Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 596 / 861

595 Field descriptions
Policy field descriptions
Rule Properties—Antivirus tab
Antivirus scanning is enabled on a rule-by-rule basis through the protocol-specific settings. To enable
the antivirus functionality, you must create a rule and select the antivirus processes that you want to
use. You can specify separate options for each protocol. After you enable the antivirus functionality,
you can configure the antivirus settings in the SGMI under Policy on the AntiVirus tab.
You can only use this tab if the service group used by the rule contains the SMTP, POP3, HTTP, or FTP
protocol.
The more antivirus scanning and filtering processes that you use, the greater the antivirus protection.
However, when you use multiple antivirus processes, you may see an impact performance due to an
increased demand on system resources.
See “Optimizing scanning resources” on page 337.
Associated tasks
The task that you can perform with this tab is:
■
“Adding antivirus protection to a rule” on page 347
Excluded network
users Displays users that are disallowed by the rule.
All users that you add are disallowed by the rule.
You can use the excluded list in conjunction with the included user groups list to allow most
users of a group but exclude some specific individuals.
Excluded user
groups Displays user groups that are disallowed by the rule.
All members of user groups that you add are disallowed by the rule unless you specifically
include a user for authentication by adding it to the Included network users list.
Table D-29 Rule Properties—Antivirus tab
Field Description
SMTP Indicates whether antivirus scanning is applied to SMTP traffic that is controlled by this
rule.
This option is only available if the service group used in the rule includes the SMTP
protocol.
This option is unchecked by default.
If you enable antivirus scanning, you can select either of the following options:
■
Replace deleted files with message file
Replaces an infected attachment in an email with a text file when the infected
attachment is deleted.
The text file that is inserted is called deleted%.txt, where % is a sequence number. For
example, if two attachments are deleted, the replacement files are called deleted1.txt
and deleted2.txt.
This option is checked by default.
■
Append message for repaired or deleted files
Appends the email message when the infected file is repaired.
This option is checked by default.
Table D-28
Rule Properties—Authentication tab (Continued)
Field Description