web
You’re offline. This is a read only version of the page.
close

Online Help Center

  • Search
  • Support
    • For Home
    • For Business
  • English (US)
    • Bahasa Indonesia (Indonesian)
    • Dansk (Danish)
    • Deutsch (German)
    • English (Australia)
    • English (US)
    • Español (Spanish)
    • Français (French)
    • Français Canadien
      (Canadian French)
    • Italiano (Italian)
    • Nederlands (Dutch)
    • Norsk (Norwegian)
    • Polski (Polish)
    • Português - Brasil
      (Portuguese - Brazil)
    • Português - Portugal
      (Portuguese - Portugal)
    • Svenska (Swedish)
    • ภาษาไทย (Thai)
    • Tiếng Việt (Vietnamese)
    • Türkçe (Turkish)
    • Čeština (Czech)
    • Ελληνικά (Greek)
    • Български (Bulgarian)
    • Русский (Russian)
    • עברית (Hebrew)
    • اللغة العربية (Arabic)
    • 日本語 (Japanese)
    • 简体中文
      (Simplified Chinese)
    • 繁體中文
      (Traditional Chinese)
    • 繁體中文 HK
      (Traditional Chinese)
    • 한국어 (Korean)
This website uses cookies for website functionality and traffic analytics. Our Cookie Notice provides more information and explains how to amend your cookie settings.
Learn More Yes, I agree
  • Online Help Center
  • Trend Micro Cloud One
  • Trend Cloud One
  • Trend Cloud One Network Security
  • Network Security with hosted infrastructure
Table of Contents
The page you're looking for can't be found or is under maintenance
Try again later or go to the home page
Go to home page
  • Getting Started
    • Network Security
    • PCI DSS compliance enabled by Network Security
    • Interactive demo
      • Emerging threat protection
      • Next Steps
    • Quick Network Security trial
      • Deploying protection
      • Attack simulation
      • Inbound attacks
      • Outbound attacks
      • Outbound attacks using Malware filters
      • Next steps
  • Network Security
    • Billing
      • Billing Overview
      • Pay as You Go billing
        • Free tier
        • Sign up for Pay as You Go
        • Prerequisites
        • Register for Pay as You Go in Workload Security
        • Vendor-provided cost allocation tags
        • Enable the Network Security cost allocation tag
        • View the itemized usage
    • Manage virtual appliances
      • Add cloud accounts and appliances
      • Manage appliance deployment tokens
        • Token generation
      • Verify deployment prerequisites
      • IAM roles and permissions
        • Updating IAM roles
      • Upgrading Appliances
        • Upgrading a Network Security Appliance
          • Seamless Appliance Upgrade
          • Downgrading your appliance
          • Verifying Build Version
          • Managing Network Service Impact
        • Using APIs to Upgrade Virtual Appliances
        • Managing Network Impact
          • AWS Upgrade Process Management
          • Azure Upgrade Process Management
      • Assets
      • Threat Insights
      • Rename a virtual appliance
      • Appliance health notifications
      • Virtual appliance outbound connections
      • Monitor events
      • Troubleshooting
    • Policies
      • Manage Policies
      • Enhance Security Value with AWS Network Firewall and Trend Micro Cloud One
      • Share threat intelligence with AWS
        • Enable Sharing
        • Verify rule group sharing
        • Shared rule groups
        • Stateless rules
        • Stateful rules
        • Create firewall policies
        • Configure firewall
        • Configure logging
        • Testing your rule groups
      • TLS inspection
        • TLS inspection overview
        • Key TLS terms
        • TLS inspection for AWS
          • TLS Requirements for AWS
          • Configure TLS inspection for AWS
        • TLS inspection for Azure
          • TLS Requirements for Azure
          • Configure TLS inspection for Azure
      • Filters
      • Customize filter settings using the GUI
      • Distribute filter overrides to your network
      • Create, update, or delete filter overrides using an API
      • Update to latest filter package
      • Threat Intelligence packages
        • Update a threat intelligence package
        • Manual Syncs
      • Geolocation filtering
        • Configure Geolocation filtering using the GUI
        • Configure Geolocation filtering using APIs
      • Domain filtering
        • Manage your permit list using the GUI
        • Manage your permit list using APIs
        • Configure a list of verified domains
        • Enable domain configuration
        • Sync permit list and domain configuration with your appliance
        • Verify your domain settings are applied to your appliances
        • Retrieve a list of permitted domains
        • Remove entries from the Permit list
        • Disable domain filtering
      • Emerging threats
    • Splunk
      • Viewing network events in Splunk
      • Connect to Splunk
        • Connect to Splunk through an API
      • View events in Splunk
  • Network Security with hosted infrastructure
    • Hosted infrastructure deployment capabilities
    • Deploy Network Security with hosted infrastructure
      • Deployment overview
      • Review your cloud environment
      • Create Network Security endpoints
        • Add a cloud account
        • Deploy Network Security endpoints
      • Make route changes using a script
      • Modify route tables
        • Make route changes manually in AWS
        • Network Security endpoint IDs
        • Modify routes for environments that use an AWS Application Load Balancer (ALB)
        • Use the following steps to create or edit the routes for environments that use an AWS Application Load Balancer (ALB)
        • Modify routes for environments with routing at the Edge
        • Modify routes for environments that use a Transit Gateway
      • Troubleshooting by bypassing inspection
        • Use an API to bypass inspection
        • Manually bypass inspection
        • Environments with Application Load Balancers
        • Environments without Application Load Balancers
        • Environments with a Transit Gateway
        • Verification
      • Validate deployment
      • View security events in AWS CloudWatch
        • View Threat Insights
    • Distribute policies with hosted infrastructure
      • Distributing policies for Network Security endpoints
  • Network Security in AWS
    • Deployment recommendations
    • Deployment options
      • Choose a deployment option
      • Edge protection deployment
        • 1. Create subnets
        • 2. Create gateways
        • 3. Create route tables
        • Create Network Security AMI instances
          • 1. Create security groups
          • 2. Create an IAM policy and role
          • 3. Modify the S3 VPC endpoint policy
          • 4. Create Network Security instances
          • 5. Create Elastic Network Interfaces
          • 6. Configure additional Network Security settings
          • 7. Route traffic for inspection
        • CloudWatch high availability
          • Set up a CloudWatch alarm
          • Create a lambda function
          • Lambda function examples for bypass inspection
      • Deploy a centralized virtual appliance with Gateway Load Balancer
        • Create the Macro template stack
        • Create the Security VPC template stack
        • Configure Workload VPCs
        • Cross-account deployments
        • Availability Zone mapping
        • Create subnet
        • Create a Gateway Load Balancer Endpoint for each AZ
        • Create or modify your route tables
        • High availability overview
        • Cross-zone load balancing
        • Deploy fail open HA
        • Create the IAM role stack for cross-account deployments
        • Create the HA stack
        • Removing the Security VPC CloudFormation stack
      • Deploy a centralized virtual appliance with Gateway Load Balancer
        • Create the Macro template stack
        • Create the Security VPC template stack
        • Modify the Security VPC
        • Create subnets
        • Create a Transit Gateway attachment
        • Create a Gateway Load Balancer Endpoint for each AZ
        • Create or modify your route tables
        • Create or modify your Transit Gateway route tables
        • Removing the Security VPC CloudFormation stack
    • CloudFormation stack creation support
      • Using AWS console
      • Using AWS CLI
      • Creating a support ticket
    • Manually enabling HA Lambda
      • Method 1: Via AWS Management Console
      • Method 2: Invoke via AWS Command Line Interface
    • Replace Network Security instances
    • Manage Network Security instances
      • Update Network Security certificate
      • CloudWatch
      • Enable CloudWatch logs
      • CloudWatch log streaming using APIs scripts
      • Before you begin
      • 1. Determine the IDs of your managed virtual appliances
      • 2. Configure CloudWatch log settings on your appliance
      • 3. Verify your CloudWatch log configuration
      • 4. View logs in CloudWatch
      • Troubleshooting tips
  • Network Security in Azure
    • Deploy a Network Security instance in Microsoft Azure
      • Virtual appliance size recommendations
      • Permissions for Azure deployments
      • Permissions for deployment
      • Permissions for operations
      • Update Network Security certificate
      • Azure resources
      • Additional recommendations
    • Deployment options
      • Choose a deployment option
      • Inspect lateral traffic
        • Before you begin
        • Create a resource group
        • Create the inspection virtual network and subnets
        • Add a NAT gateway to the management subnet
        • Deploy the Network Security virtual appliance
        • Create the spoke virtual networks and subnets
          • Create a Workload virtual machine (optional)
          • Backend workloads example
        • Add peering to connect the hub and spoke VNets
        • Configure route tables and routes
          • Step 1: Create two route tables
          • Step 2: Configure the route tables
          • Step 3: Associate route table to related subnet
        • High availability
      • Inspect inbound and outbound traffic with Azure Firewall
        • Before you begin
        • Create a resource group
        • Create the spoke virtual network and workload subnet
          • Create a Workload virtual machine (optional)
          • Backend workloads example
        • Create the hub inspection virtual network and subnets
        • Add peering to connect the hub and spoke VNets
        • Add a NAT gateway to the management subnet
        • Deploy the Network Security virtual appliance
        • Configure the Azure Firewall
          • Note the Firewall IP information
          • Configure the Firewall rules
          • Configure the NAT rule
          • Configure the Network Rule
        • Configure route tables and rules
          • Step 1: Create three route tables
          • Step 2: Configure the route tables
          • Step 3: Associate the route tables to the related subnet
      • Inspect inbound traffic with Azure Application Gateway
        • Before you begin
        • Configure inbound inspection
        • Create a resource group
        • Create the spoke virtual network and two subnets
          • Create a Workload virtual machine (optional)
        • Backend workloads example
        • Create the hub inspection virtual network and subnets
        • Add peering to connect the hub and spoke VNets
        • Add a NAT gateway to the management subnet
        • Configure the Application Gateway
        • Deploy the Network Security virtual appliance
        • Configure route tables and rules
          • Locate the frontend IP address of the load balancer
          • Step 1: Create two route tables
          • Step 2: Configure the route tables
          • Step 3: Associate a route table to its related subnet
        • Configure outbound inspection
        • Create and configure the AzureFirewall route rules
          • Create the Firewall
          • Note the Firewall IP information
        • Configure the Firewall Network Rule (egress)
        • Configure route tables and rules
          • Step 1: Create two additional route tables
          • Step 2: Configure the route tables
          • Step 3: Associate a route table to its related subnet
        • Restore traffic using routes
        • Manual Fallback
      • Inspect inbound and outbound traffic with Azure Gateway Load Balancer
        • Set up network environment
        • Before you begin
        • Deploy the virtual network and the Network Security virtual appliance
        • Connect the Gateway Load Balancer to the public load balancer
      • High availability deployment
        • HA deployment permissions
        • HA operational permissions
          • Step 1. Register a new application for the service principal
          • Step 2. Create a new secret
          • Step 3. Create new custom roles
          • Step 4. Assign the custom roles to the new application account
          • Step 5. Assign a monitoring role to the new application account
          • Step 6. Create a managed identity
          • Step 7. Assign a role to the new identity
        • Launch HA from Azure Marketplace
        • Launch HA
        • Manual Fallback
        • Verifying HA in Azure
        • Scale Set Appliances
          • Verify the Resource Group, VM Name and Scale Set:
          • Verify the Load Balancer name:
          • Check the HA Function App:
    • Azure Monitor
      • Azure Monitor Agent
  • Network Security optimization
    • Enable Automated Security Updates
    • API Gateway Protection
    • Geolocation Filtering
    • In-line Intrusion Detection or Intrusion Prevention
    • Insecure SSL/TLS Protocol
    • Apache Log4j 2 Vulnerability
  • Privacy and Personal Data Collection Disclosure
  • API reference
Network Security with hosted infrastructure
Related information
  • Hosted infrastructure deployment capabilities
  • Deploy Network Security with hosted infrastructure
  • Distribute policies with hosted infrastructure
Online Help Center

Support
For Home For Business


Privacy Notice
© 2025 Trend Micro Incorporated. All rights reserved.
Table of Contents
  • Getting Started
    • Network Security
    • PCI DSS compliance enabled by Network Security
    • Interactive demo
      • Emerging threat protection
      • Next Steps
    • Quick Network Security trial
      • Deploying protection
      • Attack simulation
      • Inbound attacks
      • Outbound attacks
      • Outbound attacks using Malware filters
      • Next steps
  • Network Security
    • Billing
      • Billing Overview
      • Pay as You Go billing
        • Free tier
        • Sign up for Pay as You Go
        • Prerequisites
        • Register for Pay as You Go in Workload Security
        • Vendor-provided cost allocation tags
        • Enable the Network Security cost allocation tag
        • View the itemized usage
    • Manage virtual appliances
      • Add cloud accounts and appliances
      • Manage appliance deployment tokens
        • Token generation
      • Verify deployment prerequisites
      • IAM roles and permissions
        • Updating IAM roles
      • Upgrading Appliances
        • Upgrading a Network Security Appliance
          • Seamless Appliance Upgrade
          • Downgrading your appliance
          • Verifying Build Version
          • Managing Network Service Impact
        • Using APIs to Upgrade Virtual Appliances
        • Managing Network Impact
          • AWS Upgrade Process Management
          • Azure Upgrade Process Management
      • Assets
      • Threat Insights
      • Rename a virtual appliance
      • Appliance health notifications
      • Virtual appliance outbound connections
      • Monitor events
      • Troubleshooting
    • Policies
      • Manage Policies
      • Enhance Security Value with AWS Network Firewall and Trend Micro Cloud One
      • Share threat intelligence with AWS
        • Enable Sharing
        • Verify rule group sharing
        • Shared rule groups
        • Stateless rules
        • Stateful rules
        • Create firewall policies
        • Configure firewall
        • Configure logging
        • Testing your rule groups
      • TLS inspection
        • TLS inspection overview
        • Key TLS terms
        • TLS inspection for AWS
          • TLS Requirements for AWS
          • Configure TLS inspection for AWS
        • TLS inspection for Azure
          • TLS Requirements for Azure
          • Configure TLS inspection for Azure
      • Filters
      • Customize filter settings using the GUI
      • Distribute filter overrides to your network
      • Create, update, or delete filter overrides using an API
      • Update to latest filter package
      • Threat Intelligence packages
        • Update a threat intelligence package
        • Manual Syncs
      • Geolocation filtering
        • Configure Geolocation filtering using the GUI
        • Configure Geolocation filtering using APIs
      • Domain filtering
        • Manage your permit list using the GUI
        • Manage your permit list using APIs
        • Configure a list of verified domains
        • Enable domain configuration
        • Sync permit list and domain configuration with your appliance
        • Verify your domain settings are applied to your appliances
        • Retrieve a list of permitted domains
        • Remove entries from the Permit list
        • Disable domain filtering
      • Emerging threats
    • Splunk
      • Viewing network events in Splunk
      • Connect to Splunk
        • Connect to Splunk through an API
      • View events in Splunk
  • Network Security with hosted infrastructure
    • Hosted infrastructure deployment capabilities
    • Deploy Network Security with hosted infrastructure
      • Deployment overview
      • Review your cloud environment
      • Create Network Security endpoints
        • Add a cloud account
        • Deploy Network Security endpoints
      • Make route changes using a script
      • Modify route tables
        • Make route changes manually in AWS
        • Network Security endpoint IDs
        • Modify routes for environments that use an AWS Application Load Balancer (ALB)
        • Use the following steps to create or edit the routes for environments that use an AWS Application Load Balancer (ALB)
        • Modify routes for environments with routing at the Edge
        • Modify routes for environments that use a Transit Gateway
      • Troubleshooting by bypassing inspection
        • Use an API to bypass inspection
        • Manually bypass inspection
        • Environments with Application Load Balancers
        • Environments without Application Load Balancers
        • Environments with a Transit Gateway
        • Verification
      • Validate deployment
      • View security events in AWS CloudWatch
        • View Threat Insights
    • Distribute policies with hosted infrastructure
      • Distributing policies for Network Security endpoints
  • Network Security in AWS
    • Deployment recommendations
    • Deployment options
      • Choose a deployment option
      • Edge protection deployment
        • 1. Create subnets
        • 2. Create gateways
        • 3. Create route tables
        • Create Network Security AMI instances
          • 1. Create security groups
          • 2. Create an IAM policy and role
          • 3. Modify the S3 VPC endpoint policy
          • 4. Create Network Security instances
          • 5. Create Elastic Network Interfaces
          • 6. Configure additional Network Security settings
          • 7. Route traffic for inspection
        • CloudWatch high availability
          • Set up a CloudWatch alarm
          • Create a lambda function
          • Lambda function examples for bypass inspection
      • Deploy a centralized virtual appliance with Gateway Load Balancer
        • Create the Macro template stack
        • Create the Security VPC template stack
        • Configure Workload VPCs
        • Cross-account deployments
        • Availability Zone mapping
        • Create subnet
        • Create a Gateway Load Balancer Endpoint for each AZ
        • Create or modify your route tables
        • High availability overview
        • Cross-zone load balancing
        • Deploy fail open HA
        • Create the IAM role stack for cross-account deployments
        • Create the HA stack
        • Removing the Security VPC CloudFormation stack
      • Deploy a centralized virtual appliance with Gateway Load Balancer
        • Create the Macro template stack
        • Create the Security VPC template stack
        • Modify the Security VPC
        • Create subnets
        • Create a Transit Gateway attachment
        • Create a Gateway Load Balancer Endpoint for each AZ
        • Create or modify your route tables
        • Create or modify your Transit Gateway route tables
        • Removing the Security VPC CloudFormation stack
    • CloudFormation stack creation support
      • Using AWS console
      • Using AWS CLI
      • Creating a support ticket
    • Manually enabling HA Lambda
      • Method 1: Via AWS Management Console
      • Method 2: Invoke via AWS Command Line Interface
    • Replace Network Security instances
    • Manage Network Security instances
      • Update Network Security certificate
      • CloudWatch
      • Enable CloudWatch logs
      • CloudWatch log streaming using APIs scripts
      • Before you begin
      • 1. Determine the IDs of your managed virtual appliances
      • 2. Configure CloudWatch log settings on your appliance
      • 3. Verify your CloudWatch log configuration
      • 4. View logs in CloudWatch
      • Troubleshooting tips
  • Network Security in Azure
    • Deploy a Network Security instance in Microsoft Azure
      • Virtual appliance size recommendations
      • Permissions for Azure deployments
      • Permissions for deployment
      • Permissions for operations
      • Update Network Security certificate
      • Azure resources
      • Additional recommendations
    • Deployment options
      • Choose a deployment option
      • Inspect lateral traffic
        • Before you begin
        • Create a resource group
        • Create the inspection virtual network and subnets
        • Add a NAT gateway to the management subnet
        • Deploy the Network Security virtual appliance
        • Create the spoke virtual networks and subnets
          • Create a Workload virtual machine (optional)
          • Backend workloads example
        • Add peering to connect the hub and spoke VNets
        • Configure route tables and routes
          • Step 1: Create two route tables
          • Step 2: Configure the route tables
          • Step 3: Associate route table to related subnet
        • High availability
      • Inspect inbound and outbound traffic with Azure Firewall
        • Before you begin
        • Create a resource group
        • Create the spoke virtual network and workload subnet
          • Create a Workload virtual machine (optional)
          • Backend workloads example
        • Create the hub inspection virtual network and subnets
        • Add peering to connect the hub and spoke VNets
        • Add a NAT gateway to the management subnet
        • Deploy the Network Security virtual appliance
        • Configure the Azure Firewall
          • Note the Firewall IP information
          • Configure the Firewall rules
          • Configure the NAT rule
          • Configure the Network Rule
        • Configure route tables and rules
          • Step 1: Create three route tables
          • Step 2: Configure the route tables
          • Step 3: Associate the route tables to the related subnet
      • Inspect inbound traffic with Azure Application Gateway
        • Before you begin
        • Configure inbound inspection
        • Create a resource group
        • Create the spoke virtual network and two subnets
          • Create a Workload virtual machine (optional)
        • Backend workloads example
        • Create the hub inspection virtual network and subnets
        • Add peering to connect the hub and spoke VNets
        • Add a NAT gateway to the management subnet
        • Configure the Application Gateway
        • Deploy the Network Security virtual appliance
        • Configure route tables and rules
          • Locate the frontend IP address of the load balancer
          • Step 1: Create two route tables
          • Step 2: Configure the route tables
          • Step 3: Associate a route table to its related subnet
        • Configure outbound inspection
        • Create and configure the AzureFirewall route rules
          • Create the Firewall
          • Note the Firewall IP information
        • Configure the Firewall Network Rule (egress)
        • Configure route tables and rules
          • Step 1: Create two additional route tables
          • Step 2: Configure the route tables
          • Step 3: Associate a route table to its related subnet
        • Restore traffic using routes
        • Manual Fallback
      • Inspect inbound and outbound traffic with Azure Gateway Load Balancer
        • Set up network environment
        • Before you begin
        • Deploy the virtual network and the Network Security virtual appliance
        • Connect the Gateway Load Balancer to the public load balancer
      • High availability deployment
        • HA deployment permissions
        • HA operational permissions
          • Step 1. Register a new application for the service principal
          • Step 2. Create a new secret
          • Step 3. Create new custom roles
          • Step 4. Assign the custom roles to the new application account
          • Step 5. Assign a monitoring role to the new application account
          • Step 6. Create a managed identity
          • Step 7. Assign a role to the new identity
        • Launch HA from Azure Marketplace
        • Launch HA
        • Manual Fallback
        • Verifying HA in Azure
        • Scale Set Appliances
          • Verify the Resource Group, VM Name and Scale Set:
          • Verify the Load Balancer name:
          • Check the HA Function App:
    • Azure Monitor
      • Azure Monitor Agent
  • Network Security optimization
    • Enable Automated Security Updates
    • API Gateway Protection
    • Geolocation Filtering
    • In-line Intrusion Detection or Intrusion Prevention
    • Insecure SSL/TLS Protocol
    • Apache Log4j 2 Vulnerability
  • Privacy and Personal Data Collection Disclosure
  • API reference
Close