
a.

For Name, type New Virtual Machine.

b.

For Compatibility, select ESXi 7.0.

c.

For Guest OS family, select Linux.

d.

For Guest OS version, select CentOS 7 (64-bit).

Create a New Virtual Appliance4.

Click Next.

5.

On the Select storage screen, select the destination storage where thevirtual machine resides and click Next.

7-9

Deep Discovery Inspector Installation and Deployment Guide

6.

Configure the settings on the Customize settings screen.
a.

For CPU, select the CPU amount based on the throughput of your
Virtual Deep Discovery Inspector license.
• For 250 or 500 Mbps throughput, select at least 6 CPUs
• For 1000 Mbps throughput, select at least 12 CPUsb.

For Memory, select at least 32 GB of memory for the virtual
machine.

c.

For Hard disk, select the hard disk size based on the throughput ofyour Virtual Deep Discovery Inspector license.
• For 250 or 500 Mbps throughput, select at least 500 GB• For 1000 Mbps throughput, select at least 1000 GBd.

For SCSI Controller 0, select LSI Logic Parallel.

e.

For Network, configure the amount of NICs based on thethroughput of your Virtual Deep Discovery Inspector license.
• For 250 or 500 Mbps throughput, configure at least 2 NICs
• For 1000 Mbps throughput, configure at least 3 NICs
1. Set the VMware ESXi server VM Network as the Deep Discovery
Inspector Management Network (NIC 1).
2. Set the Data port group as the Deep Discovery Inspector Data
Network (NIC 2).

7-10

Create a New Virtual Appliance

NoteTrend Micro recommends using the VMXNET 3 network adapter on ESXi
7.0 or 8.0.

7.

Click Next.

8.

On the Ready to complete screen, review the settings and click Finish.

7-11

Deep Discovery Inspector Installation and Deployment Guide

9.

Enable hardware-assisted virtualization in the VMware Sphere Web
Client.
For details, see Enabling Hardware-assisted Virtualization in VMware ESXi
on page 7-13.

10. In the VMWare vSphere web client, right-click the virtual machine andselect Edit Settings.
11. Go to VM Options > Boot Options.
12. Ensure Firmware is set to BIOS.

7-12

Create a New Virtual Appliance

Enabling Hardware-assisted Virtualization in VMware ESXi
Procedure
1.

Verify that Virtualization Technology (VT) is enabled on the VMware
host.
Tip
The Virtualization Technology setting is typically in the BIOS settings andthe location varies based on the system vendor. The feature may be
named AMD-V, VT, VT-x, Vanderpool Technology, Virtualization
Technology, VMX, or Virtual Machine Extensions.

2.

In the VMware vSphere Web Client, right-click the virtual machine andselect Edit Settings.

3.

On to the Virtual Hardware tab, expand CPU.

7-13

Deep Discovery Inspector Installation and Deployment Guide

4.

Enable Expose hardware-assisted virtualization to guest OS.

5.

Click OK.

Create a Microsoft Hyper-V Virtual Appliance
Learn how to create a virtual appliance using Microsoft Hyper-V in thefollowing topics:• Creating a Virtual Machine in Microsoft Hyper-V on page 7-14
• Configure Traffic Mirroring in Microsoft Hyper-V on page 7-36

Creating a Virtual Machine in Microsoft Hyper-V
Important
Deep Discovery Inspector virtual appliances installed on a Microsoft Hyper-V
virtual machines do not support UEFI generation 2.
Important
Deep Discovery Inspector only supports installation on Hyper-V virtual
machines running on Windows Server 2019 or 2022.

Procedure
1.

Create virtual management and data switches.
a.

In Hyper-V Manager, go to Action > Virtual Switch Manager.
The Virtual Switch Manager window appears.

7-14

Create a New Virtual Applianceb.

In the left column, click New Virtual network switch.
The Create virtual switch screen appears.

c.

For the switch type to create, select External.

7-15

Deep Discovery Inspector Installation and Deployment Guided.

Click Create Virtual Switch.
The Virtual Switch Properties screen appears.

7-16

e.

For Name, type Management Switch.

f.

For Connection type, select External Network and then select a
NIC card to use for the management network.

Create a New Virtual Applianceg.

Click Apply.
The Apply Networking Changes confirmation window appears.

7-17

Deep Discovery Inspector Installation and Deployment Guideh.

Read the warning and then click Yes.

i.

In the left column, click New Virtual network switch.
The Create virtual switch screen appears.

j.

For the switch type to create, select External.

k.

Click Create Virtual Switch.
The Viritual Switch Properties screen appears.

l.

For Name, type Data Switch.

m. For Connection type, select External Network and then select a
NIC card to use for the data network.
7-18

Create a New Virtual Appliancen.

Click Apply.
The Apply Networking Changes confirmation window appears.

o.

Read the warning and then click Yes.
The confirmation window closes.

p.
2.

Click OK.

Create a virtual machine.
a.

In Hyper-V Manager, go to Action > New > Virtual Machine.

The New Virtual Machine Wizard window with the Before You
Begin screen appears.
b.

Click Next.
The Specify Name and Location screen appears.

c.

For Name, type Deep Discovery Inspector.
7-19

Deep Discovery Inspector Installation and Deployment Guided.

Click Next.
The Specify Generation screen appears.

e.

7-20

Select Generation 1.

Create a New Virtual Appliancef.

Click Next.
The Assign Memory screen appears.

g.

For Startup memory, assign at least 32768 MB (32 GB).

7-21

Deep Discovery Inspector Installation and Deployment Guideh.

Click Next.
The Configure Networking screen appears.

i.

7-22

For Connection, select Mangement Switch.

Create a New Virtual Appliancej.

Click Next.
The Connect Virtual Hard Disk screen appears.

k.

Select Attach a virtual hard disk later.

7-23

Deep Discovery Inspector Installation and Deployment Guidel.

Click Next.
The Completing the New Virtual Machine Wizard screen appears.

m. Verify that the virtual machine configuration is correct and thenclick Finish.
3.

Create a virtual hard disk.
a.

7-24

In Hyper-V Manager, select the Deep Discovery Inspector virtual
machine and then go to Action > New > Hard Disk.

Create a New Virtual Appliance

The New Virtual Hard Disk Wizard window with the Before You
Begin screen appears.
b.

Click Next.
The Choose Disk Format screen appears.

c.

Select VHDX.

7-25

Deep Discovery Inspector Installation and Deployment Guided.

Click Next.
The Choose Disk Type screen appears.

e.

7-26

Select Fixed size.

Create a New Virtual Appliancef.

Click Next.
The Specify Name and Location screen appears.

g.

For Name, type Deep Discovery Inspector.vhdx.

7-27

Deep Discovery Inspector Installation and Deployment Guideh.

Click Next.
The Configure Disk screen appears.

i.

Select Create a New blank virtual hard disk.

j.

For Size, specify the following based on your Deep Discovery
Inspector model.
• For the 250 or 500 Mbps throughput models, specify at least 500
GB.
• For the 1000 Mbps throughput model, specify at least 1000 GB.

7-28

Create a New Virtual Appliancek.

Click Next.
The Completing the New Virtual Hard Disk Wizard screen appears.

l.

Verify that the hard disk configuration is correct and then click
Finish.
NoteFinishing may take a few minutes. Wait for the process to complete
before continuing.

4.

Configure the virtual machine.
a.

In Hyper-V Manager, select the Deep Discovery Inspector virtual
machine and then go to Action > Settings.

7-29

Deep Discovery Inspector Installation and Deployment Guide

The settings window appears.
b.

In the left column, click Processor.
The Processor settings appear.

c.

For Number of virtual processors, specify the following based onyour Deep Discovery Inspector model.
• For the 250 or 500 Mbps throughput models, specify at least 6
virtual processors.
• For the 1000 Mbps throughput model, specify at least 12 virtual
processors.

7-30

Create a New Virtual Applianced.

Click Apply.

e.

In the left column, click IDE Controller 0.
The IDE Controller settings appear.

f.

For the type of hard drive to attach to the controller, select Hard
Drive.

7-31

Deep Discovery Inspector Installation and Deployment Guideg.

Click Add.
The Hard Drive settings appear.

h.

7-32

For Virtual hard disk, specify the location of Deep Discovery
Inspector.vhdx.

Create a New Virtual Appliancei.

In the left column, click IDE Controller 1 and then click on DVD
Drive.
The DVD Drive settings appear.

j.

For Media, select Image file and then specify the location of the
Deep Discovery Inspector ISO file.

7-33

Deep Discovery Inspector Installation and Deployment Guidek.

In the left column, click Add Hardware.
The Add Hardware settings appear.

l.

7-34

For the devices you want to add, select Network Adapter.

Create a New Virtual Appliance

m. Click Add.
The Network Adapter settings appear.
n.

For Virtual switch, select Data Switch.

7-35

Deep Discovery Inspector Installation and Deployment Guide

5.

o.

Click Apply.

p.

Click OK.

Configure the Hyper-V network for mirroring.
For details, see Configuring Internal VM Traffic Mirroring in Microsoft
Hyper-V on page 7-39 and Configuring External Traffic Mirroring in
Microsoft Hyper-V on page 7-37.

Configure Traffic Mirroring in Microsoft Hyper-V
Learn how to enable the capture of external and internal VM traffic in thefollowing topics:
7-36

Create a New Virtual Appliance• Configuring External Traffic Mirroring in Microsoft Hyper-V on page 7-37
• Configuring Internal VM Traffic Mirroring in Microsoft Hyper-V on page
7-39

Configuring External Traffic Mirroring in Microsoft Hyper-V
Perform the follow steps on the Deep Discovery Inspector host to enable thecapture of external mirrored traffic.
Procedure
1.

On the Hyper-V host, run the following commands in Powershell to
configure the monitor mode of the Data Switch.
$DataSwitch = "Data Switch"$extFeature = Get-VMSystemSwitchExtensionPortFeature `-FeatureName "Ethernet Switch Port Security Settings"$extFeature.SettingData.MonitorMode = 2
Add-VMSwitchExtensionPortFeature `-ExternalPort -SwitchName $DataSwitch `-VMSwitchExtensionFeature $extFeature2.

Run the following commands in Powershell to verify that the settings
are configured correctly.
$extFeature = Get-VMSwitchExtensionPortFeature `-ExternalPort -SwitchName $DataSwitch `-FeatureName "Ethernet Switch Port Security Settings"$extFeature.SettingData.MonitorMode

If configured correctly, the resulting output is 2 to indicate that the port
mirroring mode is source.
3.

Configure the monitor mode of the VM Network Adapter.
a.

In Hyper-V Manager, click on the Deep Discovery Inspector VM andthen go to Action > Settings.
The settings window appears.
7-37

Deep Discovery Inspector Installation and Deployment Guide

4.

b.

Expand Data Switch and then click Advanced Features.

c.

For Mirroring mode, select Destination.

d.

Click OK.

Run the following commands in Powershell to configure the VLAN modeof the Data Switch.
$VMName = "Deep Discovery Inspector"$DataSwitch = "Data Switch"
Get-VMNetworkAdapter -VMName $VMName |? SwitchName -eq "$DataSwitch" |7-38

Create a New Virtual Appliance% { Set-VMNetworkAdapterVlan -VMNetworkAdapter $_ `-Trunk -AllowedVlanIdList 1-4094 -NativeVlanId 0 }5.

(Optional) Run the following commands in Powershell to configure thejumbo MTU setting on the physical adapter and prevent dropped
network packets.
Note
For the $NetAdapter value, use the name of the physical network
adapater on the Hyper-V host.
$NetAdapter = "Ethernet0"
Get-NetAdapterAdvancedProperty -Name $NetAdapter `-RegistryKeyword "*jumbopacket" |Set-NetAdapterAdvancedProperty -RegistryValue 4088

6.

Start the virtual machine and verify that the traffic is mirrored anddetected.

Configuring Internal VM Traffic Mirroring in Microsoft Hyper-V
Perform the follow steps on the Deep Discovery Inspector host to enable thecapture of mirrored traffic from a VM on the same host.
Procedure
1.

In Hyper-V Manager, click on the Deep Discovery Inspector virtual
machine and then go to Action > Settings.
The settings window appears.

2.

In the left column, click Add Hardware.
The Add Hardware settings appear.

3.

For the devices you want to add, select Network Adapter.

4.

Click Add.
7-39

Deep Discovery Inspector Installation and Deployment Guide

The Network Adapter settings appear.
5.

For Virtual switch, select Management Switch.

6.

In the left column, expand Management Switch and then click
Advanced Features.

7.

For Mirroring mode, select Destination.

8.

Click OK.

9.

In Hyper-V Manager, click on the virtual machine that is on the same
host as Deep Discovery Inspector and then go to Action > Settings.
The settings window appears.

10. In the left column, expand Management Switch and then click
Advanced Features.
11. For Mirroring mode, select Source.
12. Click OK.
13. Start the Deep Discovery Inspector virtual machine and verify that thetraffic is mirrored and detected.

7-40Chapter 8

Installation on a Virtual Appliance
Learn the steps for installing Deep Discovery Inspector as a virtual appliancein the following sections.

8-1

Deep Discovery Inspector Installation and Deployment Guide

Configuring Options
Set the following options to enable Deep Discovery Inspector management
console navigation.
• Setting JavaScript Options for Chrome on page 8-2• Setting JavaScript Options for Firefox on page 8-2• Setting Options for Virtual Appliance in ESXi on page 8-3

Setting JavaScript Options for Chrome
Procedure
1.

On the browser, go to Settings.

2.

Click Show advanced settings....

3.

Under Privacy, click Content settings....

4.

Under JavaScript, click Allow all sites to run JavaScript(recommended).

5.

Click Done.

Setting JavaScript Options for Firefox
Procedure
1.

2.

For Firefox versions lower than 23, do the following.
a.

On the browser, go to the Options > Content tab.

b.

Verify that Enable JavaScript is selected.

c.

Click OK.

For Firefox version 23 or higher, do the following.
a.

8-2

In the address bar, type about:config and press ENTER.

Installation on a Virtual Applianceb.

Click I'll be careful, I promise!.

c.

Verify that the Value of Preference Name javascript.enabled is set
to true.

Setting Options for Virtual Appliance in ESXi
The following steps apply to the supported versions of ESXi. For details, see
Requirements for a Virtual Machine in VMware ESXi on page 7-2.
Procedure
1.

Go toVMware ESXi > Virtual Machines, and right-click the appliancename and select Edit Settings....
The settings screen appears.

2.

On the Settings screen, click the VM Options tab and select VMware
Tools.

3.

Disable the Synchronize guest time with host option.

8-3

Deep Discovery Inspector Installation and Deployment Guide

Deep Discovery Inspector Virtual Appliance
Installation
You can install Deep Discovery Inspector on:• VMware ESXi 7.0 or 8.0.
You must obtain a separate license for VMware ESXi. Your usage issubject to the terms and conditions outlined in the VMware license
agreement specific to that product.
• Microsoft Hyper-V on Windows Server 2019 or 2022.
• RHEL 9.2 KVM.
Procedure1.

Back up any pre-existing data on the target hard drive before installing
Deep Discovery Inspector.
The installation process formats and repartitions the hard drive andremoves all existing data.
Tip
If you are reinstalling Deep Discovery Inspector, you can back up yourcurrent settings by going to Administration > System Maintenance >Backup / Restore in the Deep Discovery Inspector management console.

2.

Create a virtual appliance.
For details, see Create a New Virtual Appliance on page 7-1.
When installing Deep Discovery Inspector on a VMware ESXi server,
disable the snapshot feature for the virtual appliance to preserve harddisk space.

8-4

3.

Start the virtual machine.

4.

Insert the Deep Discovery Inspector installation DVD into the physical
CD/DVD drive of the hypervisor server.

Installation on a Virtual Appliance5.

Connect the virtual CD/DVD drive of the virtual appliance to the physical
CD/DVD drive of the hypervisor server.

6.

Connect the virtual CD/DVD drive of the virtual appliance to the ISO file.

7.

Restart the virtual appliance.
• In the VMware vSphere Client, go to Inventory > Virtual Machine >Guest > Send and press CTRL + ALT + DEL.
• On the RHEL KVM server, use a management tool.
For details, see https://www.linux-kvm.org/page/
Management_Tools.
• In the Hyper-V Manager, select the server, shut down the server,and start the server.
The Installation DVD screen appears.

8.

Press ENTER.
Important
When installing Deep Discovery Inspector through a serial connection,
type serial and press ENTER

8-5

Deep Discovery Inspector Installation and Deployment Guide

The System Information screen appears.

9.

For trial deployments, type 3 and press ENTER to skip the system
requirements check.
Note
By default, the installer checks system requirements before installing
Deep Discovery Inspector to confirm that the appliance has thenecessary resources to run the product.

10. If you need to obtain installation logs for troubleshooting, type 4 andpress ENTER.
11. Start the installation by typing 2 and pressing ENTER.
The Management Port Selection screen appears.

8-6

Installation on a Virtual ApplianceDeep Discovery Inspector automatically detects the active link cards(indicated by Link UP) available for use as a management port.

Figure 8-1. Management Port Selection

12. Verify that the network port status and the actual port status match.
If a status conflict exists, select Re-detect and press ENTER.
13. Check which active link card connects to the management domain by
doing the steps listed on the Management Port Selection screen.
14. Select an active link card and press ENTER.
The installation continues and completes.
15. If you enabled installation log export on the System Information screen,save the installation logs.
a.

Select a storage device and press ENTER.
If your storage device is not listed, Go to Re-detect and press
ENTER to refresh the list.

b.

When the installation log file name appears, press ENTER.
Record the file name for future reference. The file name uses thefollowing format:
install.log.YYYY-MM-DD-hh-mm-ss

8-7

Deep Discovery Inspector Installation and Deployment Guide

Tip
Trend Micro recommends saving exported installation logs to
sda11.

The system automatically restarts and the Preconfiguration Console
appears. If used, the installation DVD ejects from the CD/DVD drive.
16. (Optional) Remove the DVD to prevent reinstallation.
17. Configure the Deep Discovery Inspector network settings.
• Access the preconfiguration console and change the device settings.
For details, see Preconfiguration on page 10-1.
• Open the management console and change the appliance IP
settings.
For details, see the Get Started chapter of the Deep Discovery Inspector
Administrator's Guide.
What to do next
See the Deep Discovery Inspector Administrator's Guide for details about
configuring and administering Deep Discovery Inspector.

8-8Chapter 9

Port Mirroring on a VMware Virtual
Distributed Switch
Deep Discovery Inspector can monitor mirrored traffic using virtual
distributed switches. Learn how to create a virtual distributed switch andconfigure Deep Discovery Inspector virtual appliances to monitor mirrored
traffic in the following sections.
• Creating a VMware vSphere Distributed Switch (VDS) on page 9-2• Deep Discovery Inspector Virtual Appliance with a VDS on page 9-5

9-1

Deep Discovery Inspector Installation and Deployment Guide

Creating a VMware vSphere Distributed Switch(VDS)
Procedure
1.

Create a new virtual distributed switch.
a.

Log in to the vSphere Web Client.

b.

Click Networking.

c.

In the left panel, select your data center.

d.

In the right panel, click the Create a new distributed switch icon.
The New Distributed Switch window appears.

e.

Type a name for the switch and then click Next.

f.

Select the distributed switch version and then click Next.

g.

For Number of uplinks, set at least 2 if your SPAN traffic is on a
dedicated NIC. Otherwise, set this value to 1.
Note
Trend Micro recommends using a dedicated NIC.

h.

For Network I/O Control, select one of the following options.
• Disabled: If your SPAN traffic on a dedicated NIC.
Note
Trend Micro recommends using a dedicated NIC.

• Enabled: If your SPAN traffic is on the same NIC as yourmonitored traffic.

9-2

i.

Uncheck Create a default port group.

j.

Click Next.

Port Mirroring on a VMware Virtual Distributed Switchk.
2.

Verify that the summary information is correct and then click
Finish.

Configure the virtual switch.
a.

Right-click the virtual distributed switch you created in the previous
steps, and then select Settings > Edit Settings.
The Edit Settings window appears.

b.

Click Advanced.
The advanced settings appear.

c.
3.

For MTU (Bytes), specify 1600.

Add port groups to the virtual distributed switch.
a.

Click Networking.

b.

Right-click the virtual distributed switch you created in the previous
steps, and then select Distributed Port Group > New Distributed
Port Group.
The New Distributed Port Group window appears.

c.

Type a name for the port group and then click Next.

d.

For Port binding, select Static binding.

e.

For Port allocation, select Fixed.

f.

For Number of ports, type the number of ports that you want toconnect.

g.

Click Next.

h.

Verify that the settings on the summary screen are correct and thenclick Finish.
The new port group appears on the Manage tab.

4.

(Optional) Repeat step 3 to add additional port groups.

5.

Add an ESXi host to the virtual distributed switch.

9-3

Deep Discovery Inspector Installation and Deployment Guidea.

Right-click the virtual switch you created in the previous steps, andthen select Add and Manage Hosts.
The Add and Manage Hosts window appears.

b.

For Select task, select Add host and manage host networking(advanced).

c.

Click Next.

d.

For Select hosts, click + New hosts to add managed ESXi hosts.

e.

Click Next.

f.

For Selet network adapter tasks, add a checkmark to Manage
physical adapters and Migrate virtual machine networking.

g.

Click Next.

h.

For Manage physical network adapters, manage the physicalnetwork adapters according to your network environment.

i.

Click Next.

j.

For Analyze impact, specify No impact.

k.

Click Next.

l.

For Migrate VM networking, migrate the VM networking according
to your network environment.

m. Click Next.
n.

For Ready to complete, click Finish.
The Add and Manage Hosts window closes.

o.

9-4

Click the virtual switch you created in the previous steps, click theConfigure tab, and then click Topology to verify the virtual switch
topology that you configured.

Port Mirroring on a VMware Virtual Distributed Switch

Deep Discovery Inspector Virtual Appliance with a
VDS
Deep Discovery Inspector virtual appliances can monitor mirrored virtual
distributed switch traffic that is inside and outside virtual environments.
Learn about the requirments and how to configure Deep Discovery Inspector
and the virtual distrbuted switch in the following sections.
• Requirements for Virtual Appliances with a VDS on page 9-5• Virtual Appliance - Monitoring Mirrored External Network Traffic using a
VDS on page 9-7• Virtual Appliance - Monitoring Mirrored VM Traffic from a VDS on page
9-14

Requirements for Virtual Appliances with a VDS
The following table describes the minimum physical NIC requirements for
Deep Discovery Inspector virtual appliances.

9-5

Deep Discovery Inspector Installation and Deployment Guide

Table 9-1. Virtual Appliance Physical NIC Requirements
Traffic Source
External network
traffic

Remote Mirroring

Encapsulated
Remote Mirroring

Distributed Port
Mirroring

The destination ESXi
host requires a 1
Gbps Ethernet
network port as an
uplinkThe destination ESXi
host requires a 1
Gbps Ethernet
network port as an
uplinkNot supported

Note
The port
must beroutablefrom theenscapsulate
d remote
mirroringsource.
VM network traffic

Each ESXi hostrequires a 1 Gbps
Ethernet network
port as an uplink

The destination ESXi
host requires a 1
Gbps Ethernet
network port as an
uplinkNote
The port
must beroutablefrom theother ESXi
hostmanagement
VMkernel
port.

9-6

No physical port
requirement

Port Mirroring on a VMware Virtual Distributed Switch

Virtual Appliance - Monitoring Mirrored External Network
Traffic using a VDS
Deep Discovery Inspector virtual appliances can monitor mirrored traffic
using a virtual distributed switch with encapsulated remote mirroring or
remote mirroring. Learn how to configure Deep Discovery Inspector and the
network devices in the following sections.
• Virtual Appliance - Configuring Mirrored External Network Traffic
Monitoring with Encapsulated Remote Mirroring on page 9-8• Virtual Appliance - Configuring Mirrored External Network Traffic
Monitoring with Remote Mirroring on page 9-10

9-7

Deep Discovery Inspector Installation and Deployment Guide

Virtual Appliance - Configuring Mirrored External Network Traffic
Monitoring with Encapsulated Remote Mirroring
Encapsulated Remote Mirroring enables you to monitor traffic on multiple
network interfaces or VLANs and send the monitored traffic to one or more
destinations.

Figure 9-1. Mirrored External Network Traffic Monitoring with Encapsulated Remote
Mirroring

9-8

Port Mirroring on a VMware Virtual Distributed Switch

By default, encapsulated remote mirroring on the virtual switch uses the
management VMkernel port of the ESXi host as the encapsulation source IP
address.
In the steps below, the mirroring source and mirroring destination are thefollowing:• Mirroring source: Physical switch that forwards mirrored traffic• Mirroring destination: Deep Discovery Inspector

Procedure
1.

Configure the mirroring source to forward encapsulated remotemirrored traffic.
Important
Ensure that switch is able to route traffic to the encapsulated remotemirroring destination IP address that you configure on Deep Discovery
Inspector in the next step.

2.

Configure the mirroring destination to receive encapsulated remotemirrored traffic.
a.

In the Deep Discovery Inspector console, go to Administration >System Settings > Network Interface.
The Network Interface screen appears.

b.

Locate a data port, and then click the right arrow() at the beginning of the row.

c.

Select Encapsulated Remote Mirroring.

d.

Specify the encapsulated remote mirroring destination address.

e.

Click Save.

9-9

Deep Discovery Inspector Installation and Deployment Guide

Virtual Appliance - Configuring Mirrored External Network Traffic
Monitoring with Remote Mirroring
Remote mirroring enables you to monitor traffic on one switch through adevice on another switch and send the monitored traffic to one or more
destinations.

Figure 9-2. Mirrored External Network Traffic Monitoring with Remote Mirroring

9-10

Port Mirroring on a VMware Virtual Distributed Switch

Remote mirroring requires that you configure a remote mirroring VLAN on
your physical switches. If you cannot configure a remote mirroring VLAN,
consider using encapsulated remote mirroring as an alternative.
In the steps below, the mirroring source and mirroring destination are thefollowing:• Mirroring source: Physical switch that forwards mirrored traffic to thevirtual distributed switch• Mirroring destination: Virtual distributed switch that recieves mirrored
traffic
Before you begin, verify that the uplink ports of the ESXi hosts that receive
traffic are linked to the physical switch trunk port.
Procedure
1.

Configure the mirroring source to forward mirrored traffic to themirroring destination.

2.

Configure the mirroring destination recieve mirrored traffic.
a.

Log in to the vSphere Web Client.

b.

Select your virtual distributed switch in the left column and thenclick Configure.

c.

Click Port Mirroring.
The Port mirroring screen appears.

9-11

Deep Discovery Inspector Installation and Deployment Guided.

Click New....
The Add Port Mirroring Sessions window appears.

e.

Select Remote Mirroring Destination.

f.

Click Next.
The Edit properties screen appears.

9-12

Port Mirroring on a VMware Virtual Distributed Switchg.

In Name, type a session name.

h.

For Status, select Enabled.

i.

Click Next.
The Select sources screen appears.

j.

Click the plus icon to add the VLAN ID that you want to monitor.
Note
This is the remote mirroring VLAN ID configured on the VDS.

k.

Click Next.
The Select destinations screen appears.

l.

Click the plus icon(
) to add the port ID of the Deep Discovery Inspector data port.

m. Click Next.

9-13

Deep Discovery Inspector Installation and Deployment Guide

The Ready to complete screen appears.
n.

Verify that the settings are correct and then click Finish.

Virtual Appliance - Monitoring Mirrored VM Traffic from a VDS
Deep Discovery Inspector virtual appliances can monitor mirrored traffic
from the same ESXi host that contains Deep Discovery Inspector or different
ESXi hosts . Learn how to configure Deep Discovery Inspector and the virtual
distrbuted switch in the following sections.
• Virtual Appliance - Monitoring Mirrored Traffic from Different ESXi Hosts on
page 9-14• Virtual Appliance - Monitoring Mirrored Traffic from the Same ESXi Host on
page 9-26

Virtual Appliance - Monitoring Mirrored Traffic from Different
ESXi Hosts
Deep Discovery Inspector virtual appliances can monitor mirrored VM
traffic from a different ESXi hosts using encapsulated remote mirroring or
remote mirroring. Learn how to configure Deep Discovery Inspector and thevirtual distrbuted switch in the following sections.
• Virtual Appliance - Configuring Mirrored VM Traffic Monitoring with
Encapsulated Remote Mirroring on page 9-15
• Virtual Appliance - Configuring Mirrored VM Traffic Monitoring withRemote Mirroring on page 9-20

9-14

Port Mirroring on a VMware Virtual Distributed Switch

Virtual Appliance - Configuring Mirrored VM Traffic Monitoring with
Encapsulated Remote Mirroring
Encapsulated Remote Mirroring enables you to monitor traffic on multiple
network interfaces or VLANs and send the monitored traffic to one or more
destinations.

Figure 9-3. Mirrored VM Traffic Monitoring with Encapsulated Remote Mirroring

By default, encapsulated remote mirroring on the virtual switch uses the
management VMkernel port of the ESXi host as the encapsulation source IP
address.
In the steps below, the mirroring source and mirroring destination are thefollowing:

9-15

Deep Discovery Inspector Installation and Deployment Guide• Mirroring source: Virtual distributed switch that forwards mirrored
traffic• Mirroring destination: Deep Discovery Inspector
Procedure
1.

Configure the mirroring source to forward encapsulated remotemirrored traffic.
a.

Log in to the vSphere Web Client.

b.

Select your virtual distributed switch in the left column and thenclick Configure.

c.

Click Port Mirroring.
The Port mirroring screen appears.

d.

Click New....
The Add Port Mirroring Sessions window appears.

9-16

Port Mirroring on a VMware Virtual Distributed Switche.

Select Encapsulated Remote Mirroring (L3) Source.

f.

Click Next.
The Edit properties screen appears.

g.

In Name, type a session name.

9-17Deep Discovery Inspector Installation and Deployment Guideh.

For Status, select Enabled.

i.

For Encapsulation type, select the encapsulation type.
Note
Using ERSPAN THREE may cause issues. Trend Micro recommends
using GRE or ERSPAN TWO

j.

Click Next.
The Select sources screen appears.

k.

Click the plus icon(
) to add the source virtual machines that you want to monitor.

l.

Click Next.
The Select destinations screen appears.

m. Click the plus icon to add an IP address as a destination.
Note
The destination IP address is the address that you configure on
Deep Discovery Inspector in the next step.

n.

Click Next.
The Ready to complete screen appears.

o.
2.

Verify that the settings are correct and then click Finish.

Configure the mirroring destination to receive encapsulated remotemirrored traffic.
a.

In the Deep Discovery Inspector console, go to Administration >System Settings > Network Interface.
The Network Interface screen appears.

9-18

Port Mirroring on a VMware Virtual Distributed Switchb.

Locate a data port, and then click the right arrow() at the beginning of the row.

c.

Select Encapsulated Remote Mirroring.

d.

Specify the encapsulated remote mirroring destination address.
Important
The encapsulated remote mirroring destination address must be
routable from the management VMkernel port of the ESXi host.

e.

Click Save.

9-19

Deep Discovery Inspector Installation and Deployment Guide

Virtual Appliance - Configuring Mirrored VM Traffic Monitoring withRemote Mirroring
Remote mirroring enables you to monitor traffic on one switch through adevice on another switch and send the monitored traffic to one or more
destinations.

Figure 9-4. Mirrored VM Traffic Monitoring with Remote Mirroring

Remote mirroring requires that you configure a remote mirroring VLAN on
your physical switches. If you cannot configure a remote mirroring VLAN,
consider using encapsulated remote mirroring as an alternative.
In the steps below, the mirroring source and mirroring destination are thefollowing:

9-20

Port Mirroring on a VMware Virtual Distributed Switch• Mirroring source: Virtual distributed switch that fowards mirrored
traffic• Mirroring destination: Virtual distributed switch that receives mirrored
traffic and that can route the traffic to Deep Discovery Inspector
Before you begin, verify that the uplink ports of the ESXi hosts that receive
traffic are linked to the physical switch trunk port.

Procedure
1.

Configure the mirroring source to forward remote mirrored traffic to thedestination.
a.

Log in to the vSphere Web Client.

b.

Select your virtual distributed switch in the left column and thenclick Configure.

c.

Click Port Mirroring.
The Port mirroring screen appears.

d.

Click New....
The Add Port Mirroring Sessions window appears.

9-21

Deep Discovery Inspector Installation and Deployment Guidee.

Select Remote Mirroring Source.

f.

Click Next.
The Edit properties screen appears.

g.

9-22

In Name, type a session name.

Port Mirroring on a VMware Virtual Distributed Switchh.

For Status, select Enabled.

i.

In Encapsulation VLAN ID, specify the VLAN ID.
NoteThis is the remote mirroring VLAN ID configured on the VDS.

j.

Click Next.
The Select sources screen appears.

k.

Click the plus icon(
) to add the source virtual machines that you want to monitor.

l.

Click Next.
The Select destinations screen appears.

m. Add uplink in Available uplinks to Selected uplinks.
n.

Click Next.
The Ready to complete screen appears.

o.
2.

Verify that the settings are correct and then click Finish.

Configure the mirroring destination to receive mirrored traffic.
a.

Log in to the vSphere Web Client.

b.

Select your virtual distributed switch in the left column and thenclick Configure.

c.

Click Port Mirroring.
The Port mirroring screen appears.

9-23

Deep Discovery Inspector Installation and Deployment Guided.

Click New....
The Add Port Mirroring Sessions window appears.

e.

Select Remote Mirroring Destination.

f.

Click Next.
The Edit properties screen appears.

9-24

Port Mirroring on a VMware Virtual Distributed Switchg.

In Name, type a session name.

h.

For Status, select Enabled.

i.

Click Next.
The Select sources screen appears.

j.

Click the plus icon to add the VLAN ID that you want to monitor.
Note
This is the remote mirroring VLAN ID configured on the VDS.

k.

Click Next.
The Select destinations screen appears.

l.

Click the plus icon(
) to add the port ID of the Deep Discovery Inspector data port.

m. Click Next.

9-25

Deep Discovery Inspector Installation and Deployment Guide

The Ready to complete screen appears.
n.

Verify that the settings are correct and then click Finish.

Virtual Appliance - Monitoring Mirrored Traffic from the Same
ESXi Host
Deep Discovery Inspector virtual appliances can monitor mirrored VM
traffic from a same ESXi host. Learn how to configure the virtual distrbuted
switch in the following section.
• Virtual Appliance - Configuring Distributed Port Mirroring on a VDS on page
9-27

9-26

Port Mirroring on a VMware Virtual Distributed Switch

Virtual Appliance - Configuring Distributed Port Mirroring on a VDS
The distributed port mirroring for the virtual distributed switch enables you
to monitor traffic from a set of distributed ports to other distributed ports.

Figure 9-5. Distributed Port Mirroring on a VDS

The source virtual machines and destination Deep Discovery Inspector must
be on the same ESXi host. If they are on different ESXi hosts, consider using
remote mirroring or encapsulated remote mirroring as an alternative.

9-27

Deep Discovery Inspector Installation and Deployment Guide

Procedure1.

Log in to the vSphere Web Client.

2.

Select your virtual distributed switch in the left column and then click
Configure.

3.

Click Port Mirroring.
The Port mirroring screen appears.

4.

Click New....
The Add Port Mirroring Sessions window appears.

9-28

Port Mirroring on a VMware Virtual Distributed Switch

5.

Select Distributed Port Mirroring.

6.

Click Next.
The Edit properties screen appears.

9-29

Deep Discovery Inspector Installation and Deployment Guide

7.

In Name, type a session name.

8.

For Status, select Enabled.

9.

Click Next.
The Select sources screen appears.

10. Click the plus icon(
) to add the source virtual machines that you want to monitor.
11. Click Next.
The Select destinations screen appears.
12. Click the plus icon(
) to add the port ID of the Deep Discovery Inspector data port.
13. Click Next.
The Ready to complete screen appears.
14. Verify that the settings are correct and then click Finish.

9-30

Part IV
Post Installation

Chapter 10

Preconfiguration
Learn how to use the Preconfiguration Console to configure initial Deep
Discovery Inspector settings in the following sections:• Preconfiguration Console Access on page 10-2
• Preconfiguration Console Main Menu on page 10-4

10-1

Deep Discovery Inspector Installation and Deployment Guide

Preconfiguration Console
The Deep Discovery Inspector Preconfiguration Console is a terminal
communications program used to configure the network and system settings
that are required to access the Deep Discovery Inspector management
console.
The Preconfiguration Console also supports recovery operations if the
management console is not available.
Use the Preconfiguration Console to do the following:• Configure initial settings (product IP address and host name)• Perform a diagnostic test
• Ping the network to verify configuration• Restart the appliance• View device information and status• Change the root password• Configure manual traffic bypass
Note
Traffic Bypass is only configurable on supported hardware models.
Note
To enter data when using HyperTerminal, disable the scroll lock function on
your keyboard.

Preconfiguration Console Access
The Deep Discovery Inspector Preconfiguration Console is accessible from a
hardware or virtual appliance.
Access the Preconfiguration Console as follows:

10-2Preconfiguration• Accessing the Preconfiguration Console with a VGA Port on page 10-3
Tip
Trend Micro recommends accessing the Preconfiguration Console using
a monitor with a VGA port.

• Accessing the Preconfiguration Console with a Serial Port on page 10-3

Accessing the Preconfiguration Console with a VGA Port
Procedure1.

Using a VGA cable, connect the monitor VGA port to the appliance VGA
port.

2.

When the Preconfiguration Console screen opens, type the default
password admin and press ENTER twice.
Note
To enter data when using HyperTerminal, disable the scroll lock function
on your keyboard.

Accessing the Preconfiguration Console with a Serial Port
Procedure1.

Using an RS-232 serial cable, connect the serial port of the Deep
Discovery Inspector appliance to the serial port on a computer.

2.

On the computer, open a serial communication application(HyperTerminal).

3.

Type the following values if you are accessing the Preconfiguration
Console for the first time:• Bits per second: 115200
10-3Deep Discovery Inspector Installation and Deployment Guide• Data bits: 8• Parity: None
• Stop bits: 1• Flow control: None
Note
To enter data when using HyperTerminal, disable the scroll lock function
on your keyboard.

4.

When the Preconfiguration Console screen appears, type the default
password admin and press ENTER twice.

Preconfiguration Console Main Menu
The Preconfiguration Console main menu displays the following menu
items:
Table 10-1. Main Menu Items
Item

10-4

Description

1) Device Information andStatusView information about Deep Discovery Inspector andmonitor memory usage.

2) Device Settings

Modify the Deep Discovery Inspector IP address, subnet mask,
network default gateway address, and DNS servers.

3) Interface Settings

View the network speed and duplex mode for the
management port, automatically detected by Deep Discovery
Inspector.

Preconfiguration

Item4) System Tasks

Description
Configure the following:• Perform a diagnostic test
• Ping a server in the same subnet• Configure the SSH connection• Restart the system• Configure manual traffic bypass
Note
Traffic bypass is only configurable on supported
hardware models.

5) Change Password

Change the root password.

6) Log Off with Saving

Log off from the Preconfiguration Console after saving
changes.

7) Log Off without Saving

Log off from the Preconfiguration Console without saving
changes.

To access a menu item, type the number for the menu item and then press
ENTER.

Viewing Appliance Information and Status
Use the Device Information & Status screen to view the product name,version, and memory usage.
Note
View memory usage information on the Deep Discovery Inspector
management console. Go to Dashboard > System Status.
For details, see System Status in the Deep Discovery Inspector Administrator's
Guide.

10-5

Deep Discovery Inspector Installation and Deployment Guide

Procedure1.

Log on to the Preconfiguration Console.
The Main Menu appears.

2.

Type 1 to select Device Information & Status and press ENTER.
Note
To enter data when using HyperTerminal, disable the scroll lock function
on your keyboard.

The Device Information and Status screen appears.
3.

Press ENTER to return to the main menu.

Modifying Device Settings
Use the Device Settings screen to configure the management IP address
settings.
Note
These tasks can also be performed on the management console.

Procedure1.

Log on to the Preconfiguration Console.
The Main Menu appears.

2.

To select Device Settings, type 2 and press ENTER.
Note
To enter data when using a serial communication application (forexample, HyperTerminal), disable the scroll lock function on yourkeyboard.

10-6Preconfiguration

The Device Settings screen appears.
3.

In the Type field, use the space bar to select one of the following
properties:• dynamic• static

4.

Configure the following IPv4 address settings:a.

In the IP address field, type an IPv4 address.
Type a Subnet mask.

5.

b.

Type a Gateway IP address.

c.

Type a Primary and Secondary DNS server IP address.

(Optional) Configure the following IPv6 address settings:a.

In the Enable field, select yes.

b.

In the IP address field, type an IPv6 address.
Type a Subnet prefix.

6.

c.

Type a Gateway IP address.

d.

Type a DNS server IP address.

(Optional) Type a VLAN ID.
Note
The VLAN ID is used when a trunk connection is required between the
Deep Discovery Inspector management port and a switch. The VLAN ID
is used as a VLAN tag in 802.1Q Ethernet frame.

7.

Go to Return to main menu and press ENTER.

8.

To save the settings, type 6 and press ENTER.

10-7

Deep Discovery Inspector Installation and Deployment Guide

Modifying Interface Settings
By default, Deep Discovery Inspector automatically detects the network
speed and duplex mode for the management port. These settings may be
manually configured.
Tip
To maximize throughput, Trend Micro recommends full-duplex mode. Halfduplex is acceptable, but network throughput may be limited by transmission
delays.
Note
You can view the network interface settings in the management console. Go to
Administration > System Settings > Network Interface. For details, see
Network Interface in the Deep Discovery Inspector Administrator's Guide.

Procedure1.

Log on to the Preconfiguration Console.
The Main Menu appears.

2.

Type 3 to select Interface Settings and press ENTER.
Note
To enter data when using HyperTerminal, disable the scroll lock function
on your keyboard.

The Interface Settings screen appears.
3.

10-8

To change the interface settings, perform the following tasks:a.

Type 1 and press ENTER.

b.

In the Speed and Duplex fields, use the space bar to change the
network speed and duplex mode.

Preconfigurationc.

Navigate to Return to upper menu and press ENTER.

4.

Type 2 and press ENTER to return to the main menu.

5.

Type 6 and press ENTER to save the settings.

10-9Chapter 11

System Tasks
Learn how to perform system tasks on the Preconfiguration Console in thefollowing topics:• Performing a Diagnostic Test on page 11-2
• Performing a Ping Test on page 11-3
• Restarting Deep Discovery Inspector on page 11-4
• Changing the Root Password on page 11-4
• Configuring Manual Traffic Bypass on page 11-5
• Logging Off on page 11-5

11-1

Deep Discovery Inspector Installation and Deployment Guide

System Tasks Overview
Use the System Tasks screen to perform the following system tasks.
• Diagnostic test
• Restart system• Ping test
• SSH Connection• Traffic Bypass
Note
Traffic Bypass is only displayed on supported hardware models.

Performing a Diagnostic Test
Run a diagnostic test on Deep Discovery Inspector to capture and view a logof hardware and software status and events.
Procedure1.

Log on to the Preconfiguration Console.
The Main Menu appears.

2.

Type 4 and press ENTER.
The System Tasks screen appears.

3.

Type 1 and press ENTER.
The Diagnostic Test screen appears.

4.

On the HyperTerminal console, go to Transfer > Capture Text.
Note
This step uses HyperTerminal as an example. Other serial
communication applications can be used, but this step may be different.

11-2

System Tasks

5.

Browse to the folder and specify a file name for the log.
Note
This step uses HyperTerminal as an example. Other serial
communication applications can be used, but this step may be different.

6.

Click Start.
Note
This step uses HyperTerminal as an example. Other serial
communication applications can be used, but this step may be different.

7.

Under Run diagnostic test now?, go to OK and press ENTER.
While the diagnostic test runs, Deep Discovery Inspector displays log
entries on the console.
After the diagnostic test finishes, Deep Discovery Inspector generates asummary log report, and automatically restarts.

8.

After Deep Discovery Inspector restarts, open the log summary report toview the results.

Performing a Ping Test
Use a Ping test to verify network configuration.
Procedure1.

Log on to the Preconfiguration Console.
The Main Menu appears.

2.

Type 4 and press ENTER.
The System Tasks screen appears.

3.

Type 3 and press ENTER.
The Ping Test screen appears.
11-3

Deep Discovery Inspector Installation and Deployment Guide

4.

Input the server IP address and press Ping.
Ping test results appear on the screen.

5.

Press ESC to return to the main menu.

Restarting Deep Discovery Inspector
To restart Deep Discovery Inspector, access the Preconfiguration Console
using a serial communication application (for example, HyperTerminal).
Using Deep Discovery Inspector to access the Preconfiguration Console
allows you to restart the appliance remotely.
When Deep Discovery Inspector starts, it verifies the integrity of its
configuration files. The management console password may reset if theconfiguration file containing password information is corrupted. If
management console logon is unsuccessful when using the preferredpassword, log on using the default password admin.
Procedure1.

Log on to the Preconfiguration Console.
The Main Menu appears.

2.

Type 4 and press ENTER.
The System Tasks screen appears.

3.

Type 2 and press ENTER.
The Restart System screen appears.

4.

On the Restart System screen, navigate to OK and press ENTER.

Changing the Root Password
Procedure1.
11-4

Log on to the Preconfiguration Console.

System Tasks

The Main Menu appears.
2.

Type 5 and press ENTER.
The Change Password screen appears.

3.

Type the old and new passwords.

4.

Confirm the new password.

5.

Go to Return to main menu and press ENTER to return to the main
menu and save the settings.

Logging Off
Log off from the Preconfiguration Console with or without saving.
Procedure
1.

After changing the configuration settings, return to the main menu.

2.

Select one of the following logoff options:• To save the changes, type 6 and press ENTER.
• To exit without saving the changes, type 7 and press ENTER.

3.

Navigate to OK and press ENTER.

Configuring Manual Traffic Bypass
Procedure1.

Log on to the Preconfiguration Console.
The Main Menu appears.

2.

Type 4 and press ENTER.
The System Tasks screen appears.

3.

Type 5 and press ENTER.
11-5

Deep Discovery Inspector Installation and Deployment Guide

The Manual Traffic Bypass screen appears.

11-6

4.

Select Disabled or Enabled.

5.

Press ESC to return to the main menu.

Chapter 12

TroubleshootLearn about common troubleshooting options available in Deep Discovery
Inspector and find answers to frequently asked questions in the following
topics:• Frequently Asked Questions (FAQs) on page 12-2
• Troubleshooting on page 12-5

12-1

Deep Discovery Inspector Installation and Deployment Guide

Frequently Asked Questions (FAQs)
Find answers to frequently asked questions in the following topics.
• FAQs - Appliance Rescue on page 12-2
• FAQs - Configuration on page 12-3
• FAQs - Detections on page 12-3
• FAQs - Installation on page 12-3
• FAQs - Upgrade on page 12-4
• FAQs - Virtual Analyzer Image on page 12-4

FAQs - Appliance Rescue
How do I rescue the Deep Discovery Inspector appliance?
To rescue the Deep Discovery Inspector appliance, do one of the following:• Reinstall Deep Discovery Inspector and use the saved or default settings.
Important
All log data is deleted during reinstallation.

• In the management console, go to Administration > Updates > ProductUpdates > Sever Packs / Version Upgrade and install the service pack orversion upgrade file (*.R.tar).
Important
The service pack or version upgrade file must be the same version as theinstalled version.

How do I rescue the Deep Discovery Inspector appliance from unexpectedtraffic bypass?

12-2

TroubleshootTo rescue the Deep Discovery Inspector appliance from unexpected traffic
bypass, restart the Deep Discovery Inspector applaince. For details, seePower Off / Restart in the Deep Discovery Inspector Administrator's Guide.

FAQs - Configuration
Can I register Deep Discovery Inspector to more than one Apex Central
server?
No, you cannot register Deep Discovery Inspector to more than one Apex
Central server. For details on registering to an Apex Central server, see
Registering to Apex Central in the Deep Discovery Inspector Administrator's Guide.

FAQs - Detections
Why are there no more Virtual Analyzer detections on the widget or the
Log Query screen after Deep Discovery Analyzer or TippingPoint
Advanced Threat Protection Analyzer reinstalls?
After Deep Discovery Analyzer or TippingPoint Advanced Threat Protection
Analyzer reinstalls, the API key changes. Change the API key on the Deep
Discovery Inspector management console from Administration > Virtual
Analyzer > Setup.

FAQs - Installation
Does Deep Discovery Inspector installation disrupt network traffic?
When deployed out-of-band Deep Discovery Inspector does not disrupt
network traffic. When deployed out-of-band, Deep Discovery Inspector
installation should not disrupt the network traffic because the applianceconnects to the mirror port of the switch and not directly to the network.
When deployed inline, Deep Discovery Inspector can disrupt network traffic.
After a fresh installation, Deep Discovery Inspector is unable to obtain adynamic IP address. What do I do?
Restart the appliance and verify that it is able to obtain an IP address. Next,
connect an Ethernet cable from the management port to a known good
Ethernet connection and restart the appliance.
12-3

Deep Discovery Inspector Installation and Deployment Guide

FAQs - Upgrade
Can I roll back to a previous version after upgrading to Deep Discovery
Inspector 6.7?
No. The rollback function is not supported.
Why does Deep Discovery Inspector still use old components after
updating the software and restarting?
When updating components, Deep Discovery Inspector updates the software
first. Restart Deep Discovery Inspector and update the Network Content
Inspection Engine. After updating the Network Content Inspection Engine,
click Update, or wait for the next scheduled update.
How do I verify that the migration was successful?
After the upgrade, go to Administration > System Logs and in the
Description column, find the 2 events that are similar to "Attempted to
upgrade database instance" and "Updating Deep Discovery Inspector from<old version> to <new version>." Verify that the Outcome is Success for those
2 events.
What does Deep Discovery Inspector do when the database upgrade
process is unsuccessful?
Deep Discovery Inspector rebuilds a new, empty database. All previous
database data is not recoverable.

FAQs - Virtual Analyzer Image
I am unable to download images from an FTP server. What should I do?
Verify the following:• The specified server path, user name, and password are correct• Both active and passive modes are enabled on the FTP server• The FTP server supports UTF-8 (in case image names or file paths
contain multi-byte characters)
The Found New Hardware wizard opens when the image is tested in
VirtualBox. Does this affect Virtual Analyzer?
12-4Troubleshoot

The Found New Hardware wizard automatically runs whenever an image istransferred from one machine to another. If the Found New Hardware
wizard appears when the image is tested in VirtualBox, it may interfere with
the CD/DVD auto-run.

TroubleshootingThis section describes common troubleshooting options available in Deep
Discovery Inspector.
• Slow Management Console Response on page 12-5
• Detections on page 12-6
• "Database is Corrupt" Alert Displays on page 12-8
• Virtual Analyzer on page 12-8
• Virtual Analyzer Images on page 12-9
• Cannot Connect to Network Services on page 12-11• Diagnostics on page 12-11

Slow Management Console Response
The management console response is slow or times out.
This occurs when system resources are insufficient.
Procedure
1.
2.

To verify CPU, memory, and disk usage, go to https://<appliance IP

address>/html/troubleshooting.htm.

Under Real-time Status, select System Process (ATOP).
The System Process screen appears.

3.

Click Suspend and verify system resources real-time.

12-5

Deep Discovery Inspector Installation and Deployment Guide

Table 12-1. System Resources
Item
CPU

Line
CPU

ColumnIdle

Description
The lower the number, the busier the CPU is.
If this number is low, view the process
information and record the CPU with the highest
usage.

MEM

MEM

Free,
cache

The "Free" field indicates available memory. A
low number means that there is not enoughavailable memory to complete certain actions.

Disk

DSK

Busy

A high number indicates that the disk is busy.

Detections• No Detections on All Detections Screen on page 12-6
• "Unregistered Service" Server Displays in All Detections Query on page 12-7
• Unknown IP Addresses Display on a Screen on page 12-7
• Known Safe Objects Flagged as Malicious on page 12-7

No Detections on All Detections Screen
No detections appear on the management console All Detections screen.
Procedure
1.

Verify that the switch mirror port is configured to mirror both directionsof network traffic to the mirror port.
For details, see Deployment Planning in the Deep Discovery Inspector
Installation and Deployment Guide.

2.

Verify that networked packets can be captured.
a.

12-6

Go to the troubleshooting pages at https://<appliance IP
address>/html/troubleshooting.htm and then click on Network
Traffic Dump .

Troubleshootb.

In the drop-down menu, select the data port in use.

c.

Click Capture Packets.

d.

Wait 10 seconds and click Stop.

e.

Click View.
The Packet Capture Information screen appears.
1. In the Capfile information section, verify that the data rate
matches the real-time traffic rate.
2. Click Conversation by TCP or Conversation by UDP, and verify
that TCP and UDP packets are visible.

"Unregistered Service" Server Displays in All Detections Query
A server appears as an Unregistered service on the All Detections screen.
Verify that the server has been added to the Registered Services list. For
more details, see Adding Registered Services in the Deep Discovery Inspector
Administrator's Guide.

Unknown IP Addresses Display on a Screen
IP addresses that do not belong to your network appear on a screen.
Make sure that all IP addresses in your network have been added to the
network group correctly. For details, see Adding Network Groups in the Deep
Discovery Inspector Adminstrator's Guide.

Known Safe Objects Flagged as Malicious
Known safe files, IP addresses, domains, and URLs are flagged malicious byVirtual Analyzer.
• Add any safe objects to the Allow List. For details, see Creating a Custom
Allow List in the Deep Discovery Inspector Administrator's Guide.

12-7

Deep Discovery Inspector Installation and Deployment Guide• Move any safe objects from the Suspicious Objects list to the Allow List.
For details, see Viewing Suspicious Objects in the Deep Discovery Inspector
Administrator's Guide.

"Database is Corrupt" Alert Displays
The management console displays the "Database is corrupt" alert.
This message occurs when the database has been corrupted. As a precaution,
data is not written to the database, which now must be manually repaired.
For details, see Performing Product Database Maintenance in the Deep Discovery
Inspector Administrator's Guide.
WARNING!
Performing manual repairs on a database results in permanent loss of data.

Virtual Analyzer• Cannot Upload OVA on page 12-8
• No Virtual Analyzer Response to File Submissions on page 12-8

Cannot Upload OVA
The OVA is too large and cannot upload into Deep Discovery Inspector.
The OVA image must be between 1 GB and 30 GB in size.

No Virtual Analyzer Response to File Submissions
File samples were sent to Deep Discovery Inspector but no response wasreceived from Virtual Analyzer.
To receive results, enable file submission to Virtual Analyzer.
Procedure
1.
12-8

Verify that Virtual Analyzer is enabled.

TroubleshootFor details, see Enabling Virtual Analyzer in the Deep Discovery Inspector
Administrator's Guide.
2.

Go to Administration > Virtual Analyzer > File Submissions > Add andverify file submission rules are configured as follows:• Under Criteria, click the applicable file types.
• Under Actions, click Submit.
For details, see File Submission Rules in the Deep Discovery Inspector
Administrator's Guide.

3.

Go to Dashboard > Virtual Analyzer Status and view the Virtual
Analyzer status field on the Virtual Analyzer widget.
a.

If Virtual Analyzer status is "Disabled", enable Virtual Analyzer. Go
to Administration > Virtual Analyzer > Setup to enable filesubmission to a Virtual Analyzer.
For details, see Enabling Virtual Analyzer in the Deep Discovery Inspector
Administrator's Guide.

b.
4.

If the Virtual Analyzer status is "Enabled", restart Deep Discovery
Inspector.

Verify notification settings.
For details, see Configuring Email Notification Settings in the Deep Discovery
Inspector Administrator's Guide.

5.

If the problem persists, contact your technical support provider.

Virtual Analyzer Images• Installation CD/DVD Won't Start on page 12-9
• "Found New Hardware" Wizard on page 12-10• An Image Displays a Blue Screen on page 12-10

Installation CD/DVD Won't Start
The installation CD/DVD does not automatically start.
12-9

Deep Discovery Inspector Installation and Deployment Guide

Verify items by testing the Virtual Analyzer images in VirtualBox.
Procedure
1.

In Oracle VM VirtualBox Manager, click the imported custom Virtual
Analyzer image in the left panel.

2.

Click Settings and select Storage.

3.

Select Controller: IDE and verify that the specified type is PIIX4.

4.

Select the optical disc icon and verify that the specified CD/DVD drive is
IDE Secondary Master.

"Found New Hardware" Wizard
During Virtual Analyzer image creation, the Found New Hardware wizard
appears.
The Found New Hardware wizard automatically runs whenever an image istransferred from one machine to another.
When an image is imported, the Found New Hardware wizard may interferewith the CD/DVD auto-run. Make sure the Virtual Analyzer image is createdand prepared using the correct procedure. For details, see the Virtual Analyzer
Image Preparation User's Guide at https://docs.trendmicro.com/en-us/
enterprise/virtual-analyzer-image-preparation.aspx.

An Image Displays a Blue Screen
An image displays the blue "Cannot find Operating System" screen whentested in VirtualBox.
Verify items by testing the Virtual Analyzer images in VirtualBox.
Procedure
1.

12-10

In Oracle VM VirtualBox Manager, click the imported custom Virtual
Analyzer image in the left panel.

Troubleshoot2.

Click the Settings and select System.

3.

On the Motherboard tab, verify that the following are selected:• Chipset: ICH9
• Enable IO APIC

4.

On the Processor tab, verify that the PAE/NX is enabled.

5.

On the Acceleration tab, verify that the TV-x/AMD-V is enabled.

Cannot Connect to Network Services
You can use the Network Services Diagnostics screen to test the network
connections for the internal Virtual Analyzer and other network services.
Procedure
1.

Go to https://<appliance IP address>/html/troubleshooting.htm
and click Network Services Diagnostics.

2.

Select one or more enabled services and click Test.
Wait for the connection test to complete. The time required depends on
the network environment and the number of services selected. View theconnection test result in the Result column.

Diagnostics
For any issue not mentioned, run diagnostics to give test results and debug
logs to your Trend Micro Deep Discovery Inspector support provider.
Procedure
1.

Open the preconfiguration console.

2.

Select 4) System Tasks, and press ENTER.

3.

Follow the instructions in Performing a Diagnostic Test in the Deep
Discovery Inspector Installation and Deployment Guide.
12-11

Deep Discovery Inspector Installation and Deployment Guide

4.

Generate a debug log.
a.

Go to https://<appliance IP address>/html/
troubleshooting.htm.

b.

Go to Logs > Debug Logsc.

Under Debug Log Settings, set the debug level to Debug for themodules you want to debug.
To avoid performance loss, only set the debug level to Debug forrequired modules. Contact your support provider for advice on how
to set the level to debug and obtain the debug report.

d.

Click Save.

e.

If possible, reproduce the issue.

f.

Select one or more debug logs to export.
• Export debug log.
• Export advanced debug log.
• Select one or more dated debug logs under Export advanced
debug log to export the advanced debug log for that date.

g.

Click Export.
Tip
To conserve system resources, perform one export at a time.

h.

Under Debug Log Settings, click Reset to default log settings.

i.

Under Debug Log Maintenance, click Purge Debug Logs.

Inline Deployment and TLS Inspection• Network Connectivity Issue on page 12-13• TLS Connection Issue on page 12-14

12-12

TroubleshootNetwork Connectivity Issue
Procedure
1.

Verify that the link status of the inline port is connected.
a.

In the management console, go to Administration > System
Settings > Network Interface.

b.

In the Inline Interfaces section, view the connection status in the
Status column.
Click the right arrow() at the beginning of the row to display additional information about
the connection status.

2.

If the link status of the inline port is not connected, then verify that thefollowing applicable items are correct.
• Interface speed setting• Interface duplex setting• Interface and transceiver compatibility (particularly for fiberconnections)3.

Verify that the there is network activity.
12-13

Deep Discovery Inspector Installation and Deployment Guidea.

In the top-right corner of the management console, hover over thethroughput to get more information about the network activity.

4.

If there is no network activity, then verify that TLS traffic inspection isenabled in Deep Discovery Inspector and verify that the cable is securely
connected to Deep Discovery Inspector and the network device.

5.

(Optional) To monitor when traffic bypass unexpectedly occurs,configure agent mode or trap mode for SNMP in Deep Discovery
Inspector.
For details, see Network Interface and SNMP in the Administrator’s Guide.

TLS Connection Issue
Procedure
1.

2.

12-14

Identify the reason for the TLS connection issue.
a.

In the management console, go to Administration > Monitoring /Scanning > TLS Traffic Inspection > Inspection Settings > Domain
Tunneling > Configure tunneled domain.

b.

If you understand and are able to resolve the issue, then do so.
Otherwise, use the steps below to continue troubleshooting.

If you are unable to find the issue in Domain Tunneling, then viewabnormal connection information in the TLS Connection Monitoringtroubleshooting screen.

Troubleshoota.

Go to https://<appliance IP address>/html/
troubleshooting.htm and then click TLS Connection Monitoring.
The TLS Connection Monitoring screen appears.

b.

Type a client IP address and then click Monitor.

c.

After sufficient data is monitored, stop the monitoring.
Note
The monitoring can only save up to 10 minutes of data.

d.
3.

If you understand and are able to resolve the issue, then do so.
Otherwise, use the steps below to continue troubleshooting.

If you are unable to find the issue in TLS Connection Monitoring, thencollect more details and contact your support provider.
a.

Go to https://<appliance IP address>/html/
troubleshooting.htm and then click TLS Network Traffic Dump.
The TLS Network Traffic Dump screen appears.

b.

Type a client IP address and optionally type the server IP address
and port, and then click Capture Packets.

c.

After sufficient data is captured, stop the capture.

d.

If the client application that you are using has a log file with TLS
connection information, take a screen shot of the client application
log.

e.

Take screen shots of your TLS traffic inspection settings.

f.

Send the traffic dump and screen shots to your support
representative.

12-15

Part V
Technical Support
Learn about the following topics:• Troubleshooting Resources on page 13-1
• Contacting Trend Micro on page 14-1
• Sending Suspicious Content to Trend Micro on page 15-1
• Other Resources on page 16-1

Chapter 13

Troubleshooting Resources
Before contacting technical support, consider visiting the following Trend
Micro online resources.

13-1

Deep Discovery Inspector Installation and Deployment Guide

Using the Support Portal
The Trend Micro Support Portal is a 24x7 online resource that contains themost up-to-date information about both common and unusual problems.
Procedure
1.

Go to https://success.trendmicro.com.

2.

Select from the available products or click the appropriate button to
search for solutions.

3.

Use the Search Support box to search for available solutions.

4.

If no solution is found, click Contact Support and select the type of
support needed.
Tip
To submit a support case online, visit the following URL:
https://success.trendmicro.com/smb-new-request

A Trend Micro support engineer investigates the case and responds in 24
hours or less.

Threat Encyclopedia
Most malware today consists of blended threats, which combine two or more
technologies, to bypass computer security protocols. Trend Micro combats
this complex malware with products that create a custom defense strategy.
The Threat Encyclopedia provides a comprehensive list of names andsymptoms for various blended threats, including known malware, spam,
malicious URLs, and known vulnerabilities.
Go to https://www.trendmicro.com/vinfo/us/threat-encyclopedia/#malware
to learn more about:• Malware and malicious mobile code currently active or "in the wild"
13-2

Troubleshooting Resources• Correlated threat information pages to form a complete web attack story• Internet threat advisories about targeted attacks and security threats• Web attack and online trend information• Weekly malware reports

13-3

Chapter 14

Contacting Trend MicroIn the United States, Trend Micro representatives are available by phone oremail:
Address

Trend Micro, Incorporated
225 E. John Carpenter Freeway, Suite 1500
Irving, Texas 75062 U.S.A.

Phone

Phone: +1 (817) 569-8900
Toll-free: (888) 762-8736

Websitehttps://www.trendmicro.com

Email address

support@trendmicro.com• Worldwide support offices:
https://www.trendmicro.com/us/about-us/contact/index.html• Trend Micro product documentation:
https://docs.trendmicro.com

14-1

Deep Discovery Inspector Installation and Deployment Guide

Speeding Up the Support Call
To improve problem resolution, have the following information available:• Steps to reproduce the problem• Appliance or network information• Computer brand, model, and any additional connected hardware or
devices• Amount of memory and free hard disk space• Operating system and service pack version• Version of the installed agent• Serial number or Activation Code• Detailed description of install environment• Exact text of any error message received

14-2

Chapter 15

Sending Suspicious Content to Trend
Micro
Several options are available for sending suspicious content to Trend Microfor further analysis.

15-1

Deep Discovery Inspector Installation and Deployment Guide

Email Reputation Services
Query the reputation of a specific IP address and nominate a message
transfer agent for inclusion in the global approved list:
https://servicecentral.trendmicro.com/en-us/ers/
Refer to the following Knowledge Base entry to send message samples toTrend Micro:
https://success.trendmicro.com/solution/1112106

File Reputation Services
Gather system information and submit suspicious file content to Trend
Micro:
https://success.trendmicro.com/solution/1059565
Record the case number for tracking purposes.

Web Reputation Services
Query the safety rating and content type of a URL suspected of being aphishing site, or other so-called "disease vector" (the intentional source ofInternet threats such as spyware and malware):https://global.sitesafety.trendmicro.com/
If the assigned rating is incorrect, send a re-classification request to Trend
Micro.

15-2

Chapter 16

Other Resources
In addition to solutions and support, there are many other helpful resources
available online to stay up to date, learn about innovations, and be aware of
the latest security trends.

16-1

Deep Discovery Inspector Installation and Deployment Guide

Download Center
From time to time, Trend Micro may release a patch for a reported known
issue or an upgrade that applies to a specific product or service. To find out
whether any patches are available, go to:https://www.trendmicro.com/download/
If a patch has not been applied (patches are dated), open the Readme file todetermine whether it is relevant to your environment. The Readme file also
contains installation instructions.

Documentation Feedback
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please go to the following site:
https://docs.trendmicro.com/en-us/survey.aspx

16-2

Appendix A

Ports Used by the Appliance
The following section shows the ports that are used with Deep Discovery
Inspector and why they are used.
Table A-1. Port 22
Port

22

ProtocolTCP

Function

Listening

PurposeDeep Discovery Inspector uses this port to:• Connect to the preconfiguration console• Send logs and data to the Threat Management Services Portal if Deep
Discovery Inspector is registered over SSH

Table A-2. Port 25
Port

25

ProtocolTCP

Function

OutboundPurposeDeep Discovery Inspector sends notifications and scheduled reports through
SMTP.

A-1

Deep Discovery Inspector Installation and Deployment Guide

Table A-3. Port 53
Port

53

ProtocolTCP/UDP

Function

OutboundPurposeDeep Discovery Inspector uses this port for DNS resolution.

Table A-4. Port 67
Port

67

Protocol

UDP

Function

OutboundPurposeDeep Discovery Inspector sends requests to the DHCP server if IP addresses are
assigned dynamically.

Table A-5. Port 68
Port

68

Protocol

UDP

Function

Listening

PurposeDeep Discovery Inspector receives responses from the DHCP server.

Table A-6. Port 80
Port

80

ProtocolTCP

Function

Listening

PurposeDeep Discovery Inspector connects to other computers and integrated Trend
Micro products and hosted services through this port.
• Share threat intelligence information with other products

Function

A-2

OutboundPorts Used by the AppliancePurposeDeep Discovery Inspector connects to other computers and integrated Trend
Micro products and hosted services through this port.
• Communicate with Trend Micro Apex Central if Deep Discovery Inspector isregistered over HTTP
• Update components by connecting to the ActiveUpdate server

Table A-7. Port 123
Port

123

Protocol

UDP

Function

OutboundPurposeDeep Discovery Inspector uses this port to connect to the NTP server tosynchronize time.

Table A-8. Port 137
Port

137

Protocol

UDP

Function

OutboundPurposeDeep Discovery Inspector uses NetBIOS to resolve IP addresses to host names.

Table A-9. Port 161
Port

161

Protocol

UDP

Function

Listening

PurposeDeep Discovery Inspector uses this port for SNMP agent listening and protocol
translation.

Table A-10. Port 162
Port

162

Protocol

UDP

Function

OutboundA-3

Deep Discovery Inspector Installation and Deployment Guide

PurposeDeep Discovery Inspector uses this port to send SNMP trap notifications.

Table A-11. Port 389
Port

389

ProtocolTCP/UDP

Function

OutboundPurposeDeep Discovery Inspector uses this port to retrieve user information from LDAP
servers.
Note
This is the default port. Configure this port through the management
console.

Table A-12. Port 443
Port

443

ProtocolTCP

Function

Listening

PurposeDeep Discovery Inspector uses this port to:• Access the management console with a computer through HTTPSFunction

A-4

OutboundPorts Used by the AppliancePurposeDeep Discovery Inspector uses this port to:• Communicate with Deep Discovery Director - On-premises version
NoteThis is the default port. Configure this port through the
management console.
• Communicate with Trend Micro Apex Central
NoteThis is the default port. Configure this port through the
management console.
• Communicate with Trend Micro Service Gateway• Communicate with Trend Vision One• Connect to MITRE ATT&CK™ Tactics and Techniques website• Connect to Trend Micro Threat Connect• Query Mobile App Reputation Service through Smart Protection Server• Query Predictive Machine Learning engine• Query the Web Reputation Services blocking reason• Register to the mitigation server• Scan APK files and send detection information to the Mobile App
Reputation Service• Send files to Deep Discovery Analyzer for sandbox analysis
NoteThis is the default port. Configure this port through the
management console.
• Send logs and data to the Threat Management Services Portal if Deep
Discovery Inspector is using SSL encryption• Share anonymous threat information with the Smart Protection Network

A-5

Deep Discovery Inspector Installation and Deployment Guide• Share threat intelligence information with Trend Micro TXOne OT Defense
Console• Verify the safety of files through the Certified Safe Software Service

Table A-13. Port 465
Port

465

ProtocolTCP

Function

OutboundPurposeDeep Discovery Inspector sends notifications and scheduled reports through
SMTP over TCP with SSL/TLS encryption.

Table A-14. Port 514
Port

514

Protocol

UDP

Function

OutboundPurposeDeep Discovery Inspector sends logs to a syslog server over UDP.
Note
The port must match the syslog server.
NoteThis is the default port. Configure this port through the management
console.

Table A-15. Port 587

A-6

Port

587

ProtocolTCP

Function

OutboundPurposeDeep Discovery Inspector sends notifications and scheduled reports through
SMTP over TCP with STARTTLS encryption.

Ports Used by the Appliance

Table A-16. Port 601
Port

601

ProtocolTCP

Function

OutboundPurposeDeep Discovery Inspector uses this port to send logs to a syslog server.
Note
The port must match the syslog server.
NoteThis is the default port. Configure this port through the management
console.

Table A-17. Port 636
Port

636

Protocol

UDP

Function

OutboundPurposeDeep Discovery Inspector uses this port to retrieve user information from LDAP
servers.
Note
This is the default port. Configure this port through the management
console.

Table A-18. Port 3268
Port

3268

ProtocolTCP

Function

OutboundA-7

Deep Discovery Inspector Installation and Deployment Guide

PurposeDeep Discovery Inspector uses this port to retrieve user information from LDAP
servers.

Table A-19. Port 3269
Port

3269

ProtocolTCP

Function

OutboundPurposeDeep Discovery Inspector uses this port to retrieve user information from LDAP
servers.

Table A-20. Port 4343
Port

4343

ProtocolTCP

Function

OutboundPurposeCommunicate with Smart Protection Server

Table A-21. Port 5275
Port

5275

ProtocolTCP

Function

OutboundPurpose• Query Web Reputation Services through Smart Protection Server using
HTTPS• Query Web Reputation Services through Service Gateway Smart Protection
Server using HTTPS

Table A-22. Port 6514

A-8

Port

6514

ProtocolTCP

Function

OutboundPorts Used by the AppliancePurposeDeep Discovery Inspector sends logs to a syslog server over TCP with SSL
encryption.
Note
The port must match the syslog server.
NoteThis is the default port. Configure this port through the management
console.

Table A-23. Port 8514
Port

8514

Protocol

UDP

Function

OutboundPurposeDeep Discovery Inspector sends syslog information to Deep Discovery Advisor if
Deep Discovery Inspector is integrated with Deep Discovery Advisor.
Note
This is the default port. It can be configured through the management
console, and it must match the syslog settings on Deep Discovery
Advisor.

Table A-24. Port 8080
Port

8080

ProtocolTCP

Function

Listening

A-9

Deep Discovery Inspector Installation and Deployment Guide

PurposeDeep Discovery Inspector uses this port to share threat intelligence with otherproducts.
NoteThis is the default port. Configure this port through the management
console.

A-10

Item Code: APEM69874/231211