Skip to main content
A
Anonymous_User
Contributor III
May 26, 2010
Question

Extreme antivirus database not updated

  • May 26, 2010
  • 5 replies
  • 7495 views
In my new Fortigate-200B (firmware MR2 279) extreme antivirus database status : " 0.00000 (Updated 2003-01-01 via Manual Update)" Somebody knows the solution?

    5 replies

    Carl_Wallmark
    Carl_Wallmark
    New Member
    May 26, 2010
    Hi, have you enabled updates ??
    A
    Anonymous_UserAuthor
    Contributor III
    May 26, 2010
    Yes, push updates is enabled, all other engines and databases updated
    ejhardin
    ejhardin
    New Member
    May 27, 2010
    The extreme database is no longer available for the 200b models.
    A
    Anonymous_UserAuthor
    Contributor III
    May 27, 2010
    Why? what reason? had to be supported
    abelio
    SuperUser
    abelio
    SuperUser
    May 27, 2010
    Hi,
    ORIGINAL: Roms Why? what reason? had to be supported
    Let me comment some points about this. fortiOS 4.2 introduced the capability of include 3 virus database as options to choose ( four db actually included ' flow' , but this is another question): - standard (the known ' zoo' or wild list in fortinet jargon) - extended (an extended set including the former one) - extreme (above ' extended' plus complete viruses database) How to choose? Is your choice. Is a matter of perfomance and criteria; As many characteristics of FTG units, you need to know your network, to get the maximum from your UTM unit; it' s not matter of " enable everything all the time in all situations" to be ' more secure' . To enable ' extreme' viruses db you' ll need extra storage and memory, near 1GB; not only units can allocate such db; 200B, 620B, 1240B can do it. To enable extreme db you need use CLI commands: 
      config antivirus settings      set default-db extreme  end
    Anyway, many AV vendors sell its units saying ' n- zillions of viruses detected' , (including ping-pong virus in its databases, even when your plattform cannot ever be afected by such viruses). In your shoes, i' ll test it a lot several weeks and maybe you wan to roll back your conf to extended or normal conf. Your call. regards,
    ejhardin
    ejhardin
    New Member
    May 27, 2010
    Actually I know a lot about this issue as I have been working with two support techs and the development team on this issue. The extreme database was released to the 200b’s but it was a mistake. The extreme database is the same that the FortiClient uses and is over 200mb in size. I have a 200b and the amount of memory that extreme database was using to load the definitions (even if you are not using it) was really high. After fixing the memory leak and high CPU with the new 164 IPS engine (I was one of the early testers) my memory was idling at 69%. After the tech manually deleted the extreme database from my box the memory dropped to 31%. The development team and other agreed to remove the extreme database from the FortiGuard servers. So it is no longer available for the 200b. I have a support ticket from the dev team stating that in 4.2.2 (4.2 patch 2) the extreme database will be removed from the GUI. The 200b can’t support the extreme database and most likely never will. Don’t worry you are not missing much. FYI, it doesn’t matter what you enable or change on the config the extreme database is not available for down for the 200b model.
    abelio
    SuperUser
    abelio
    SuperUser
    May 27, 2010
    Thanks for share this experience I was arguing with only my docs and certfication material, clearly outdated as you comment; We still waiting new 200B units here to do actual testing. best regards
    gili
    gili
    New Member
    June 1, 2010
    i am still suffering from 66-70% memory utilization on my 200B unit. it is really affecting my security as the unit enters conserve mode and session fail few min from restart. i am waiting for support to deal but if anyone knows how to delete the extra DB, please post thanks
    ejhardin
    ejhardin
    New Member
    June 1, 2010
    You will need to wait for support as they need to backdoor into the system. You could backup your config and format the drive, reload 4.2.1 and reload the config.
    Terms & ConditionsAccessibility statement