FortiGate Administration Guide - FirewallShop.com

AntiVirus
Antivirus CLI configuration
Misc
NMT
P2P
Plugin
RAT
Spy
Toolbar
Block any programs included in the miscellaneous grayware
category.
Block network management tools. Network management tools can
be installed and used maliciously to change settings and disrupt
network security.
Block peer to peer communications programs. P2P, while a
legitimate protocol, is synonymous with file sharing programs that
are used to swap music, movies, and other files, often illegally.
Block browser plugins. Browser plugins can often be harmless
Internet browsing tools that are installed and operate directly from
the browser window. Some toolbars and plugins can attempt to
control or record and send browsing preferences.
Block remote administration tools. Remote administration tools
allow outside users to remotely change and monitor a computer on
a network.
Block spyware programs. Spyware, like adware, is often included
with freeware. Spyware is a tracking and analysis program that can
report your activities, such as web browsing habits, to the
advertiser’s web site where it may be recorded and analyzed.
Block custom toolbars. While some toolbars are harmless,
spyware developers can use these toolbars to monitor web habits
and send information back to the developer.
Antivirus CLI configuration
system global optimize
config antivirus heuristic
This section describes the CLI commands that extend features available through
the web-based manager. For complete descriptions and examples of how to
enable additional features through CLI commands, see the FortiGate CLI
Reference.
The optimize feature configures CPU settings to ensure efficient operation of the
FortiGate unit for either antivirus scanning or straight throughput traffic. When
optimize is set to antivirus, the FortiGate unit uses symmetric multiprocessing to
spread the antivirus tasks to several CPUs, making scanning faster.
This feature is available on models numbered 1000 and higher.
For more information, see the Antivirus failopen and optimization Fortinet
Knowledge Center article.
The FortiGate heuristic antivirus engine performs tests on files to detect virus-like
behavior or known virus indicators. Heuristic scanning is performed last, after file
blocking and virus scanning have found no matches. In this way, heuristic
scanning may detect new viruses, but may also produce some false positive
results.
The heuristic engine is enabled by default to pass suspected files to the recipient
and send a copy to quarantine. Once configured in the CLI, heuristic scanning is
enabled in a protection profile when Virus Scan is enabled.
Use the heuristic command to change the heuristic scanning mode.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 409