New Member

Question

Protocol Options

Forum|Forum|11 years ago
August 28, 2014
20 replies
30628 views

Hello All, I am looking for the location in the gui to edit protocol options and have not been able to locate it. I have recently upgraded to 5.2 and it appear a lot of stuff has changed or moved. I get notifications about downloads that file limit is exceeded and it categorizes that event as subtype of virus?? Makes no sense to me. I only want notification emails when a virus signature gets a hit. Anyone have any ideas about why this my be behaving like this? I just don' t understand how a file size (which I suppose I will need o change) would trigger an event with a subtype of " virus" .

Show previous replies

Dave_Hall

New Member

What netmin has posted is more in line with 4.0. MR3 (which I am more familiar with).

Under 4.0. MR3, that section looks like this...

 config firewall profile-protocol-options      edit " default"           set comment " all default services"               config http                  set port 80                   set options clientcomfort                  set comfort-amount 100                  unset post-lang                  set oversize-limit 5              end              config https                  set port 443                   unset options              end              config ftp                  set port 21                   set options no-content-summary splice                  set oversize-limit 5              end              config imap                  set port 143                   set options fragmail no-content-summary                  set oversize-limit 5              end              config pop3                  set port 110                   set options fragmail no-content-summary                  set oversize-limit 5              end              config smtp                  set port 25                   set options fragmail no-content-summary splice                  set oversize-limit 5              end              config nntp                  set port 119                   set options no-content-summary splice                  set oversize-limit 5              end              config im                  unset options                  set oversize-limit 5              end      next  end

Under 5.0, tried to edit " default" and add " set oversize-log disable" but just gives me an error. Only options I can set under " default" is

 (default) # set   comment             comment  replacemsg-group    Replacement message group.  extended-utm-log    Enable/disable detailed UTM log messages.

netmin

New Member

Here a 5.2 version:

 FGT (default) # show full-configuration     config firewall profile-protocol-options      edit " default"           set comment " all default services"           set replacemsg-group ' '           set oversize-log disable          set switching-protocols-log disable              config http                  set ports 80                  set status enable                  set inspect-all disable                  set options clientcomfort no-content-summary                  set comfort-interval 10                  set comfort-amount 1                  unset post-lang                  set fortinet-bar disable                  set streaming-content-bypass enable                  set switching-protocols bypass                  set oversize-limit 10                  set retry-count 0              end              config ftp                  set ports 21                  set status enable                  set inspect-all disable                  set options clientcomfort no-content-summary splice                  set comfort-interval 10                  set comfort-amount 1                  set oversize-limit 10              end              config imap                  set ports 143                  set status enable                    set inspect-all disable                  set options fragmail                  set oversize-limit 10              end              config mapi                  set ports 135                  set status enable                  set options fragmail no-content-summary                  set oversize-limit 10              end              config pop3                  set ports 110                  set status enable                  set inspect-all disable                  set options fragmail no-content-summary                  set oversize-limit 10              end              config smtp                  set ports 25                  set status enable                  set inspect-all disable                  set options fragmail no-content-summary splice                  set oversize-limit 10                  set server-busy disable              end              config nntp                  set ports 119                  set status enable                  set inspect-all disable                  set options no-content-summary splice                  set oversize-limit 10              end                config dns                  set ports 53                  set status enable              end              config mail-signature                  set status disable                  set signature ' '               end      next  end    and a screenshot:

Zx70104.jpg

jrpayneAuthor

New Member

The box you have noted here is not checked on my FG. I was hoping that was the issue but no dice on that one. :(

jrpayneAuthor

New Member

I used the " config firewall profile-protocol-options edit " default" ' set oversize-log disable . We shall see if that does the trick. I will let you know. I really appreciate your time and answers. Thank you folks.

jrpayneAuthor

New Member

Well I went in and ran that command and I am still getting those messages. So I don' t know what else there could be to change.

netmin

New Member

The ' default' profile was meant as an example of course (in case you are using multiple/different proxy option profiles). Other areas that could be checked: are you using a DLP sensor? What logging options are used in the AV profile? Could you also post an anonymized log entry? It was already asked - is the email sent by your FGT or a FortiAnalyzer event setting?

jrpayneAuthor

New Member

The notification is being sent by the FG. The only event setup in the FAZ is a high memory event. The notifications look like this when they come to me in an email. " Message meets Alert condition File Block Detected: iR3245_Series_HTML PC_02262014.exe Protocol: HTTP Source IP: ************* Destination IP: ************** Email Address From: Email Address To: date=2014-09-02 time=15:12:23 devname=*********** devid=************** logid=************ type=utm subtype=virus eventtype=oversize level=notice vd=" root" msg=" Size limit is exceeded." action=passthrough service=HTTP sessionid=54608523 srcip=************* dstip=************** srcport=3828 dstport=80 proto=6 direction=incoming filename=" iR3245_Series_HTML PC_02262014.exe" url=" http://downloads.canon.com/navilp/iR3245_Series_HTML%20PC_02262014.exe" profile=" Forsyth Protocol Options" user=" guest" group=" SSO_Guest_Users" agent=" Mozilla/4.0" DLP sensor is turned off. I looked in the AV profile and I do not see any logging options listed there. I am going to look once more.

jrpayneAuthor

New Member

These are the AV options from the CLI FG300B3909601246 (**********) # get name : ************* comment : replacemsg-group : inspection-mode : flow-based scan-botnet-connections: block ftgd-analytics : disable http: options : scan quarantine archive-block : archive-log : ftp: options : scan quarantine archive-block : archive-log : imap: options : scan quarantine archive-block : archive-log : pop3: options : scan quarantine archive-block : archive-log : smtp: options : scan quarantine --More-- archive-block : archive-log : nntp: options : archive-block : archive-log : smb: options : archive-block : archive-log : nac-quar: infected : quar-src-ip expiry : 364d23h59m log : disable av-virus-log : enable av-block-log : enable

netmin

New Member

profile=" Forsyth Protocol Options"

- this one has oversize logging disabled as well?

jrpayneAuthor

New Member

No it wasn' t. I thought I had turned off globally when I turned it off earlier. So, I have now turned it off in those options and we will see if the notifications stop. Thanks again for your help everyone.

Sign up

Login with SSO

Login to the community

Login with SSO