13.1 Conditions and limitations of antivirus scan
Prev | Chapter 13 Antivirus control | Next

## 13.1 Conditions and limitations of antivirus scan

Antivirus check of objects transferred by a particular protocol can be applied only to traffic where a corresponding protocol inspector which supports the antivirus is used (see chapter 14.3 Services). This implies that the antivirus check is limited by the following factors:

- Antivirus check cannot be used if the traffic is transferred by a secured channel (SSL/TLS). In such a case, it is not possible to decipher traffic and separate transferred objects.

- Within email antivirus scanning (SMTP and POP3 protocols), the firewall only removes infected attachments — it is not possible to drop entire email messages. In case of SMTP protocol, only incoming traffic is checked (i.e. traffic from the Internet to the local network — incoming email at the local SMTP server). Check of outgoing traffic causes problems with temporarily undeliverable email.

  For details, see chapter 13.4 Email scanning.

- Object transferred by other than HTTP, FTP, SMTP and POP3 protocols cannot be checked by an antivirus.

- If a substandard port is used for the traffic, corresponding protocol inspector will not be applied automatically. In that case, simply define a traffic rule which will allow this traffic using a corresponding protocol inspector (for details, see chapter 7.3 Definition of Custom Traffic Rules).

  Example: You want to perform antivirus checks of the HTTP protocol at port `8080`.

  1. Define the HTTP 8080 service (`TCP` protocol, port `8080`).

  2. Create a traffic rule which will allow this service applying a corresponding protocol inspector.

     Figure 13.1. Traffic rule for HTTP protocol inspection at non-standard ports

     Add the new rule before the rule allowing access to any service in the Internet (if such a rule exists). If the NAT (source address translation) technology is used for Internet connection, address translation must be set for this rule as well.

     Note: A corresponding protocol inspector can be also specified within the service definition, or both definition methods can be used. Both methods yield the same result, however, the corresponding traffic rule is more transparent when the protocol inspector is defined in it.

Prev | Up | Next
Chapter 13 Antivirus control | Contents | 13.2 How to choose and setup antiviruses