To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Can RPC storage appliances, for example NetApp ONTAP and VSES scanners, be in the same Active Directory domain?
Yes. This configuration is recommended for the following reasons:

• Security—If the storage appliances and the VSES scanners and NAS reside in different Active Directory domains, you must make sure that authentication is unhindered.
• Performance—The closer the storage appliances and VSES scanners are, both logically (security boundaries) and physically (router hops), the more optimum the performance. The RPC design choice involves the following protocols and their dependencies:
  • Active Directory
  • CIFS/SMB
  • Named Pipes
  • NetBIOS over TCP/IP
  • RPC

This design choice confers permanent throughput benefits over competing designs such as ICAP. The storage appliances, network, Windows operating system, and the VSES scanner product must fulfill the prerequisites. The same prerequisites exist, regardless of the vendor; these requirements are not specific to VSES.

What environments does VSES support?
The filer models supported are covered in KB74863.

Are read-only storage appliance volumes supported?
No. Any read-only volume on a storage appliance is not a candidate for VSES scanning and must be excluded in VSES. Examples of such volumes are a NetApp ONTAP SnapMirror volume and a NetApp ONTAP Snapshot volume. For additional information, see KB60568.

Does VSES work successfully in the presence of SMB3?
Yes. But, whether VSES works successfully depends on the filer. If the filer supports SMB3, and it can successfully negotiate with the operating system used for the VSES scan server, then VSES continues to function as normal.

Is there any best practice advice before installing VSES?
Yes. Both McAfee Enterprise and storage appliance vendors have documents to help:

• For important prerequisites for installing VSES 1.2.0, see KB86868.
• Product documentation:
  - See the VSES 1.2.0 Product Guide.
  - See the VSES 1.3.0 Product Guide.
• VSES Product Data Sheet: http://www.mcafee.com/ca/resources/data-sheets/ds-virusscan-enterprise-for-storage.pdf
• NetApp Documentation:
  - Antivirus Scanning Best Practices Guide: https://www.netapp.com/us/media/tr-4286.pdf
  - To access the specific timeout values for NetApp and VSES article, you must log on and search for the right NetApp Knowledge Base at http://support.netapp.com/

- Time out settings for CDOT environments: https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/What_is_the_recommended_value_for_ONTAP_Vscan_offbox_timeout_settings%3F
- Time out settings for 7 mode environments: https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/The_recommended_value_for_vscan_options_timeout_for_Data_ONTAP_7-Mode

• Antivirus Solutions with EMC Isilon Scale-Out NAS (Best Practice Recommendations for Capacity and Performance): https://community.emc.com/thread/199473
  
  NOTE: McAfee Enterprise can't accept any responsibility for the accuracy of third-party information.

Back to Contents

Can I have two VSES scanners monitoring one storage appliance?
Yes. Having two scanners is actually the best configuration to obtain good performance. See NetApp best practices: https://www.netapp.com/us/media/tr-4286.pdf


Is the NetApp policy in ePolicy Orchestrator (ePO) related to the Network Appliance filer AV Scanner feature in the local VSES scanner UI?
Yes. The NetApp policy is what propagates to the Network Appliance filer AV Scanner in the local VSES scanner UI. Both ICAP AV Scanner and Network Appliance filer AV Scanner are configured using two separate policies in ePO.


Is it needed to enable Interactive Logon for the VSES service account, when using RPC-based or NetApp ONTAP controllers?
Other environmental group policies might require that Interactive Logon be enabled for the service account, for the account to apply successfully within the Network Appliance AV Scanner plug-in, in the VSE console. Certain restrictions can prevent the account from applying during McAfee Agent policy enforcement, and when manually entering the credentials in the NetApp plug-in, without Interactive Log on being enabled.


Can I enable the scan on network drives feature for VSE or ENS Threat Prevention when these products are installed on the client systems accessing the filer that is already protected by VSE for Storage? 
Although this option is configurable within VSE and ENS Threat Prevention, McAfee Enterprise does not support the scan on network drives feature when the network share is already protected by a separate real-time scanner such as VSES. For example, when the storage device is already protected by VSES, enabling scan on network drives for the VSE or ENS on-access scanner does not provide any added malware detection capability. When you enable this feature for VSE or ENS Threat Prevention with VSE for Storage real-time scanning present, it might introduce performance and file-locking issues. The issues are caused because these products try to scan files simultaneously, when accessed by the user.

Does VSES share a global cache like MOVE AV?
No. The storage appliance keeps the clean file cache, if there is one configured for the storage appliance. VSES sends a notification to the storage appliance when DATs are updated, and it is up to the storage appliance to delete its cache when notified and is not the responsibility of VSES.


Does VSES use the persistent cache shared between VSE on-access scanner (OAS) and VSE on-demand scanner ODS?
No. VSES uses the VSE McAfee McShield service purely as its scan engine. Scan requests that VSES makes on the engine come via a separate code path to the McAfee McShield service, and are unrelated to any local scans and their caching that VSE is responsible for.


How does VSES scan large files?
Only a small subset of a file is scanned. The engine determines which parts. RPC storage appliances allow VSES to access their file systems directly, greatly enhancing scan request fulfillment speed. ICAP storage appliances must copy the whole file to be scanned to the VSES scanner first, before the engine can then scan, making scan request fulfillment times longer than with RPC. So, file size and network saturation are more important in an ICAP scenario.


Does VSES load its own DAT and Engine or does it use what the 'McAfee McShield' service loads?
VSES uses the McAfee McShield service as its DAT and Engine server.


Does VSES use threads from the 'McAfee McShield' service if there is excessive load?
The McAfee McShield service spawns scan threads to serve each VSES scan request it receives. This thread count is irrespective of other scan threads related to local VSE scanning.


What is the relevance of the VSES scan thread configuration and how does it affect the needed scanner count?
Depending on your environment, you must plan for VSES to handle the expected load. You determine this load as follows:

• You have y number of physical filers.
• You have z number of discrete filer IP addresses that send scan requests.

Back to Contents