Prepare FortiSandbox for scanning contents
Upload firmware license to FortiSandbox instance
If the deployment mode is On-Demand, a firmware license file is not required. If the mode is BYOL, download a firmware license from the Customer Support website and then upload it to FortiSandbox.
To upload the license:
- Go to Dashboard > Status > Licenses widget.
- Click the Upload License button next to FortiSandbox-AWS and upload the license.
Upload the rating and tracer engine
A copy of the rating and tracer engines are required for your instance to be fully functional. The instance can automatically download and install the engines if it is connected to FDN. You can also upload the engines manually. These engines can be downloaded from the Customer Support web site. For more information, see the Tracer and Rating Engines section of the FortiSandbox Release Notes.
To manually upload the rating and tracer engine:
- In FortiSandbox, go to System > FortiGuard.
- Beside Upload Package File, click Choose file and locate the rating or tracer engine to be uploaded.
Import AWS settings into FortiSandbox
- Go to System > AWS Config page, click Configuration Wizard, and enter the Access Key ID and Secret Access Key information created in Create an IAM group.
- Select Local VM Instance Type.
Instance type t3.medium is recommended for the pre-built
awsENAwin10x64.7z(https://fsavm.fortinet.net/vmtools/awsENAwin10x64.7z b6a5c040b93451640f92e7725dc47120) because this customized VM image is ENA enabled, and instance type t3 supports ENA.For other instance types supporting ENA, please refer to the AWS documentation.
Medium size instance types are recommended for better performance during configuration.
- Click Next.
- For VPC ID, select the VPC you created.
- For Private Subnet, select the subnet created for the local Windows or Linux VM communication (port2) if one exists. Otherwise, select the management subnet.
- For Security Groups, select the security group for the Private Subnet you selected in step 5.
- Click Save.
- Click Connection Test.
Configure the VM scan time.
The VM Scan time covers the actual sample detonation plus some overhead (e.g. the VM and OS boot-up, engine preparation, cleanup). This overhead has been observed to take longer in VM deployment including public cloud. As a result, the sample detonation does not have enough time to collect enough behavior and will affect the rating causing a misdiagnosis.
To compensate for overhead, we recommend to at least 120 seconds for the VM Scan timeout.
To configure the VM scan timeouts:
Go to Scan Policy and Object >Scan Profile > Advanced tab, under the section Limits and Timeouts.