How to Configure Antivirus Scanning in the Firewall

Transcription

1 How to Configure Antivirus Scanning in the Firewall To protect against malicious software and files that users receive from download portals or accept from file transfers in instant messengers, you can enable Application Control and antivirus (AV) scanning in your firewall rules. The Barracuda NG Firewall uses Application Control to identify the connections that originate from these applications and then scans the traffic for viruses and malware. If a user downloads a file containing malware, the Barracuda NG Firewall detects and discards the infected file and then redirects the user to a warning page. You can also enable SSL Interception in your firewall rules to scan SSL-encrypted connections. In this article: Before You Begin Enable Application Control 0. For more information, see How to Enable Application Control 0, SSL Interception, AV Scanning and URL Filtering. Create a Virus Scanner service. For more information, see Virus Scanner. Use feature level 5.3 for the Forwarding Firewall Rules. Step Enable the Virus Scanner Service Ensure that the Virus Scanner service is enabled. Open the Service Properties page (Config > Full Config > Box > Virtual Servers > your virtual server > Assigned Services > Virus-Scanner). Enable the Virus Scanner service by selecting yes from the Enable Service list. Click Send Changes and Activate. Step Configure an AV Engine Select and configure a Virus Scanner engine. You can use Avira and ClamAV either separately or together. Using both AV engines significantly increases CPU utilization and load. 1 / 5

2 Open the Virus Scanner Setup page (Config > Full Config > Box > Virtual Server > your virtual server > Assigned Services > Virus-Scanner). Enable the virus scanner engines of your choice: Enable the Avira AV engine by selecting Yes from the Enable Avira Engine list. Enable the ClamAV engine by selecting Yes from the Enable ClamAV list. Click Send Changes and Activate. Step Enable SSL Interception and AV Scanning in the Firewall If you want to configure your firewall rules to scan files in the firewall which are transmitted over a SSLencrypted connection, enable SSL Interception and virus scanning in the firewall. 5. Open the Security Policy page (Config > Full Config > Box > Virtual Server > your virtual server > Assigned Services > Firewall > Security Policy). Enable SSL Interception. Upload your root CA certificate or create a self-signed Root Certificate. (Optional) Click the plus sign (+) in the Trusted Root Certificates section to add additional root certificates In the Virus Scanner Configuration section enable Virus Scanning in the firewall. Add the MIME types of files you want the AV scanner to scan to the Scanned MIME types list. The default <factory-default-mime-types> includes the most important MIME file types. Click here for a full list of the factory default MIME types... application/zip application/x-msdos-program application/x-zoo application/mac-binhex40 application/x-apple-diskimage application/x-tar application/x-bzip2 2 / 5

3 application/x-archive application/x-rpm application/x-gzip application/x-rar application/rar application/x-gtar application/x-7z-compressed application/x-stuffit application/x-iso9660-image application/x-dosexec application/x-msdownload application/x-msdos-windows application/x-download application/bat application/x-bat application/com application/x-com application/exe application/x-exe application/x-winexe application/x-winhlp application/x-winhelp application/x-javascript application/hta application/x-ms-shortcut application/octet-stream 8. (optional) Change the Action if Virus Scanner is unavailable. 9. Click Send Changes and Activate. 3 / 5

4 Step Enable the AV Scanner in the Firewall Rules You can enable AV scanning for every Pass firewall rule Open the Forwarding Firewall page (Config > Full Config > Box > Virtual Server > your virtual server > Assigned Services > Firewall). Double-click the firewall rule for which you want to enable AV scanning. Click the Application Policy link. Select the Application Control and AV Scan check boxes. If you want to scan SSL-encrypted traffic, select the SSL Interception check box Click OK. Click Send Changes and Activate. Monitoring and Testing Test the AV scan setup by downloading EICAR test files from You then receive the following block page: To monitor detected viruses and malware, go to the Firewall > Threat Scan page. 4 / 5

5 Figures 5 / 5