Configuring an antivirus profile
In an antivirus profile, the FortiGate can be configured to apply antivirus protection to HTTP, FTP, IMAP, POP3, SMTP, CIFS, and NNTP sessions. Proxy-based profiles also support MAPI and SSH. Antivirus inspection prevents potentially unwanted and malicious files from entering the network. Antivirus profiles include multiple different functions, such as scanning files for virus signatures, scanning for advanced persistent threats, checking external malware hash lists and threat feeds, and others. Malicious files can be blocked or monitored, and can be quarantined. Some antivirus profile options require a license and/or other Fortinet products. Some antivirus profile options can only be configured in the CLI (refer to the FortiOS CLI Reference).
|
The feature set setting (proxy or flow) in the antivirus profile must match the inspection mode setting (proxy or flow) in the associated firewall policy. For example, a flow-based antivirus profile must be used with a flow-based firewall policy. |
To configure an antivirus profile:
-
Go to Security Profiles > AntiVirus and click Create New.
-
Configure the following settings:
Name
Enter a unique name for the profile.
Comments
Enter a comment (optional).
AntiVirus scan
Enable one or more protocols for inspection, then enable AntiVirus scan for the selected protocols with a specified action.
- Block: block the malicious traffic.
- Monitor: log malicious traffic and allow it to pass inspection.
Feature set
Select the feature set for the profile. The feature set mode must match the inspection mode used in the associated firewall policy.
- Flow-based
- Proxy-based
Additional options are available in proxy-based mode and are identified in the GUI with a P icon. See Inspection mode feature comparison for more details.
Inspected Protocols
Enable to inspect the protocol for session inspection: HTTP, SMTP, POP3, IMAP, FTP, and CIFS. Disabled protocols are not inspected.
MAPI and SSH can be inspected in proxy-based mode.
APT Protection Options
This section includes options available with FortiGuard to mitigate advanced persistent threats (APT) in file-based attacks.
Content Disarm and Reconstruction
This option is available in proxy-based mode when at least one protocol is enabled for inspection and AntiVirus scan is enabled.
Enable to allow the FortiGate to sanitize Microsoft Office documents and PDF files (including files in ZIP archives) by removing active content (disarm) without affecting the integrity of the textual content (reconstruction). See Content disarm and reconstruction for more details.
Allow transmission when an error occurs
Enable to allow traffic to pass when an inspection error occurs. Disable to block traffic when an inspection error occurs.
Original File Destination
Specify how to quarantine files processed by content disarm and reconstruction.
- FortiSandbox: quarantine files on FortiSandbox. The FortiSandbox must be enabled. See Using FortiSandbox with antivirus for more details.
- File Quarantine: quarantine files on FortiGate models with a hard disk.
- Discard: discard suspicious files.
Treat Windows executables in email attachments as viruses
Enable to deem all Windows executable files located in email traffic as viruses.
Send files to FortiNDR for inspection
This option is available in proxy-based mode when at least one protocol is enabled for inspection, AntiVirus scan is enabled, and FortiNDR is enabled. SeeUsing FortiNDR inline scanning with antivirus for more details.
Include mobile malware protection
Enable to use the mobile malware protection database from FortiGuard for content scanning.
Quarantine
This option is available when at least one protocol is enabled for inspection and AntiVirus scan is enabled.
Enable to quarantine infected files.
Virus Outbreak Prevention
This section includes options available with the FortiGuard Virus Outbreak Protection Service. A license is required to use these options. See FortiGuard outbreak prevention for more details.
Use FortiGuard outbreak prevention database
Enable to use the outbreak prevention database that is available with Advanced Malware Protection on FortiGuard. A license is required.
- Block: block the malicious traffic.
- Monitor: log malicious traffic and allow it to pass inspection.
Use external malware block list
Enable to use one or more external blocklist file hashes. See External blocklist file hashes for more details.
- Block: block the malicious traffic.
- Monitor: log malicious traffic and allow it to pass inspection.
- All: use all malware block lists.
- Specify: select specific malware block lists.
Use EMS threat feed
This option is available when at least one protocol is enabled for inspection and AntiVirus scan is enabled.
Enable to use malware threat feeds from FortiClient EMS. A FortiClient EMS Fabric connector with EMS threat feed enabled is required. See External malware block list for more details.
-
Click OK.
Protocol options
When applying an antivirus profile to a firewall policy, the protocol options profile defines parameters for handling protocol-specific traffic. These parameters affect functions such as the port mapping for inspecting each protocol, whether to log or block oversized files when performing AV scanning, enabling comfort client, and more. Protocol options profiles are configured by going to Policy & Objects > Protocol Options, or in the CLI under config firewall profile-protocol-options. See Protocol options for more information.
Scan mode
In proxy-based antivirus profiles, the scan mode can be set to either default or legacy. This setting can only be configured in the CLI. See Proxy mode stream-based scanning for more information.
To configure the scan mode:
config antivirus profile
edit <name>
set feature-set proxy
set scan-mode {default | legacy}
next
end