Grayware; Grayware Options - Fortinet FortiGate FortiGate-1000A Administration Manual

Antivirus

Grayware

Grayware options

FortiGate-1000A/FA2 Administration Guide
Note: For email scanning, the oversize threshold refers to the final size of the email after
encoding by the email client, including attachments. Email clients may use a variety of encoding
types and some encoding types translate into larger file sizes than the original attachment. The
most common encoding, base64, translates 3 bytes of binary data into 4 bytes of base64 data.
So a file may be blocked or logged as oversized even if the attachment is several megabytes
less than the configured oversize threshold.
Figure 165:Example threshold configuration
You can enable oversized file blocking in a firewall protection profile. To access
protection profiles go to Firewall > Protection Profile, select Anti-Virus > Oversized
File/Email and choose to pass or block oversized email and files for each protocol.
Further file size limits for uncompressed files can be configured as an advanced
feature via the CLI. See
Grayware programs are unsolicited commercial software programs that get installed
on computers, often without the user's consent or knowledge. Grayware programs are
generally considered an annoyance, but these programs can cause system
performance problems or be used for malicious means.
The FortiGate unit scans for known grayware executable programs in each category
you enable. The category list and contents are added or updated whenever your
FortiGate unit receives a virus update package. New categories may be added at any
time and will be loaded with the virus updates. By default, all new categories are
disabled. Grayware is enabled in a protection profile when Virus Scan is enabled.
Grayware categories are populated with known executable files. Each time the
FortiGate unit receives a virus and attack definitions update, the grayware categories
and contents are updated.
01-28011-0254-20051115
"CLI configuration" on page 317.
Config
315