Enabling Antivirus - McAfee SG310 Administration Manual

Firewall menu options
Antivirus
If a virus is detected, the user on your LAN sending or receiving the infected file or email is informed by an
error message or error email, and the infected file or email is not delivered to its destination. A message
similar to the following is logged in the syslog:
E-Mail was blocked by pop3.proxy/2.0.0-beta5 using ClamAV 0.88/1516/Tue June 6 22:45:31
Note: If messages in your system log state your clamav installation is outdated, it may be possible to update the
virus scanning engine of the UTM Firewall appliance (clamav) by upgrading your UTM Firewall firmware. Such
messages are not cause for alarm and Antivirus still functions correctly. As with all firmware updates, McAfee
determines an appropriate firmware release schedule based on the nature of the changes made. Serious
vulnerabilities are given priority over feature enhancements.
Antivirus scanning can be resource-intensive. To set the amount of system memory allocated to antivirus
scanning, navigate to the Memory Allocation tab (System > System Setup > Memory Allocation tab).
See Memory Allocation tab
The antivirus database is updated automatically at intervals set when antivirus is enabled. If your UTM
Firewall appliance is not connected to the Internet, the clam antivirus database files must be downloaded
manually. For further information, see
Note: Due to the growth of antivirus signature databases, the SG565 and SG580 must be configured with
external storage in order to enable antivirus. The SG565 can use local USB or network storage. For more
information, see Auxiliary storage for virus
Once you enable antivirus scanning and allocate extra storage, configure antivirus for the areas you want to
scan: SMTP or POP email, Web traffic, and FTP.
The main topics in this section are:
•

Enabling antivirus

• Manually downloading antivirus database files
• Auxiliary storage for virus scanning
• Virus scanning SMTP email
• Virus scanning POP email
• Virus scanning Web traffic
• Enabling FTP virus scanning
Enabling antivirus
Use this procedure to enable and configure antivirus.
Note: For the SG565 and SG580 models, you must allocate extra memory for the scanning process. For more
information, see Auxiliary storage for virus
McAfee UTM Firewall 4.0.4 Administration Guide
for more information.
Manually downloading antivirus database
scanning.
scanning.
files.
223