New Member

Question

FortiGate Antivirus is blocking but not logging

Forum|Forum|4 years ago
April 21, 2022
12 replies
11250 views

Hi everyone,

Very strange behaviour with FortiGate and AntiVirus in firewall rule. I have sometime my traffic blocked by AntiVirus but I can't see anything in logs.

In my Forward Traffic logs, I can see sometimes a value in result, sometimes not. When Result is green and has traffic, AntiVirus is disabled and request correctly pass. When Result is empty, traffic is blocked and AntiVirus is enabled on policy.

If I looked inside AntiVirus logs, the are empty. My AntiVirus configuration is here :

I tried to disabled one by one each part of AntiVirus configuration but no change. The request is working only if I disabled AntiVirus in firewall rule.

I've mistaken somewhere or is it a bug ? If a virus is detected, why I don't have any log ? For me it looks like an AntiVirus engine bug...

Maybe you have more tools to debug this behaviour :)

Thanks for your help

FortiGate

AlexC-FTNT

Staff

If you don't see any logs, why do you think it is blocked by the AV?

And where do you look for AV logs? You can find the AV logs in the dedicated Antivirus section of Log & Report (not in Forward traffic) if logging is enabled in policy.

zoriaxAuthor

New Member

Hi !

I suspected the AV beacause if I disabled it form my policy, here :

My request is correctyl forwarded. If I changed it to :

My request is not working correctly.

My AntiVirus logs are totally empty...

AlexC-FTNT

Staff

Once again, this is not a proof of a log problem. The traffic may be blocked by a wrongly configured AV (or maybe a bug). Make sure that AV profile mode is consistent with the policy operation mode (proxy-mode). Also, check that the FortiOS version you are running is up to date (6.4.8 / 7.0.5) to eliminate possible bugs.

zoriaxAuthor

New Member

For me the problem seems to be related to AV more than log... Or something strange in AV that is not logged (a bug maybe...)

If I follow you, I need to pass my policy to Proxy-baded inspection if I wanted to user AV in profile ? I'm a bit confuse about that...

Thanks for your return.

AlexC-FTNT

Staff

Yes. In flow-based mode only IPS and Webfilter work correctly.

For other inspection profiles, the policy must to be in proxy-based mode to offer proper results.

Jirka1

Explorer II

Hi Alex,

what exactly do you mean by: "Yes. In flow-based mode only IPS and Webfilter work correctly. For other inspection profiles, the policy must be in proxy-based mode to offer proper results."

Does this mean that, for example, application control or antivirus does not work in Flow mode? Or is their functionality reduced? How do I understand that?

Thank you.

Jirka

AlexC-FTNT

Staff

You may get some false positive identifications in flow-based mode, or impossible to block the stream/connection after a positive identification.

AV/AppControl works on 'best effort' basis since the packets are not buffered (proxied).

Surely, flow-based inspection is 'lighter' on resource usage.

zoriaxAuthor

New Member

As I can see in version 7.0.5, AntiVirus seems to work correctly with the 2 types :

But I tried proxy-mode in my firewall rule and it works now correctly...

So your recommandation is to always set proxy-based when AV is needed ?

zoriaxAuthor

New Member

Just to clarify the configuraiton of Policy and AV I can set :

Flow-based / Proxy-based in Policies
Flow-based / Proxy-based in AntiVirus

If I understand correctly I must set Proxy-Based in policies and I can choose inspection in AV right ?

AlexC-FTNT

Staff

if your policy is proxy-based, your AV profile MUST be proxy-based

if your policy is flow-based, your AV profile MUST be flow-based

zoriaxAuthor

New Member

OK I understand. But in fact I can set a proxy-based firewall policy with a flow-based AV policy... No warning and AV works correctly.

So you recommand to add proxy-based with AV or flow-based ? Both of them works but not in the same way. And as I can see in my case proxy-based with AV works but not flow-based...

zoriaxAuthor

New Member

Someone can share with me his best practice / recommandation ?

Thanks :)

Sign up

Login with SSO

Login to the community

Login with SSO