Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Protocol Options
Hello All,
I am looking for the location in the gui to edit protocol options and have not been able to locate it. I have recently upgraded to
5.2 and it appear a lot of stuff has changed or moved. I get notifications about downloads that file limit is exceeded and it categorizes that event as subtype
of virus?? Makes no sense to me. I only want notification emails when a virus signature gets a hit. Anyone have any ideas about why this my be behaving like this?
I just don' t understand how a file size (which I suppose I will need o change) would trigger an event with a subtype of " virus" .
20 REPLIES 20
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The file size piece can be annoying but basically it' s letting you know it couldn' t scan the file for viruses because the file size was larger than your settings are set for. Vast majority of viruses are under 1MB so this can be verbose at times. The protocol options you are looking for are listed under " proxy options" under the Policy headed in 5.2. However if you wish to change the max file size option for AV scanning it' s located in the CLI:
config antivirus service http(or other protocols)
set uncompsizelimit 15 (default is 10)
end
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I follow what you are saying. It would be nice if they told you the size of the file that it
was skipping the scanning process on. I am not so sure I care about what it doesn' t scan because
of a size limitation being that I also have an enterprise antivirus solution. I will give you
an example. I feel pretty confident that my AV signature updates are not virus laden.
However, I get a notification that it did not scan them. That gets to be a lot of emails.
So is the solutions to somehow exempt an IP from where the signatures come or something different?
Does that make sense?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jrpayne,
Are you doing email notifications from the FortiGate or from FortiAnalyzer? From the FortiGate you can filter out the logging of these oversize messages entirely if you want:
conf log disk filter
set oversized disable
end
Hope that helps.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh really? That is awesome to know. I will certainly give that at shot. I should still continue
receive av signature hit notifications, correct?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes this should only affect the oversized log messages. One thing you' ll find with FortiOS is the option you want very likely exists it' s just not in the GUI...I guess if they put every possible option in the gui it would be unusable though.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tried that command and it did not seem to be valid.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
According to the 5.2 CLI ref guide, the command should work, unless logging is enabled/directed to another device.
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0
(FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FG300B3909601246 # config log fortianalyzer
filter Filters for FortiAnalyzer.
setting Global FortiAnalyzer settings.
FG300B3909601246 # config log fortianalyzer filter
FG300B3909601246 (filter) # set
severity Lowest severity level to log.
forward-traffic Enable/disable log through traffic messages.
local-traffic Enable/disable log local in or out traffic messages.
multicast-traffic Enable/disable log multicast traffic messages.
sniffer-traffic Enable/disable log sniffer traffic messages.
anomaly Enable/disable log anomaly messages.
netscan-discovery Enable/disable log netscan discovery events.
netscan-vulnerability Enable/disable log netscan vulnerability events.
voip Enable/disable log VoIP messages.
dlp-archive Enable/disable log DLP archive.
FG300B3909601246 (filter) # set
These are the options that I get when trying to rrun either of these .
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the GUI there' s a checkbox in the proxy options profile " Log oversized" - this is why the AV oversize messages are logged.
In the CLI it should be (example: " default" profile):
config firewall profile-protocol-options edit " default" set oversize-log disablein the profile-protocol options there are also individual (http/ftp/...) values for oversize-limit (default 10MB).