Description
This article provides a flow antivirus statistics check, and an API for SNMP to get AV statistics.
Solution
Two CLI commands are used to show and clear the antivirus statistics:
# diagnose ips av stats show
# diagnose ips av stats clear
This example uses the following topology:
[PC]=====[Fortigate]====[server]
To check flow antivirus statistics.
1) Create an antivirus profile:
# config antivirus profile
edit "av-test"
# config http
set options scan avmonitor
end
# config ftp
set options scan quarantine
end
next
end
2) Enable the profile on a firewall policy:
# config firewall policy
edit 1
set name "policy1"
set srcintf "port2"
set dstintf "port1"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set utm-status enable
set fsso disable
set av-profile "av-test"
set ssl-ssh-profile "custom-deep-inspection"
set nat enable
next
end
3) On the client's PC, download the EICAR Standard 'Anti-Virus Test' file via HTTP.
Check the antivirus statistics on FortiGate.
As the action is set to monitor for.
4) HTTP, HTTP virus detected is increased by 1:
# diagnose ips av stats show
AV stats:
HTTP virus detected: 1
HTTP virus blocked: 0
SMTP virus detected: 0
SMTP virus blocked: 0
POP3 virus detected: 0
POP3 virus blocked: 0
IMAP virus detected: 0
IMAP virus blocked: 0
NNTP virus detected: 0
NNTP virus blocked: 0
FTP virus detected: 0
FTP virus blocked: 0
SMB virus detected: 0
SMB virus blocked: 0
5) On the client's PC, download the EICAR file via FTP.
6) Check the antivirus statistics on FortiGate.
As the action is set to quarantine for FTP, the FTP virus detected and the FTP virus blocked are both increased by 1:
# diagnose ips av stats show
AV stats:
HTTP virus detected: 1
HTTP virus blocked: 0
SMTP virus detected: 0
SMTP virus blocked: 0
POP3 virus detected: 0
POP3 virus blocked: 0
IMAP virus detected: 0
IMAP virus blocked: 0
NNTP virus detected: 0
NNTP virus blocked: 0
FTP virus detected: 1
FTP virus blocked: 1
SMB virus detected: 0
SMB virus blocked: 0
7) Check the antivirus statistics using 'snmpwalk':
root:~# snmpwalk -c public -v 1 10.1.100.6 1.3.6.1.4.1.12356.101.8.2.1.1
iso.3.6.1.4.1.12356.101.8.2.1.1.1.1 = Counter32: 2 (fgAvVirusDetected)
iso.3.6.1.4.1.12356.101.8.2.1.1.2.1 = Counter32: 1 (fgAvVirusBlocked)
iso.3.6.1.4.1.12356.101.8.2.1.1.3.1 = Counter32: 1 (fgAvHTTPVirusDetected)
iso.3.6.1.4.1.12356.101.8.2.1.1.4.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.5.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.6.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.7.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.8.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.9.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.10.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.11.1 = Counter32: 1 (fgAvFTPVirusDetected)
iso.3.6.1.4.1.12356.101.8.2.1.1.12.1 = Counter32: 1 (fgAvFTPVirusBlocked)
iso.3.6.1.4.1.12356.101.8.2.1.1.13.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.14.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.15.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.16.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.17.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.18.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.19.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.20.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.21.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.8.2.1.1.22.1 = Counter32: 0
8) Optionally, reset the antivirus statistics to zero:
# diagnose ips av stats clear
9) diag ips av stat show: will show only the statistics when IPS engine was used i.e policy in flow-based. Hence, it is not possible to see the counter increase when the policy is proxy-based.
- diag wad stats worker.http_scan.avscan: will show the statistics when the WAD engine was used i.e in proxy-based.
- diag wad worker avscan clear: Will clear statistics for proxy-based.
