config antivirus profile

Configure AntiVirus profiles.

config antivirus profile
    Description: Configure AntiVirus profiles.
    edit <name>
        set analytics-accept-filetype {integer}
        set analytics-db [disable|enable]
        set analytics-ignore-filetype {integer}
        set av-block-log [enable|disable]
        set av-virus-log [enable|disable]
        config cifs
            Description: Configure CIFS AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
        end
        set comment {var-string}
        config content-disarm
            Description: AV Content Disarm and Reconstruction settings.
            set original-file-destination [fortisandbox|quarantine|...]
            set error-action [block|log-only|...]
            set office-macro [disable|enable]
            set office-hylink [disable|enable]
            set office-linked [disable|enable]
            set office-embed [disable|enable]
            set office-dde [disable|enable]
            set office-action [disable|enable]
            set pdf-javacode [disable|enable]
            set pdf-embedfile [disable|enable]
            set pdf-hyperlink [disable|enable]
            set pdf-act-gotor [disable|enable]
            set pdf-act-launch [disable|enable]
            set pdf-act-sound [disable|enable]
            set pdf-act-movie [disable|enable]
            set pdf-act-java [disable|enable]
            set pdf-act-form [disable|enable]
            set cover-page [disable|enable]
            set detect-only [disable|enable]
        end
        set ems-threat-feed [disable|enable]
        set extended-log [enable|disable]
        set external-blocklist <name1>, <name2>, ...
        set external-blocklist-enable-all [disable|enable]
        set feature-set [flow|proxy]
        set fortindr-error-action [log-only|block|...]
        set fortindr-timeout-action [log-only|block|...]
        set fortisandbox-error-action [log-only|block|...]
        set fortisandbox-max-upload {integer}
        set fortisandbox-mode [inline|analytics-suspicious|...]
        set fortisandbox-timeout-action [log-only|block|...]
        config ftp
            Description: Configure FTP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
        end
        config http
            Description: Configure HTTP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set content-disarm [disable|enable]
        end
        config imap
            Description: Configure IMAP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set executables [default|virus]
            set content-disarm [disable|enable]
        end
        config mapi
            Description: Configure MAPI AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set executables [default|virus]
        end
        set mobile-malware-db [disable|enable]
        config nac-quar
            Description: Configure AntiVirus quarantine settings.
            set infected [none|quar-src-ip]
            set expiry {user}
            set log [enable|disable]
        end
        config nntp
            Description: Configure NNTP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
        end
        set outbreak-prevention-archive-scan [disable|enable]
        config pop3
            Description: Configure POP3 AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set executables [default|virus]
            set content-disarm [disable|enable]
        end
        set replacemsg-group {string}
        set scan-mode [default|legacy]
        config smtp
            Description: Configure SMTP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set executables [default|virus]
            set content-disarm [disable|enable]
        end
        config ssh
            Description: Configure SFTP and SCP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
        end
    next
end

config antivirus profile

Parameter

Description

Type

Size

Default

analytics-accept-filetype

Only submit files matching this DLP file-pattern to FortiSandbox (post-transfer scan only).

integer

Minimum value: 0 Maximum value: 4294967295

analytics-db

Enable/disable using the FortiSandbox signature database to supplement the AV signature databases.

option

disable

Option	Description
disable	Use only the standard AV signature databases.
enable	Also use the FortiSandbox signature database.

analytics-ignore-filetype

Do not submit files matching this DLP file-pattern to FortiSandbox (post-transfer scan only).

integer

Minimum value: 0 Maximum value: 4294967295

av-block-log

Enable/disable logging for AntiVirus file blocking.

option

enable

Option	Description
enable	Enable setting.
disable	Disable setting.

av-virus-log

Enable/disable AntiVirus logging.

option

enable

Option	Description
enable	Enable setting.
disable	Disable setting.

comment

Comment.

var-string

Maximum length: 255

ems-threat-feed

Enable/disable use of EMS threat feed when performing AntiVirus scan. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable use of EMS threat feed when performing AntiVirus scan.
enable	Enable use of EMS threat feed when performing AntiVirus scan.

extended-log

Enable/disable extended logging for antivirus.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

external-blocklist <name>

One or more external malware block lists.

External blocklist.

string

Maximum length: 79

external-blocklist-enable-all

Enable/disable all external blocklists.

option

disable

Option	Description
disable	Use configured external blocklists.
enable	Enable all external blocklists.

feature-set

Flow/proxy feature set.

option

flow

Option	Description
flow	Flow feature set.
proxy	Proxy feature set.

fortindr-error-action

Action to take if FortiNDR encounters an error.

option

log-only

Option	Description
log-only	Log FortiNDR error, but allow the file.
block	Block the file on FortiNDR error.
ignore	Do nothing on FortiNDR error.

fortindr-timeout-action

Action to take if FortiNDR encounters a scan timeout.

option

log-only

Option	Description
log-only	Log FortiNDR scan timeout, but allow the file.
block	Block the file on FortiNDR scan timeout.
ignore	Do nothing on FortiNDR scan timeout.

fortisandbox-error-action

Action to take if FortiSandbox inline scan encounters an error.

option

log-only

Option	Description
log-only	Log FortiSandbox inline scan error, but allow the file.
block	Block the file on FortiSandbox inline scan error.
ignore	Do nothing on FortiSandbox inline scan error.

fortisandbox-max-upload

Maximum size of files that can be uploaded to FortiSandbox.

integer

Minimum value: 1 Maximum value: 1606 **

fortisandbox-mode

FortiSandbox scan modes.

option

analytics-everything

Option	Description
inline	FortiSandbox inline scan.
analytics-suspicious	FortiSandbox post-transfer scan: submit supported files if heuristics or other methods determine they are suspicious.
analytics-everything	FortiSandbox post-transfer scan: submit supported files and known infected files.

fortisandbox-timeout-action

Action to take if FortiSandbox inline scan encounters a scan timeout.

option

log-only

Option	Description
log-only	Log FortiSandbox inline scan timeout, but allow the file.
block	Block the file on FortiSandbox inline scan timeout.
ignore	Do nothing on FortiSandbox inline scan timeout.

mobile-malware-db

Enable/disable using the mobile malware signature database.

option

enable

Option	Description
disable	Do not use the mobile malware signature database.
enable	Also use the mobile malware signature database.

name

Profile name.

string

Maximum length: 35

outbreak-prevention-archive-scan

Enable/disable outbreak-prevention archive scanning.

option

enable

Option	Description
disable	Analyze files as sent, not the content of archives.
enable	Analyze files including the content of archives.

replacemsg-group

Replacement message group customized for this profile.

string

Maximum length: 35

scan-mode

Configure scan mode.

option

default

Option	Description
default	On the fly decompression and scanning of certain archive files.
legacy	Scan archive files only after the entire file is received.

** Values may differ between models.

config cifs

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

config content-disarm

Parameter

Description

Type

Size

Default

original-file-destination

Destination to send original file if active content is removed.

option

discard

Option	Description
fortisandbox	Send original file to configured FortiSandbox.
quarantine	Send original file to quarantine.
discard	Original file will be discarded after content disarm.

error-action

Action to be taken if CDR engine encounters an unrecoverable error.

option

log-only

Option	Description
block	Block file on CDR error.
log-only	Log CDR error, but allow file.
ignore	Do nothing on CDR error.

office-macro

Enable/disable stripping of macros in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-hylink

Enable/disable stripping of hyperlinks in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-linked

Enable/disable stripping of linked objects in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-embed

Enable/disable stripping of embedded objects in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-dde

Enable/disable stripping of Dynamic Data Exchange events in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-action

Enable/disable stripping of PowerPoint action events in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-javacode

Enable/disable stripping of JavaScript code in PDF documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-embedfile

Enable/disable stripping of embedded files in PDF documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-hyperlink

Enable/disable stripping of hyperlinks from PDF documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-gotor

Enable/disable stripping of PDF document actions that access other PDF documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-launch

Enable/disable stripping of PDF document actions that launch other applications.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-sound

Enable/disable stripping of PDF document actions that play a sound.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-movie

Enable/disable stripping of PDF document actions that play a movie.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-java

Enable/disable stripping of PDF document actions that execute JavaScript code.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-form

Enable/disable stripping of PDF document actions that submit data to other targets.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

cover-page

Enable/disable inserting a cover page into the disarmed document.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

detect-only

Enable/disable only detect disarmable files, do not alter content.

option

disable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

config ftp

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

config http

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

content-disarm

Enable/disable Content Disarm and Reconstruction when performing AntiVirus scan.

option

disable

Option	Description
disable	Disable Content Disarm and Reconstruction when performing AntiVirus scan.
enable	Enable Content Disarm and Reconstruction when performing AntiVirus scan.

config imap

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

executables

Treat Windows executable files as viruses for the purpose of blocking or monitoring.

option

default

Option	Description
default	Perform standard AntiVirus scanning of Windows executable files.
virus	Treat Windows executables as viruses.

content-disarm

Enable/disable Content Disarm and Reconstruction when performing AntiVirus scan.

option

disable

Option	Description
disable	Disable Content Disarm and Reconstruction when performing AntiVirus scan.
enable	Enable Content Disarm and Reconstruction when performing AntiVirus scan.

config mapi

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

executables

Treat Windows executable files as viruses for the purpose of blocking or monitoring.

option

default

Option	Description
default	Perform standard AntiVirus scanning of Windows executable files.
virus	Treat Windows executables as viruses.

config nac-quar

Parameter

Description

Type

Size

Default

infected

Enable/Disable quarantining infected hosts to the banned user list.

option

none

Option	Description
none	Do not quarantine infected hosts.
quar-src-ip	Quarantine all traffic from the infected hosts source IP.

expiry

Duration of quarantine.

user

Not Specified

log

Enable/disable AntiVirus quarantine logging.

option

disable

Option	Description
enable	Enable AntiVirus quarantine logging.
disable	Disable AntiVirus quarantine logging.

config nntp

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

config pop3

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

executables

Treat Windows executable files as viruses for the purpose of blocking or monitoring.

option

default

Option	Description
default	Perform standard AntiVirus scanning of Windows executable files.
virus	Treat Windows executables as viruses.

content-disarm

Enable/disable Content Disarm and Reconstruction when performing AntiVirus scan.

option

disable

Option	Description
disable	Disable Content Disarm and Reconstruction when performing AntiVirus scan.
enable	Enable Content Disarm and Reconstruction when performing AntiVirus scan.

config smtp

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

executables

Treat Windows executable files as viruses for the purpose of blocking or monitoring.

option

default

Option	Description
default	Perform standard AntiVirus scanning of Windows executable files.
virus	Treat Windows executables as viruses.

content-disarm

Enable/disable Content Disarm and Reconstruction when performing AntiVirus scan.

option

disable

Option	Description
disable	Disable Content Disarm and Reconstruction when performing AntiVirus scan.
enable	Enable Content Disarm and Reconstruction when performing AntiVirus scan.

config ssh

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

config antivirus profile

Configure AntiVirus profiles.

config antivirus profile
    Description: Configure AntiVirus profiles.
    edit <name>
        set analytics-accept-filetype {integer}
        set analytics-db [disable|enable]
        set analytics-ignore-filetype {integer}
        set av-block-log [enable|disable]
        set av-virus-log [enable|disable]
        config cifs
            Description: Configure CIFS AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
        end
        set comment {var-string}
        config content-disarm
            Description: AV Content Disarm and Reconstruction settings.
            set original-file-destination [fortisandbox|quarantine|...]
            set error-action [block|log-only|...]
            set office-macro [disable|enable]
            set office-hylink [disable|enable]
            set office-linked [disable|enable]
            set office-embed [disable|enable]
            set office-dde [disable|enable]
            set office-action [disable|enable]
            set pdf-javacode [disable|enable]
            set pdf-embedfile [disable|enable]
            set pdf-hyperlink [disable|enable]
            set pdf-act-gotor [disable|enable]
            set pdf-act-launch [disable|enable]
            set pdf-act-sound [disable|enable]
            set pdf-act-movie [disable|enable]
            set pdf-act-java [disable|enable]
            set pdf-act-form [disable|enable]
            set cover-page [disable|enable]
            set detect-only [disable|enable]
        end
        set ems-threat-feed [disable|enable]
        set extended-log [enable|disable]
        set external-blocklist <name1>, <name2>, ...
        set external-blocklist-enable-all [disable|enable]
        set feature-set [flow|proxy]
        set fortindr-error-action [log-only|block|...]
        set fortindr-timeout-action [log-only|block|...]
        set fortisandbox-error-action [log-only|block|...]
        set fortisandbox-max-upload {integer}
        set fortisandbox-mode [inline|analytics-suspicious|...]
        set fortisandbox-timeout-action [log-only|block|...]
        config ftp
            Description: Configure FTP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
        end
        config http
            Description: Configure HTTP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set content-disarm [disable|enable]
        end
        config imap
            Description: Configure IMAP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set executables [default|virus]
            set content-disarm [disable|enable]
        end
        config mapi
            Description: Configure MAPI AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set executables [default|virus]
        end
        set mobile-malware-db [disable|enable]
        config nac-quar
            Description: Configure AntiVirus quarantine settings.
            set infected [none|quar-src-ip]
            set expiry {user}
            set log [enable|disable]
        end
        config nntp
            Description: Configure NNTP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
        end
        set outbreak-prevention-archive-scan [disable|enable]
        config pop3
            Description: Configure POP3 AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set executables [default|virus]
            set content-disarm [disable|enable]
        end
        set replacemsg-group {string}
        set scan-mode [default|legacy]
        config smtp
            Description: Configure SMTP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
            set executables [default|virus]
            set content-disarm [disable|enable]
        end
        config ssh
            Description: Configure SFTP and SCP AntiVirus options.
            set av-scan [disable|block|...]
            set outbreak-prevention [disable|block|...]
            set external-blocklist [disable|block|...]
            set fortindr [disable|block|...]
            set fortisandbox [disable|block|...]
            set quarantine [disable|enable]
            set archive-block {option1}, {option2}, ...
            set archive-log {option1}, {option2}, ...
            set emulator [enable|disable]
        end
    next
end

config antivirus profile

Parameter

Description

Type

Size

Default

analytics-accept-filetype

Only submit files matching this DLP file-pattern to FortiSandbox (post-transfer scan only).

integer

Minimum value: 0 Maximum value: 4294967295

analytics-db

Enable/disable using the FortiSandbox signature database to supplement the AV signature databases.

option

disable

Option	Description
disable	Use only the standard AV signature databases.
enable	Also use the FortiSandbox signature database.

analytics-ignore-filetype

Do not submit files matching this DLP file-pattern to FortiSandbox (post-transfer scan only).

integer

Minimum value: 0 Maximum value: 4294967295

av-block-log

Enable/disable logging for AntiVirus file blocking.

option

enable

Option	Description
enable	Enable setting.
disable	Disable setting.

av-virus-log

Enable/disable AntiVirus logging.

option

enable

Option	Description
enable	Enable setting.
disable	Disable setting.

comment

Comment.

var-string

Maximum length: 255

ems-threat-feed

Enable/disable use of EMS threat feed when performing AntiVirus scan. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable use of EMS threat feed when performing AntiVirus scan.
enable	Enable use of EMS threat feed when performing AntiVirus scan.

extended-log

Enable/disable extended logging for antivirus.

option

disable

Option	Description
enable	Enable setting.
disable	Disable setting.

external-blocklist <name>

One or more external malware block lists.

External blocklist.

string

Maximum length: 79

external-blocklist-enable-all

Enable/disable all external blocklists.

option

disable

Option	Description
disable	Use configured external blocklists.
enable	Enable all external blocklists.

feature-set

Flow/proxy feature set.

option

flow

Option	Description
flow	Flow feature set.
proxy	Proxy feature set.

fortindr-error-action

Action to take if FortiNDR encounters an error.

option

log-only

Option	Description
log-only	Log FortiNDR error, but allow the file.
block	Block the file on FortiNDR error.
ignore	Do nothing on FortiNDR error.

fortindr-timeout-action

Action to take if FortiNDR encounters a scan timeout.

option

log-only

Option	Description
log-only	Log FortiNDR scan timeout, but allow the file.
block	Block the file on FortiNDR scan timeout.
ignore	Do nothing on FortiNDR scan timeout.

fortisandbox-error-action

Action to take if FortiSandbox inline scan encounters an error.

option

log-only

Option	Description
log-only	Log FortiSandbox inline scan error, but allow the file.
block	Block the file on FortiSandbox inline scan error.
ignore	Do nothing on FortiSandbox inline scan error.

fortisandbox-max-upload

Maximum size of files that can be uploaded to FortiSandbox.

integer

Minimum value: 1 Maximum value: 1606 **

fortisandbox-mode

FortiSandbox scan modes.

option

analytics-everything

Option	Description
inline	FortiSandbox inline scan.
analytics-suspicious	FortiSandbox post-transfer scan: submit supported files if heuristics or other methods determine they are suspicious.
analytics-everything	FortiSandbox post-transfer scan: submit supported files and known infected files.

fortisandbox-timeout-action

Action to take if FortiSandbox inline scan encounters a scan timeout.

option

log-only

Option	Description
log-only	Log FortiSandbox inline scan timeout, but allow the file.
block	Block the file on FortiSandbox inline scan timeout.
ignore	Do nothing on FortiSandbox inline scan timeout.

mobile-malware-db

Enable/disable using the mobile malware signature database.

option

enable

Option	Description
disable	Do not use the mobile malware signature database.
enable	Also use the mobile malware signature database.

name

Profile name.

string

Maximum length: 35

outbreak-prevention-archive-scan

Enable/disable outbreak-prevention archive scanning.

option

enable

Option	Description
disable	Analyze files as sent, not the content of archives.
enable	Analyze files including the content of archives.

replacemsg-group

Replacement message group customized for this profile.

string

Maximum length: 35

scan-mode

Configure scan mode.

option

default

Option	Description
default	On the fly decompression and scanning of certain archive files.
legacy	Scan archive files only after the entire file is received.

** Values may differ between models.

config cifs

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

config content-disarm

Parameter

Description

Type

Size

Default

original-file-destination

Destination to send original file if active content is removed.

option

discard

Option	Description
fortisandbox	Send original file to configured FortiSandbox.
quarantine	Send original file to quarantine.
discard	Original file will be discarded after content disarm.

error-action

Action to be taken if CDR engine encounters an unrecoverable error.

option

log-only

Option	Description
block	Block file on CDR error.
log-only	Log CDR error, but allow file.
ignore	Do nothing on CDR error.

office-macro

Enable/disable stripping of macros in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-hylink

Enable/disable stripping of hyperlinks in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-linked

Enable/disable stripping of linked objects in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-embed

Enable/disable stripping of embedded objects in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-dde

Enable/disable stripping of Dynamic Data Exchange events in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

office-action

Enable/disable stripping of PowerPoint action events in Microsoft Office documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-javacode

Enable/disable stripping of JavaScript code in PDF documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-embedfile

Enable/disable stripping of embedded files in PDF documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-hyperlink

Enable/disable stripping of hyperlinks from PDF documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-gotor

Enable/disable stripping of PDF document actions that access other PDF documents.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-launch

Enable/disable stripping of PDF document actions that launch other applications.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-sound

Enable/disable stripping of PDF document actions that play a sound.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-movie

Enable/disable stripping of PDF document actions that play a movie.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-java

Enable/disable stripping of PDF document actions that execute JavaScript code.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

pdf-act-form

Enable/disable stripping of PDF document actions that submit data to other targets.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

cover-page

Enable/disable inserting a cover page into the disarmed document.

option

enable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

detect-only

Enable/disable only detect disarmable files, do not alter content.

option

disable

Option	Description
disable	Disable this Content Disarm and Reconstruction feature.
enable	Enable this Content Disarm and Reconstruction feature.

config ftp

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

config http

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

content-disarm

Enable/disable Content Disarm and Reconstruction when performing AntiVirus scan.

option

disable

Option	Description
disable	Disable Content Disarm and Reconstruction when performing AntiVirus scan.
enable	Enable Content Disarm and Reconstruction when performing AntiVirus scan.

config imap

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

executables

Treat Windows executable files as viruses for the purpose of blocking or monitoring.

option

default

Option	Description
default	Perform standard AntiVirus scanning of Windows executable files.
virus	Treat Windows executables as viruses.

content-disarm

Enable/disable Content Disarm and Reconstruction when performing AntiVirus scan.

option

disable

Option	Description
disable	Disable Content Disarm and Reconstruction when performing AntiVirus scan.
enable	Enable Content Disarm and Reconstruction when performing AntiVirus scan.

config mapi

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

executables

Treat Windows executable files as viruses for the purpose of blocking or monitoring.

option

default

Option	Description
default	Perform standard AntiVirus scanning of Windows executable files.
virus	Treat Windows executables as viruses.

config nac-quar

Parameter

Description

Type

Size

Default

infected

Enable/Disable quarantining infected hosts to the banned user list.

option

none

Option	Description
none	Do not quarantine infected hosts.
quar-src-ip	Quarantine all traffic from the infected hosts source IP.

expiry

Duration of quarantine.

user

Not Specified

log

Enable/disable AntiVirus quarantine logging.

option

disable

Option	Description
enable	Enable AntiVirus quarantine logging.
disable	Disable AntiVirus quarantine logging.

config nntp

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

config pop3

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

executables

Treat Windows executable files as viruses for the purpose of blocking or monitoring.

option

default

Option	Description
default	Perform standard AntiVirus scanning of Windows executable files.
virus	Treat Windows executables as viruses.

content-disarm

Enable/disable Content Disarm and Reconstruction when performing AntiVirus scan.

option

disable

Option	Description
disable	Disable Content Disarm and Reconstruction when performing AntiVirus scan.
enable	Enable Content Disarm and Reconstruction when performing AntiVirus scan.

config smtp

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

executables

Treat Windows executable files as viruses for the purpose of blocking or monitoring.

option

default

Option	Description
default	Perform standard AntiVirus scanning of Windows executable files.
virus	Treat Windows executables as viruses.

content-disarm

Enable/disable Content Disarm and Reconstruction when performing AntiVirus scan.

option

disable

Option	Description
disable	Disable Content Disarm and Reconstruction when performing AntiVirus scan.
enable	Enable Content Disarm and Reconstruction when performing AntiVirus scan.

config ssh

Parameter

Description

Type

Size

Default

av-scan

Enable AntiVirus scan service.

option

disable

Option	Description
disable	Disable.
block	Block the virus infected files.
monitor	Log the virus infected files.

outbreak-prevention

Enable virus outbreak prevention service.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

external-blocklist

Enable external-blocklist. Analyzes files including the content of archives.

option

disable

Option	Description
disable	Disable.
block	Block the matched files.
monitor	Log the matched files.

fortindr

Enable scanning of files by FortiNDR.

option

disable

Option	Description
disable	Disable.
block	Block the FortiNDR detected infections.
monitor	Log the FortiNDR detected infections.

fortisandbox

Enable scanning of files by FortiSandbox.

option

disable

Option	Description
disable	Disable.
block	Block the FortiSandbox detected infections.
monitor	Log the FortiSandbox detected infections.

quarantine

Enable/disable quarantine for infected files.

option

disable

Option	Description
disable	Disable quarantine for infected files.
enable	Enable quarantine for infected files.

archive-block

Select the archive types to block.

option

Option	Description
encrypted	Block encrypted archives.
corrupted	Block corrupted archives.
partiallycorrupted	Block partially corrupted archives.
multipart	Block multipart archives.
nested	Block nested archives that exceed uncompressed nest limit.
mailbomb	Block mail bomb archives.
timeout	Block scan timeout.
unhandled	Block archives that FortiOS cannot open.

archive-log

Select the archive types to log.

option

Option	Description
encrypted	Log encrypted archives.
corrupted	Log corrupted archives.
partiallycorrupted	Log partially corrupted archives.
multipart	Log multipart archives.
nested	Log nested archives that exceed uncompressed nest limit.
mailbomb	Log mail bomb archives.
timeout	Log scan timeout.
unhandled	Log archives that FortiOS cannot open.

emulator

Enable/disable the virus emulator.

option

enable

Option	Description
enable	Enable the virus emulator.
disable	Disable the virus emulator.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

CLI Reference

config antivirus profile

config antivirus profile

config antivirus profile

config cifs

config content-disarm

config ftp

config http

config imap

config mapi

config nac-quar

config nntp

config pop3

config smtp