Antivirus and flow-based full scan

fjulianom · ‎10-29-2017

Hi guys,

I have been reading about Antivirus with both inspection modes and had a doubt. I thought when using Antivirus with flow-based full scan only the IPS engine is used, but the NSE4 course says the following about Antivirus with flow-based full scan: "The IPS engine checks for the rule match and then sends to the AV engine for scanning".

Then, what is the exactly function of the IPS engine is the AV engine scans the file? What does rule match mean?

Thanks in advance,

Julián

tanr · ‎10-29-2017

I think it's a little more complicated than that.

Life of a Packet http://docs.fortinet.com/uploaded/files/2795/fortigate-optimal-life-54.pdf on pages 20 and 22 show the flow-based and proxy-based inspection process -- or at least a rough outline of it.

There was some discussion of this a while back: https://forum.fortinet.com/tm.aspx?m=135666.

View solution in original post

tanr · ‎10-29-2017

I think it's a little more complicated than that.

Life of a Packet http://docs.fortinet.com/uploaded/files/2795/fortigate-optimal-life-54.pdf on pages 20 and 22 show the flow-based and proxy-based inspection process -- or at least a rough outline of it.

There was some discussion of this a while back: https://forum.fortinet.com/tm.aspx?m=135666.