# Antivirus and Web Filtering

> Chapter 7 of the Courseiva FORTINET-NSE4 curriculum — https://courseiva.com/learn/fortinet-nse4/antivirus-and-web-filtering

**Official objective:** 4.2 — Deploy antivirus scanning profiles and configure web filtering policies to block malicious and inappropriate content.

## Introduction

How does a company stop its employees from accidentally visiting a dangerous website that installs ransomware, or from downloading a legitimate-looking file that actually contains a virus? That is the exact problem solved by antivirus and web filtering in Fortinet's FortiGate firewalls. For someone studying the NSE4 exam, understanding how to configure these two defences is critical because they are the most common tools used to protect users from malware, phishing sites, and inappropriate content every single day.

## The Bouncer and the Mailroom Clerk Analogy

The front door of a busy nightclub has a specific person watching everyone who tries to enter. That person is the bouncer. The bouncer has a list of banned people, a list of suspicious behaviours, and a rulebook. If a person on the banned list tries to walk in, the bouncer stops them and sends them away. If someone is acting drunk or aggressive but not on the list yet, the bouncer still blocks them because their behaviour matches a known dangerous pattern. The bouncer does not care if the person is a famous celebrity or a regular customer — the rules are applied to everyone equally. This is the first layer of protection for the nightclub.

The mailroom clerk works in the back office, sorting through every single package and letter that arrives for the club. The clerk opens every envelope and inspects every box before it is handed over to a staff member. If a package contains a strange liquid or a sharp object, the clerk isolates it immediately. The clerk also knows that some letters might contain a tiny camera or a listening device, so every piece of mail is scanned and tested. The clerk does not trust anything until it has been proven safe. This is the second layer of protection, catching things that got past the front door.

Together, the bouncer and the mailroom clerk provide complete security. The bouncer handles the obvious threats at the entrance, while the mailroom clerk catches the sneaky threats that look innocent on the outside. In a computer network, the web filtering engine is the bouncer, blocking bad websites before a user even clicks a link. The antivirus scanner is the mailroom clerk, inspecting files and emails that have already entered the network to find hidden malware. Both are essential for a safe and secure network environment.

## Core explanation

Antivirus and web filtering are two separate but closely related security features built into Fortinet firewalls. They work together to protect a network from harmful software (malware) and dangerous or inappropriate websites. Imagine the firewall as a security guard at the entrance of a company building. The web filtering feature is like a rulebook that tells the guard which visitors are allowed and which are banned. The antivirus feature is like a scanning machine that checks every package brought into the building for hidden weapons or explosives.

What is a firewall? A firewall is a hardware device or software program that sits between a company's internal network and the internet. It controls what traffic can enter or leave the network based on a set of security rules. FortiGate is a brand of firewall made by Fortinet. It is called a Next-Generation Firewall (NGFW) because it does more than just block IP addresses and ports — it can also inspect the actual content of traffic.

What is web filtering? Web filtering is a feature that allows the firewall to block or allow access to websites based on their category, reputation, or URL. For example, a company might want to block all websites in the 'Social Media' category during work hours, or block all sites known to host malware. The FortiGate uses a database of website categories (like 'News', 'Gambling', 'Phishing') that is regularly updated by Fortinet's security team. When a user tries to visit a website, the firewall looks up the site's category in its database and either allows or blocks the request based on the policy.

How does web filtering work step by step? When a user types a website address into their browser, the browser sends a request to the firewall. The firewall checks the destination URL against its web filtering profile. The profile includes rules like 'Block sites in category Malware' or 'Allow sites in category Education'. The firewall then looks up the URL in its locally cached database or queries Fortinet's cloud-based service (FortiGuard) if it does not have the information locally. If the site is blocked, the user sees a warning page. If allowed, the request is forwarded to the internet.

What is antivirus? Antivirus is a feature that scans files, emails, and web downloads for known patterns of malicious code. These patterns are called virus signatures. A virus signature is like a digital fingerprint of a specific piece of malware. The antivirus engine compares every file that passes through the firewall against a database of these fingerprints. If a match is found, the file is blocked or quarantined so it cannot harm any computer on the network.

How does antivirus scanning work? When a user downloads a file from the internet, the file passes through the firewall. The firewall's antivirus engine receives the file and looks at its contents. It checks the file against a list of known virus signatures. It can also use heuristics — which means analysing the file's behaviour or structure to guess if it might be malicious, even if no exact signature match exists. If the file is clean, it is passed through to the user. If it is infected, the firewall blocks the download and logs the event.

There are different types of antivirus scanning modes in FortiGate:

- Flow-based inspection: This is a faster method that checks the file as it streams through the firewall. It only looks at the beginning and key parts of the file. It is good for high-traffic networks but may miss some threats.
- Proxy-based inspection: This method buffers (holds) the entire file before scanning it completely. It is more thorough but uses more memory and can slow down traffic. It is better for networks where security is more important than speed.
- Quick scan: Scans only the first part of a file to speed up the process for common file types.
- Full scan: Scans the entire file, which is more secure but slower.

Why do we need both web filtering and antivirus? Web filtering blocks the entry point — the dangerous website. Antivirus catches what gets past the web filter — the file that seemed safe but actually contains malware. For example, a user might visit a legitimate website that has been hacked. The web filter might allow the site because it is usually safe, but the antivirus scanner will catch the malicious file that the hacked site tries to download onto the user's computer. Together, they provide defence in depth.

What is a security policy? A security policy is a set of rules in the firewall that tells it what to do with specific types of traffic. For example, a policy might say: 'If the traffic is HTTP traffic to the internet, apply web filtering profile X and antivirus profile Y.' You create these policies in the FortiGate's web interface or command line. The NSE4 exam tests your ability to configure these policies correctly.

What is a profile? A profile is a collection of settings for a specific security feature. For example, an antivirus profile might specify which file types to scan (e.g., .exe, .pdf, .zip), which scanning mode to use (flow or proxy), and what to do when a virus is found (block, quarantine, or alert only). A web filtering profile might specify which categories to allow or block and whether to show a warning page to the user.

In summary, antivirus and web filtering are two essential tools in a network administrator's toolkit. Web filtering stops users from reaching bad places on the internet. Antivirus stops bad things from entering the network even if the place seems safe. Both are configured through security policies on the FortiGate firewall.

## Real-world context

An IT professional at a medium-sized accounting firm with 200 employees receives a complaint from a user named Sarah in finance. Sarah says her computer is running slowly and strange pop-ups keep appearing. The IT professional suspects malware. Here is what they do step by step.

First, the IT professional checks the FortiGate's logs to see if any antivirus events have been recorded for Sarah's computer. The logs show that a file called 'invoice_template.exe' was downloaded from a free template website and was flagged by the antivirus engine as 'EMPRV:Malware.gen'. The file was blocked, but Sarah might have clicked 'ignore' or bypassed the warning. The IT professional realises that the antivirus profile was set to 'Monitor' mode instead of 'Block' mode, so the file was allowed through even though it was detected.

The IT professional then investigates the web filtering logs. They find that the website where Sarah downloaded the file was categorised as 'File Sharing and Storage', which was allowed by the web filtering policy. The site itself was not a known malicious site, so web filtering did not block it. The threat was only caught by the antivirus profile, but because the profile was set to monitor only, the file got through.

The IT professional takes several actions to fix the problem:

- They change the antivirus profile for internal users from 'Monitor' to 'Block' for all file types. This ensures that any file detected as malware will be blocked immediately, not just logged.
- They create a new web filtering profile that blocks the 'Malware' website category entirely, and also adds a custom URL filter to block the specific free template website.
- They update the FortiGate's virus signatures by forcing a manual update from FortiGuard to ensure they have the latest protections.
- They run a full antivirus scan on Sarah's computer using FortiClient (the endpoint agent) to find and remove any remaining malware.
- They create a new security policy for web browsing (HTTP/HTTPS) that applies the updated antivirus and web filtering profiles to all internal users.

After these changes, the IT professional monitors the logs for the next few days. They see that the number of malware detections has dropped significantly because the web filter now blocks more dangerous sites, and the antivirus now blocks any files that slip through. They also receive fewer complaints about slow computers, because malware is being stopped before it can infect machines.

This scenario is a typical day for an IT professional managing a FortiGate firewall. They constantly balance between allowing users to access the internet they need for work and blocking the threats that come from that same internet. The NSE4 exam tests exactly these skills: configuring the right profiles, setting the right actions (block vs monitor), and troubleshooting when things go wrong. Mastering these tasks on the exam and in real life requires understanding that web filtering and antivirus work together like a two-layer defence system.

## Exam focus

The NSE4 exam will test your understanding of antivirus and web filtering in several specific ways. You must know the difference between flow-based and proxy-based inspection, which categories of web filtering exist, and how to configure a basic security policy that applies both features. Here is exactly what to focus on.

First, exam questions often ask you to identify the correct scanning mode for a given scenario. For example: 'A company needs to scan large file transfers for malware without slowing down the network. Which inspection mode should you use?' The answer is flow-based, because it is faster. If the scenario emphasises thoroughness over speed, the answer is proxy-based. Trap: The exam may give you a scenario with high traffic volume and ask for the best mode. Always choose flow-based for high throughput, proxy-based for maximum security.

Second, questions about web filtering categories are very common. You will be given a list of categories and asked which one to block to prevent access to social media. Or you might be asked which category to allow for a specific department that needs access to download software. The exam expects you to know standard categories like 'Malware', 'Phishing', 'Social Media', 'File Sharing', 'News', 'Education', and 'Gambling'. Trap: The question might describe a category vaguely and expect you to pick the correct official category name from Fortinet's list. Memorise the most common ones.

Third, the exam tests how to configure a security policy that uses both an antivirus profile and a web filtering profile. You will be asked: 'Which part of the firewall configuration ties the profiles to the traffic?' The answer is the security policy. You must also know that profiles are created first (under 'Security Profiles'), then referenced in the policy. Trap: Do not confuse a security policy with a profile. A profile is the settings; the policy is the rule that applies the profile to specific traffic.

Fourth, expect questions about what to do when a false positive occurs — when antivirus blocks a file that the company needs. The exam teaches that you can add an exemption to the antivirus profile for that specific file's checksum (a unique hash value). This allows the file through without disabling the entire antivirus feature. Trap: A question might suggest disabling the antivirus profile entirely for that traffic, but that is wrong because it leaves you unprotected against other threats. The correct answer is to create a hash-based exemption.

Fifth, the exam tests your knowledge of the differences between FortiGate's antivirus and endpoint antivirus (FortiClient). FortiGate scans traffic passing through the firewall. FortiClient scans files directly on the computer. They are complementary, not replacements. Trap: A question might ask you to choose one over the other. The correct answer usually involves using both.

Key definitions to memorise for the exam:

- Malware: Malicious software designed to harm a computer or network.
- Virus signature: A unique pattern of code that identifies a specific virus.
- Heuristic analysis: A method of detecting viruses by analysing behaviour rather than exact signatures.
- Flow-based inspection: Fast scanning that checks data as it passes through.
- Proxy-based inspection: Slow, thorough scanning that buffers the entire file first.
- FortiGuard: Fortinet's cloud-based threat intelligence service that updates virus signatures and website categories.
- Security policy: A set of rules that tells the firewall how to handle specific traffic.
- Profile: A container of settings for a security feature like antivirus or web filtering.
- False positive: When a security tool flags a legitimate file or website as malicious.
- Exemption: A rule that allows a specific file or site to bypass scanning.

Finally, the exam loves to test your understanding of the order of operations. Web filtering checks the website first. If the site is blocked, the user never reaches the download. If allowed, the antivirus scans the download. Questions may ask: 'What is the first step in preventing malware from a web download?' The answer is to block the malicious website at the web filter level, because that stops the threat before any file transfer occurs.

## Step by step

1. **Create a Web Filtering Profile** — Go to the FortiGate interface, navigate to Security Profiles > Web Filter, and click 'Create New'. Give the profile a name (e.g., 'Corporate-Web-Filter'). In the 'FortiGuard Categories' section, set the action for categories like 'Malware' and 'Phishing' to 'Block'. For categories like 'Social Media', choose 'Warning' or 'Block' based on company policy. This profile becomes a template you can reuse in multiple policies.
2. **Create an Antivirus Profile** — Go to Security Profiles > Antivirus and click 'Create New'. Name it (e.g., 'Corporate-AV'). In the 'HTTP' section, set the action for virus detections to 'Block'. Choose the inspection mode: select 'Flow-based' for high-traffic or 'Proxy-based' for thorough scanning. Under 'Protocols', ensure that HTTP and FTP are enabled so web downloads and file transfers are scanned. This profile is the second template you will apply.
3. **Configure a Security Policy** — Go to Policy & Objects > Firewall Policy and click 'Create New'. Set the incoming interface to your internal network (e.g., 'internal') and the outgoing interface to the internet (e.g., 'wan'). In the 'Source' field, add the internal user IP range or a group like 'All Employees'. In the 'Destination' field, set it to 'All' for internet access. Under 'Schedule', set it to 'Always'. Under 'Security Profiles', enable both the web filtering profile and antivirus profile you created. This policy tells the firewall to apply both protections to all web traffic from internal users.
4. **Test the Configuration** — Open a browser on a computer inside the network and try to visit a known test malware site (use FortiGuard's test URLs if available). The firewall should block the site and display a web filter warning page. Then try to download a harmless test file (like a .txt file) to confirm it passes through. Finally, download the EICAR test file (a standard non-malicious file that mimics a virus) to verify that antivirus blocks it. Check the Firewall Logs > Antivirus and Web Filter logs to see the events.
5. **Tune and Monitor** — After testing, monitor the logs daily for false positives. If a legitimate website is blocked by the web filter, add it to an allowed URL list in the web filtering profile. If a legitimate file is blocked by antivirus, add a hash exemption for that file. Adjust the antivirus scanning mode if performance is too slow or if threats are slipping through. Document any changes in your network change log for audit purposes.
6. **Update Signatures and Categories** — Go to System > FortiGuard and ensure that the 'AntiVirus' and 'Web Filtering' services are licensed and set to automatic updates. Virus signatures and website category databases update frequently (sometimes multiple times per day). If updates fail, your firewall will be using old data and may miss new threats. Manually trigger an update after initial setup and check the 'Update Status' to confirm it completed successfully.

## Comparisons

### Flow-based Inspection vs Proxy-based Inspection

**Flow-based Inspection:**
- Scans data as it streams through the firewall without buffering the entire file.
- Uses less memory and CPU, making it suitable for high-traffic networks.
- May miss threats that are hidden deep inside a file because it only checks the beginning.

**Proxy-based Inspection:**
- Buffers (holds) the entire file in memory before scanning it completely.
- Uses more memory and CPU, which can slow down traffic throughput.
- Provides thorough scanning of the entire file, catching threats hidden anywhere inside.

### Web Filtering vs Antivirus

**Web Filtering:**
- Blocks access to entire websites based on URL categories from FortiGuard.
- Prevents users from even reaching dangerous pages, stopping threats at the entry point.
- Does not inspect the content of files; only looks at the website address or category.

**Antivirus:**
- Scans the actual data inside files and emails for known virus signatures.
- Catches threats that were downloaded from seemingly safe websites that were hacked.
- Does not block websites; it inspects files after the website has already been accessed.

### FortiGate Antivirus (Network) vs FortiClient Antivirus (Endpoint)

**FortiGate Antivirus (Network):**
- Scans traffic passing through the firewall, protecting multiple devices at once.
- Cannot scan files already stored on a computer if the file bypassed the firewall.
- Is managed centrally from the FortiGate interface, giving IT a single view.

**FortiClient Antivirus (Endpoint):**
- Scans files directly on the individual computer, even if they arrived via USB or offline.
- Can scan files after they have been stored on the hard drive, catching delayed threats.
- Is managed per machine unless integrated with FortiManager for central control.

## Diagram

_This flowchart shows how a web request travels through a FortiGate firewall: first the web filter checks the site category, then the antivirus scans the downloaded file if the site was allowed._

```mermaid
flowchart TD
    A[User requests website] --> B[FortiGate Firewall]
    B --> C{Web Filter check}
    C -->|Category is Blocked| D[Block access, show warning page]
    C -->|Category is Allowed| E[Forward request to internet]
    E --> F[Server sends file to user]
    F --> G[Antivirus scan starts]
    G --> H{Malware detected?}
    H -->|Yes| I[Block file, log event]
    H -->|No| J[Allow file to reach user]
```

## Common misconceptions

- **Misconception:** Antivirus and web filtering are the same thing, just with different names. **Reality:** They are entirely different security features. Web filtering blocks access to dangerous websites based on URL categories. Antivirus scans the actual content of files and emails for malware signatures. They work together but solve different problems. (Many beginners see both features mentioned in the same security policy and assume they are redundant. The distinction is only clear once you understand that one blocks the route (web filtering) and the other inspects the payload (antivirus).)
- **Misconception:** If you set antivirus to 'Monitor' mode, it will still block infected files. **Reality:** 'Monitor' mode only logs the detection and allows the file to pass through. It does not block anything. To block infected files, you must set the action to 'Block' or 'Quarantine'. (This mistake happens because the word 'Monitor' sounds passive but still sounds like it would stop something. Beginners often assume the firewall will automatically block anything it detects, not realising that monitoring is for observation, not protection.)
- **Misconception:** Web filtering only blocks adult content or inappropriate sites. **Reality:** Web filtering blocks a wide range of categories including malware, phishing, and spyware sites. It is a security tool first, a content control tool second. Blocking adult content is just one of many uses. (The term 'web filtering' is often associated with parental controls or school filters. Beginners think it is only about blocking explicit content, overlooking its critical role in stopping cyber attacks like phishing.)
- **Misconception:** Once you configure an antivirus profile, it applies to all traffic automatically. **Reality:** An antivirus profile must be explicitly assigned to a security policy. If no policy includes that profile, the antivirus will not scan any traffic. Profiles are just templates; they do nothing until referenced in a policy. (This misconception comes from the word 'profile' sounding like a global setting. Beginners think of it like a system-wide antivirus program that runs automatically after installation, not a component that must be manually linked to traffic rules.)
- **Misconception:** Flow-based inspection is always better than proxy-based inspection because it is faster. **Reality:** Flow-based is faster but less thorough. Proxy-based inspects the entire file and catches more threats. The best choice depends on the network's needs: high traffic volume benefits from flow, maximum security requires proxy. (Beginners often assume the faster option is always superior because it sounds more efficient. They do not understand the trade-off between speed and security depth, which is a key exam point.)

## Key takeaways

- Web filtering blocks access to dangerous websites based on their URL category (e.g., Malware, Phishing, Social Media).
- Antivirus scanning inspects files and email attachments for known virus signatures and suspicious behaviour.
- You must apply both a web filtering profile and an antivirus profile within a security policy for them to take effect.
- Flow-based inspection is fast but less thorough; proxy-based inspection is slow but scans the entire file.
- Setting antivirus to 'Monitor' mode logs detections but does not block files — you must select 'Block' or 'Quarantine' to stop threats.
- A false positive occurs when a legitimate file is flagged as malware; resolve it by adding a hash-based exemption, not by disabling the antivirus profile.

## FAQ

**What is the difference between web filtering and URL filtering?**

Web filtering blocks websites based on pre-defined categories from FortiGuard (like 'Malware' or 'Social Media'). URL filtering is more granular: it allows you to block or allow specific individual URLs (like 'example.com/test.html') that you add manually. URL filtering is used within a web filtering profile to override the category-based defaults.

**Can antivirus scan encrypted HTTPS traffic?**

Yes, but only if the FortiGate is configured for SSL/TLS inspection. This requires installing a certificate on users' machines so the firewall can decrypt the traffic, scan it, and re-encrypt it. Without SSL inspection, the firewall can only see the domain name, not the actual file contents, so antivirus may miss threats hidden in HTTPS downloads.

**Why is my antivirus not blocking a file even though I set the profile to 'Block'?**

Double-check that the antivirus profile is actually assigned to the correct security policy. Also verify that the file type is included in the scan settings (e.g., .exe, .pdf). The profile may be set to 'Block' for HTTP but not for FTP, or the file might be too large and skipped due to a size limit. Check the logs for 'skipped' events.

**What is the difference between 'Block' and 'Monitor' in an antivirus profile?**

'Block' stops the file from being downloaded and shows an error page to the user. 'Monitor' allows the file to pass through but logs the detection in the firewall logs. Use 'Monitor' for testing new profiles before enforcing a block, or when you want to gather data without disrupting users.

**How do I allow a specific website that is being blocked by web filtering?**

In the web filtering profile, add the website's URL to the 'Allow' list under 'URL Filter'. This creates an exception that overrides the category-based rule. For example, if 'socialmedia.com' is blocked by the 'Social Media' category, you can add 'socialmedia.com' to the allowed list so it passes through for those who need it.

**Do I need both a web filtering profile and an antivirus profile in every security policy?**

No, it depends on the traffic. For web traffic (HTTP/HTTPS) to the internet, you should use both. For internal traffic between departments, you might only need antivirus to scan file transfers. For traffic from the internet to a public server, you might use only web filtering to block malicious requests. The decision is based on the risk for each type of traffic.

## Check your understanding

1. **What is the first security check that a web request goes through when passing through a FortiGate firewall?**

   Answer: The first check is web filtering, which determines whether the website is allowed based on its category. If blocked, the request never reaches the antivirus stage.

2. **You configure an antivirus profile with the action set to 'Monitor'. A user downloads a file that contains malware. What happens to the download?**

   Answer: The file is allowed to pass through to the user because 'Monitor' only logs the detection without blocking. The IT admin will see the event in the logs but the user receives the infected file.

3. **A company needs to scan large file downloads for malware without significantly slowing down network performance. Which inspection mode should be used?**

   Answer: Flow-based inspection should be used because it scans data as it streams through, using less memory and causing less latency than proxy-based inspection.

4. **A legitimate file is being blocked by the antivirus engine. What is the correct way to allow it while maintaining security?**

   Answer: Add a hash-based exemption for the file in the antivirus profile. This allows that specific file to pass through while the antivirus engine continues to block all other threats.

5. **Where do you assign the web filtering profile and antivirus profile so that they actually apply to traffic?**

   Answer: You assign them within a security policy. The security policy specifies which traffic (e.g., from internal users to the internet) should have those profiles applied.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/fortinet-nse4/antivirus-and-web-filtering