• Directly with an IP policy. The Service object used with the policy must have the Protocol
property set to a protocol that supports anti-virus scanning.
Activating Anti-Virus Scanning with IP Rules
IP rules are one of the means by which the anti-virus feature is deployed, the deployment. IP
rules specify that the ALG and its associated anti-virus scanning can apply to traffic going in a
given direction and between specific source and destination IP addresses and/or networks.
Scheduling can also be applied to virus scanning so that it takes place only at specific times.
When used with IP rules, an ALG that allows anti-virus scanning must then be associated with an
appropriate service object for the protocol to be scanned. The service object is then associated
with a rule in the IP rule set which defines the origin and destination of the traffic to which the
ALG is to be applied.
Example 6.28. Activating Anti-Virus with an IP Rule
This example shows how to set up an anti-virus scanning policy for HTTP traffic from lannet to
all-nets. We will assume there is already a NAT rule defined in the IP rule set to NAT this traffic.
Command-Line Interface
First, create an HTTP Application Layer Gateway (ALG) Object with anti-virus scanning enabled:
gw-world:/> set ALG ALG_HTTP anti_virus Antivirus=Protect
Next, create a Service object using the new HTTP ALG:
gw-world:/> add Service ServiceTCPUDP http_anti_virus
Type=TCP
DestinationPorts=80
ALG=anti_virus
Finally, modify the NAT rule to use the new service:
gw-world:/> set IPRule NATHttp Service=http_anti_virus
Web Interface
A. First, create an HTTP ALG Object:
1. Go to: Objects > ALG > Add > HTTP ALG
2. Specify a suitable name for the ALG, for instance anti_virus
3. Click the Antivirus tab
4. Select Protect in the Mode dropdown list
5. Click OK
B. Then, create a Service object using the new HTTP ALG:
1. Go to: Local Objects > Services > Add > TCP/UDP service
2. Specify a suitable name for the Service, for instance http_anti_virus
Chapter 6: Security Mechanisms
547
To Next Page
Loading...
