FortiAI inline blocking and integration with an AV profile

FortiAI can be used with antivirus profiles in proxy inspection mode (flow mode is currently not supported). FortiAI inspects high-risk files and issues a verdict to the firewall based on how close the file features match those of malware. When enabled, FortiAI can log, block, ignore, or monitor (allow) the file based on the verdict.

Note

A licensed FortiAI appliance with version 1.5.1 or later is required to use this feature.

To configure FortiAI inline inspection with an AV profile:
  1. Configure FortiAI to join a Security Fabric in FortiOS (see FortiAI).

  2. In the FortiAI CLI, enable inline inspection:
    config system fortiai
        set status enable
    end
  3. Configure an AV profile in FortiOS to use inline inspection and block detected infections:
    config antivirus profile
        edit "av"
            set feature-set proxy
            config http
                set fortiai block
            end
            config ftp
                set fortiai block
            end
            config imap
                set fortiai block
            end
            config pop3
                set fortiai block
            end
            config smtp
                set fortiai block
            end
            config mapi
                set fortiai block
            end
            config nntp
                set fortiai block
            end
            config cifs
                set fortiai block
            end
            config ssh
                set fortiai block
            end
        next
    end
  4. Add the AV profile to a firewall policy. When potential infections are blocked by FortiAI inline inspection, a replacement message appears (FortiAI Block Page, see Replacement messages for more information). An infection blocked over HTTP looks similar to the following:

Sample log
date=2021-04-29 time=15:12:07 eventtime=1619734327633022960 tz="-0700" logid="0209008221" type="utm" subtype="virus" eventtype="fortiai" level="notice" vd="vdom1" policyid=1 msg="Detected by FortiAI." action="monitored" service="HTTP" sessionid=13312 srcip=10.1.100.221 dstip=172.16.200.224 srcport=50792 dstport=80 srcintf="wan2" srcintfrole="wan" dstintf="wan1" dstintfrole="wan" proto=6 direction="incoming" filename="detected_samples.zip" quarskip="File-was-not-quarantined" virus="MSIL/Kryptik.KVH!tr" dtype="FortiAI" ref="http://www.fortinet.com/ve?vn=MSIL%2FKr