Without understanding how to scan files for viruses and filter out dangerous file types, your company’s network could be infected by a single malicious email attachment, causing data loss or ransomware. Antivirus scanning and file filtering are the two security layers that protect your FortiGate gateway from malware and unwanted content. For the NSE7 exam, you must know how to deploy and tune these profiles to balance security with performance.
Jump to a section
A simple way to picture Antivirus and File Filtering
Three hundred suitcases arrive every hour at an international airport from a large flight. Each suitcase is a file coming into your FortiGate firewall from the internet. The airport has two layers of security: an X-ray machine that scans every bag for dangerous items, and a manual check for prohibited objects like lighters or oversized liquids. The X-ray machine is your antivirus scanner: it looks for known malicious code patterns, like a file with a virus signature, and flags it. The manual check is your file filter: it examines the properties of the bag itself, not the contents, and stops items that violate policy, like an .exe file attachment in an email. If the X-ray machine flags a bag, a security officer pulls it aside for a deeper scan, just as FortiGate quarantines a suspicious file. The manual check might reject a bag because it contains a liquid over 100ml, even if that liquid is perfectly harmless, similar to how a file filter can block a legitimate PDF file if it’s too large or the wrong type. The airport needs both systems to work together because a virus could hide in a harmless-looking soda bottle, and a banned item (like a power bank) would pass the X-ray but get caught by the manual check. Just as passengers wait longer when both checks are thorough, your network might slow down if you apply deep antivirus scanning on every single file, so you configure filters for risk-based decisions.
The airport’s rule book lists all the banned items, updated daily by the aviation authority. Your FortiGate’s antivirus database is updated by Fortinet with new virus signatures every few hours. If you skip the manual check, a passenger might carry a sharp object that doesn’t trigger the X-ray, but is still dangerous — a real risk if you disable file filtering and only rely on antivirus.
Antivirus scanning and file filtering are two separate but complementary security features on a FortiGate firewall. They work together to inspect files as they pass through the firewall from the internet or from internal users.
First, let’s define the terms. A firewall is a device that controls network traffic based on rules. FortiGate is a brand of firewall made by Fortinet. A policy is a set of rules that tell the firewall what to do with traffic that matches certain conditions (like source IP address, destination port, or application). Antivirus (AV) scanning examines the content of files to find malicious code, such as viruses, worms, trojans, or ransomware. A virus is a piece of code that can copy itself and spread to other files. A worm is a self-replicating program that spreads across networks without needing a host file. Ransomware is malware that encrypts your files and demands payment to unlock them. A signature is a unique pattern or fingerprint of a known malware strain. FortiGate uses a regularly updated signature database to compare file contents against known threats. This is similar to how your phone uses a list of known spam numbers to block calls.
File filtering, on the other hand, does not look at the contents of a file for malicious code. Instead, it looks at the file’s metadata — its name, extension, type, and size — and decides whether to allow or block it based on policy rules. For example, a file filter rule might block all files with the extension .exe (executables) from email attachments, because .exe files are a common way to deliver malware. It might also block files larger than 10 MB to prevent network congestion, or block files that are password-protected because you cannot scan them for viruses. A file filter profile is a collection of these rules that you assign to firewall policies.
Why use both? Because each layer catches things the other might miss. A clever virus might be compressed inside a ZIP file that looks harmless, but the antivirus scanner can unzip it and scan the contents. However, a file filter could block all ZIP files from email altogether if your company policy forbids them. Conversely, a legitimate PDF file might contain a zero-day exploit (a brand-new virus that has no signature yet). The antivirus might miss it because the signature doesn’t exist, but a file filter could block PDF files from untrusted sources. The two features are configured in the FortiGate GUI under Security Profiles. You create a separate antivirus profile and file filter profile, then apply both to the same firewall policy. The order matters: FortiGate applies the file filter first, then the antivirus scan. If the file filter blocks a file, it never reaches the antivirus engine, saving processing power. If the file filter allows it, the antivirus scanner unpacks and examines the file.
When you configure antivirus scanning, you choose a scanning mode. The options are:
Flow-based: fast, low CPU usage, uses pattern matching to quickly check signatures. Good for high-throughput networks.
Proxy-based: slower, but more thorough. It reconstructs the entire file before scanning, allowing detection of packed or obfuscated malware. Uses more memory.
Both: FortiGate uses flow-based for an initial quick check, then proxy-based for deeper inspection if the file is suspicious.
You also configure what types of files to scan. Common choices include email attachments, web downloads, and FTP transfers. You can enable or disable scanning for specific protocols (HTTP, SMTP, IMAP, POP3, FTP). Each scanned file consumes CPU and memory. You must balance the need for security with the risk of slowing down network traffic.
File filter profiles have a different set of settings. You define a list of file patterns (by name, extension, or type) and choose an action: allow, block, or log (record the event without blocking). You can also specify what to do with password-protected files: skip (do not scan), block, or scan (only if password is provided, which is impractical). File filters are especially powerful for blocking executable files (like .exe, .bat, .scr, .vbs) that are common malware vectors. They can also block audio/video files (like .mp4, .mp3) if your company wants to save bandwidth and block personal streaming.
A crucial detail: file filtering can be applied to files that are already encrypted, like HTTPS traffic, but only if you have enabled SSL inspection (decrypting the traffic). The exam loves to test this point. Without SSL inspection, the antivirus and file filter cannot see inside encrypted connections, so malicious files can bypass both.
Another important concept is the distinction between flow-based and proxy-based scanning for file filtering. Flow-based file filtering works on the fly as each packet arrives, so it can start blocking large files early without waiting for the whole file to be received. Proxy-based file filtering buffers the entire file before making a decision. The exam asks which mode is better for blocking large files early — that is flow-based.
Finally, you need to understand that antivirus and file filter profiles are separate objects in the FortiGate configuration. You can create multiple profiles for different scenarios (e.g., a strict profile for incoming email, a moderate profile for web browsing, a permissive profile for internal file transfers). You then attach these profiles to firewall policies. The NSE7 exam heavily tests your ability to match the right profile to the right policy based on a scenario.
Identify the traffic flow
Determine which firewall policy will handle the traffic you want to secure (e.g., incoming email from internet to mail server). This step ensures you apply the profiles to the correct policy, not all policies.
Create an antivirus profile
Go to Security Profiles > Antivirus, create a new profile. Choose scanning mode (flow-based, proxy-based, or both). Enable the specific protocols (like SMTP for email). Set the maximum file size to scan. This defines how malware detection will work.
Create a file filter profile
Go to Security Profiles > File Filter, create a new profile. Add rules for file extensions, file types, or sizes you want to block or allow. Specify action (block, allow, log). Include rules for password-protected archives. This controls which files get through to the antivirus engine.
Apply profiles to the firewall policy
Edit the firewall policy that matches the traffic. Under Security Profiles, enable both the antivirus profile and the file filter profile. If you only enable one, the other will not be used. Also ensure SSL inspection is enabled if traffic is encrypted.
Test and monitor
Send a test email with a benign .exe file attached to verify it is blocked by the file filter. Check the logs for blocked events. Monitor CPU usage to ensure performance is acceptable. Adjust scanning mode or file filter rules if false positives occur.
Tune and update
Add exceptions for legitimate files that are falsely blocked (false positives). Ensure the antivirus signature database is set to auto-update. Periodically review logs to identify new threats or misconfigurations.
You work as an IT administrator for a medium-sized company with 500 employees. The company receives a lot of email from external clients, and also provides a web-based portal where employees can upload files. The CEO wants to ensure no malware enters the network, but the sales team complains that their legitimate email attachments are sometimes blocked. How do you configure antivirus and file filtering?
First, you gather requirements. The security policy says:
All email attachments must be scanned for viruses.
Executable files (.exe, .bat, .com) must be blocked from email and web uploads.
Compressed files (.zip, .rar) must be scanned for viruses, but not blocked unless they contain a threat.
Files larger than 20 MB from email should be blocked to prevent mailbox overload.
Password-protected ZIP files must be blocked because they cannot be scanned.
You log into the FortiGate GUI. Navigate to Security Profiles > Antivirus. Create a new profile called 'Strict-Incoming-Mail'. Set the scan mode to 'Proxy-based' because email security is critical and you can accept a slight delay. Enable scanning for SMTP (incoming email) and also for POP3 and IMAP if employees use client software. Under 'Options', set 'File size limit for scanning' to 20 MB. Any file over that will be skipped (not scanned) — but you will block them with the file filter instead. Ensure the 'Signature database' is up to date (Fortinet updates automatically by default).
Next, create a file filter profile. Go to Security Profiles > File Filter. Create a new profile called 'Email-File-Filter'. Add a rule for executable files: select 'File type' as 'Executable' and set action to 'Block'. Add a rule for archives: select 'Archive' type and set action to 'Allow' (so they reach the antivirus). Add a rule for file extension '.exe' as a second layer. Add a rule for file size: set 'Max file size' to 20 MB, action 'Block'. Finally, add a rule for password-protected archives: select the option 'Password-protected archives' and set action to 'Block'. Configure the file filter to 'Log' all blocked events for auditing.
Now, you need to apply these profiles to a firewall policy. Go to Policy & Objects > Firewall Policy. Find the policy that handles incoming email from external sources to your mail server. Edit that policy. Under 'Security Profiles', enable the antivirus profile and select 'Strict-Incoming-Mail'. Enable the file filter profile and select 'Email-File-Filter'. Save the policy.
After a week, the sales team reports that a client’s PDF attachment was blocked. You check the logs and see the file filter blocked it because the PDF had an embedded executable component (which FortiGate classified as 'Executable'). This is a false positive — a legitimate file flagged as malicious. You can adjust the file filter to add an exception: specifying the sender’s domain or a specific filename pattern to allow that file. In the file filter profile, add an 'Exception' rule: file name matches '*.pdf' AND source IP is the client’s mail server IP. This is a common real-world task: fine-tuning filters to reduce false positives while keeping security strong.
Another scenario: a new ransomware variant starts spreading via PDF files with malicious macros. The antivirus signature database might not yet have the signature. You can quickly create a temporary file filter rule to block all PDF files from external sources until the signature is updated. This is called a compensating control. The exam may ask you to implement this kind of emergency measure.
Finally, you need to monitor performance. On the FortiGate dashboard, check the 'Security' widget to see antivirus and file filter processing rates. If the CPU is high, you might switch to flow-based scanning for lower-priority traffic like web browsing. Document your actions for compliance audits.
The NSE7 exam (exam code NSE7) for Advanced Security includes objective 4.4: Deploy antivirus scanning and file filter profiles on FortiGate. This objective appears in multiple-choice questions, drag-and-drop questions, and scenario-based questions. You must know both the conceptual differences and the exact steps to configure each feature in the FortiGate GUI or CLI.
The exam tests these specific concepts:
The difference between flow-based and proxy-based scanning modes. You will be asked: 'Which scanning mode is recommended for high-throughput environments?' Answer: flow-based. 'Which mode provides deeper inspection?' Answer: proxy-based. 'Which mode can block a file before it is fully downloaded?' Answer: flow-based.
The order of operations: file filter is applied before antivirus scanning. If the file filter blocks a file, it is never scanned for viruses. This saves resources. The exam might present a scenario where a file is blocked by a file filter, and ask what happens to the antivirus processing — the correct answer is it never runs.
What happens when a file is password-protected. The exam loves this. You must know that password-protected archives cannot be scanned by the antivirus engine. The admin must choose an action: block (recommended), skip (and allow through without scanning), or log (still allow through). The correct answer in a security-conscious scenario is to block.
File filtering by file extension vs. file type. Extension (e.g., .docx) is easy to spoof (rename a .exe to .docx). File type analysis checks the magic bytes (header bytes) of the file to determine true type. The exam asks which is more secure — file type analysis. But file type analysis consumes more CPU than extension checks.
The need for SSL inspection. If a file is downloaded over HTTPS, the antivirus and file filter cannot inspect it unless you have an SSL inspection profile applied to the policy. The exam often sets a trap: 'You configure antivirus but malware still gets through — why?' The answer: missing SSL inspection.
How to apply profiles to a firewall policy: you must enable both the antivirus profile and the file filter profile under the Security Profiles section. They are separate dropdowns. The exam asks: 'Which two profiles must be configured to block malicious .exe files from email?' Answer: file filter profile (to block .exe) and antivirus profile (to scan other files).
Common traps: The exam might say 'You created an antivirus profile and applied it to a policy, but files are not being scanned. Why?' Possible correct reasons: (1) The policy does not have SSL inspection enabled, (2) The file filter is blocking files before scanning, (3) The antivirus profile is not enabled on the policy, (4) The traffic is not matching the policy (e.g., incorrect source/destination). Another trap: 'Which feature prevents the antivirus from scanning a file?' Answer: file filter with 'block' action.
Signature database updates: The exam might ask about the importance of the AV database being up to date. A common question: 'What happens if the FortiGate cannot reach the Fortinet update server?' Answer: antivirus scanning still works, but against an outdated database, so new malware may pass through.
Key definitions to memorise:
Antivirus profile: contains settings for scanning mode, protocols to scan, and signature behaviour.
File filter profile: contains rules based on file name, extension, type, size, and password protection.
Flow-based scanning: first packet arrives, quick scan, low overhead.
Proxy-based scanning: entire file reassembled and scanned, more thorough, higher latency.
False positive: a legitimate file flagged as malicious.
False negative: a malicious file not detected.
Exam tip: When presented with a drag-and-drop, you often must place the file filter step before the antivirus step in the inspection flow. Memorise the sequence: packet arrives -> policy match -> file filter -> antivirus -> other security profiles (e.g., web filter, IPS) -> forward packet.
Antivirus scanning examines file content for malware signatures, while file filtering blocks files based on name, extension, size, or password protection before scanning happens.
File filter rules are applied before antivirus scanning in the inspection pipeline, so a blocked file never consumes antivirus processing resources.
Flow-based scanning offers higher performance but less thorough inspection, while proxy-based scanning provides deeper analysis at the cost of latency.
Without SSL inspection, antivirus and file filter profiles cannot inspect files transferred over HTTPS, creating a major security gap.
Password-protected archives cannot be scanned for viruses, so the recommended policy is to block them outright or log them as a risk.
You must explicitly enable the protocols (HTTP, SMTP, IMAP, POP3, FTP) within an antivirus profile for scanning to occur on those traffic types.
These come up on the exam all the time. Here's how to tell them apart.
Flow-based AV scanning
Processes packets as they arrive, no buffering of the whole file
Lower CPU overhead, ideal for high-throughput networks
Cannot detect certain obfuscated malware that requires file reconstruction
Proxy-based AV scanning
Reassembles the entire file before scanning
Higher CPU overhead but more thorough detection
Can detect malware hidden in packed or encoded files
File block by extension
Checks only the filename suffix (e.g., .exe)
Very low CPU usage, fast to process
Easily bypassed by renaming a file (e.g., virus.exe to virus.pdf)
File block by type (magic bytes)
Checks the actual file header bytes to determine true type
Higher CPU usage because it reads the beginning of the file
More secure because renaming does not bypass the filter
Antivirus scanning
Inspects file content for malicious code using signature database
Catches new variants only when signatures are updated
Cannot inspect password-protected files
File filtering
Inspects file metadata (name, size, extension) not content
Can block zero-day threats that have no signature yet
Can block password-protected files from passing through
Mistake
Antivirus scanning and file filtering are the same thing, just with different names.
Correct
Antivirus scans file content for malicious code using signatures, while file filtering checks file metadata (name, type, size) to block unwanted files regardless of content.
Both features are under 'Security Profiles' in FortiGate and both relate to files, so beginners lump them together. But they serve different purposes and have different configuration options.
Mistake
Setting a file filter to 'block .exe files' is the only protection needed, so I don't need antivirus scanning.
Correct
Many malware types (like macro viruses in Word documents or script-based malware in PDFs) are not .exe files. Antivirus scanning catches those by analysing content, not just file extension.
Beginners over-focus on executable files because they are the most common vector, but the exam tests understanding that both layers are needed for defence in depth.
Mistake
If I apply an antivirus profile to a policy, it will scan all traffic regardless of the protocol.
Correct
Antivirus scanning only works on protocols you explicitly enable within the profile (HTTP, SMTP, IMAP, POP3, FTP, etc.). Other protocols like SQL or custom TCP ports are not scanned unless you configure them.
The GUI defaults to scanning only popular protocols, and beginners assume 'antivirus' means everything. The exam tests that you must enable each protocol individually.
Mistake
Flow-based scanning is always better because it's faster, so I should use it for all policies.
Correct
Flow-based scanning is less thorough than proxy-based. For high-security zones like email from the internet, proxy-based is recommended despite the performance cost.
Beginners gravitate toward 'faster' without understanding the security trade-off. The exam presents scenarios where you must choose the correct mode based on risk and performance.
Mistake
A file filter rule that blocks files by extension (e.g., .pdf) is completely secure because it blocks all PDFs.
Correct
File extension can be faked (a malicious file can be renamed from .exe to .pdf). File type analysis based on magic bytes is more secure, but it consumes more CPU. The best approach is to combine both, or use file type if CPU allows.
This misconception arises because many home users are familiar with blocking extensions on email servers. The exam tests the more advanced concept of file type analysis.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Flow-based scanning inspects packets as they arrive, using pattern matching for speed, making it suitable for high-throughput networks. Proxy-based scanning reconstructs the entire file before analysis, providing deeper inspection but with higher latency.
Not by itself. You must enable SSL inspection on the FortiGate to decrypt the traffic before the antivirus scanner can see the file contents. Without it, the antivirus can only see the encrypted tunnel, not the files inside.
File filter can block files based on type or size before they reach the antivirus engine, saving CPU resources. It also blocks files that the antivirus cannot scan (like password-protected archives) and can stop zero-day threats that have no signatures yet.
The antivirus engine cannot open a password-protected archive to scan its contents. By default, FortiGate will skip scanning it (allow it through without inspection) unless you configure a file filter rule to block it.
Create a file filter profile with a rule that blocks files with the .exe extension or the executable file type. Apply that profile to the firewall policy handling incoming email traffic. Optionally, also use an antivirus profile for additional scanning of other file types.
Yes. FortiGate always applies the file filter first. If the file filter blocks a file, it never goes to the antivirus scanner. This order is fixed and cannot be changed.
You've finished Antivirus and File Filtering. Continue through the NSE7 study guide to build a complete picture of the exam.
Done with this chapter?