Port/Protocol listing for AV scan (Proxy/Flow)

[bgetz_FTNT]

Hello,

Can somone point me in the right direction? I’m trying to find information relating to which ports/protocols the FG scans AV against in flow/proxy mode. 

I am only able to see the following, but it leads be to believe that it’s incomplete since it should be able to do, at a minimum, HTTPS. I feel that SMTPS or POP3S if SSL inspection is enabled. It also doesn’t tell me if this is for both Proxy and Flow.

FTP - TCP 21

SMTP - TCP 25

HTTP - TCP 80

POP3 - TCP 110

IMAP - TCP 143

NNTP - TCP 119

Regards,

Blair

[DaviWang1 · Accepted solution]

Flow mode (done in IPS engine) doesn't rely on port numbers for security inspection. As long as the relevant protocol is enabled, all traffic will be inspected for protocol recognization first.

As for HTTPS, it depends on SSL deep inspection settings. If SSL deep inspection is enabled, HTTPS will be convered if the HTTP option is enabled. For flow mode, just like all other protocols, SSL traffic can run on top of any ports.

If you stick with proxy based UTM detection, you can also enable inspect-all in the individual protocol settings to make IPS engine do protocol recognation and retransfer the traffic to proxy once a valid protocol is detected.