End-of-Life (EoL)
Objects > Security Profiles > Antivirus
Use the
Antivirus Profiles
page
to configure options to have the firewall scan for viruses on the defined
traffic. Set the applications that should be inspected for viruses
and the action to take when a virus is detected. The default profile
inspects all of the listed protocol decoders for viruses, generates
alerts for Simple Mail Transport Protocol (SMTP), Internet Message
Access Protocol (IMAP), and Post Office Protocol Version 3 (POP3),
and takes the default action for other applications (alert or deny),
depending on the type of virus detected. The profile will then be
attached to a Security policy rule to determine the traffic traversing
specific zones that will be inspected.Customized profiles can be used to minimize antivirus inspection
for traffic between trusted security zones, and to maximize the
inspection of traffic received from untrusted zones, such as the
internet, as well as the traffic sent to highly sensitive destinations,
such as server farms.
To add a new Antivirus profile, select
Add and enter the following settings:
Field | Description |
|---|---|
Name | Enter a profile name (up to 31 characters).
This name appears in the list of antivirus profiles when defining
security policies. The name is case-sensitive and must be unique.
Use only letters, numbers, spaces, hyphens, periods, and underscores. |
Description | Enter a description for the profile (up
to 255 characters). |
Shared | Select this option if you want the profile
to be available to:
|
Disable override ( Panorama only ) | Select this option to prevent administrators
from overriding the settings of this Antivirus profile in device
groups that inherit the profile. This selection is cleared by default,
which means administrators can override the settings for any device
group that inherits the profile. |
The Antivirus tab allows
you to specify the action for the different types of traffic, such as
ftp, and http. | |
Packet Capture | Select this option if you want to capture
identified packets. |
Decoders and Actions | For each type of traffic that you want to
inspect for viruses, select an action from the drop-down. You can
define different actions for standard antivirus signatures (Action
column) and signatures generated by the WildFire system (WildFire
Action column). Some environments may have requirements for
a longer soak time for antivirus signatures, so this option enables
the ability to set different actions for the two antivirus signature
types provided by Palo Alto Networks. For example, the standard
antivirus signatures go through a longer soak period before being
released (24 hours), versus WildFire signatures, which can be generated
and released within 15 minutes after a threat is detected. Because
of this, you may want to choose the alert action on WildFire signatures
instead of blocking. |
Applications Exceptions and Actions | The Applications Exception table
allows you to define applications that will not be inspected. For
example, to block all HTTP traffic except for a specific application,
you can define an antivirus profile for which the application is
an exception. Block is the action for the
HTTP decoder, and Allow is the exception
for the application. For each application exception, select the
action to be taken when the threat is detected. For a list of actions,
see Actions
in Security Profiles.To find an application, start
typing the application name in the text box. A matching list of
applications is displayed, and you can make a selection. |
Virus Exception | The Virus Exceptions tab
to define a list of threats that will be ignored by the antivirus
profile. |
Threat ID | To add specific threats that you want to
ignore, enter one Threat ID at a time and click Add .
Threat IDs are presented as part of the threat log information.
Refer to Monitor
> Logs. |
Recommended For You
Recommended Videos
Recommended videos not found.
