newbie question - antivirus profiles

[Mbutler522010]

I inherited a Fortigate800c with a complex set of profiles, policies and overrides configured and I am trying to understand why much of this was done. We have a pretty standard setup with staff and students, each with different policies and categories. However I don' t see why I would need more than 1 Antivirus profile for everyone. The manual does not give much help on why you would want multiple AntiVirus profiles and I don' t understand why I would not want everything checked - if I uncheck " POP3" doesn' t that mean all POP3 mail would not be checked for viruses? other than a research group, why would I ever want that? Please help me to understand Mark

[ede_pfau]

For each protocol scanned by the AV engine the FGT needs to set up a proxy. Sparing protocols that the policy itself will not allow preserves ressources on the FGT. Different policies can make sense in tailoring the AV measures to the services allowed. For example, usually policies for clients differ from those for servers. One very handy feature of FOS is " profile groups" . Here, you define which profiles are used (AV, IPS, AppControl etc.) for a specific set of hosts or a set of allowed services. Using protocol groups, you can manage these settings at a central place in contrast to every policy in a big policy table.

[Nihas]

Yes Ede.! But generally we don' t have to create multiple profiles for Antivirus scanning. I am using a single AV Profile which has all enabled for all of my policies. I believe, this option probably for those whom have specific services or servers. Exmple for a HTTP server , we don' t need to use all. So that can possibly reduce the use of physical resources.

[FortiAdam]

One reason I prefer two AV profiles is so I can have one be proxy based and one be flow based. Always configure your proxy options to fit your firewall policy. If you allow all ports outgoing, then you may as well be using your proxy options to catch all that outgoing traffic and put it through the AV proxy.

[Sean_Toomey_FTNT]

To add to this discussion: For best results you should try to keep your protections all proxy-based or flow-based and not mix the two. Antivirus is one of the heaviest hitting UTM protections on the box. It is therefore appropriate to scope the AV profile down to what is truly necessary and apply them as needed on a per rule basis. For example, if you don' t need to scan POP3 or IMAP then turn it off. Likewise for inbound traffic, if you are hosting HTTP/HTTPS only, then an AV profile only scanning those protocols is appropriate. There are only so many options with AV, that said, and I can' t imagine a good use case for having a ton of profiles, but nothing wrong with a few profiles for certain needs. In simpler installations, one profile may do the trick for the whole rulebase. Cheers!

[FortiAdam]

Sean, If a policy only allows HTTP and HTTPS why does it matter if my AV profile is set to scan all protocols? Wont only the HTTP and HTTPS traffic pass through the AV proxy in this scenario? Thanks!

[Sean_Toomey_FTNT]

ORIGINAL: FortiAdam If a policy only allows HTTP and HTTPS why does it matter if my AV profile is set to scan all protocols? Wont only the HTTP and HTTPS traffic pass through the AV proxy in this scenario?

Hi FortiAdam, sorry I should have clarified. Good question! For the bit about inbound traffic, if the rule only allows HTTP/HTTPS then it wouldn' t matter if other protocols are checked. The recommendation to scope the profile down comes from two parts.. one is organization, and two is flexibility. You probably want - or will want - in most installations the ability to change outbound profiles vs inbound profiles to suit your needs. You may not want someone to accidentally change something that affects every rule that has AV turned on. Not to say that your model won' t work, the point I was trying to make is that with a few different profiles scoped to your needs you lessen the risk that making changes to outbound UTM (which can be common) may make unintended consequences for inbound UTM (less common). If your needs only dictate one AV profile and you have administrative access to the firwall locked down pretty well, there is no reason why you couldn' t be successful. Hope this helps. Cheers!