Fortigate Antivirus Not updated

Will the subscription for AV has expired. So you need a new subscription license. Read more about this here

http://www.fortinet.com/technology/network-threat-response-fortiguard.html

I'll try to answer some of the concerns & questions;

The impact on the update is minor during any of the updates

Any time is okay for manual updates execution, and the  unit will perform auto updates which is reccommended so that you stay fresh with  current threats. ( If a new threat comes out, you want to be aware of it )

btw; And there's no such thing as firewall features license outside of additonal vdoms  and forticlients

Hi Emnoc,

Thank you for the great insight. Seems like it's a necessity to have the antivirus subcription. I did a check against SANS institute's Fortigate best practices paper Page 34, and it did say antivirus needs to be updated.

Link :

http://www.giac.org/paper/gsna/178/fortigate-60-firewall-security-audit-auditors-perspective/106725

 If the impact is minimal, as you said, then there shouldn't be any problem to have it updated during office hours.

So I guess this antivirus definition update is definitely a company needs to have otherwise the FortiO.S will not be secured. It's like having a Server with Microsoft Windows 2008 but without any antivirus inside. Correct me if I am wrong.

Hi Dave,

Thanks for the great input on the cookbook and other guides. Looks like the antivirus update is definitely a good practice to enable. I will highlight this to the management. By the way what is the difference between AV definitions and AV engine?

I also have one concern, although our Fortigate Firewall is equipped with IPS capabilities, should we also update the IPS engine and definition because we have our own IPS from McAfee.

Thanks again for the great help.

Hi Dave,

Would like to seek your expert on this, the administrator of the Fortigate device responded as below when we queried as to why the device did not have the latest antivirus definition. Does running the antivirus and updating it network speeds by 20-50%? That's a huge number!. We do have additional controls in the environment, however would like to gauge your experience if it does clog the network. I believe updating the antivirus can be done after office hours but how about running the antivirus if the below statement is correct.  

"We agreed with term another layer of defense. Yes, indeed IT security had applied defense in depth approach within security perimeter. But to consider your suggestion, we have to take into account the detrimental impact they can have on network performance, eg. scanning incoming traffic for viruses alone can reduce network speeds by 20-50%. Enabling IPS and other security features reduces performance even further"