vSphere AutoDeploy and Trend Micro Deep Security

Background
When researching online documentation to see if we could get Trend Micro Deep Security implemented in our VMware vSphere AutoDeploy environment, the only references we could find were a japanese blog posting and a japanese white paper. My language abilities is a bit limited, but I still found the screen shots valuable.

Overview
To get Deep Security working there are several components that needs to get fixed in a given order:

1. Manually load vShield Endpoint driver on one of the ESXi hosts
2. Update Host Profile based on ESXi host with vShield Endpoint driver
3. Edit Host profile in order to get it working
4. Create new ESXi image with Image builder that includes the vShield Endpoint driver and Trend Micro Filter driver
5. Boot ESXi hosts from new ESXi Image
6. Remediate new Host Profile for these hosts
7. Deploy DSVA per ESXi host

Details

1. You need to use vShield Manager to install the vShield Endpoint driver. Note that the ESXi host should not be in maintenance mode when doing this. This may sound strange, but you'll get an error message after installing it if the host was in maintenance mode.

2. Go to host profiles and either create a new Host Profile based on Host, or update an existing Host based on the host you installed the driver on.

3. You need to edit the Host Profile. In addition to other tasks that needs to be done when a Host Profile has been updated from a host config, you now also need to make this new vShield based endpoint network work automatically. There are basically three things that needs to be done: Unselect a vShield Connection ID field, Don't get asked for a MAC address and Set a static ip address. This address is always 169.254.1.1 and is an internal  (host only) network on each host.

4. The following needs to be added to the VMware vSphere Image Builder script:

Add-EsxSoftwareDepot -DepotUrl "e:\vmware\drivers\vShield-Endpoint-Mux.zip"
Add-EsxSoftwareDepot -DepotUrl "e:\vmware\drivers\FilterDriver-ESX_5.0-9.5.3-2750.x86_64.zip"

Add-EsxSoftwarePackage -ImageProfile $imageprofile -SoftwarePackage epsec-mux
Add-EsxSoftwarePackage -ImageProfile $imageprofile -SoftwarePackage dvfilter-dsa

5. Activate the new image using the cmdlet Repair-DeployRuleSetCompliance

6. Remediate the host with the new Host Profile.

7. You can now see that the ESXi host has a prepared status and you can now start deploying DSVAs.