Block .exe

[amateolo]

Hi experts,

It is possible with the antivirus blocks .exe downloads?

I have firmware 5.4.0

Regards!!

[sebastan_bach]

Yes you can use file-filter in the DLP Pattern to match exe file-type & block it.

Regards

Sebastan

[AndreaSoliva]

Hi

this what is mentioned here is absolutly correct but something addtional has to be mentioned! In FortiOS 5.4 you have addtional the possibility to block executables within the antivirus profile itself for the mail based protocols like mapi, imap, pop3 as smtp. This is done with the option within the protocol "set executables". "default" for "set executables" does not block executables and is used by standard for this option. If you set the option to "virus" the executables will be treated as virus and blocked:

       # config antivirus profile        # edit [Wähle das entsprechende Antivirus Profile zB "local-default.intra"]        # set comment [Gebe einen Kommentar ein zB "Scan and delete default profile local-sg0e0"]        # unset replacemsg-group        # set inspection-mode proxy        # set mobile-malware-db enable        # config http        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # end        # config ftp        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # end        # config imap        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # set executables default        # end        # config pop3          # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # set executables default        # end        # config smtp        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # set executables default        # end        # config mapi        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # set executables default        # end        # config nntp        # set options scan        # unset archive-block        # set archive-log encrypted corrupted multipart nested mailbomb unhandled        # set emulator enable        # end        # config nac-quar        # set infected none        # set log enable        # end        # set av-virus-log enable        # set av-block-log enable        # end

Hope this helps....

have fun

Andrea

[sebastan_bach]

Hi Andrea,

Thanks for your post. Any particular reason you are using Proxy AV mode & not the flow mode for treating exe as viruses over email protocols as they are supported in flow mode as well.

I went through the documentation but I could not find the purpose of enabling the emulator. Any idea what benefits it brings in the AV profile.

Regards

Sebastan

[AndreaSoliva]

Hi

lets say in this way! The standard technology is proxy based. From this point of view I would recommend to use always proxy based. If you have some performance problem on the device change to flow based. The AV engine was completly re-engineered for 5.2 meanign two engine one for proxy and one for flow. This is the reason you do not have anymore differences between flow and proxy based (this is technical based). In FortiOS 5.0 there was only one AV engine meaning for proxy based and additional this engine was also used for flow based. This was the reason under 5.0 flow based was restricted to some funtions like not capable to look into a zip file etc. because the engine was actually proxy based. This changed under 5.2.

Whatever the technology which is used since years etc. is proxy based and this I would use. If you have as mentioned performance problem I would change to flow based.

hope this helps

have fun

Andrea

[sebastan_bach]

Thanks Andrea,

There is still fundamental difference between proxy & flow mode based AV. in proxy mode the file needs to be completed downloaded before the AV engine scans the file. Also the Firewall works as a man in the middle between the client and the server.

In flow mode however the packets are allowed to pass-through but a copy of the packet is buffered in the memory. When the firewall sees the end of file marker in the original packet it holds that packet and then scans the entire packet which is stored in the memory. If the verdict is virus the last segment is dropped otherwise allowed if the verdict is clean about the file.

Regards

Sebastan

[AndreaSoliva]

Hi

yes absolutly correct and the reason why flow is faster then proxy mode. Anyway from functionality point of view "should" be no difference which means this what proxy mode can is also possible with flow mode even the flow mode does it in a difference way.

Hope this helps

have fun

Andrea 

[sebastan_bach]

Yeah true Andrea,

I couldn't get any info on then emulator option. I am not sure what does that option does. So filtering based on nested files, filtering based on level of compression & file size is all possible with flow as well right. I am sure it's possible with proxy mode. will have to test this out.

Do you have any idea on the same.

Regards

Sebastan