Improved Antivirus Scanning for WAF Modules (8.0.3)

FortiWeb 8.0.3 introduces an updated antivirus (AV) scanning framework for WAF modules designed to improve performance, reduce latency, and increase resilience during file and payload inspection. In previous releases, AV scans were performed synchronously inside Proxyd, which could delay traffic processing when scans took too long or the AV engine became unresponsive.

In this release, AV scanning is handled by a dedicated backend process, allowing Proxyd to continue processing traffic while scans occur in parallel. This design improves responsiveness under load and isolates scanning issues from the main WAF processing path.

Enhancements

• Nonblocking AV scanning — AV scans no longer block Proxyd threads, improving overall responsiveness and reducing the likelihood of traffic delays.

• Improved stability and fault isolation — backend scan failures or timeouts no longer affect Proxyd.

• Parallel scanning workers — multiple AV scan workers allow concurrent scanning to improve throughput.

• Verdict caching — repeated scans of identical content can now be skipped, reducing scanning overhead.

• New CLI controls — administrators can fine-tune worker behavior, timeouts, and cache handling through updated antivirus CLI settings.

CLI Configuration Updates

FortiWeb 8.0.3 adds several new antivirus configuration parameters to support the updated scanning architecture. These options allow administrators to tune how FortiWeb handles scanning concurrency, timeout behavior, and verdict caching.

config system antivirus
    set default-db basic|extended
    set scan-bzip2 {enable|disable}
    set uncomp-size-limit <integer>
    set uncomp-nest-limit <integer>
    set use-fsa {enable|disable}
    set scan-worker-number <integer>
    set scan-worker-timeout <integer>
    set waf-module-timeout <integer>
    set verdict-cache-expire <integer>
    set verdict-cache-clear-when-pkg-update {enable|disable}
end

Parameter	Description
scan-worker-number	Number of backend AV scan processes. Additional workers improve parallel scanning. The valid range is 2–64. Default: 4.
scan-worker-timeout	Timeout (seconds) for backend scan workers. If exceeded, the worker is treated as unresponsive and the scan request times out. The valid range is 30–300 seconds. Default: 30.
waf-module-timeout	Timeout (seconds) for the WAF module waiting for an AV verdict. Traffic proceeds if the timeout expires. The valid range is 5–30 seconds. Default: 5.
verdict-cache-expire	How long (minutes) AV verdicts remain in the cache, reducing duplicate scans for identical content. The valid range is 10–1800 minutes. Default: 720.
verdict-cache-clear-when-pkg-update	Determines whether FortiWeb automatically clears the antivirus verdict cache when a new AV package is installed. AV package updates (including AVDB, AVET, and AVEN) may introduce new signatures or scanning behaviors. When enabled, the existing cache is cleared so that previously scanned content is re-evaluated with updated definitions. Default: disable.

Monitoring and Diagnostics

New CLI commands provide visibility into backend scanning behavior and cache performance:

execute scand av show-stats
execute scand av clear-stats
execute scand av show-cache-summary
execute scand av clear-cache

These commands provide visibility into worker activity, queue behavior, and cache efficiency. The standalone avscan tool remains available for testing and verification of file scanning behavior.