Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Handbook

    Home FortiADC 5.4.2 Handbook
    5.4.2
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.1.4
    7.1.3
    7.1.2
    7.1.1
    7.1.0
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.6
    6.1.5
    6.1.4
    6.1.3
    6.1.2
    6.1.1
    6.1.0
    6.0.1
    6.0.0
    5.4.3
    5.4.2
    5.4.1
    5.4.0
    5.3.6
    5.3.5
    5.3.4
    5.3.3
    5.3.2
    5.3.1
    5.3.0
    5.2.7

    Creating an AV profile

    Creating an AV profile

    You must configure AV profiles to use the anti-virus service module, which can be done either from the GUI or the Console. Once created, you can include your AV profiles when creating advanced virtual server profiles that use the HTTP or HTTPS protocol. For more information, refer to Configuring virtual servers.

    Configure AV profiles from the GUI

    To configure an AV profile from the GUI:

    1. Click Network Security>Anti Virus.
    2. Select the Profile tab.
    3. Click the Create New button.
    4. Make the entries or selections as described in AV profile configuration.
    5. Click Save when done.

    AV profile configuration

    Settings Description
    Name

    A unique name for the AV profile.

    Note: An AV profile name can contain up to 63 alphanumeric characters.
    Comments

    A brief description of the profile.

    Note: A description can be up to 1024 alphanumeric characters long.
    Uncomp Size Limit

    The maximum size in MB of the memory buffer used to temporarily decompress files.

    Note: The default is 1 MB. Valid values range from 1 to 10 MB.
    Uncomp Nest Limit

    The maximum number of levels of nesting (compression) allowed for the system to decompress.

    Note: The default is 2. Valid values range from 2 to 100.
    Scan Bzip2

    Scan archives using the bzip2 algorithm.

    Note: Disabled by default.
    Streaming Content Bypass

    Enable or disable bypass streaming content (rather than buffering it).

    Note: Enabled by default.
    Oversize Limit

    The maximum in-memory file size in KB to be scanned.

    Note: The default is 1024 KB. Valid values range from 1 to 1024 KB.
    Oversize

    Select one of the options for the system to handle over-sized files:

    • Bypass—Ignore oversized files.
    • Log—Log and block oversized files.
    • Block—Block oversized files.

    Note: The default option is Bypass.
    Options

    Select an option for the system to handle infected files:

    • AV Monitor—Monitor and log infected files.
    • Quarantine—Monitor, log, and quarantine infected files.

    Note: The default is AV Monitor.
    Emulator

    Enable or disable the Win32 Emulator.

    Note: Disabled by default to improve throughput.
    FSA Analytics

    Select an option to submit files to to FortiSandbox.

    • Disable—No file is submitted.
    • Suspicious—Only suspicious files are submitted.
    • All—All files are submitted.

    Note: The default is Disable.
    Analytics Max Upload

    The maximum file size in KB allowed to upload to FortiSandbox.

    Note: The default is 1024 KB. Valid values range from 1 to 2048 KB.
    Analytics DB

    Enable or disable supplementing the AV signature databases with the FortiSandbox signature database.

    Note: Disabled by default.
    AV Virus Log

    Enable or disable logging for anti-virus scanning.

    Note: Enabled by default.

    Note that FortiADC currently imposes no restriction on the types of files that can be uploaded for AV analysis or evaluation. When scanning files for viruses, it makes no distinction between viruses and Trojans, and submits all suspicious files to FortiSandbox for evaluation. A log is generated whenever a file is uploaded to FortiSandbox.

    Configure AV profiles from the Console

    To configure an AV profile from the Console, execute the following commands:

    config security antivirus profile

    edit <name_str>

    set comment <var-string>

    set uncomp-size-limit <limit_int>

    set uncomp-nest-limit <limit_int>

    set scan-bzip2 {enable | disable}

    set streaming-content-bypass {enable | disable}

    set oversize-limit <size_int>

    set oversize {bypass | log | block}

    set options {avmonitor | quarantine}

    set emulator {enable | disable}

    set fsa-analytics {disable | suspicious | everything}

    set analytics-max-upload <integer>

    set analytics-db {disable | enable}

    set av-virus-log {enable | disable}

    end

    Previous
    Next

    Creating an AV profile

    Creating an AV profile

    You must configure AV profiles to use the anti-virus service module, which can be done either from the GUI or the Console. Once created, you can include your AV profiles when creating advanced virtual server profiles that use the HTTP or HTTPS protocol. For more information, refer to Configuring virtual servers.

    Configure AV profiles from the GUI

    To configure an AV profile from the GUI:

    1. Click Network Security>Anti Virus.
    2. Select the Profile tab.
    3. Click the Create New button.
    4. Make the entries or selections as described in AV profile configuration.
    5. Click Save when done.

    AV profile configuration

    Settings Description
    Name

    A unique name for the AV profile.

    Note: An AV profile name can contain up to 63 alphanumeric characters.
    Comments

    A brief description of the profile.

    Note: A description can be up to 1024 alphanumeric characters long.
    Uncomp Size Limit

    The maximum size in MB of the memory buffer used to temporarily decompress files.

    Note: The default is 1 MB. Valid values range from 1 to 10 MB.
    Uncomp Nest Limit

    The maximum number of levels of nesting (compression) allowed for the system to decompress.

    Note: The default is 2. Valid values range from 2 to 100.
    Scan Bzip2

    Scan archives using the bzip2 algorithm.

    Note: Disabled by default.
    Streaming Content Bypass

    Enable or disable bypass streaming content (rather than buffering it).

    Note: Enabled by default.
    Oversize Limit

    The maximum in-memory file size in KB to be scanned.

    Note: The default is 1024 KB. Valid values range from 1 to 1024 KB.
    Oversize

    Select one of the options for the system to handle over-sized files:

    • Bypass—Ignore oversized files.
    • Log—Log and block oversized files.
    • Block—Block oversized files.

    Note: The default option is Bypass.
    Options

    Select an option for the system to handle infected files:

    • AV Monitor—Monitor and log infected files.
    • Quarantine—Monitor, log, and quarantine infected files.

    Note: The default is AV Monitor.
    Emulator

    Enable or disable the Win32 Emulator.

    Note: Disabled by default to improve throughput.
    FSA Analytics

    Select an option to submit files to to FortiSandbox.

    • Disable—No file is submitted.
    • Suspicious—Only suspicious files are submitted.
    • All—All files are submitted.

    Note: The default is Disable.
    Analytics Max Upload

    The maximum file size in KB allowed to upload to FortiSandbox.

    Note: The default is 1024 KB. Valid values range from 1 to 2048 KB.
    Analytics DB

    Enable or disable supplementing the AV signature databases with the FortiSandbox signature database.

    Note: Disabled by default.
    AV Virus Log

    Enable or disable logging for anti-virus scanning.

    Note: Enabled by default.

    Note that FortiADC currently imposes no restriction on the types of files that can be uploaded for AV analysis or evaluation. When scanning files for viruses, it makes no distinction between viruses and Trojans, and submits all suspicious files to FortiSandbox for evaluation. A log is generated whenever a file is uploaded to FortiSandbox.

    Configure AV profiles from the Console

    To configure an AV profile from the Console, execute the following commands:

    config security antivirus profile

    edit <name_str>

    set comment <var-string>

    set uncomp-size-limit <limit_int>

    set uncomp-nest-limit <limit_int>

    set scan-bzip2 {enable | disable}

    set streaming-content-bypass {enable | disable}

    set oversize-limit <size_int>

    set oversize {bypass | log | block}

    set options {avmonitor | quarantine}

    set emulator {enable | disable}

    set fsa-analytics {disable | suspicious | everything}

    set analytics-max-upload <integer>

    set analytics-db {disable | enable}

    set av-virus-log {enable | disable}

    end

    Previous
    Next