Technical Tip: Default Antivirus profile option in policy missing

Description

This article describes how to have the option to select the 'default' antivirus profile in a policy.

Scope

FortiGate.

Solution

By default, FortiGate may be set to Proxy-based inspection mode, which can limit the available options for antivirus profiles in policies.

To enable the 'default' antivirus profile option, switch to Flow-based inspection mode.

From GUI:

1. Change Inspection Mode to Flow-based from the default proxy mode.

2. Change VDOM inspection mode to Flow-based.

Go to Dashboard -> System Information dashboard widget ->  Inspection Mode -> Change the mode from Proxy-based to Flow-based.

This can be done at the global level or per VDOM (Virtual Domain), depending on the configuration.

From CLI:

config antivirus profile
edit default
set inspection-mode flow-based
end

Go to Policy & Objects -> Select the policy, and it will now be possible to select the default antivirus profile.

The 'default' antivirus profile is only available for selection in policies when the inspection mode is set to Flow-based.

In Proxy-based mode, only certain profiles or options may be available, and the 'default' profile may not appear.