Hi,
I've just finished a FSA PoC with an FSA-3000E and a FML-400C.
In my mind it's important to supply reliable statistics to the customer, that is, have a sizeable number of files scanned. And watch the CPU and memory consumption of the FSA, plus the max. number of queued scan jobs, to get a feeling for the right size of the FSA in this environment.
For example, in this PoC the FSA scanned about 110.000 files of which 60 were malicious and 80 more of high risk. I agree with the customer that only one malicious file was too much, yet alone 60 in 4 weeks (2 per day). The huge number of detected, unique trojans was astonishing as the network stream had already been AV scanned by their Fortigates.
"unique" because immediately after categorizing a file as malicious the FSA created a signature which prevented subsequent occurrences of the same file to pass the Fortigate (or be scanned again by the FSA).
Another observation to point out: half of the bad files cames from the FortiMail as attachments but the other half came in by web via the FGT. I would have thought that ratio be 10:1 before we measured it.
Additionally, half ot fhe malicious objects were files, the other half were URLs (well, not 'malicious' but 'high risk'). As URLs in eMails are not scanned at all in a FGT this is worth pointing out.
So, it's quite apparent that a FSA is effective, easy to integrate with FGT, FML and FWB and worth the investment. Finally, the right sizing was no easy task. Ask your FTNT SE to help you with this. At this point I would prefer an appliance over a VM for sheer performance.
HTH,
ede_pfau
