Antivirus for VM environment

Mishra

My boss is looking to get anti virus for our VM environments. Currently we have XenServer and VMware.

We have Microsoft Forefront currently but he says that when he turns on real time protection, it kills the host so we cannot run it.

I've used Symantec in almost all my environments, and have never seen real time protection unable to be used. That doesn't mean I like Symantec by the way.


Do you all have an antivirus solution running real time protection in your VM environments? If so, what product and what hypervisor? And most specifically, are the VMs running Citrix?

Thanks.

Everyone

I've seen the same thing with Forefront running on VMWare, not sure what causes it. I was only playing with Forefront as a trial, gave up after it made everything unusably slow.

I'm guessing you're talking an AV gateway as a "Virtual Appliance" then? Need just AV, or anti-spam too?

TLeTourneau

If you are looking for the guests, we use Symantec Client Security with no problems.

Zaits

We use Trend Micro Deep Security for our VMware environment, but that wont work for XenServer( at least I don't think so). Deep Security takes an agentless approach for Windows server that just need anti-malware protection. Basically you install endpoint security on the VM and it redirects traffic to the deep security virtual appliance that does the actual scanning. If you need more detailed information then that just IM me.

Mishra

Zaits wrote: »

We use Trend Micro Deep Security for our VMware environment, but that wont work for XenServer( at least I don't think so). Deep Security takes an agentless approach for Windows server that just need anti-malware protection. Basically you install endpoint security on the VM and it redirects traffic to the deep security virtual appliance that does the actual scanning. If you need more detailed information then that just IM me.

We just watched a demo provided by Trend Micro today about Deep Security. Seems decent but I don't want to have 2 different installations.

Does it work well? Do you do a lot of IO in your Vmware environment?

Mishra

Everyone wrote: »

I've seen the same thing with Forefront running on VMWare, not sure what causes it. I was only playing with Forefront as a trial, gave up after it made everything unusably slow.

I'm guessing you're talking an AV gateway as a "Virtual Appliance" then? Need just AV, or anti-spam too?

We would prefer having anti-spam included but it's not required. I think Deep Security does spam too.

I don't mind AV clients as long as they don't cause huge performance hits.

Zaits

Mishra wrote: »

We just watched a demo provided by Trend Micro today about Deep Security. Seems decent but I don't want to have 2 different installations.

Does it work well? Do you do a lot of IO in your Vmware environment?

When it works it works great and the IO is very little. When there are problems Trend points the finger at VMware and VMware points the finger at Trend. Both vendors have very little knowledge of each others product when it comes to troubleshooting as well, which makes it more difficult. The concept is great and like I said when it works its amazing, but it still has some maturity to do.

Everyone

Mishra wrote: »

We would prefer having anti-spam included but it's not required. I think Deep Security does spam too.

I don't mind AV clients as long as they don't cause huge performance hits.

I've worked with Symantec and McAfee products in on both VMware and Citrix, never had an issue with them. Also worked with Websense products. I think Websense is forcing you to buy their hardware appliance now... not sure if they came out with a virtual one yet... you used to just run it on a Windows server. When you could run it on a Windows server, it ran great on a VMware VM.

We have TrendMicro on everything where I work now, and I hate it. I can't say it's had any problems with any of our VMs, but it sucks on all our Exchange 2003 clusters.

SilverGenius

We have Forefront running on our VMware machines. I really don't notice a hit on the virtual machines at all. A few of the VM's are running XenApp etc.