Antivirus
FortiOS offers the unique ability to implement both flow-based and proxy-based antivirus concurrently, depending on the traffic type, users, and locations. Flow-based antivirus offers higher throughput performance.
FortiOS includes two preloaded antivirus profiles:
- default
- wifi-default
You can customize these profiles, or you can create your own to inspect certain protocols, remove viruses, analyze suspicious files with FortiSandbox, and apply botnet protection to network traffic. Once configured, you can add the antivirus profile to a firewall policy.
|
This functionality requires a subscription to FortiGuard Antivirus. |
Starting from 6.2, for oversized files, the UTM scan strategy used in proxy mode for the HTTP, HTTPS, FTP, FTPS, and SSH protocols is best effort in both default and legacy scan modes. In the FortiGate memory allocation based on the oversize limit and uncompressed oversize limit defined in the protocol options, the FortiGate scans buffered files as much as it can. This strategy improves the effectiveness of the malware detection, and provides better security by scanning whole or partial files that would be bypassed if oversized files were bypassed.
The following topics provide information about antivirus profiles:
- Configuring an antivirus profile
- Proxy mode stream-based scanning
- Databases
- Content disarm and reconstruction
- FortiGuard outbreak prevention
- External malware block list
- Checking flow antivirus statistics
- CIFS support
The following topics provide information about sandbox inspection with antivirus:
Protocol comparison between antivirus inspection modes
The following table indicates which protocols can be inspected by the designated antivirus scan modes.
|
|
HTTP |
FTP |
IMAP |
POP3 |
SMTP |
NNTP |
MAPI |
CIFS |
SSH |
|---|---|---|---|---|---|---|---|---|---|
|
Proxy |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes* |
Yes |
|
Flow |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
No |
Yes |
No |
* Proxy mode antivirus inspection on CIFS protocol has the following limitations:
- Cannot detect infections within some archive files.
- Cannot detect oversized files.
Other antivirus differences between inspection modes
Starting from 6.4.0, the scan mode option is no longer available for flow-based AV.
This means that AV no longer exclusively uses the default or legacy scan modes when handling traffic on flow-based firewall policies. Instead, AV in flow-based policies uses a hybrid of the two scan modes. Flow AV may use a pre-filtering database for malware detection in some circumstances as opposed to the full AV signature database in others. The scan method is determined by the IPS engine algorithm that is based on the type of file being scanned. When handling oversized files in flow-based AV, the action can either be pass (default) or block. When theaction is pass, IPS appends to-be-scan data into the AV scan buffer. If the appended file size exceeds the oversize-limit that is defined in the protocol option profile, then the AV session is cleared and the file is bypassed from AV scanning.
In contrast, proxy mode maintains the scan mode option, which can be toggled between default or legacy mode. In default mode, the WAD daemon receives the file and then decides if it can do an in-process scan of the file in simple AV configuration scenarios. If the file is in an oversized archive that is supported by the stream‑based decompressor, then it is sent to stream‑based scan for best effort inspection. Stream‑based scan decompresses and scans the entire archive without archiving the file. If the file is not supported by stream‑based scan, then it is buffered and then sent to the scanunit daemon for inspection on content that is under the oversize limit.
In legacy mode, stream-based scanning is disabled, so oversized archive files and files that cannot be handled by WAD in-process scan are buffered and sent to the scanunit daemon for processing.