Storage refers to the remote network file shares that contain the files the File Protect appliance scans for malware. The appliance can perform malware analysis scans on accessible files stored in network shares, collaboration servers, and remote hard drives.
Important
By default, The File Protect appliance supports using the ether1 interface to access storage. When the ether2 interface is used to access storage, the ether1 and ether2 interfaces must be on different networks. You can use the following CLI command to configure a nondefault gateway to reach the storage server from the ether2 interface:
ip route <network prefix> <netmask or mask length> <next hop IP address or interface name> <interface name> (terminal)
The following remote file access protocols are supported:
CIFS shares store files on Windows systems.
SMB shares store files, printers, and serial ports on Windows systems.
Note
The default in File Protect is SMB Version 2.
NFS shares store files on Linux systems.
WebDAV shares store files on Web servers.
Secure WebDAV shares store files on Web servers over HTTPS.
There are three share types. The File Protect appliance scans Files shares. Files are then moved from it as follows:
Malicious files are moved to a Quarantine share, if one is configured for a scan. You can select either a quarantine share you added or "local_QF." If you select "local_QF," the File Protect appliance will create a
local_QFfolder in the source file share the first time it encounters a malicious file, and will move all malicious files into it. Trellix recommends against using "local_QF," because malicious files will not be isolated from the source files.Non-malicious files are moved to a Good files share, whitelisted files are moved to a Whitelist Files share, and files with disabled or unknown file types are moved to an Unknown files share. You need to configure three separate shares as mentioned in the line before.
In the next scan, the malicious files remaining in the Files share will be reanalyzed. The non-malicious files remaining in the Files share will be marked as duplicates; they will be reanalyzed the next time the share is scanned after seven days has elapsed.
Important
Files cannot be moved to shares with read-only access.
Storage settings
Setting | Description |
|---|---|
Name | A unique name to identify the storage. The name can contain letters, numbers, hyphens (-), underscores (_), and periods (.). |
Protocol | CIFS, NFS, WebDAV, or Secure WebDAV |
Certificate | Certificate Authority (CA) certificate (Secure WebDav shares only) |
Server | The URL or name of the file server that hosts the network share. |
Share to mount | The network share name or full export path. |
Username | A user with access to the remote file system (CIFS, WebDAV, and Secure WebDAV shares only). |
Password | The password used to authenticate the user (CIFS, WebDAV, and Secure WebDAV shares only). |
Type of share | Quarantine, Good, Whitelist, Unknown Files, or Files. |