Enable Antivirus scanning cause a major performance backdrop

[Phuoc_Ngo]

Had anyone experience a sluggish performance when enabling Antivirus scan under protection setting? Every single time we enable antivirus scan, the firewall throughput perform is degraded 90% and stay at the max throughput all the times. We only have one Antivirus scanning policy enable as a test.

[TopJimmy]

ORIGINAL: dbay21 Thanks for the replies abelio & Phuoc. I changed the suggested setting to 1 - 600 based on this article http://tinyurl.com/njfn9w. However, I noticed that the download was still taking longer so I configured the setting to be 1 – 1200; this seems to fix the issue. Phuoc brought up a great point, how do I know if the HTTP scan is working at all with the applied settings I have. Anyone know a known Trojan horse sites? Any Suggestions

Are you referring to " Comfort Clients" ? " Interval" at 1 and " Amount" set to 1200 p.s. Your tinyurl link doesn' t work. 404 error.

[#3]

Sorry about the link TJ http://tinyurl.com/njfn9w Yep, I am referring about " Comfort Client" db

[Phuoc_Ngo]

I still haven' t been able to figure out how the virus got pass through the firewall when we lower down the client comfort setting. Virus traffic always got through port 80 and SMTP port 25. Our web filter and mailgateway was able to detected and clean out the virus before it hit the internal network. What is the best way to validate whether the antivirus scan on the Fortigate function properly? Thanks,

[RickP]

What is the best way to validate whether the antivirus scan on the Fortigate function properly?

I use the EICAR test files at http://www.eicar.org/ The AV scanner treats them as viruses though they' re not dangerous.

[#6]

Yes, you will notice a significant throughput drop when using the AV scanning. The more filters you apply, the worst it will get. Fortinet gives rating for each of their Fortigate, but a Fortinet engineer told me those figures are slightly exagerated because " The competition also exagerates theirs figures" , he says. Using a pair of Fortigate 800 in A/A mode, http throughtput go from 85-95 Mbps without AV scanning turn on, down to 20-25 Mbps with it turned on. Fortinet rates it at 150 Mbps. Slightly exagerated figures indeed. Just godda get a much faster Fortigate... says the Fortinet Reseller...

[ede_pfau]

You might consider using the " simple" in-the-wild database only not the extended DB for AV scanning. The former contains the top-NNN hottest viruses, the latter most of all known ones. Scanning with the leaner DB poses no real risk IMHO as many known viruses are no longer circulating. And yes, if the FGT passes 1200 bytes of a web page while still scanning it might well be passing a virus. I' d do away with client comforting over, say, 256 bytes at a time. But then again, I don' t have any performance issues with AV, using a 50B or a cluster of 310Bs. The hardware you are using might really be not up to the performance you are expecting - how many concurrent users, on which FGT?