Prerequisites

You have completed aSecurity installation.

Precautions

1. Specification adjustment may generate the following impacts on your business: For access to services with cyber attack protection enabled, a small number of packets (one or two) may be lost, and a network jitter of no more than 10 seconds may occur. We recommend that you perform the operation during off-peak hours.
2. Specification adjustment may generate the following impacts on security protection: After configuration modification, the cyberattack protection module will restart to make the modification effective. The security protection policy will lose efficacy and recover within 1 minute. If any troubleshooting task exists, it will also be automatically closed.
3. If cyber attack protection is enabled, it occupies the CPU and memory resources of each physical host, which can be 1 CPU core, 1 GB memory by default and 8 CPU cores, 8 GB memory at maximum.

Steps

1. After installing aSecurity, click aSecurity. In the pop-up dialog box, click Go Now to enable VM security protection.

2. Go to Security Settings > Security Capabilities and click Enable for VM Security Protection

3. Configure and deploy EDR-MGR.

• Basics

Import the .vma VM file.

Select the datastore.

Keep the default value for the run location.

• Management interface: Specify the connection to the physical interface (this physical interface must have access to the HCI management interface, and we recommend that you plan it on the same segment as the HCI management network).

• (Optional) Business interface: Specify the connection to the physical interface of the business network, which can be used for connecting to security servers such as Antivirus Database and Cloud-Based Engine. Make sure that the physical interface can be connected to the following servers:

Antivirus Database: http://download.sangfor.com.cn/download/product/edr

Vulnerability Service Pack: https://upd.sangfor.com.cn

Neural-X: https://auth.sangfor.com.cn

Cloud-Based Engine: https://analysis.sangfor.com.cn

Cloud Security Program: https://clt.sangfor.com.cn

4. Click OK.
5. After the successful deployment, it will automatically redirect to the Security Capabilities page. Then, enable cyber attack protection.

• Cyber attack protection specification: Select the specifications as needed. If the specifications do not match the remaining resources of the physical host, that is, resources are insufficient, enablement may fail.

• Processing for performance overload:

Passthrough: The platform automatically enables the policy passthrough mode if it is detected that the traffic limit is exceeded. This helps avoid business interruption.

Packet loss: The platform directly drops excessive packets if it is detected that the traffic limit is exceeded, which may cause business interruption.