CLI Reference

alertemail
- alertemail setting
antivirus
- antivirus heuristic
- antivirus profile
- antivirus quarantine
- antivirus settings
application
- application custom
- application group
- application list
- application name
- application rule-settings
authentication
- authentication rule
- authentication scheme
- authentication setting
certificate
- certificate ca
- certificate crl
- certificate local
- certificate remote
credential-store
- credential-store domain-controller
dlp
- dlp filepattern
- dlp fp-doc-source
- dlp sensitivity
- dlp sensor
- dlp settings
dnsfilter
- dnsfilter domain-filter
- dnsfilter profile
emailfilter
- emailfilter bwl
- emailfilter bword
- emailfilter dnsbl
- emailfilter fortishield
- emailfilter iptrust
- emailfilter mheader
- emailfilter options
- emailfilter profile
endpoint-control
- endpoint-control fctems
extender-controller
- extender-controller dataplan
- extender-controller extender
file-filter
- file-filter profile
firewall
- firewall DoS-policy
- firewall DoS-policy6
- firewall acl
- firewall acl6
- firewall address
- firewall address6
- firewall address6-template
- firewall addrgrp
- firewall addrgrp6
- firewall auth-portal
- firewall central-snat-map
- firewall city
- firewall country
- firewall decrypted-traffic-mirror
- firewall dnstranslation
- firewall identity-based-route
- firewall interface-policy
- firewall interface-policy6
- firewall internet-service
- firewall internet-service-addition
- firewall internet-service-append
- firewall internet-service-botnet
- firewall internet-service-custom
- firewall internet-service-custom-group
- firewall internet-service-definition
- firewall internet-service-extension
- firewall internet-service-group
- firewall internet-service-ipbl-reason
- firewall internet-service-ipbl-vendor
- firewall internet-service-list
- firewall internet-service-name
- firewall internet-service-owner
- firewall internet-service-reputation
- firewall internet-service-sld
- firewall ip-translation
- firewall ipmacbinding setting
- firewall ipmacbinding table
- firewall ippool
- firewall ippool6
- firewall ldb-monitor
- firewall local-in-policy
- firewall local-in-policy6
- firewall multicast-address
- firewall multicast-address6
- firewall multicast-policy
- firewall multicast-policy6
- firewall policy
- firewall policy46
- firewall policy64
- firewall profile-group
- firewall profile-protocol-options
- firewall proxy-address
- firewall proxy-addrgrp
- firewall proxy-policy
- firewall region
- firewall schedule group
- firewall schedule onetime
- firewall schedule recurring
- firewall security-policy
- firewall service category
- firewall service custom
- firewall service group
- firewall shaper per-ip-shaper
- firewall shaper traffic-shaper
- firewall shaping-policy
- firewall shaping-profile
- firewall sniffer
- firewall ssh host-key
- firewall ssh local-ca
- firewall ssh local-key
- firewall ssh setting
- firewall ssl setting
- firewall ssl-server
- firewall ssl-ssh-profile
- firewall traffic-class
- firewall ttl-policy
- firewall vendor-mac
- firewall vip
- firewall vip46
- firewall vip6
- firewall vip64
- firewall vipgrp
- firewall vipgrp46
- firewall vipgrp6
- firewall vipgrp64
- firewall wildcard-fqdn custom
- firewall wildcard-fqdn group
ftp-proxy
- ftp-proxy explicit
icap
- icap profile
- icap server
ips
- ips custom
- ips decoder
- ips global
- ips rule
- ips rule-settings
- ips sensor
- ips settings
- ips view-map
log
- log custom-field
- log disk filter
- log disk setting
- log eventfilter
- log fortianalyzer filter
- log fortianalyzer override-filter
- log fortianalyzer override-setting
- log fortianalyzer setting
- log fortianalyzer-cloud filter
- log fortianalyzer-cloud override-filter
- log fortianalyzer-cloud override-setting
- log fortianalyzer-cloud setting
- log fortianalyzer2 filter
- log fortianalyzer2 override-filter
- log fortianalyzer2 override-setting
- log fortianalyzer2 setting
- log fortianalyzer3 filter
- log fortianalyzer3 override-filter
- log fortianalyzer3 override-setting
- log fortianalyzer3 setting
- log fortiguard filter
- log fortiguard override-filter
- log fortiguard override-setting
- log fortiguard setting
- log gui-display
- log memory filter
- log memory global-setting
- log memory setting
- log null-device filter
- log null-device setting
- log setting
- log syslogd filter
- log syslogd override-filter
- log syslogd override-setting
- log syslogd setting
- log syslogd2 filter
- log syslogd2 override-filter
- log syslogd2 override-setting
- log syslogd2 setting
- log syslogd3 filter
- log syslogd3 override-filter
- log syslogd3 override-setting
- log syslogd3 setting
- log syslogd4 filter
- log syslogd4 override-filter
- log syslogd4 override-setting
- log syslogd4 setting
- log threat-weight
- log webtrends filter
- log webtrends setting
monitoring
- monitoring np6-ipsec-engine
report
- report chart
- report dataset
- report layout
- report setting
- report style
- report theme
router
- router access-list
- router access-list6
- router aspath-list
- router auth-path
- router bfd
- router bfd6
- router bgp
- router community-list
- router isis
- router key-chain
- router multicast
- router multicast-flow
- router multicast6
- router ospf
- router ospf6
- router policy
- router policy6
- router prefix-list
- router prefix-list6
- router rip
- router ripng
- router route-map
- router setting
- router static
- router static6
ssh-filter
- ssh-filter profile
switch-controller
- switch-controller auto-config custom
- switch-controller auto-config default
- switch-controller auto-config policy
- switch-controller custom-command
- switch-controller global
- switch-controller initial-config template
- switch-controller initial-config vlans
- switch-controller lldp-profile
- switch-controller lldp-settings
- switch-controller location
- switch-controller mac-policy
- switch-controller managed-switch
- switch-controller nac-device
- switch-controller nac-settings
- switch-controller port-policy
- switch-controller ptp policy
- switch-controller qos dot1p-map
- switch-controller qos ip-dscp-map
- switch-controller qos qos-policy
- switch-controller qos queue-policy
- switch-controller remote-log
- switch-controller security-policy 802-1X
- switch-controller security-policy local-access
- switch-controller snmp-community
- switch-controller snmp-user
- switch-controller storm-control-policy
- switch-controller stp-instance
- switch-controller stp-settings
- switch-controller switch-group
- switch-controller switch-interface-tag
- switch-controller switch-profile
- switch-controller system
- switch-controller traffic-policy
- switch-controller virtual-port-pool
- switch-controller vlan-policy
system
- system 3g-modem custom
- system accprofile
- system admin
- system alarm
- system alias
- system api-user
- system arp-table
- system auto-install
- system auto-script
- system automation-action
- system automation-destination
- system automation-stitch
- system automation-trigger
- system autoupdate push-update
- system autoupdate schedule
- system autoupdate tunneling
- system central-management
- system cluster-sync
- system console
- system csf
- system custom-language
- system ddns
- system dedicated-mgmt
- system dhcp server
- system dhcp6 server
- system dns
- system dns-database
- system dns-server
- system dscp-based-priority
- system email-server
- system external-resource
- system fips-cc
- system fortiguard
- system fortimanager
- system fortisandbox
- system fsso-polling
- system ftm-push
- system geneve
- system geoip-country
- system geoip-override
- system global
- system gre-tunnel
- system ha
- system ha-monitor
- system interface
- system ipip-tunnel
- system ips
- system ips-urlfilter-dns
- system ips-urlfilter-dns6
- system ipsec-aggregate
- system ipv6-neighbor-cache
- system ipv6-tunnel
- system isf-queue-profile
- system link-monitor
- system lldp network-policy
- system lte-modem
- system mac-address-table
- system mobile-tunnel
- system modem
- system nat64
- system nd-proxy
- system netflow
- system network-visibility
- system np6
- system npu
- system ntp
- system object-tagging
- system password-policy
- system password-policy-guest-admin
- system pppoe-interface
- system probe-response
- system proxy-arp
- system ptp
- system replacemsg admin
- system replacemsg alertmail
- system replacemsg auth
- system replacemsg fortiguard-wf
- system replacemsg ftp
- system replacemsg http
- system replacemsg icap
- system replacemsg mail
- system replacemsg nac-quar
- system replacemsg spam
- system replacemsg sslvpn
- system replacemsg traffic-quota
- system replacemsg utm
- system replacemsg webproxy
- system replacemsg-group
- system replacemsg-image
- system resource-limits
- system saml
- system sdn-connector
- system sdwan
- system session-helper
- system session-ttl
- system settings
- system sflow
- system sit-tunnel
- system sms-server
- system snmp community
- system snmp sysinfo
- system snmp user
- system speed-test-server
- system sso-admin
- system standalone-cluster
- system storage
- system switch-interface
- system tos-based-priority
- system vdom
- system vdom-dns
- system vdom-exception
- system vdom-link
- system vdom-netflow
- system vdom-property
- system vdom-radius-server
- system vdom-sflow
- system virtual-wire-pair
- system vne-tunnel
- system vxlan
- system wccp
- system zone
user
- user adgrp
- user domain-controller
- user exchange
- user fortitoken
- user fsso
- user fsso-polling
- user group
- user krb-keytab
- user ldap
- user local
- user nac-policy
- user password-policy
- user peer
- user peergrp
- user pop3
- user radius
- user saml
- user security-exempt-list
- user setting
- user tacacs+
voip
- voip profile
vpn
- vpn certificate ca
- vpn certificate crl
- vpn certificate local
- vpn certificate ocsp-server
- vpn certificate remote
- vpn certificate setting
- vpn ipsec concentrator
- vpn ipsec forticlient
- vpn ipsec manualkey
- vpn ipsec manualkey-interface
- vpn ipsec phase1
- vpn ipsec phase1-interface
- vpn ipsec phase2
- vpn ipsec phase2-interface
- vpn l2tp
- vpn ocvpn
- vpn pptp
- vpn ssl settings
- vpn ssl web host-check-software
- vpn ssl web portal
- vpn ssl web realm
- vpn ssl web user-bookmark
- vpn ssl web user-group-bookmark
waf
- waf main-class
- waf profile
- waf signature
- waf sub-class
wanopt
- wanopt auth-group
- wanopt cache-service
- wanopt content-delivery-network-rule
- wanopt peer
- wanopt profile
- wanopt remote-storage
- wanopt settings
- wanopt webcache
web-proxy
- web-proxy debug-url
- web-proxy explicit
- web-proxy forward-server
- web-proxy forward-server-group
- web-proxy global
- web-proxy profile
- web-proxy url-match
- web-proxy wisp
webfilter
- webfilter content
- webfilter content-header
- webfilter fortiguard
- webfilter ftgd-local-cat
- webfilter ftgd-local-rating
- webfilter ips-urlfilter-cache-setting
- webfilter ips-urlfilter-setting
- webfilter ips-urlfilter-setting6
- webfilter override
- webfilter profile
- webfilter search-engine
- webfilter urlfilter
wireless-controller
- wireless-controller access-control-list
- wireless-controller address
- wireless-controller addrgrp
- wireless-controller ap-status
- wireless-controller apcfg-profile
- wireless-controller arrp-profile
- wireless-controller ble-profile
- wireless-controller bonjour-profile
- wireless-controller global
- wireless-controller hotspot20 anqp-3gpp-cellular
- wireless-controller hotspot20 anqp-ip-address-type
- wireless-controller hotspot20 anqp-nai-realm
- wireless-controller hotspot20 anqp-network-auth-type
- wireless-controller hotspot20 anqp-roaming-consortium
- wireless-controller hotspot20 anqp-venue-name
- wireless-controller hotspot20 h2qp-conn-capability
- wireless-controller hotspot20 h2qp-operator-name
- wireless-controller hotspot20 h2qp-osu-provider
- wireless-controller hotspot20 h2qp-wan-metric
- wireless-controller hotspot20 hs-profile
- wireless-controller hotspot20 icon
- wireless-controller hotspot20 qos-map
- wireless-controller inter-controller
- wireless-controller log
- wireless-controller mpsk-profile
- wireless-controller qos-profile
- wireless-controller region
- wireless-controller setting
- wireless-controller snmp
- wireless-controller timers
- wireless-controller utm-profile
- wireless-controller vap
- wireless-controller vap-group
- wireless-controller wag-profile
- wireless-controller wids-profile
- wireless-controller wtp
- wireless-controller wtp-group
- wireless-controller wtp-profile

Home FortiGate / FortiOS 6.4.3 CLI Reference

6.4.3

antivirus profile

Configure AntiVirus profiles.

  config antivirus profile
      Description: Configure AntiVirus profiles.
      edit <name>
          set comment {var-string}
          set replacemsg-group {string}
          set feature-set [flow|proxy]
          set ftgd-analytics [disable|suspicious|...]
          set analytics-max-upload {integer}
          set analytics-wl-filetype {integer}
          set analytics-bl-filetype {integer}
          set analytics-db [disable|enable]
          set mobile-malware-db [disable|enable]
          config http
              Description: Configure HTTP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
              set content-disarm [disable|enable]
          end
          config ftp
              Description: Configure FTP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
          end
          config imap
              Description: Configure IMAP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set executables [default|virus]
              set outbreak-prevention [disabled|files|...]
              set content-disarm [disable|enable]
          end
          config pop3
              Description: Configure POP3 AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set executables [default|virus]
              set outbreak-prevention [disabled|files|...]
              set content-disarm [disable|enable]
          end
          config smtp
              Description: Configure SMTP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set executables [default|virus]
              set outbreak-prevention [disabled|files|...]
              set content-disarm [disable|enable]
          end
          config mapi
              Description: Configure MAPI AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set executables [default|virus]
              set outbreak-prevention [disabled|files|...]
          end
          config nntp
              Description: Configure NNTP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
          end
          config cifs
              Description: Configure CIFS AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
          end
          config ssh
              Description: Configure SFTP and SCP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
          end
          config nac-quar
              Description: Configure AntiVirus quarantine settings.
              set infected [none|quar-src-ip]
              set expiry {user}
              set log [enable|disable]
          end
          config outbreak-prevention
              Description: Configure Virus Outbreak Prevention settings.
              set ftgd-service [disable|enable]
              set external-blocklist [disable|enable]
          end
          config content-disarm
              Description: AV Content Disarm and Reconstruction settings.
              set original-file-destination [fortisandbox|quarantine|...]
              set error-action [block|log-only|...]
              set office-macro [disable|enable]
              set office-hylink [disable|enable]
              set office-linked [disable|enable]
              set office-embed [disable|enable]
              set office-dde [disable|enable]
              set office-action [disable|enable]
              set pdf-javacode [disable|enable]
              set pdf-embedfile [disable|enable]
              set pdf-hyperlink [disable|enable]
              set pdf-act-gotor [disable|enable]
              set pdf-act-launch [disable|enable]
              set pdf-act-sound [disable|enable]
              set pdf-act-movie [disable|enable]
              set pdf-act-java [disable|enable]
              set pdf-act-form [disable|enable]
              set cover-page [disable|enable]
              set detect-only [disable|enable]
          end
          set av-virus-log [enable|disable]
          set av-block-log [enable|disable]
          set extended-log [enable|disable]
          set scan-mode [default|legacy]
      next
  end

config antivirus profile

Parameter Name	Description	Type	Size
comment	Comment.	var-string	Maximum length: 255
replacemsg-group	Replacement message group customized for this profile.	string	Maximum length: 35
feature-set	Flow/proxy feature set. flow: Flow feature set. proxy: Proxy feature set.	option	-
ftgd-analytics	Settings to control which files are uploaded to FortiSandbox. disable: Do not upload files to FortiSandbox. suspicious: Submit files supported by FortiSandbox if heuristics or other methods determine they are suspicious. everything: Submit all files scanned by AntiVirus to FortiSandbox. AntiVirus may not scan all files.	option	-
analytics-max-upload	Maximum size of files that can be uploaded to FortiSandbox (1 - 395 MBytes, default = 10).	integer	Minimum value: 1 Maximum value: 6446
analytics-wl-filetype	Do not submit files matching this DLP file-pattern to FortiSandbox.	integer	Minimum value: 0 Maximum value: 4294967295
analytics-bl-filetype	Only submit files matching this DLP file-pattern to FortiSandbox.	integer	Minimum value: 0 Maximum value: 4294967295
analytics-db	Enable/disable using the FortiSandbox signature database to supplement the AV signature databases. disable: Use only the standard AV signature databases. enable: Also use the FortiSandbox signature database.	option	-
mobile-malware-db	Enable/disable using the mobile malware signature database. disable: Do not use the mobile malware signature database. enable: Also use the mobile malware signature database.	option	-
av-virus-log	Enable/disable AntiVirus logging. enable: Enable setting. disable: Disable setting.	option	-
av-block-log	Enable/disable logging for AntiVirus file blocking. enable: Enable setting. disable: Disable setting.	option	-
extended-log	Enable/disable extended logging for antivirus. enable: Enable setting. disable: Disable setting.	option	-
scan-mode	Choose between default scan mode and legacy scan mode. default: On the fly decompression and scanning of certain archive files. legacy: Scan archive files only after the entire file is received.	option	-

config http

Parameter Name	Description	Type	Size
options	Enable/disable HTTP AntiVirus scanning, monitoring, and quarantine. scan: Enable HTTP antivirus scanning. avmonitor: Enable HTTP antivirus logging. quarantine: Enable HTTP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-
content-disarm	Enable Content Disarm and Reconstruction for this protocol. disable: Disable Content Disarm and Reconstruction for this protocol. enable: Enable Content Disarm and Reconstruction for this protocol.	option	-

config ftp

Parameter Name	Description	Type	Size
options	Enable/disable FTP AntiVirus scanning, monitoring, and quarantine. scan: Enable FTP antivirus scanning. avmonitor: Enable FTP antivirus logging. quarantine: Enable FTP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config imap

Parameter Name	Description	Type	Size
options	Enable/disable IMAP AntiVirus scanning, monitoring, and quarantine. scan: Enable IMAP antivirus scanning. avmonitor: Enable IMAP antivirus logging. quarantine: Enable IMAP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
executables	Treat Windows executable files as viruses for the purpose of blocking or monitoring. default: Perform standard AntiVirus scanning of Windows executable files. virus: Treat Windows executables as viruses.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-
content-disarm	Enable Content Disarm and Reconstruction for this protocol. disable: Disable Content Disarm and Reconstruction for this protocol. enable: Enable Content Disarm and Reconstruction for this protocol.	option	-

config pop3

Parameter Name	Description	Type	Size
options	Enable/disable POP3 AntiVirus scanning, monitoring, and quarantine. scan: Enable POP3 antivirus scanning. avmonitor: Enable POP3 antivirus logging. quarantine: Enable POP3 antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
executables	Treat Windows executable files as viruses for the purpose of blocking or monitoring. default: Perform standard AntiVirus scanning of Windows executable files. virus: Treat Windows executables as viruses.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-
content-disarm	Enable Content Disarm and Reconstruction for this protocol. disable: Disable Content Disarm and Reconstruction for this protocol. enable: Enable Content Disarm and Reconstruction for this protocol.	option	-

config smtp

Parameter Name	Description	Type	Size
options	Enable/disable SMTP AntiVirus scanning, monitoring, and quarantine. scan: Enable SMTP antivirus scanning. avmonitor: Enable SMTP antivirus logging. quarantine: Enable SMTP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
executables	Treat Windows executable files as viruses for the purpose of blocking or monitoring. default: Perform standard AntiVirus scanning of Windows executable files. virus: Treat Windows executables as viruses.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-
content-disarm	Enable Content Disarm and Reconstruction for this protocol. disable: Disable Content Disarm and Reconstruction for this protocol. enable: Enable Content Disarm and Reconstruction for this protocol.	option	-

config mapi

Parameter Name	Description	Type	Size
options	Enable/disable MAPI AntiVirus scanning, monitoring, and quarantine. scan: Enable MAPI antivirus scanning. avmonitor: Enable MAPI antivirus logging. quarantine: Enable MAPI antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
executables	Treat Windows executable files as viruses for the purpose of blocking or monitoring. default: Perform standard AntiVirus scanning of Windows executable files. virus: Treat Windows executables as viruses.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config nntp

Parameter Name	Description	Type	Size
options	Enable/disable NNTP AntiVirus scanning, monitoring, and quarantine. scan: Enable NNTP antivirus scanning. avmonitor: Enable NNTP antivirus logging. quarantine: Enable NNTP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config cifs

Parameter Name	Description	Type	Size
options	Enable/disable CIFS AntiVirus scanning, monitoring, and quarantine. scan: Enable CIFS antivirus scanning. avmonitor: Enable CIFS antivirus logging. quarantine: Enable CIFS antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config ssh

Parameter Name	Description	Type	Size
options	Enable/disable SFTP and SCP AntiVirus scanning, monitoring, and quarantine. scan: Enable SSH antivirus scanning. avmonitor: Enable SSH antivirus logging. quarantine: Enable SSH antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config nac-quar

Parameter Name	Description	Type	Size
infected	Enable/Disable quarantining infected hosts to the banned user list. none: Do not quarantine infected hosts. quar-src-ip: Quarantine all traffic from the infected hosts source IP.	option	-
expiry	Duration of quarantine.	user	Not Specified
log	Enable/disable AntiVirus quarantine logging. enable: Enable AntiVirus quarantine logging. disable: Disable AntiVirus quarantine logging.	option	-

config outbreak-prevention

Parameter Name	Description	Type	Size
ftgd-service	Enable/disable FortiGuard Virus outbreak prevention service. disable: Disable FortiGuard Virus Outbreak Prevention service. enable: Enable FortiGuard Virus Outbreak Prevention service.	option	-
external-blocklist	Enable/disable external malware blocklist. disable: Disable external malware blocklist. enable: Enable external malware blocklist.	option	-

config content-disarm

Parameter Name	Description	Type	Size
original-file-destination	Destination to send original file if active content is removed. fortisandbox: Send original file to configured FortiSandbox. quarantine: Send original file to quarantine. discard: Original file will be discarded after content disarm.	option	-
error-action	Action to be taken if CDR engine encounters an unrecoverable error. block: Block file on CDR error. log-only: Log CDR error, but allow file. ignore: Do nothing on CDR error.	option	-
office-macro	Enable/disable stripping of macros in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-hylink	Enable/disable stripping of hyperlinks in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-linked	Enable/disable stripping of linked objects in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-embed	Enable/disable stripping of embedded objects in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-dde	Enable/disable stripping of Dynamic Data Exchange events in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-action	Enable/disable stripping of PowerPoint action events in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-javacode	Enable/disable stripping of JavaScript code in PDF documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-embedfile	Enable/disable stripping of embedded files in PDF documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-hyperlink	Enable/disable stripping of hyperlinks from PDF documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-gotor	Enable/disable stripping of PDF document actions that access other PDF documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-launch	Enable/disable stripping of PDF document actions that launch other applications. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-sound	Enable/disable stripping of PDF document actions that play a sound. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-movie	Enable/disable stripping of PDF document actions that play a movie. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-java	Enable/disable stripping of PDF document actions that execute JavaScript code. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-form	Enable/disable stripping of PDF document actions that submit data to other targets. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
cover-page	Enable/disable inserting a cover page into the disarmed document. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
detect-only	Enable/disable only detect disarmable files, do not alter content. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-

Configure AntiVirus profiles.

  config antivirus profile
      Description: Configure AntiVirus profiles.
      edit <name>
          set comment {var-string}
          set replacemsg-group {string}
          set feature-set [flow|proxy]
          set ftgd-analytics [disable|suspicious|...]
          set analytics-max-upload {integer}
          set analytics-wl-filetype {integer}
          set analytics-bl-filetype {integer}
          set analytics-db [disable|enable]
          set mobile-malware-db [disable|enable]
          config http
              Description: Configure HTTP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
              set content-disarm [disable|enable]
          end
          config ftp
              Description: Configure FTP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
          end
          config imap
              Description: Configure IMAP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set executables [default|virus]
              set outbreak-prevention [disabled|files|...]
              set content-disarm [disable|enable]
          end
          config pop3
              Description: Configure POP3 AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set executables [default|virus]
              set outbreak-prevention [disabled|files|...]
              set content-disarm [disable|enable]
          end
          config smtp
              Description: Configure SMTP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set executables [default|virus]
              set outbreak-prevention [disabled|files|...]
              set content-disarm [disable|enable]
          end
          config mapi
              Description: Configure MAPI AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set executables [default|virus]
              set outbreak-prevention [disabled|files|...]
          end
          config nntp
              Description: Configure NNTP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
          end
          config cifs
              Description: Configure CIFS AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
          end
          config ssh
              Description: Configure SFTP and SCP AntiVirus options.
              set options {option1}, {option2}, ...
              set archive-block {option1}, {option2}, ...
              set archive-log {option1}, {option2}, ...
              set emulator [enable|disable]
              set outbreak-prevention [disabled|files|...]
          end
          config nac-quar
              Description: Configure AntiVirus quarantine settings.
              set infected [none|quar-src-ip]
              set expiry {user}
              set log [enable|disable]
          end
          config outbreak-prevention
              Description: Configure Virus Outbreak Prevention settings.
              set ftgd-service [disable|enable]
              set external-blocklist [disable|enable]
          end
          config content-disarm
              Description: AV Content Disarm and Reconstruction settings.
              set original-file-destination [fortisandbox|quarantine|...]
              set error-action [block|log-only|...]
              set office-macro [disable|enable]
              set office-hylink [disable|enable]
              set office-linked [disable|enable]
              set office-embed [disable|enable]
              set office-dde [disable|enable]
              set office-action [disable|enable]
              set pdf-javacode [disable|enable]
              set pdf-embedfile [disable|enable]
              set pdf-hyperlink [disable|enable]
              set pdf-act-gotor [disable|enable]
              set pdf-act-launch [disable|enable]
              set pdf-act-sound [disable|enable]
              set pdf-act-movie [disable|enable]
              set pdf-act-java [disable|enable]
              set pdf-act-form [disable|enable]
              set cover-page [disable|enable]
              set detect-only [disable|enable]
          end
          set av-virus-log [enable|disable]
          set av-block-log [enable|disable]
          set extended-log [enable|disable]
          set scan-mode [default|legacy]
      next
  end

config antivirus profile

Parameter Name	Description	Type	Size
comment	Comment.	var-string	Maximum length: 255
replacemsg-group	Replacement message group customized for this profile.	string	Maximum length: 35
feature-set	Flow/proxy feature set. flow: Flow feature set. proxy: Proxy feature set.	option	-
ftgd-analytics	Settings to control which files are uploaded to FortiSandbox. disable: Do not upload files to FortiSandbox. suspicious: Submit files supported by FortiSandbox if heuristics or other methods determine they are suspicious. everything: Submit all files scanned by AntiVirus to FortiSandbox. AntiVirus may not scan all files.	option	-
analytics-max-upload	Maximum size of files that can be uploaded to FortiSandbox (1 - 395 MBytes, default = 10).	integer	Minimum value: 1 Maximum value: 6446
analytics-wl-filetype	Do not submit files matching this DLP file-pattern to FortiSandbox.	integer	Minimum value: 0 Maximum value: 4294967295
analytics-bl-filetype	Only submit files matching this DLP file-pattern to FortiSandbox.	integer	Minimum value: 0 Maximum value: 4294967295
analytics-db	Enable/disable using the FortiSandbox signature database to supplement the AV signature databases. disable: Use only the standard AV signature databases. enable: Also use the FortiSandbox signature database.	option	-
mobile-malware-db	Enable/disable using the mobile malware signature database. disable: Do not use the mobile malware signature database. enable: Also use the mobile malware signature database.	option	-
av-virus-log	Enable/disable AntiVirus logging. enable: Enable setting. disable: Disable setting.	option	-
av-block-log	Enable/disable logging for AntiVirus file blocking. enable: Enable setting. disable: Disable setting.	option	-
extended-log	Enable/disable extended logging for antivirus. enable: Enable setting. disable: Disable setting.	option	-
scan-mode	Choose between default scan mode and legacy scan mode. default: On the fly decompression and scanning of certain archive files. legacy: Scan archive files only after the entire file is received.	option	-

config http

Parameter Name	Description	Type	Size
options	Enable/disable HTTP AntiVirus scanning, monitoring, and quarantine. scan: Enable HTTP antivirus scanning. avmonitor: Enable HTTP antivirus logging. quarantine: Enable HTTP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-
content-disarm	Enable Content Disarm and Reconstruction for this protocol. disable: Disable Content Disarm and Reconstruction for this protocol. enable: Enable Content Disarm and Reconstruction for this protocol.	option	-

config ftp

Parameter Name	Description	Type	Size
options	Enable/disable FTP AntiVirus scanning, monitoring, and quarantine. scan: Enable FTP antivirus scanning. avmonitor: Enable FTP antivirus logging. quarantine: Enable FTP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config imap

Parameter Name	Description	Type	Size
options	Enable/disable IMAP AntiVirus scanning, monitoring, and quarantine. scan: Enable IMAP antivirus scanning. avmonitor: Enable IMAP antivirus logging. quarantine: Enable IMAP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
executables	Treat Windows executable files as viruses for the purpose of blocking or monitoring. default: Perform standard AntiVirus scanning of Windows executable files. virus: Treat Windows executables as viruses.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-
content-disarm	Enable Content Disarm and Reconstruction for this protocol. disable: Disable Content Disarm and Reconstruction for this protocol. enable: Enable Content Disarm and Reconstruction for this protocol.	option	-

config pop3

Parameter Name	Description	Type	Size
options	Enable/disable POP3 AntiVirus scanning, monitoring, and quarantine. scan: Enable POP3 antivirus scanning. avmonitor: Enable POP3 antivirus logging. quarantine: Enable POP3 antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
executables	Treat Windows executable files as viruses for the purpose of blocking or monitoring. default: Perform standard AntiVirus scanning of Windows executable files. virus: Treat Windows executables as viruses.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-
content-disarm	Enable Content Disarm and Reconstruction for this protocol. disable: Disable Content Disarm and Reconstruction for this protocol. enable: Enable Content Disarm and Reconstruction for this protocol.	option	-

config smtp

Parameter Name	Description	Type	Size
options	Enable/disable SMTP AntiVirus scanning, monitoring, and quarantine. scan: Enable SMTP antivirus scanning. avmonitor: Enable SMTP antivirus logging. quarantine: Enable SMTP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
executables	Treat Windows executable files as viruses for the purpose of blocking or monitoring. default: Perform standard AntiVirus scanning of Windows executable files. virus: Treat Windows executables as viruses.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-
content-disarm	Enable Content Disarm and Reconstruction for this protocol. disable: Disable Content Disarm and Reconstruction for this protocol. enable: Enable Content Disarm and Reconstruction for this protocol.	option	-

config mapi

Parameter Name	Description	Type	Size
options	Enable/disable MAPI AntiVirus scanning, monitoring, and quarantine. scan: Enable MAPI antivirus scanning. avmonitor: Enable MAPI antivirus logging. quarantine: Enable MAPI antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
executables	Treat Windows executable files as viruses for the purpose of blocking or monitoring. default: Perform standard AntiVirus scanning of Windows executable files. virus: Treat Windows executables as viruses.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config nntp

Parameter Name	Description	Type	Size
options	Enable/disable NNTP AntiVirus scanning, monitoring, and quarantine. scan: Enable NNTP antivirus scanning. avmonitor: Enable NNTP antivirus logging. quarantine: Enable NNTP antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config cifs

Parameter Name	Description	Type	Size
options	Enable/disable CIFS AntiVirus scanning, monitoring, and quarantine. scan: Enable CIFS antivirus scanning. avmonitor: Enable CIFS antivirus logging. quarantine: Enable CIFS antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config ssh

Parameter Name	Description	Type	Size
options	Enable/disable SFTP and SCP AntiVirus scanning, monitoring, and quarantine. scan: Enable SSH antivirus scanning. avmonitor: Enable SSH antivirus logging. quarantine: Enable SSH antivirus quarantine. Files are quarantined depending on quarantine settings.	option	-
archive-block	Select the archive types to block. encrypted: Block encrypted archives. corrupted: Block corrupted archives. partiallycorrupted: Block partially corrupted archives. multipart: Block multipart archives. nested: Block nested archives. mailbomb: Block mail bomb archives. fileslimit: Block exceeded archive files limit. timeout: Block scan timeout. unhandled: Block archives that FortiOS cannot open.	option	-
archive-log	Select the archive types to log. encrypted: Log encrypted archives. corrupted: Log corrupted archives. partiallycorrupted: Log partially corrupted archives. multipart: Log multipart archives. nested: Log nested archives. mailbomb: Log mail bomb archives. fileslimit: Log exceeded archive files limit. timeout: Log scan timeout. unhandled: Log archives that FortiOS cannot open.	option	-
emulator	Enable/disable the virus emulator. enable: Enable the virus emulator. disable: Disable the virus emulator.	option	-
outbreak-prevention	Enable Virus Outbreak Prevention service. disabled: Disabled. files: Analyze files as sent, not the content of archives. full-archive: Analyze files including the content of archives.	option	-

config nac-quar

Parameter Name	Description	Type	Size
infected	Enable/Disable quarantining infected hosts to the banned user list. none: Do not quarantine infected hosts. quar-src-ip: Quarantine all traffic from the infected hosts source IP.	option	-
expiry	Duration of quarantine.	user	Not Specified
log	Enable/disable AntiVirus quarantine logging. enable: Enable AntiVirus quarantine logging. disable: Disable AntiVirus quarantine logging.	option	-

config outbreak-prevention

Parameter Name	Description	Type	Size
ftgd-service	Enable/disable FortiGuard Virus outbreak prevention service. disable: Disable FortiGuard Virus Outbreak Prevention service. enable: Enable FortiGuard Virus Outbreak Prevention service.	option	-
external-blocklist	Enable/disable external malware blocklist. disable: Disable external malware blocklist. enable: Enable external malware blocklist.	option	-

config content-disarm

Parameter Name	Description	Type	Size
original-file-destination	Destination to send original file if active content is removed. fortisandbox: Send original file to configured FortiSandbox. quarantine: Send original file to quarantine. discard: Original file will be discarded after content disarm.	option	-
error-action	Action to be taken if CDR engine encounters an unrecoverable error. block: Block file on CDR error. log-only: Log CDR error, but allow file. ignore: Do nothing on CDR error.	option	-
office-macro	Enable/disable stripping of macros in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-hylink	Enable/disable stripping of hyperlinks in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-linked	Enable/disable stripping of linked objects in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-embed	Enable/disable stripping of embedded objects in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-dde	Enable/disable stripping of Dynamic Data Exchange events in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
office-action	Enable/disable stripping of PowerPoint action events in Microsoft Office documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-javacode	Enable/disable stripping of JavaScript code in PDF documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-embedfile	Enable/disable stripping of embedded files in PDF documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-hyperlink	Enable/disable stripping of hyperlinks from PDF documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-gotor	Enable/disable stripping of PDF document actions that access other PDF documents. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-launch	Enable/disable stripping of PDF document actions that launch other applications. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-sound	Enable/disable stripping of PDF document actions that play a sound. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-movie	Enable/disable stripping of PDF document actions that play a movie. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-java	Enable/disable stripping of PDF document actions that execute JavaScript code. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
pdf-act-form	Enable/disable stripping of PDF document actions that submit data to other targets. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
cover-page	Enable/disable inserting a cover page into the disarmed document. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-
detect-only	Enable/disable only detect disarmable files, do not alter content. disable: Disable this Content Disarm and Reconstruction feature. enable: Enable this Content Disarm and Reconstruction feature.	option	-

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

CLI Reference

antivirus profile

Configure AntiVirus profiles.

config antivirus profile

config http

config ftp

config imap

config pop3

config smtp

config mapi

config nntp

config cifs

config ssh

config nac-quar