Content disarm and reconstruction for antivirus

Content disarm and reconstruction (CDR) allows the FortiGate to sanitize Microsoft Office documents and PDF files by removing active content, such as hyperlinks, embedded media, javascript, macros, and so on (disarm) from the files without affecting the integrity of its textual content (reconstruction). It allows network admins to protect their users from malicious document files.

• CDR can be performed on Microsoft Office document and PDF files, including those that are in ZIP archives.
• CDR is supported on HTTP, SMTP, POP3, IMAP. SMTP splice and client-comfort mode are not supported.
• CDR does not support flow-based inspection modes.
• Local disk CDR quarantine can be used on FortiGate models that contain a hard disk or disks.

Files processed by CDR can have the original copy quarantined on the FortiGate, allowing administrators to observe them. The original copies can also be obtained in the event of a false positive.

Network topology example

Configuring the feature

In order to configure antivirus to work with CDR, you must enable CDR on your antivirus profile, set the quarantine location, and then fine-tune the CDR detection parameters.

To enable CDR on your antivirus profile:

1. Go to Security Profiles > AntiVirus.
2. Edit an antivirus profile, or create a new one.
3. Enable the toggle for Content Disarm and Reconstruction under APT Protection Options.

   

To set a quarantine location:

1. Go to Security Profiles > AntiVirus.
2. Edit an antivirus profile, or create a new one.
3. Select a quarantine location from the available options: Discard, File Quarantine, or FortiSandbox.

   Discard	The default setting, which discards the original document file.
   File Quarantine	Saves the original document file to disk (if possible) or a connected FortiAnalyzer based on the FortiGate's log settings, visible through Config Global > Config Log FortiAnalyzer Setting.
   FortiSandbox	Saves the original document file to a connected FortiSandbox.

4. Click Apply.

To fine-tune CDR detection parameters in the CLI:

• Select which active content to detect/process:

  By default, all active office and PDF content types are enabled. To fine-tune CDR to ignore certain content, you must disable that particular content parameter. The example below configures the CDR to ignore Microsoft Office macros.

  config antivirus profile 
      edit av
          config content-disarm
              set office-macro disable
          end
      next
  end

• Detect but do not modify active content:

  By default, CDR will disarm any detected documents containing active content. To prevent CDR from disarming documents, you can set it to operate in detect-only mode. To do this, the option detect-only must be enabled.

  config antivirus profile 
      edit av
          config content-disarm 
              set detect-only enable
          end
      next
  end

• Disable the CDR cover page:

  By default, a cover page will be attached to the file's content when the file has been processed by CDR. To disable the cover page, the cover-page parameter needs to be disabled.

  config antivirus profile 
      edit av
          config content-disarm 
              set cover-page disable
          end
      next
  end