Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 342 / 861

341 Preventing attacks
Protecting your network resources from virus infections
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
6
To apply these settings, create a rule and enable the appropriate actions on the Antivirus tab.
Related information
For further information related to this topic, see the following:
■
“Antivirus—Configuration tab” on page 630
■
“How data comforting works” on page 341
■
“Warnings and limitations about data comforting” on page 341
■
“Adding antivirus protection to a rule” on page 347
How data comforting works
For the HTTP protocol, when a user downloads a file, the security gateway stores a copy of the
requested file in a buffer and begins the scanning process. While the copy is being scanned, a small
portion of the original, unscanned file is sent to the user through the client application. The trickled
data triggers the File Download or Save File As dialog box, which provides the user with a quicker
download response. After the user enters a file location and clicks Save in the File Download or Save
File As dialog box, the file is trickled to the user, at regular intervals until the scan is complete, which
prevents the browser from timing out. The browser indicates how much of the file has been trickled so
far.
If no virus is detected during the scan, data trickling stops, and the remainder of the file is sent to the
user.
Note:
When configuring the antivirus data comforting option for HTTP, FTP, and POP3, a pop-up
window reports that infected (repairable and unrepairable) files will be deleted even when the
antivirus response is set to repair and delete.
If a virus is detected, the connection is terminated, and no additional data is sent to the user. The user
receives no notification that the file might be incomplete or that it might contain a virus. However, the
security gateway logging regarding virus detection functions normally when data comforting is active.
A log message about the virus detection is sent to all active logging destinations.
For the POP3 protocol, an x-header is sent to the client to keep the client from timing out. The body of
the email is not trickled, only the header data.
Trickling occurs during any HTTP or FTP transaction that takes long enough to require trickling.
For more information, see the following:
■
“Monitoring log files” on page 470
Warnings and limitations about data comforting
You might consider enabling data comforting if your users routinely download large files. However,
enabling data comforting can compromise antivirus integrity. Symantec does not recommend using
the data comforting feature for the following reasons:
■
The data that is trickled to the user may contain portions of a virus.
Note:
If you enable data comforting, you should install an antivirus program such as Symantec
AntiVirus Corporate Edition that provides real-time virus scanning. If the trickled data is infected,
the real-time virus scanning feature will detect the virus immediately.