Configure Gateway AntiVirus Actions for HTTP Content

By default, when you enable Gateway AntiVirus for a proxy policy from the Gateway AntiVirus configuration, the default action for content that does not match a proxy rule is automatically set to AV Scan. You can improve Gateway AntiVirus performance if you change the default action for HTTP content that does not match a configured proxy rule.

To optimize performance, you can configure Gateway AntiVirus actions for the HTTP proxy to make the proxy more selective about which content types to scan. When you set the None matched action to AV Scan for the URL Paths, Content Types, or Body Content Types categories, the HTTP proxy scans all objects that do not match a rule.

To set the actions for HTTP proxy rulesets, follow the instructions in the next section. The same steps apply to rules in the TCP-UDP proxy and the Explicit proxy, which also apply to HTTP connections.

Configure AV Scan Actions Based on URL Paths

You can configure rules for when to AV scan HTTP content, based on the URL path of the request.

  1. Edit the HTTP-Proxy policy.
  2. Select the Proxy Action tab.
  3. In the HTTP Request tab select URL Paths.
    The URL Paths proxy action settings appear.
  4. From the Action to take if no rule above is matched drop-down list, select Allow.
    With this setting, URLs that do not match a rule in the list are not scanned by Gateway AntiVirus.

Screen shot of the URL Paths settings for an HTTP-Proxy action

If you add rules to the URL Paths Rules list, you can set the If matched action to AV Scan to scan the content if the URL matches a rule in the list.

  1. Edit the HTTP-Proxy policy and edit the proxy action.
  2. In the Categories tree, expand HTTP Request and select URL Paths.
    The URL Paths rules and actions settings appear.

Screenshot of the URL Paths rules and actions settings

  1. From the None matched drop-down list, select Allow.
    With this setting, URLs that do not match a rule in the list are not scanned by Gateway AntiVirus.

If you add rules to the URL Paths Rules list, you can set the If matched action to AV Scan to scan the content if the URL matches a rule in the list.

Configure AV Scan Actions Based on Content Types

You can configure the actions for Content Type rules to scan the content types that are most likely to contain a virus, and to not scan other content types. To set the actions more granularly based on content type, in Policy Manager use the advanced view of the rules.

  1. Edit the HTTP-Proxy policy.
  2. Select the Proxy Action tab.
  3. In the HTTP Response tab select Content Types.
    The Content Types proxy action settings appear.

Screen shot of the Content Types settings for an HTTP-proxy action in Fireware Web UI

  1. From the Action to take if no rule above is matched drop-down list, select Allow.
    Or, select an option other than the default (AV Scan).
    If you select Allow, Gateway AntiVirus scans only the content types enabled in the Content Types list.
  2. To enable or disable rules in the Content Types list, select or clear the Enabled check box.

For information about HTTP Response Content Types, go to HTTP Response: Content Types.

  1. Edit the HTTP-proxy action used by the proxy policy.
  2. In the Categories tree, expand HTTP Response and select Content Types.

Screen shot of the Gateway AntiVirus configuration in the HTTP-proxy, Content Types category

  1. From the None matched drop-down list, select Allow.  
    Or, select an option other than the default (AV Scan).
  2. Click Change View.
    The Content Type Rules settings change to the advanced view.

Screen shot of the Gateway AntiVirus configuratin for the HTTP-proxy, Content Types, Advanced view

  1. To select which rules to use, select or clear the Enabled check box for each rule .
  2. For each enabled rule, double-click the rule to select the Action to take for that rule.
    The Edit Content Type Rule dialog box appears.
  • To scan all content that matches the rule, set the action to AV Scan.
  • To allow content that matches the rule without an AV scan, set the action to Allow.

For information about HTTP Response Content Types, go to HTTP Response: Content Types.

Configure AV Scan Actions Based on Body Content Types

You can also configure the actions for HTTP content based on the Body Content Types rules.

  1. Edit the HTTP-Proxy policy.
  2. Select the Proxy Action tab.
  3. In the HTTP Response tab select Body Content Types.
    The Body Content Types proxy action settings appear.
  4. For each content type you want to want to scan with Gateway AntiVirus, add a rule and set the Action to AV Scan.

Screen shot of the Body Content Types rules in an HTTP Proxy action in Fireware Web UI

  1. From the Action to take if no rule above is matched drop-down list, select Allow.  
    Or, select an option other than the default (AV Scan).
  2. To enable or disable rules in the Body Content Types list, select or clear the Enabled check box.

For information about HTTP Response Body Content Types, go to HTTP Response: Body Content Types.

  1. Edit the HTTP-proxy action used by the proxy policy.
  2. In the Categories tree, expand HTTP Response and select Body Content Types.

Screen shot of Gateway AntiVirus configuratino for the HTTP-proxy, Body Content Types

  1. From the None matched drop-down list, select Allow.  
    Or, select an option other than the default (AV Scan).
  2. From the If matched drop-down list, select AV Scan.
    Or, click Change View to set rules individually for different body content types.

For information about HTTP Response Body Content Types, go to HTTP Response: Body Content Types.

Configure Alarm Notifications for Antivirus Actions

In each rule in a proxy action, you can select the Alarm check box so the proxy policy sends an alarm notification when the rule applies to network traffic. If you enable alarms for a proxy antivirus action, you must also configure the type of alarm to use in the proxy policy.

  1. Select Firewall > Firewall Policies.
  2. Double click a policy to edit.
  3. Select the Proxy Action tab.
  4. Select Proxy and AV Alarms.
  5. Configure the Proxy and AV Alarms settings as described in Set Logging and Notification Preferences.
  1. Double-click the policy to edit.
  2. Select the Properties tab.
  3. Click .
  4. Select Proxy and AV Alarms.
  5. Configure the Proxy and AV Alarms settings as described in Set Logging and Notification Preferences.

Related Topics

Update Gateway AntiVirus Settings