file/email exceeds size limit

[#1]

In the AV section of the logs I am seeubg this ' exceeds file size limit' message a lot. It seems to happen the most when someone tries to view any online video. Is there a way to raise the limit? I have not been able to find anything in the GUI that would fix this. The suits want to view their YouTube! Help. TYIA, Chris

[#2]

No problems - in V3.00 the setting you need is under Firewall / Protection Profile / Anti-virus - look for the " Oversized File/Email" setting and the " Threshold" . If you have V2.80 there' s something similar but I' ve already forgotten where - definately in protection profiles... For each type of communication, http, ftp, smtp etc you can select what you would like to do with oversized files - block or pass - and the threshold in MB. Depending on your FGT model the limits will be 1-x MB, on my 3000s it' s 1-139MB. These settings are a compromise between safety and performance. For http and ftp downloads I have a threshold of 20MB but set to pass if they are larger, so the first 20MB of all files is scanned, if the file is larger then the remainder is not scanned, but almost all files propagating viruses are small - it makes them efficient, any virus which needs a 20MB file to move around wouldn' t get far - so this isn' t a big problem. For email protocols I have a 30MB limit but block oversized files because most organisations don' t support email bigger than that anyway. <Nomenludi>

[#3]

a little bit more info... FortiGate60 w/ 2.80 firmware there' s a setting in the anti-virus config that u can set the oversize threshold from 1-12MB. Mine is set max at 12. If I upgrade to 3.00 I' ll get upto 139? Is that what you' re saying?

[RickP]

ORIGINAL: rippyautomotive If I upgrade to 3.00 I' ll get upto 139? Is that what you' re saying?

The largest file size you can set is determined by the amount of RAM...and that' s determined by model. Nomenludi' s got an FGT-3000 which is more than a few models up from the FGT-60.

[#5]

Yes, that' s it - unfortunately upgrading to V3.00 will not increase the limit, you can still choose to pass or block oversized files in the different protocols, but you can only choose the amount to scan in the range 1-12MB.

[#6]

upgrading to V3.00 will not increase the limit, you can still choose to pass or block oversized files in the different protocols, but you can only choose the amount to scan in the range 1-12MB.

...So if it is not scanning files larger than 12mb then why am I experiencing this slow down loading/downloading larger files? I have it set to pass oversize files instead of block. I understand that some of the smaller ' larger' files may be smaller than the 12MB limit I' ve set, so they will take a bit longer to pass through the firewall, since they' re getting scanned by the A/V, but not being able to download Eudora 7 (see image in first post) or stream a flash based video doesn' t seem right. It' s supposed to pass those oversize files, which it will do eventually, but it takes a long time... much longer than it used to before we had the FortiGate. Is there some sort of workaround/solution that I' m not thinking of?

[edsouza_FTNT]

Your FGT60 is pretty slow on transferring data, so expect it to take some time to download a file from the FGT. You probably will want to lower your oversize limit to make downloads faster.

[#8]

I have a question that' s related to the topic... Is there any way to make exceptions to file size blocking by host/subnet? For example, I have an internal machine that shares media to the network, however, Fortigate applys the same file size restrictions to this machine as it does to machines communicating with the internet. This machine does not connect to the internet itself, so file size restrictions are unnecessary. We are using a FG-800 Thanks Cam

[edsouza_FTNT]

Cam, Why don' t you just create a new policy that has no profile enabled for that subnet? Or if still need AV and you are running 3.00, then you can set specific file sizes, and file blocks inside a Protection Profile.

[#10]

Thanks for your reply. I am relatively new to the Fortigate appliance, but I would specifically like to disable file size restrictions for specific machines. Is it possible to create protection profiles for specific IP addresses (as opposed to subnets)? I am using the 2.8 firmware. Cheers, Cam