# Antivirus and File Filtering

> Chapter 10 of the Courseiva FORTINET-NSE7 curriculum — https://courseiva.com/learn/fortinet-nse7/antivirus-and-file-filtering

**Official objective:** 4.4 — Deploy antivirus scanning and file filter profiles on FortiGate

## Introduction

Without understanding how to scan files for viruses and filter out dangerous file types, your company’s network could be infected by a single malicious email attachment, causing data loss or ransomware. Antivirus scanning and file filtering are the two security layers that protect your FortiGate gateway from malware and unwanted content. For the NSE7 exam, you must know how to deploy and tune these profiles to balance security with performance.

## The Airport Baggage Screening Analogy

Three hundred suitcases arrive every hour at an international airport from a large flight. Each suitcase is a file coming into your FortiGate firewall from the internet. The airport has two layers of security: an X-ray machine that scans every bag for dangerous items, and a manual check for prohibited objects like lighters or oversized liquids. The X-ray machine is your antivirus scanner: it looks for known malicious code patterns, like a file with a virus signature, and flags it. The manual check is your file filter: it examines the properties of the bag itself, not the contents, and stops items that violate policy, like an .exe file attachment in an email. If the X-ray machine flags a bag, a security officer pulls it aside for a deeper scan, just as FortiGate quarantines a suspicious file. The manual check might reject a bag because it contains a liquid over 100ml, even if that liquid is perfectly harmless, similar to how a file filter can block a legitimate PDF file if it’s too large or the wrong type. The airport needs both systems to work together because a virus could hide in a harmless-looking soda bottle, and a banned item (like a power bank) would pass the X-ray but get caught by the manual check. Just as passengers wait longer when both checks are thorough, your network might slow down if you apply deep antivirus scanning on every single file, so you configure filters for risk-based decisions.

The airport’s rule book lists all the banned items, updated daily by the aviation authority. Your FortiGate’s antivirus database is updated by Fortinet with new virus signatures every few hours. If you skip the manual check, a passenger might carry a sharp object that doesn’t trigger the X-ray, but is still dangerous — a real risk if you disable file filtering and only rely on antivirus.

## Core explanation

Antivirus scanning and file filtering are two separate but complementary security features on a FortiGate firewall. They work together to inspect files as they pass through the firewall from the internet or from internal users.

First, let’s define the terms. A firewall is a device that controls network traffic based on rules. FortiGate is a brand of firewall made by Fortinet. A policy is a set of rules that tell the firewall what to do with traffic that matches certain conditions (like source IP address, destination port, or application). Antivirus (AV) scanning examines the content of files to find malicious code, such as viruses, worms, trojans, or ransomware. A virus is a piece of code that can copy itself and spread to other files. A worm is a self-replicating program that spreads across networks without needing a host file. Ransomware is malware that encrypts your files and demands payment to unlock them. A signature is a unique pattern or fingerprint of a known malware strain. FortiGate uses a regularly updated signature database to compare file contents against known threats. This is similar to how your phone uses a list of known spam numbers to block calls.

File filtering, on the other hand, does not look at the contents of a file for malicious code. Instead, it looks at the file’s metadata — its name, extension, type, and size — and decides whether to allow or block it based on policy rules. For example, a file filter rule might block all files with the extension .exe (executables) from email attachments, because .exe files are a common way to deliver malware. It might also block files larger than 10 MB to prevent network congestion, or block files that are password-protected because you cannot scan them for viruses. A file filter profile is a collection of these rules that you assign to firewall policies.

Why use both? Because each layer catches things the other might miss. A clever virus might be compressed inside a ZIP file that looks harmless, but the antivirus scanner can unzip it and scan the contents. However, a file filter could block all ZIP files from email altogether if your company policy forbids them. Conversely, a legitimate PDF file might contain a zero-day exploit (a brand-new virus that has no signature yet). The antivirus might miss it because the signature doesn’t exist, but a file filter could block PDF files from untrusted sources. The two features are configured in the FortiGate GUI under Security Profiles. You create a separate antivirus profile and file filter profile, then apply both to the same firewall policy. The order matters: FortiGate applies the file filter first, then the antivirus scan. If the file filter blocks a file, it never reaches the antivirus engine, saving processing power. If the file filter allows it, the antivirus scanner unpacks and examines the file.

When you configure antivirus scanning, you choose a scanning mode. The options are:
- Flow-based: fast, low CPU usage, uses pattern matching to quickly check signatures. Good for high-throughput networks.
- Proxy-based: slower, but more thorough. It reconstructs the entire file before scanning, allowing detection of packed or obfuscated malware. Uses more memory.
- Both: FortiGate uses flow-based for an initial quick check, then proxy-based for deeper inspection if the file is suspicious.

You also configure what types of files to scan. Common choices include email attachments, web downloads, and FTP transfers. You can enable or disable scanning for specific protocols (HTTP, SMTP, IMAP, POP3, FTP). Each scanned file consumes CPU and memory. You must balance the need for security with the risk of slowing down network traffic.

File filter profiles have a different set of settings. You define a list of file patterns (by name, extension, or type) and choose an action: allow, block, or log (record the event without blocking). You can also specify what to do with password-protected files: skip (do not scan), block, or scan (only if password is provided, which is impractical). File filters are especially powerful for blocking executable files (like .exe, .bat, .scr, .vbs) that are common malware vectors. They can also block audio/video files (like .mp4, .mp3) if your company wants to save bandwidth and block personal streaming.

A crucial detail: file filtering can be applied to files that are already encrypted, like HTTPS traffic, but only if you have enabled SSL inspection (decrypting the traffic). The exam loves to test this point. Without SSL inspection, the antivirus and file filter cannot see inside encrypted connections, so malicious files can bypass both.

Another important concept is the distinction between flow-based and proxy-based scanning for file filtering. Flow-based file filtering works on the fly as each packet arrives, so it can start blocking large files early without waiting for the whole file to be received. Proxy-based file filtering buffers the entire file before making a decision. The exam asks which mode is better for blocking large files early — that is flow-based.

Finally, you need to understand that antivirus and file filter profiles are separate objects in the FortiGate configuration. You can create multiple profiles for different scenarios (e.g., a strict profile for incoming email, a moderate profile for web browsing, a permissive profile for internal file transfers). You then attach these profiles to firewall policies. The NSE7 exam heavily tests your ability to match the right profile to the right policy based on a scenario.

## Real-world context

You work as an IT administrator for a medium-sized company with 500 employees. The company receives a lot of email from external clients, and also provides a web-based portal where employees can upload files. The CEO wants to ensure no malware enters the network, but the sales team complains that their legitimate email attachments are sometimes blocked. How do you configure antivirus and file filtering?

First, you gather requirements. The security policy says:
- All email attachments must be scanned for viruses.
- Executable files (.exe, .bat, .com) must be blocked from email and web uploads.
- Compressed files (.zip, .rar) must be scanned for viruses, but not blocked unless they contain a threat.
- Files larger than 20 MB from email should be blocked to prevent mailbox overload.
- Password-protected ZIP files must be blocked because they cannot be scanned.

You log into the FortiGate GUI. Navigate to Security Profiles > Antivirus. Create a new profile called 'Strict-Incoming-Mail'. Set the scan mode to 'Proxy-based' because email security is critical and you can accept a slight delay. Enable scanning for SMTP (incoming email) and also for POP3 and IMAP if employees use client software. Under 'Options', set 'File size limit for scanning' to 20 MB. Any file over that will be skipped (not scanned) — but you will block them with the file filter instead. Ensure the 'Signature database' is up to date (Fortinet updates automatically by default).

Next, create a file filter profile. Go to Security Profiles > File Filter. Create a new profile called 'Email-File-Filter'. Add a rule for executable files: select 'File type' as 'Executable' and set action to 'Block'. Add a rule for archives: select 'Archive' type and set action to 'Allow' (so they reach the antivirus). Add a rule for file extension '.exe' as a second layer. Add a rule for file size: set 'Max file size' to 20 MB, action 'Block'. Finally, add a rule for password-protected archives: select the option 'Password-protected archives' and set action to 'Block'. Configure the file filter to 'Log' all blocked events for auditing.

Now, you need to apply these profiles to a firewall policy. Go to Policy & Objects > Firewall Policy. Find the policy that handles incoming email from external sources to your mail server. Edit that policy. Under 'Security Profiles', enable the antivirus profile and select 'Strict-Incoming-Mail'. Enable the file filter profile and select 'Email-File-Filter'. Save the policy.

After a week, the sales team reports that a client’s PDF attachment was blocked. You check the logs and see the file filter blocked it because the PDF had an embedded executable component (which FortiGate classified as 'Executable'). This is a false positive — a legitimate file flagged as malicious. You can adjust the file filter to add an exception: specifying the sender’s domain or a specific filename pattern to allow that file. In the file filter profile, add an 'Exception' rule: file name matches '*.pdf' AND source IP is the client’s mail server IP. This is a common real-world task: fine-tuning filters to reduce false positives while keeping security strong.

Another scenario: a new ransomware variant starts spreading via PDF files with malicious macros. The antivirus signature database might not yet have the signature. You can quickly create a temporary file filter rule to block all PDF files from external sources until the signature is updated. This is called a compensating control. The exam may ask you to implement this kind of emergency measure.

Finally, you need to monitor performance. On the FortiGate dashboard, check the 'Security' widget to see antivirus and file filter processing rates. If the CPU is high, you might switch to flow-based scanning for lower-priority traffic like web browsing. Document your actions for compliance audits.

## Exam focus

The NSE7 exam (exam code NSE7) for Advanced Security includes objective 4.4: Deploy antivirus scanning and file filter profiles on FortiGate. This objective appears in multiple-choice questions, drag-and-drop questions, and scenario-based questions. You must know both the conceptual differences and the exact steps to configure each feature in the FortiGate GUI or CLI.

The exam tests these specific concepts:
- The difference between flow-based and proxy-based scanning modes. You will be asked: 'Which scanning mode is recommended for high-throughput environments?' Answer: flow-based. 'Which mode provides deeper inspection?' Answer: proxy-based. 'Which mode can block a file before it is fully downloaded?' Answer: flow-based.
- The order of operations: file filter is applied before antivirus scanning. If the file filter blocks a file, it is never scanned for viruses. This saves resources. The exam might present a scenario where a file is blocked by a file filter, and ask what happens to the antivirus processing — the correct answer is it never runs.
- What happens when a file is password-protected. The exam loves this. You must know that password-protected archives cannot be scanned by the antivirus engine. The admin must choose an action: block (recommended), skip (and allow through without scanning), or log (still allow through). The correct answer in a security-conscious scenario is to block.
- File filtering by file extension vs. file type. Extension (e.g., .docx) is easy to spoof (rename a .exe to .docx). File type analysis checks the magic bytes (header bytes) of the file to determine true type. The exam asks which is more secure — file type analysis. But file type analysis consumes more CPU than extension checks.
- The need for SSL inspection. If a file is downloaded over HTTPS, the antivirus and file filter cannot inspect it unless you have an SSL inspection profile applied to the policy. The exam often sets a trap: 'You configure antivirus but malware still gets through — why?' The answer: missing SSL inspection.
- How to apply profiles to a firewall policy: you must enable both the antivirus profile and the file filter profile under the Security Profiles section. They are separate dropdowns. The exam asks: 'Which two profiles must be configured to block malicious .exe files from email?' Answer: file filter profile (to block .exe) and antivirus profile (to scan other files).
- Common traps: The exam might say 'You created an antivirus profile and applied it to a policy, but files are not being scanned. Why?' Possible correct reasons: (1) The policy does not have SSL inspection enabled, (2) The file filter is blocking files before scanning, (3) The antivirus profile is not enabled on the policy, (4) The traffic is not matching the policy (e.g., incorrect source/destination). Another trap: 'Which feature prevents the antivirus from scanning a file?' Answer: file filter with 'block' action.
- Signature database updates: The exam might ask about the importance of the AV database being up to date. A common question: 'What happens if the FortiGate cannot reach the Fortinet update server?' Answer: antivirus scanning still works, but against an outdated database, so new malware may pass through.

Key definitions to memorise:
- Antivirus profile: contains settings for scanning mode, protocols to scan, and signature behaviour.
- File filter profile: contains rules based on file name, extension, type, size, and password protection.
- Flow-based scanning: first packet arrives, quick scan, low overhead.
- Proxy-based scanning: entire file reassembled and scanned, more thorough, higher latency.
- False positive: a legitimate file flagged as malicious.
- False negative: a malicious file not detected.

Exam tip: When presented with a drag-and-drop, you often must place the file filter step before the antivirus step in the inspection flow. Memorise the sequence: packet arrives -> policy match -> file filter -> antivirus -> other security profiles (e.g., web filter, IPS) -> forward packet.

## Step by step

1. **Identify the traffic flow** — Determine which firewall policy will handle the traffic you want to secure (e.g., incoming email from internet to mail server). This step ensures you apply the profiles to the correct policy, not all policies.
2. **Create an antivirus profile** — Go to Security Profiles > Antivirus, create a new profile. Choose scanning mode (flow-based, proxy-based, or both). Enable the specific protocols (like SMTP for email). Set the maximum file size to scan. This defines how malware detection will work.
3. **Create a file filter profile** — Go to Security Profiles > File Filter, create a new profile. Add rules for file extensions, file types, or sizes you want to block or allow. Specify action (block, allow, log). Include rules for password-protected archives. This controls which files get through to the antivirus engine.
4. **Apply profiles to the firewall policy** — Edit the firewall policy that matches the traffic. Under Security Profiles, enable both the antivirus profile and the file filter profile. If you only enable one, the other will not be used. Also ensure SSL inspection is enabled if traffic is encrypted.
5. **Test and monitor** — Send a test email with a benign .exe file attached to verify it is blocked by the file filter. Check the logs for blocked events. Monitor CPU usage to ensure performance is acceptable. Adjust scanning mode or file filter rules if false positives occur.
6. **Tune and update** — Add exceptions for legitimate files that are falsely blocked (false positives). Ensure the antivirus signature database is set to auto-update. Periodically review logs to identify new threats or misconfigurations.

## Comparisons

### Flow-based AV scanning vs Proxy-based AV scanning

**Flow-based AV scanning:**
- Processes packets as they arrive, no buffering of the whole file
- Lower CPU overhead, ideal for high-throughput networks
- Cannot detect certain obfuscated malware that requires file reconstruction

**Proxy-based AV scanning:**
- Reassembles the entire file before scanning
- Higher CPU overhead but more thorough detection
- Can detect malware hidden in packed or encoded files

### File block by extension vs File block by type (magic bytes)

**File block by extension:**
- Checks only the filename suffix (e.g., .exe)
- Very low CPU usage, fast to process
- Easily bypassed by renaming a file (e.g., virus.exe to virus.pdf)

**File block by type (magic bytes):**
- Checks the actual file header bytes to determine true type
- Higher CPU usage because it reads the beginning of the file
- More secure because renaming does not bypass the filter

### Antivirus scanning vs File filtering

**Antivirus scanning:**
- Inspects file content for malicious code using signature database
- Catches new variants only when signatures are updated
- Cannot inspect password-protected files

**File filtering:**
- Inspects file metadata (name, size, extension) not content
- Can block zero-day threats that have no signature yet
- Can block password-protected files from passing through

## Diagram

_The inspection flow for antivirus and file filtering on a FortiGate firewall policy._

```mermaid
flowchart TD
    A[Packet Arrives] --> B[Firewall Policy Match]
    B --> C{File Filter Applied?}
    C -- Yes --> D[File Filter Profile]
    D -- Block --> E[Packet Dropped / Logged]
    D -- Allow --> F[Antivirus Profile Applied?]
    F -- Yes --> G[Antivirus Scanner]
    G -- Malicious --> H[Quarantine / Block]
    G -- Clean --> I[Forward Packet]
    F -- No --> I
    C -- No --> F
```

## Common misconceptions

- **Misconception:** Antivirus scanning and file filtering are the same thing, just with different names. **Reality:** Antivirus scans file content for malicious code using signatures, while file filtering checks file metadata (name, type, size) to block unwanted files regardless of content. (Both features are under 'Security Profiles' in FortiGate and both relate to files, so beginners lump them together. But they serve different purposes and have different configuration options.)
- **Misconception:** Setting a file filter to 'block .exe files' is the only protection needed, so I don't need antivirus scanning. **Reality:** Many malware types (like macro viruses in Word documents or script-based malware in PDFs) are not .exe files. Antivirus scanning catches those by analysing content, not just file extension. (Beginners over-focus on executable files because they are the most common vector, but the exam tests understanding that both layers are needed for defence in depth.)
- **Misconception:** If I apply an antivirus profile to a policy, it will scan all traffic regardless of the protocol. **Reality:** Antivirus scanning only works on protocols you explicitly enable within the profile (HTTP, SMTP, IMAP, POP3, FTP, etc.). Other protocols like SQL or custom TCP ports are not scanned unless you configure them. (The GUI defaults to scanning only popular protocols, and beginners assume 'antivirus' means everything. The exam tests that you must enable each protocol individually.)
- **Misconception:** Flow-based scanning is always better because it's faster, so I should use it for all policies. **Reality:** Flow-based scanning is less thorough than proxy-based. For high-security zones like email from the internet, proxy-based is recommended despite the performance cost. (Beginners gravitate toward 'faster' without understanding the security trade-off. The exam presents scenarios where you must choose the correct mode based on risk and performance.)
- **Misconception:** A file filter rule that blocks files by extension (e.g., .pdf) is completely secure because it blocks all PDFs. **Reality:** File extension can be faked (a malicious file can be renamed from .exe to .pdf). File type analysis based on magic bytes is more secure, but it consumes more CPU. The best approach is to combine both, or use file type if CPU allows. (This misconception arises because many home users are familiar with blocking extensions on email servers. The exam tests the more advanced concept of file type analysis.)

## Key takeaways

- Antivirus scanning examines file content for malware signatures, while file filtering blocks files based on name, extension, size, or password protection before scanning happens.
- File filter rules are applied before antivirus scanning in the inspection pipeline, so a blocked file never consumes antivirus processing resources.
- Flow-based scanning offers higher performance but less thorough inspection, while proxy-based scanning provides deeper analysis at the cost of latency.
- Without SSL inspection, antivirus and file filter profiles cannot inspect files transferred over HTTPS, creating a major security gap.
- Password-protected archives cannot be scanned for viruses, so the recommended policy is to block them outright or log them as a risk.
- You must explicitly enable the protocols (HTTP, SMTP, IMAP, POP3, FTP) within an antivirus profile for scanning to occur on those traffic types.

## FAQ

**What is the difference between flow-based and proxy-based antivirus scanning on FortiGate?**

Flow-based scanning inspects packets as they arrive, using pattern matching for speed, making it suitable for high-throughput networks. Proxy-based scanning reconstructs the entire file before analysis, providing deeper inspection but with higher latency.

**Can antivirus scanning work on encrypted HTTPS traffic?**

Not by itself. You must enable SSL inspection on the FortiGate to decrypt the traffic before the antivirus scanner can see the file contents. Without it, the antivirus can only see the encrypted tunnel, not the files inside.

**Why would I use a file filter if I already have antivirus scanning?**

File filter can block files based on type or size before they reach the antivirus engine, saving CPU resources. It also blocks files that the antivirus cannot scan (like password-protected archives) and can stop zero-day threats that have no signatures yet.

**What happens to a password-protected ZIP file when antivirus scanning is enabled?**

The antivirus engine cannot open a password-protected archive to scan its contents. By default, FortiGate will skip scanning it (allow it through without inspection) unless you configure a file filter rule to block it.

**How do I block .exe files from email attachments on FortiGate?**

Create a file filter profile with a rule that blocks files with the .exe extension or the executable file type. Apply that profile to the firewall policy handling incoming email traffic. Optionally, also use an antivirus profile for additional scanning of other file types.

**Does the order of antivirus and file filter profiles matter in a FortiGate policy?**

Yes. FortiGate always applies the file filter first. If the file filter blocks a file, it never goes to the antivirus scanner. This order is fixed and cannot be changed.

## Check your understanding

1. **What is the correct order of security inspections on a FortiGate firewall policy that has both an antivirus profile and a file filter profile enabled?**

   Answer: The file filter is applied first, then the antivirus scanner processes the file only if the file filter allows it through.

2. **An employee receives an email with a password-protected ZIP file. The FortiGate has antivirus scanning enabled but no file filter. What happens to the ZIP file?**

   Answer: The antivirus scanner cannot open the ZIP file because it is password-protected, so it is allowed through without scanning (skip action by default).

3. **You want to block all .exe files from incoming email to reduce malware risk, but you also want to scan other file types for viruses. Which two profiles must you apply to the email firewall policy?**

   Answer: A file filter profile that blocks .exe files, and an antivirus profile set to scan SMTP traffic for other file types.

4. **In a high-throughput environment handling hundreds of megabytes of web traffic per second, which antivirus scanning mode is most suitable and why?**

   Answer: Flow-based scanning is most suitable because it processes packets without buffering files, using less CPU and memory, minimising latency.

5. **A company uses HTTPS for all internal web downloads. They enabled an antivirus profile on the firewall policy but malware still gets through. What is the most likely missing configuration?**

   Answer: SSL inspection is not enabled; without decrypting HTTPS traffic, the antivirus scanner cannot see the file contents inside the encrypted tunnel.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/fortinet-nse7/antivirus-and-file-filtering