Configuring a protection profile
Firewall Protection Profile
FortiGate Version 4.0 Administration Guide
410
01-400-89802-20090424
HTTP and FTP client comforting
In general, client comforting provides a visual display of progress for web page loading or
HTTP or FTP file downloads. Client comforting does this by sending the first few packets
of the file or web page being downloaded to the client at configured time intervals so that
the client is not aware that the download has been delayed. The client is the web browser
or FTP client. Without client comforting, clients and their users have no indication that the
download has started until the FortiGate unit has completely buffered and scanned the
download. During this delay users may cancel or repeatedly retry the transfer, thinking it
has failed.
The appearance of a client comforting message (for example, a progress bar) is client-
dependent. In some instances, there will be no visual client comforting cue.
During client comforting, if the file being downloaded is found to be infected, then the
FortiGate unit caches the URL and drops the connection. The client does not receive any
notification of what happened because the download to the client had already started.
Instead the download stops, and the user is left with a partially downloaded file.
If the user tries to download the same file again within a short period of time, then the
cached URL is matched and the download is blocked. The client receives the Infection
cache message replacement message as a notification that the download has been
blocked. The number of URLs in the cache is limited by the size of the cache.
FTP and HTTP client comforting steps
The following steps show how client comforting works for an FTP or HTTP download of a
10 Mbyte file with the client comforting interval set to 20 seconds and the client comforting
amount set to 512 bytes.
1
The FTP or HTTP client requests the file.
2
The FortiGate unit buffers the file from the server. The connection is slow, so after 20
seconds about one half of the file has been buffered.
3
The FortiGate unit continues buffering the file from the server, and also sends 512
bytes to the client.
4
After 20 more seconds, the FortiGate unit sends the next 512 bytes of the buffered file
to the client.
5
When the file has been completely buffered, the client has received the following
amount of data:
ca * (T/ci) bytes == 512 * (40/20) == 512 * 2 == 1024 bytes,
where
ca
is the client comforting amount,
T
is the buffering time and
ci
is the client
comforting interval.
6 FTP client
: If the file does not contain a virus, the FortiGate unit sends the rest of the
file to the client. If the file is infected, the FortiGate unit closes the data connection and
sends the FTP Virus replacement message to the client.
HTTP client
: If the file does not contain a virus, the FortiGate unit sends the rest of the
file to the client. If the file is infected, the FortiGate unit closes the data connection but
cannot send a message to the client.
Caution:
Client comforting can send unscanned and therefore potentially infected content
to the client. You should only enable client comforting if you are prepared to accept this risk.
Keeping the client comforting interval high and the amount low will reduce the amount of
potentially infected data that is downloaded.
Summary of Contents for Gate 60D
Page 705: ...www fortinet com...
Page 706: ...www fortinet com...
