Fortinet FortiGate FortiGate-5020, Administration Manual

Page: 310 / 402

310
01-28008-0013-20050204 Fortinet Inc.
CLI configuration Antivirus
config antivirus service http
Use this command to configure how the FortiGate unit handles antivirus scanning of
large files in HTTP traffic and what ports the FortiGate unit scans for HTTP.
Command syntax pattern
config antivirus service http
set <keyword> <variable>
end
config antivirus service http
unset <keyword>
end
get antivirus service [http]
show antivirus service [http]
antivirus quarantine command keywords and variables
Keywords and variables Description Default Availability
drop_heuristic
{ftp http imap pop3 smtp}
Do not quarantine files found by
heuristic scanning in traffic for the
specified protocols.
imap
smtp
pop3
http
ftp
FortiGate
models
numbered
200 and
higher.
store_heuristic
{ftp http imap pop3 smtp}
Quarantine files found by heuristic
scanning in traffic for the specified
protocols.
No
default.
FortiGate
models
numbered
200 and
higher.
antivirus service http command keywords and variables
Keywords and
variables Description Default Availability
memfilesizelimit
<MB_integer>
Set the maximum file size (in megabytes)
that can be buffered to memory for virus
scanning.
The maximum file size allowed is 10% of the
FortiGate RAM size. For example, a
FortiGate unit with 256 MB of RAM could
have a threshold range of 1 MB to 25 MB.
Note: For email scanning, the oversize
threshold refers to the final size of the email
after encoding by the email client, including
attachments. Email clients may use a variety
of encoding types and some encoding types
translate into larger file sizes than the
original attachment. The most common
encoding, base64, translates 3 bytes of
binary data into 4 bytes of base64 data. So a
file may be blocked or logged as oversized
even if the attachment is several megabytes
less than the configured oversize threshold.
10
(MB) All models.