AV Engine cannot block virus attached in emails that sent to my email server

[networkingkool]

Hi Fortinet, I have a rule which used for my Exchange 2013 to send and receive emails. I would like to use my Fortigate unit to protect the Exchange Server and our clients email from getting virus in their emails. That is my objective. I enabled the flow based AV profile for the rule, but it seem that it doesn' t meet my first objective. The fortigate unit can well detect virus, if I go to the Exchange Server, surf web, and purposely download a virus from http/https. But It cannot detect the virus if I attach virus in email, and send to one email address in my company. I ' m sure that my Exchange use SMTP, not SMTPS, to receive the email from outside. Please advice me. Much thanks to any suggestion.

[Istvan_Takacs_FTNT]

First of all, what I would suggest is to turn on proxy-based AV scanning, instead of flow-based one. The scanning engine is more accurate and also not limited to decompress only a few compressed attachment types. Your users don' t think will miss emails if the Fortigate gets hold onto the attachment until it could fully scan it. Do you have Fortiguard subscription to receive all the latest updates? http://www.fortinet.com/support/fortiguard_services/antivirus.html What is your Fortigate/FortiOS version? How do you send emails to your users at the company. I assume the email always traverses through the Fortigate, instead of just passing the message internally from one Exchange box to the other. If you are trying to send through some new virus that doesn' t get caught? If so then you may want to submit it to Fortiguard, so they can add the signature to the next AV update. http://www.fortiguard.com/antivirus/submit.html BTW, this is a group of mostly independent individuals, not an official Fortinet customer support service. If you want to create a ticket to investigate, you can do it online or by calling their number: http://www.fortinet.com/support/forticare_support/

[networkingkool]

Hi Istvan, Yes we have Fortiguard subscription for Antivirus, Antispam.... My Fortigate unit model is 60D/ FortiOS version is v5.2.0,build0589 (GA) I use another company' s email system to send email to this company users. The virus sample I used, is in eicar.org. I ' m sure that Fortigate can catch the virus, not depend on flow based or proxy based mode. Fortigate control traffic from/to Exchange Server, the Fortigate box doesn' t control traffic between Exchange and clients if they sit inside the network, but control the traffic if clients are outside the Internet. Clients are using web browsers or outlook application to check their emails. So what I have to do now? Open o support case? Please advise. Thanks.

[Istvan_Takacs_FTNT]

Just check first if not your 60D is using all the resources first and the AV scanning has failed open as the result. # diagnose sys top-summary # get sys glob | grep failopen-se If by any chance you have ' pass' configured and the 60D is in conserve mode due to low in resources, connections bypass the antivirus system until the system enters non-conserve mode again. That can also explain potentially why it' s unable to catch the file. Check if the system is in conserve mode: # diagnose hardware sysinfo shm ......... conservemode: 0 <--------- # 0 not in conserve mode, 1 or 2 means it is. If none of the above explains and you won' t receive any better advise here from more experienced forum users, then yes, I guess the best is to open a ticket.

[Nihas]

First off, Fortinet has a dedicated instrument for protecting the Mail Systems from Spam' s and viruses. " FortiMail" . So if you are looking for a high level protection for your mail system better you have to incorporate the device between your exchange server and internet.( Of Course fortigate should be there) Or if you are simply looking for a Fortigate protection, Ideally I will do like below ( Later we will fine tune :P) - I am sure there are great genius among us in this group and they gonna help us to find out the missing points. ;P 1.Separate the Servers to another zone(DMZ) if it mixed with users network. 2. Limit only the required services to /from the Servers ( From WAN- DMZ & LAN- DMZ) 3. Create an antivirus policy with proxy option and place in both policies ( will take more resource, but more accurate than flow based) 4. Create antispam policy ( proxy) with the all available options. few options are there to use the spam detection( You can start with replaced message in header something like SPAM ( Tagged), and later you can fine tune with block( Discard), and you can eventually create a local Black White list also ) 5. Create an IPS sensor to protect email server and place in both policies.