Using FortiSandbox inline scanning with antivirus

FortiSandbox inline scanning can be used in proxy inspection mode. When inline scanning is enabled, the client's file is held while it is sent to FortiSandbox for inspection. During this time, the FortiGate may apply client comforting (see Protocol options). For example, leaking a certain amount of bytes at a certain time interval to the client. Once a verdict is returned, the appropriate action (allow or block) is performed on the held file. If there is an error connecting to the FortiSandbox or a timeout on the FortiSandbox scanning the file within the default 50 seconds, the file can be passed, logged, or blocked based on FortiGate's configuration. For more information, see Configuring sandboxing.

This topic describes how to configure the following:

• FortiSandbox appliance inline scanning

• FortiGuard AI-based Inline Malware Prevention Service

• FortiSandbox scanning error and timeout actions

FortiSandbox appliance inline scanning

Inline scanning requires a FortiSandbox appliance running version 4.2 or later, and the FortiSandbox must be reachable by port 4443. See Understanding Inline Block feature in the FortiSandbox Best Practices for more information.

FortiSandbox inline scanning is disabled by default. FortiSandbox inline scanning is best used in conjunction with AV engine scanning since there is a higher rate of detection by using both at the same time.

To enable FortiSandbox inline scanning:

config system fortisandbox
    set status enable
    set inline-scan {enable | disable}
    set server <fortisandbox_server_ip>
end

To configure the FortiSandbox scanning options in an antivirus profile:

config antivirus profile
    edit <name>
        set fortisandbox-mode {inline | analytics-suspicious | analytics-everything}
        set fortisandbox-error-action {ignore | log-only | block}  
        set fortisandbox-timeout-action {ignore | log-only | block}
        set fortisandbox-max-upload <integer>
        config {http | ftp | imap | pop3 | smtp | mapi | cifs | ssh}
            set av-scan {disable | block | monitor}
            set fortisandbox {disable | block | monitor}
        end	
    next
end

fortisandbox-mode {inline | analytics-suspicious | analytics-everything}	Set the FortiSandbox scan mode: inline: FortiSandbox inline scanning analytics-suspicious: FortiSandbox post-transfer scanning; submit supported files if heuristics or other methods determine they are suspicious analytics-everything: FortiSandbox post-transfer scanning; submit supported files and known infected files (default)
fortisandbox-error-action {ignore | log-only | block}	Set the action to take if FortiSandbox inline scanning encounters an error reaching the FortiSandbox: ignore: take no action log-only: log the FortiSandbox inline scan error, but allow the file (default) block: block the file upon FortiSandbox inline scan error
fortisandbox-timeout-action {ignore | log-only | block}	Set the action to take if FortiSandbox inline scanning encounters a scan timeout: ignore: take no action log-only: log the FortiSandbox inline scan timeout, but allow the file (default) block: block the file upon FortiSandbox inline scan timeout
fortisandbox-max-upload <integer>	Set the maximum size of files that can be uploaded to FortiSandbox (1 - 396, default = 10).
av-scan {disable | block | monitor}	Enable the antivirus scan service. Set to block or monitor to work with FortiSandbox (default = disable).
fortisandbox {disable | block | monitor}	Set the protocol level parameter for FortiSandbox file scanning: disable (default), block, and monitor are available for inline scanning disable (default) and monitor are available for post-transfer scanning

This example assumes that Inline Block Policy is already enabled in FortiSandbox for the FortiGate with selected risk levels (see FortiGate devices in the FortiSandbox Administration Guide for more information). The inline block policy in this example blocks all risk levels: malicious, high risk, medium risk, and low risk.

To configure FortiSandbox inline scanning in the GUI:

1. Enable FortiSandbox inline scanning globally:

   config system fortisandbox
       set status enable
       set inline-scan enable
       set server "172.18.70.76"
   end

2. Configure the antivirus profile:

   1. Go to Security Profiles > AntiVirus and click Create New.

   2. Set the Feature set to Proxy-based.

   3. Enable the protocols to inspect.

   4. Enable AntiVirus scan and set it to Block.

   5. Enable Send files to FortiSandbox for inspection and set the Action to Block. The Scan strategy appears as Inline because it was configured in the CLI.

      

   6. Click OK.

To configure FortiSandbox inline scanning in the CLI:

1. Enable FortiSandbox inline scanning globally:

   config system fortisandbox
       set status enable
       set inline-scan enable
       set server "172.18.70.76"
   end

2. Configure the antivirus profile:

   config antivirus profile
       edit "Inline_scan_demo"
           set feature-set proxy
           set fortisandbox-mode inline
           config http
               set av-scan block
               set fortisandbox block
           end
           config ftp
               set av-scan block
               set fortisandbox block
           end
           config imap
               set av-scan block
               set fortisandbox block
           end
           config pop3
               set av-scan block
               set fortisandbox block
           end
           config smtp
               set av-scan block
               set fortisandbox block
           end
           config mapi
               set av-scan block
               set fortisandbox block
           end
           config cifs
               set av-scan block
               set fortisandbox block
           end
           config ssh
               set av-scan block
               set fortisandbox block
           end
       next 
   end

To verify that infected files are blocked inline:

1. On a client, open a web browser and download an infected file.

2. The file is held while being scanned by FortiSandbox. Once FortiSandbox determines that file's risk level is not tolerated by the inline block policy, the FortiGate drops the connection and displays a replacement message that the file cannot be downloaded.

   

3. In FortiOS, view the antivirus log.

   • In the GUI, go to Log & Report > Security Events and click the AntiVirus card.

   • In the CLI:

     # execute log filter category 2
     # execute log display
     1 logs found.
     1 logs returned.
     
     1: date=2022-03-23 time=16:19:37 eventtime=1648077577156255080 tz="-0700" logid="0210008232" type="utm" subtype="virus" eventtype="fortisandbox" level="warning" vd="vdom1" policyid=1 poluuid="9170ca3e-aade-51ec-772b-1d31f135fe26" policytype="policy" msg="Blocked by FortiSandbox." action="blocked" service="HTTP" sessionid=10545 srcip=10.1.100.181 dstip=172.16.200.184 srcport=37046 dstport=80 srccountry="Reserved" dstcountry="Reserved" srcintf="port1" srcintfrole="undefined" dstintf="port9" dstintfrole="undefined" srcuuid="5b426c60-aade-51ec-f020-b3d334ba18d3" dstuuid="5b426c60-aade-51ec-f020-b3d334ba18d3" proto=6 direction="incoming" filename="skip_vm.vXE" quarskip="File-was-not-quarantined" virus="Trojan" viruscat="Unknown" dtype="fortisandbox" ref="http://www.fortinet.com/ve?vn=Trojan" virusid=0 url="http://172.16.200.184/sandbox/inline/skip_vm.vXE" profile="Inline_scan_demo" agent="curl/7.68.0" httpmethod="GET" analyticssubmit="false" fsaaction="deny" fsaseverity="high-risk" fsaverdict="block" fsafileid=0 fsafiletype="exe" crscore=50 craction=2 crlevel="critical

FortiGuard AI-based Inline Malware Prevention Service

Inline scanning is supported when the FortiGate is licensed with the FortiGuard AI-based Inline Malware Prevention Service (IL MPS). It works similar to inline scanning for the FortiSandbox appliance by holding a file up to 50 seconds for the verdict to be returned. Timed out scans can be set to block, log, or ignore. Inline scanning can be enabled from the GUI on the Cloud Sandbox configuration page.

Inline scanning is supported for FortiSandbox appliance, FortiNDR, and IL MPS. On a FortiGate, only a single inline scanning type can be configured at a time.

To configure IL MPS scanning in the GUI:

1. Enable the FortiGate Cloud feature visibility:

   1. Go to System > Feature Visibility.

   2. In the Additional Features section, enable FortiGate Cloud Sandbox.

   3. Click Apply.

2. Configure the Sandbox Fabric connector:

   1. Go to Security Fabric > Fabric Connectors and double-click the Sandbox card.

   2. In the Settings tab, set the Type to FortiGate Cloud.

   3. Select a Region.

   4. Enable Inline scan.

      

   5. Click OK.

3. Configure the antivirus profile:

   1. Go to Security Profiles > AntiVirus and click Create New.

   2. Set the Feature set to Proxy-based.

   3. Enable the protocols to inspect.

   4. Enable Send files to FortiSandbox for inspection.

   5. Set the Scan strategy to Inline, and set the Action to Block.

      

   6. Click OK.

To configure IL MPS scanning in the CLI:

1. Disable FortiSandbox appliance and FortiSandbox Cloud:

   config system fortisandbox 
       set status disable 
   end

2. Configure FortiGate Cloud Sandbox:

   # execute forticloud-sandbox region 
   0  Global
   1  Europe
   2  Japan
   3  US
   Please select cloud sandbox region[0-3]:0
   Cloud sandbox region is selected: Global

3. Enable inline scanning for FortiGate Cloud:

   config system fortiguard
       set sandbox-region "Global"
       set sandbox-inline-scan enable
   end

4. Configure the antivirus profile:

   config antivirus profile
       edit "av"
           set feature-set proxy
           set fortisandbox-mode inline
           config http
               set fortisandbox block
           end
           config ftp
               set fortisandbox block
           end
           config imap
               set fortisandbox block
           end
           config pop3
               set fortisandbox block
           end
           config smtp
               set fortisandbox block
           end
           config mapi
               set fortisandbox block
           end
           config cifs
               set fortisandbox block
           end
           config ssh
               set fortisandbox block
           end
           set scan-mode default
       next
   end

To verify that infected files are blocked inline:

1. On a client, open a web browser and download an infected file using HTTP.

2. The file is held while being scanned by FortiGate Cloud Sandbox. Once FortiGate Cloud Sandbox determines that file's risk level is not tolerated, the FortiGate drops the connection and displays a replacement message that the file cannot be downloaded.

3. Verify the antivirus log:

   # execute log display
   1 logs found.
   1 logs returned.
   
   1: date=2022-07-12 time=16:31:26 eventtime=1657668686245018328 tz="-0700" logid="0210008232" type="utm" subtype="virus" eventtype="fortisandbox" level="warning" vd="vdom1" policyid=1 poluuid="54c06312-01fd-51ed-0db5-10c9586a0c2e" policytype="policy" msg="Blocked by FortiSandbox." action="blocked" service="HTTP" sessionid=19934 srcip=10.1.100.191 dstip=172.16.200.194 srcport=51688 dstport=80 srccountry="Reserved" dstcountry="Reserved" srcintf="port1" srcintfrole="undefined" dstintf="port9" dstintfrole="undefined" srcuuid="1cb467b6-01fd-51ed-8abf-72abd959c0d0" dstuuid="1cb467b6-01fd-51ed-8abf-72abd959c0d0" proto=6 direction="incoming" filename="skip_vm.vXE" quarskip="Quarantine-disabled" virus="Unknown" viruscat="Trojan" dtype="fortisandbox" ref="http://www.fortinet.com/ve?vn=Unknown" virusid=0 url="http://172.16.200.194/sandbox/inline/skip_vm.vXE" profile="av" agent="curl/7.68.0" httpmethod="GET" analyticssubmit="false" fsaaction="deny" fsaverdict="block" fsaseverity="high-risk" fsafileid=0 fsafiletype="exe" crscore=50 craction=2 crlevel="critical"

To verify that infected files are monitored:

1. Edit the antivirus profile to monitor files over HTTP:

   config antivirus profile
       edit "av"
           set feature-set proxy
           set fortisandbox-mode inline
           config http
               set fortisandbox monitor
           end
       next
   end

2. On a client, open a web browser and download an infected file using HTTP.

3. Verify the antivirus log:

   # execute log display
   1 logs found.
   1 logs returned.
   					
   1: date=2022-07-12 time=16:34:25 eventtime=1657668865371976563 tz="-0700" logid="0210008233" type="utm" subtype="virus" eventtype="fortisandbox" level="notice" vd="vdom1" policyid=1 poluuid="54c06312-01fd-51ed-0db5-10c9586a0c2e" policytype="policy" msg="Detected by FortiSandbox." action="monitored" service="HTTP" sessionid=20002 srcip=10.1.100.191 dstip=172.16.200.194 srcport=51724 dstport=80 srccountry="Reserved" dstcountry="Reserved" srcintf="port1" srcintfrole="undefined" dstintf="port9" dstintfrole="undefined" srcuuid="1cb467b6-01fd-51ed-8abf-72abd959c0d0" dstuuid="1cb467b6-01fd-51ed-8abf-72abd959c0d0" proto=6 direction="incoming" filename="skip_vm.vXE" quarskip="Quarantine-disabled" virus="Unknown" viruscat="Trojan" dtype="fortisandbox" ref="http://www.fortinet.com/ve?vn=Unknown" virusid=0 url="http://172.16.200.194/sandbox/inline/skip_vm.vXE" profile="av" agent="curl/7.68.0" httpmethod="GET" analyticssubmit="false" fsaaction="deny" fsaverdict="block" fsaseverity="high-risk" fsafileid=0 fsafiletype="exe" crscore=50 craction=2 crlevel="critical"

To verify that infected files are blocked inline if a scan timeout occurs:

1. Edit the antivirus profile to block files over HTTP and when there is a scan timeout:

   config antivirus profile
       edit "av"
           set feature-set proxy
           set fortisandbox-mode inline
           config http
               set fortisandbox block
           end
           set fortisandbox-timeout-action block
       next
   end

2. On a client, open a web browser and download a large ZIP file (clean file).

3. When the scan timeout occurs, a replacement message appears that The file "zipfile.zip" is still being scanned and will be released once complete. Please try the transfer again in a few minutes.

4. Verify the antivirus log:

   # execute log display
   1 logs found.
   1 logs returned.
   
   1: date=2022-07-12 time=16:44:51 eventtime=1657669491697816069 tz="-0700" logid="0210008236" type="utm" subtype="virus" eventtype="fortisandbox" level="warning" vd="vdom1" policyid=1 poluuid="54c06312-01fd-51ed-0db5-10c9586a0c2e" policytype="policy" msg="FortiSandbox scan timeout." action="blocked" service="HTTP" sessionid=20258 srcip=10.1.100.191 dstip=172.16.200.194 srcport=51830 dstport=80 srccountry="Reserved" dstcountry="Reserved" srcintf="port1" srcintfrole="undefined" dstintf="port9" dstintfrole="undefined" srcuuid="1cb467b6-01fd-51ed-8abf-72abd959c0d0" dstuuid="1cb467b6-01fd-51ed-8abf-72abd959c0d0" proto=6 direction="incoming" filename="zipfile.zip" quarskip="Quarantine-disabled" url="http://172.16.200.194/sandbox/zipfile.zip" profile="av" agent="curl/7.68.0" httpmethod="GET" analyticssubmit="false" fsaaction="timeout" fsafileid=0 crscore=50 craction=2 crlevel="critical"

5. After a few minutes, download the ZIP file again.

6. When the scan is complete on the FortiSandbox side, the file is downloaded and no log is generated because the scan deemed that the file is clean.

FortiSandbox scanning error and timeout actions

In this example, the HTTP protocol settings for av-scan and fortisandbox in the AV profile are both set to block. All files traversing HTTP in this configuration are scanned by the AV engine first, and then by FortiSandbox inline scanning for further file analysis. Based on the FortiSandbox results, FortiOS will take the appropriate action.

Files can be blocked if they contain a scan error or timeout. The scan timeout is configured in FortiSandbox and set to 50 seconds. If the file scan takes longer than 50 seconds, FortiSandbox returns a timeout to the FortiGate, and file is dropped with the current configuration. If a user tries to download the same file again, the cached result is provided by FortiSandbox to the FortiGate based on the previous file scan.

This example assumes FortiSandbox inline scanning has been configured globally. The FortiGate will block the file if there is an inline scanning error or timeout.

To configure the antivirus profile to block files if there is an inline scanning error or timeout:

config antivirus profile
    edit "av"
        set feature-set proxy
        set fortisandbox-mode inline
        config http
            set av-scan block
            set fortisandbox block
        end
        set fortisandbox-error-action block
        set fortisandbox-timeout-action block
    next
end

If the administrator decides to take more risk and scan all files traversing HTTP, but log or ignore an inline scanning error or timeout, the profile is modified as follows:

config antivirus profile
    edit "av"
        set fortisandbox-error-action {log-only | ignore}
        set fortisandbox-timeout-action {log-only | ignore}
    next
end

The AV engine is still used first, followed by FortiSandbox inline scanning. The FortiGate will log or ignore the file if there is an inline scanning error or timeout, and the file is allowed to pass through.