FortiGate Administration Guide - FirewallShop.com

Quarantine
AntiVirus
Figure 277:Quarantine Configuration (FortiAnalyzer from FortiGate with no local
disk)
Note: NNTP options cannot be selected. Support will be added in the future.
Quarantine configuration has the following options:
Options
Age limit
Max filesize to
quarantine
Quarantine Infected Files: Select the protocols from which to quarantine
infected files identified by antivirus scanning.
Quarantine Suspicious Files: Select the protocols from which to
quarantine suspicious files identified by heuristics.
Quarantine Blocked Files. Select the protocols from which to quarantine
blocked files identified by antivirus file blocking. The Quarantine Blocked
Files option is not available for HTTP, FTP, or IM because a file name is
blocked before downloading and cannot be quarantined.
The time limit in hours for which to keep files in quarantine. The age limit
is used to formulate the value in the TTL column of the quarantined files
list. When the limit is reached, the TTL column displays EXP. and the file
is deleted (although a record is maintained in the quarantined files list).
Entering an age limit of 0 (zero) means files are stored on disk
indefinitely, depending on low disk space action.
The maximum size of quarantined files in MB. Setting the maximum file
size too large may affect performance.
Low disk space Select the action to take when the local disk is full: overwrite the oldest
file or drop the newest file.
FortiAnalyzer
Enable
AutoSubmit
Apply
Select to enable storage of blocked and quarantined files on a
FortiAnalyzer unit. See “Log&Report” on page 469 for more information
about configuring a FortiAnalyzer unit.
Enable AutoSubmit: enables the AutoSubmit feature. Select one or both
of the options below.
Use file pattern: Enables the automatic upload of files matching the file
patterns in the AutoSubmit list.
Use file status: Enables the automatic upload of quarantined files based
on their status. Select either Heuristics or Block Pattern.
Heuristics is configurable through the CLI only. See “Antivirus CLI
configuration” on page 409.
Select to save the configuration.
FortiGate Version 3.0 MR5 Administration Guide
406 01-30005-0203-20070830