Skip to main content
amateolo
amateolo
New Member
March 31, 2016
Question

Block .exe

  • March 31, 2016
  • 3 replies
  • 11427 views

Hi experts,

 

It is possible with the antivirus blocks .exe downloads?

I have firmware 5.4.0

 

Regards!!

    3 replies

    sebastan_bach
    sebastan_bach
    New Member
    April 7, 2016

    Yes you can use file-filter in the DLP Pattern to match exe file-type & block it.

     

    Regards

     

    Sebastan

    AndreaSoliva
    AndreaSoliva
    New Member
    April 12, 2016

    Hi

     

    this what is mentioned here is absolutly correct but something addtional has to be mentioned! In FortiOS 5.4 you have addtional the possibility to block executables within the antivirus profile itself for the mail based protocols like mapi, imap, pop3 as smtp. This is done with the option within the protocol "set executables". "default" for "set executables" does not block executables and is used by standard for this option. If you set the option to "virus" the executables will be treated as virus and blocked:

     

           # config antivirus profile        # edit [Wähle das entsprechende Antivirus Profile zB "local-default.intra"]        # set comment [Gebe einen Kommentar ein zB "Scan and delete default profile local-sg0e0"]        # unset replacemsg-group        # set inspection-mode proxy        # set mobile-malware-db enable        # config http        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # end        # config ftp        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # end        # config imap        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # set executables default        # end        # config pop3          # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # set executables default        # end        # config smtp        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # set executables default        # end        # config mapi        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # set executables default        # end        # config nntp        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # end        # config nac-quar        # set infected none        # set log enable        # end        # set av-virus-log enable        # set av-block-log enable        # end

     

    Hope this helps....

     

    have fun

     

    Andrea

    sebastan_bach
    sebastan_bach
    New Member
    April 13, 2016

    Hi Andrea,

     

    Thanks for your post. Any particular reason you are using Proxy AV mode & not the flow mode for treating exe as viruses over email protocols as they are supported in flow mode as well.

     

    I went through the documentation but I could not find the purpose of enabling the emulator. Any idea what benefits it brings in the AV profile.

     

    Regards

     

    Sebastan

    AndreaSoliva
    AndreaSoliva
    New Member
    April 14, 2016

    Hi

     

    lets say in this way! The standard technology is proxy based. From this point of view I would recommend to use always proxy based. If you have some performance problem on the device change to flow based. The AV engine was completly re-engineered for 5.2 meanign two engine one for proxy and one for flow. This is the reason you do not have anymore differences between flow and proxy based (this is technical based). In FortiOS 5.0 there was only one AV engine meaning for proxy based and additional this engine was also used for flow based. This was the reason under 5.0 flow based was restricted to some funtions like not capable to look into a zip file etc. because the engine was actually proxy based. This changed under 5.2.

     

    Whatever the technology which is used since years etc. is proxy based and this I would use. If you have as mentioned performance problem I would change to flow based.

     

    hope this helps

     

    have fun

     

    Andrea

    sebastan_bach
    sebastan_bach
    New Member
    April 14, 2016

    Thanks Andrea,

     

    There is still fundamental difference between proxy & flow mode based AV. in proxy mode the file needs to be completed downloaded before the AV engine scans the file. Also the Firewall works as a man in the middle between the client and the server.

     

    In flow mode however the packets are allowed to pass-through but a copy of the packet is buffered in the memory. When the firewall sees the end of file marker in the original packet it holds that packet and then scans the entire packet which is stored in the memory. If the verdict is virus the last segment is dropped otherwise allowed if the verdict is clean about the file.

     

    Regards

     

    Sebastan

    AndreaSoliva
    AndreaSoliva
    New Member
    April 14, 2016

    Hi

     

    yes absolutly correct and the reason why flow is faster then proxy mode. Anyway from functionality point of view "should" be no difference which means this what proxy mode can is also possible with flow mode even the flow mode does it in a difference way.

     

    Hope this helps

     

    have fun

     

    Andrea 

    Terms & ConditionsAccessibility statement