Block infected files?

Hi,

In the Protection Profile I' ve set up, I am performing Virus Scan on HTTP traffic. One of my users recently was allowed to download an infected exe file despite the fact that the FortiGate identified it as infected.

could you post here the log message as printed by your FTG? " infected" really or ' suspicious' ?

What am I missing? How can I tell the FortiGate 50A to block an infected file but allow clean files?

Maybe (until you provide more information) the protection profile was not applied to firewall policy that your user traffic matched, maybe another thing. could you post the out of CLI command " show firewall profile <name_profile_you' ve_configured>" ?

Here is the log entry (technically it is the Alert message that is sent, but it should provide the same information).

Message meets Alert condition Virus/Worm detected: Suspicious Protocol: " http" Source IP: 192.168.XXX.XXX Destination IP: 216.240.134.208 Email Address From: " N/A" Email Address To: " N/A" http://www.fortinet.com/ve?vn=Suspicious 2008-10-06 21:04:47 device_id=FGT50A2906500337 log_id=0211060000 type=virus subtype=infected pri=notice vd=root policyid=1 serial=307353 user=" N/A" group=" N/A" src=192.168.XXX.XXX sport=49511 src_int=" internal" dst=216.240.134.208 dport=80 dst_int=" external" service=" http" status=passthrough file=" A9installer_77075603.exe" virus=" Suspicious" url=" http://onlineprivatescan.com/2009/download/trial/A9installer_77075603.exe" ref=" http://www.fortinet.com/ve?vn=Suspicious" msg=" File is infected."

And here is the profile:

config firewall profile edit " web" set httpoversizelimit 5 set ftpoversizelimit 5 set imapoversizelimit 5 set pop3oversizelimit 5 set smtpoversizelimit 5 set nntpoversizelimit 1 set log-ips enable set log-av-virus enable set log-av-block enable set log-web-content enable set log-web-url enable set ftp block scan splice set http block scan bannedword exemptword fortiguard-wf urlfilter set https urlfilter set imap block scan bannedword fragmail spamemailbwl spamfsip spamfssubmit spamfsurl spamhdrcheck spamipbwl spamraddrdns spamrbl set pop3 block scan bannedword fragmail spamemailbwl spamfsip spamfssubmit spamfsurl spamhdrcheck spamipbwl spamraddrdns spamrbl set smtp scan fragmail spamfssubmit splice set pop3-spamtagtype subject set filepattable 1 set weburlfiltertable 1 set spammheadertable 1 set spamrbltable 1 set spamiptrusttable 1 set nntp no-content-summary set ips-sensor-status enable set ips-sensor " all_default" unset im set p2p enable set bittorrent block set edonkey block set gnutella block set kazaa block set winny block set ftgd-wf-options http-err-detail rate-image-urls strict-blocking set ftgd-wf-https-options strict-blocking set ftgd-wf-allow 83 g03 g04 g06 g07 g08 g21 g22 c01 c02 c03 c04 c05 c06 set ftgd-wf-deny 1 2 3 4 5 6 57 58 59 60 61 62 g02 g05 next end

Clearly the Alert message says " Suspicious." The final portion of the Alert, msg=" File is infected," is what led me to the conclusion that the file was infected. It is entirely possible that I' m simply ignorant, in which case I' m happy to learn! Any enlightenment provided is appreciated.

Thank you for the information!

We also had trouble with our firewall letting these A9installer...exe files passthrough. I had to make sure the file limit size was set high enough to catch them (10MB should do it) and the other reasons they can passthrough is if you have different protection profiles enabled on the policy or do not have the File Filter settings clicked on in the protection profile you are using. You can see what policy ID you are using and then see what protection profile you have enabled on that policy. You also have to be sure that you have a file filter pattern setup on the protection profile - these are initially defined under the Antivirus section. You could also setup a file pattern to block a9*.* which may help as well as the *.exe. By the way you do want to block these - this is a nasty fake AV program that can be installed very easily since it generates popups that users may be tricked into clicking on and that is all it takes to download and install.