How to verify that AV engine is running

[seadave]

I have a FG-100D running 4.3 MR3 P11. I noticed today I was able to download an .EXE without being blocked. We normally block these with a rule and only allow .EXEs from trusted sites using another rule. This has worked well for a number of years. I went to the EICAR site to download some of the test virus files: http://www.eicar.org/85-0-Download.html And the fortinet is not blocking or detecting them. I ran a diag sys top 99 99 and I don' t see any D=dead processes. How do I determine if the AV engine is running or not? AV defs are 17.00294 and AV Engine is 4.00398. This is very disconcerting. With the number of attacks that are occuring these days having something down without a method of notification is not good.

[ede_pfau]

I' m betting you downloaded the EICAR file via HTTPS and don' t have SSL scanning in place. Otherwise, the EICAR site is the place to go. You could analyze the data path through the FGT using ' diag debug flow' to be sure the correct policy is hit.

[seadave]

Good suggestion, but I' m aware of that limitation. I was downloading the normal http .txt and .com file. It must have something to do with how my rules are setup, but it isn' t obvious. I tried to use diag debug flow from the console but how to use that and obtain viewable results isn' t obvious to me. Would you mind a quick example? I' ll check the guide also. Thanks

[ede_pfau]

The main point is to determine how to narrow down the traffic flow to what you really want to see. So you start with

 diag deb ena
 diag deb flow filter clear

Then, narrow down the filter as much as you can:

 diag deb flow filter daddr <destination_IP>
 diag deb flow filter saddr <source_IP>

etc. A ' ?' instead of the keyword will give you a list of options. Then you enable output to the console:

 diag deb flow show cons ena

and start to decipher a fixed number of transactions

 diag deb flow trace start <n>

Start with n=20 or so. Debugging will stop after the 20th message. A HTTP download should be completed within 20 or so messages.

[seadave]

Great explanation thanks. I realized I was doing something stupid. I had a rule setup to allow DNS servers to get out unfiltered and I had inadvertantly added my host to the group. Once I removed that EICAR is detected as expected.

[billp]

Ede, BTW, that' s a great explanation on how to use diag debug flow. I' m adding it to my FTNT cheat sheet. Thanks!!

[ede_pfau]

thanks for the flowers Bill! I' m glad I' m part of this wonderful bunch of pro users in this forum who keep the discussions alive, learn and share. The forum is a special place on the net, very respectful and open in comparison to other places. Still remember how I dared my first post a couple of years ago -