Comfort Client setting

[#1]

We are on the lastest OS with the Fortigate 300-A. We are using the AntiVirus feature and we are experiencing the following on downloads: When downloading IT related files… most of them are 10MB to 40MB... we are having to wait 7+minutes (clicked the download at 11:07 and at 11:14 still nothing) with the hourglass/arrow waiting for the save option to appear on a 21MB file that normally would have downloaded in less than a couple of minutes. Ones that were 100K had the save dialog pop up in seconds but any that I’ve tried that are greater than 10 MB pause way too long and act like the aren’t doing anything… How can this be aleviated without totally abandoning antivirus for file downloads and ftp??? I enabled comfort client, but it doesn' t seem to help at all. Thank you.

[Fireshield]

Lower the max size scanned. Start with going all the way to 1MB and test there, then raise it as needed until you hit the performance point that is acceptable.

[#3]

I realize I could probably do that, but then we may be making ourselves more susceptible... obviously my main concern is performance, but I thought that was the whole purpose of the Comfort Client Setting... to make it appear as if it is coming down with no problems. In real world settings... does this functionality even work??? Why include it if it doesn' t help do anything. Thank you.

[Fireshield]

Client comforting is not a function of speed, but rather gives the client bits of the download to keep it from giving up and/or starting over.

[#5]

So it is not designed to cause the client to show the download progress as the fortigate gets it? I had thought that as fortigate downloaded the file it somehow fooled the client in to showing its progress bar so the user does not believe he is hung up. This is what the help says:

Enable or disable client comforting for HTTP and FTP traffic. Client comforting provides a visual status for files that are being buffered for downloads using HTTP and FTP. Users can observe web pages being drawn or file downloads progressing. If disabled, users have no indication the FortiGate unit is buffering the download and they may cancel the transfer thinking it has failed. Interval The time in seconds before client comforting starts after the download has begun. It is also the time between subsequent intervals. Amount The number of bytes sent at each interval.

The bold section really leads you to believe it is suppose to do what I thought it was. I must be misunderstanding what it means there.

[RickP]

ORIGINAL: gsaunders So it is not designed to cause the client to show the download progress as the fortigate gets it? I had thought that as fortigate downloaded the file it somehow fooled the client in to showing its progress bar so the user does not believe he is hung up.

It does show some progress so the user sees his transfer is in progress, but it does not play any trickery with the user' s progress indicator. Client comforting simply sends a very small amount of the file to the user to show the transfer is working, as the FortiGate unit buffers the file at the maximum possible speed. The default client comforting settings send one byte to the user every ten seconds. This will continue until the FortiGate unit receives the entire file, scans it, and pronounces it virus-free. Only then does the user receive the file at full speed... You can increase the amount sent, and the sending interval. The danger is the virus will be at the beginning of the file and that portion of the download ill be delivered to the user because the FortiGate realises it' s infected and aborts the transmission.

[player]

how can the " Comfort Client" be enabled and configured?

[#8]

Well it is found in the Firewall / Protection Profile. You then edit the needed profile, go to the anti-virus section, and then check the Comfort Clients... but I believe this is on OS 3.x and higher. But I still need clarification myself on my last post. Anyone from Fortinet hear?

[Fireshield]

You are correct, gsaunders. It will also give the actual user a slow, but at least progressing, progress bar. This is still not a performance feature in any way other than preventing some re-requesting. Your best bet is still to look at the size of files you are scanning. This isn' t much of a security issue today as almost all malicious virus traffic is passed in very small files. One day this could change as the internet gets faster and faster, but the more bloat in the malicious software then the better chance it will affect performance on the machines as well and be discovered/eliminated.

[#10]

Fireshield, What do you recommend for a setting? What do you use? Is the maximum size to scan setting in the same location as the Comfort Client Setting? I see the following in the Anti-Virus section: Oversized File / Email = Pass or Block and then I see Threshold which I had changed to 5 MB.

You are correct, gsaunders. It will also give the actual user a slow, but at least progressing, progress bar. This is still not a performance feature in any way other than preventing some re-requesting.

Even with the Comfort Setting we see no change at all... no progress bar for 7 or 8 minutes and then we get the whole thing. I wonder if this Comfort Client Setting even works, because if we could give the user a indication that something is happening that would be fine, but since we sit their for 5 to 10 minutes then we don' t know what is going on. Anyway, I' ll probably just lower the file size limit.