To create a NextGen malware scanner instance

1. Make sure that the NextGen malware scanner application you want to use is located in the repository on the Flex Appliance Console.
2. Perform the following tasks if you have not already:

   • Configure at least one network interface. You can configure a physical interface, add a VLAN tag, or create a bond.

   • Add at least one tenant.

3. Gather the following information for the new instance:

   Note:

   The hostname and IP address must not be in use anywhere else in your domain.

   • Tenant that you want to assign it to

   • Hostname (maximum of 63 characters including the domain name)

   • IP address

   • Network interface

   • Domain name

   • Name servers

   • Search domains

   • Primary server hostname

     Note:

     The Flex Appliance Console does not prevent entering the same hostname in both the Hostname for NextGen Malware Scanner and the Primary server hostname fields, but that configuration is not supported. You must have a preexisting primary server with a different hostname.

   • API key for primary server operations

     For more information about API keys, see the chapter "Creating and using API keys" in the NetBackup Web UI Security Administrator's Guide.

   • Scanner host pool name

     If the scanner host pool doesn't exist, it is created when you create the instance.

   • Certificate Authority (CA) information for one of the following:

     For a NetBackup CA:

     • CA SHA-1 or SHA-256 certificate fingerprint

       If the primary server is a Flex instance, you can locate this information from the instance details page of the primary server instance. Click on the instance name under Application instances on the System topology page.

       If the primary server is not a Flex instance, see the NetBackup Security and Encryption Guide for the steps to locate this information from NetBackup.

     • (Optional) Token for host ID-based certificate

       Depending on the primary server security level, the host may require an authorization or a reissue token. If you do not specify a token when you create the instance, the wizard attempts to automatically obtain the certificate.

     For an external CA:

     • Trust store, in PEM format

     • Host certificate, in PEM format

     • Private key, in PEM format

     • (Optional) Passphrase of the private key

       A passphrase is required if the key is encrypted.

     • (Optional) Custom CRL files

4. If a firewall exists between the primary server and the new instance, open the following port on the primary server to allow communication:

   PBX: 1556

5. From the System topology page of the Flex Appliance Console, navigate to the Application instances section.
6. Click Create instance.
7. Select the appropriate malware scanner application from the repository list that appears, making sure to verify the version number. Click Next.
8. Follow the prompts to create the instance. When you are done, you can view the progress in the Activity Monitor, which is accessible from the left pane of the Flex Appliance Console.

   Note:

   If you use DNS and the DNS server includes both IPv4 and IPv6 addresses, the instance must be configured with both as well.

   If you do not want to use DNS or want to bypass DNS for certain hosts, verify that the hostname resolution information is included in the Hosts file entries field. You must include entries for the primary server and any other NetBackup hosts that you want to communicate with the instance.

9. (Optional) If you entered the information for an HTTPS proxy server when you created the instance, perform the following additional steps:

   • Log in to the instance and upload the CA certificates to /mnt/nbdata.

   • Run the following command:

     sudo su -

     vi ~/.bashrc

   • Add the following line to the file:

     SOPHOS_CA_CERTIFICATE_PATH=/mnt/nbdata/<certificate path>

     Where <certificate path> is the path to the CA certificates.

10. Cohesity recommends that you configure email alerts so that you receive a notification if the staging volume becomes full. To configure email alerts, see the topic "Configuring email alerts" in the NetBackup Flex Appliance Getting Started and Administration Guide.

    Note:

    If you receive alerts that the staging volume is close to full, and it is already at the maximum size of 50 GB, you can reduce the number of images that are scanned at the same time. To do so, set the scan host resource limits to a lower value on the primary server from the NetBackup web UI. For more details, see the topic "Configure resource limits for malware detection" in the NetBackup Security and Encryption Guide.

    Note:

    When you start the instance, it is activated on the NetBackup side. When you stop the instance, it is deactivated.

    If the scan host is not activated after starting the scanner container, wait until the NetBackup primary server is fully started, then restart the scanner container so the scan host activation can be retried.