Installing Norton AntiVirus on CallManagers

[ksowell]

Should antivirus software be installed on CallManager (Win2k) servers? My organization is moving ahead with AV on CallManagers. But consultant engineers are advising against it, that CSA will protect the CallManager without AV software. What is Cisco's recommendation?

[jbarcena]

CSA is the best way to go, but here is a document for the supported 3rd party antivirus:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/prod_bulletin0900aecd800f8572.html

HTH

Jorge

[stomasko]

Cisco doesn't formally support it however it can be done. It can cause performance issues because as you know it will use processor and memory resources.

Here is a link on some issues with Norten AV, there are others on Cisco's site for McAfee and others as well.

http://www.cisco.com/en/US/products/sw/voicesw/ps556/prod_bulletin0900aecd800f6180.html

Hope this helps.

Steve

[wojtek]

Hi,

Are this setings still valid for Norton AV 9.0?

Regards

Wojtek

[Tommer Catlin]

Here is the document I found a little ways back. Personally, I'm not a fan of Norton at all. It's always been a slow hog on servers. But here is what Cisco has to say on it.

[wojtek]

Hi

Thanks for your reply. I know this document, but there is only info where the newest NAV is 8.1. I am looking for some info about 9.0, and I want to know if this information for NAV 8.1 (registry settings, etc.) are still valid for 9.0...

Regards

Wojtek

[Tommer Catlin]

I would verify with TAC. They are pretty picky about AV software on the CCM and Unity servers.

[maharris]

Here is a link to the latest list of supported third party apps that I have seen:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/prod_bulletin0900aecd800f8572.html

And this is from the SRND:

Unmanaged Cisco Security Agent

Cisco developed a default Cisco Security Agent policy for its servers that allows all the correct things needed for that VoIP server to function, while also preventing known and unknown attacks from affecting the VoIP servers. At a minimum, you should install and run this unmanaged version Cisco Security Agent. This software protects the application and the operating system from both viruses and worm attacks. To get the maximum protection from these types of intrusions, ensure that the newest version of the Cisco Security Agent software is always installed on your servers. With the unmanaged agent installed on your servers, you will be able to see the logs of attacks on only the system where the agent is installed. You will have to log into each system to check the log files that might be there because of some type of alarm that has occurred.

And

Antivirus

Approved antivirus software should be run on all of the IP Telephony servers and VoIP application servers that have been approved to run that software. As with any other server in a network, antivirus software helps protect the Cisco CallManager server from being infected with a worm or a virus that could impact call processing. The Cisco Security Agent should not be the only preventative software installed on the system because Cisco Security Agent cannot clean the system of infection. Only an antivirus software can clean and infected system.

Additional information about running antivirus software on the Cisco CallManager servers is available at

http://www.cisco.com/univercd/cc/td/doc/product/voice/c_callmg/sec_vir/index.htm

This is link to the SRND:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_implementation_design_guide_chapter09186a00805fba3a.html#wp1061427

Mary Beth